259 files changed, 4042 insertions, 3602 deletions
diff --git a/net/802/hippi.c b/net/802/hippi.c
index 51a1f530417d..a97a3bde77bb 100644
--- a/net/802/hippi.c
+++ b/net/802/hippi.c
@@ -172,14 +172,14 @@ EXPORT_SYMBOL(hippi_mac_addr);
 int hippi_neigh_setup_dev(struct net_device *dev, struct neigh_parms *p)
 {
        /* Never send broadcast/multicast ARP messages */
-        p->mcast_probes = 0;
+        NEIGH_VAR_SET(p, MCAST_PROBES, 0);
        /* In IPv6 unicast probes are valid even on NBMA,
        * because they are encapsulated in normal IPv6 protocol.
        * Should be a generic flag.
        */
        if (p->tbl->family != AF_INET6)
-                p->ucast_probes = 0;
+                NEIGH_VAR_SET(p, UCAST_PROBES, 0);
        return 0;
 }
 EXPORT_SYMBOL(hippi_neigh_setup_dev);
diff --git a/net/Kconfig b/net/Kconfig
index 0715db64a5c3..d334678c0bd8 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -224,7 +224,7 @@ source "net/hsr/Kconfig"
 config RPS
        boolean
-        depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
+        depends on SMP && SYSFS
        default y
 config RFS_ACCEL
@@ -235,7 +235,7 @@ config RFS_ACCEL
 config XPS
        boolean
-        depends on SMP && USE_GENERIC_SMP_HELPERS
+        depends on SMP
        default y
 config NETPRIO_CGROUP
diff --git a/net/batman-adv/main.h b/net/batman-adv/main.h
index f94f287b8670..322dd7323732 100644
--- a/net/batman-adv/main.h
+++ b/net/batman-adv/main.h
@@ -266,7 +266,7 @@ static inline void batadv_dbg(int type __always_unused,
 */
 static inline int batadv_compare_eth(const void *data1, const void *data2)
 {
-        return (memcmp(data1, data2, ETH_ALEN) == 0 ? 1 : 0);
+        return ether_addr_equal_unaligned(data1, data2);
 }
 /**
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 8ab14340d10f..803ab4be40c2 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -41,7 +41,7 @@ int batadv_compare_orig(const struct hlist_node *node, const void *data2)
        const void *data1 = container_of(node, struct batadv_orig_node,
                                         hash_entry);
-        return (memcmp(data1, data2, ETH_ALEN) == 0 ? 1 : 0);
+        return batadv_compare_eth(data1, data2);
 }
 /**
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 4add57d4857f..06506e6f9006 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -51,7 +51,7 @@ static int batadv_compare_tt(const struct hlist_node *node, const void *data2)
        const void *data1 = container_of(node, struct batadv_tt_common_entry,
                                         hash_entry);
-        return (memcmp(data1, data2, ETH_ALEN) == 0 ? 1 : 0);
+        return batadv_compare_eth(data1, data2);
 }
 /**
diff --git a/net/bluetooth/bnep/bnep.h b/net/bluetooth/bnep/bnep.h
index e7ee5314f39a..5a5b16f365e9 100644
--- a/net/bluetooth/bnep/bnep.h
+++ b/net/bluetooth/bnep/bnep.h
@@ -12,8 +12,7 @@
  GNU General Public License for more details.
  You should have received a copy of the GNU General Public License
-  along with this program; if not, write to the Free Software
+  along with this program; if not, see <http://www.gnu.org/licenses/>.
-  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 */
 #ifndef _BNEP_H
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 33e8f23acddd..c5f5a4a933f4 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -570,8 +570,7 @@ static void fdb_notify(struct net_bridge *br,
        rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
        return;
 errout:
-        if (err < 0)
+        rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
-                rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
 }
 /* Dump information about entries, in response to GETNEIGH */
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 4b81b1471789..d3409e6b5453 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -26,13 +26,13 @@ static int deliver_clone(const struct net_bridge_port *prev,
                         void (*__packet_hook)(const struct net_bridge_port *p,
                                               struct sk_buff *skb));
-/* Don't forward packets to originating port or forwarding diasabled */
+/* Don't forward packets to originating port or forwarding disabled */
 static inline int should_deliver(const struct net_bridge_port *p,
                                 const struct sk_buff *skb)
 {
-        return (((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
+        return ((p->flags & BR_HAIRPIN_MODE) || skb->dev != p->dev) &&
                br_allowed_egress(p->br, nbp_get_vlan_info(p), skb) &&
-                p->state == BR_STATE_FORWARDING);
+                p->state == BR_STATE_FORWARDING;
 }
 static inline unsigned int packet_length(const struct sk_buff *skb)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 4bf02adb5dc2..1f6bd1e2e8a4 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -61,7 +61,7 @@ static int port_cost(struct net_device *dev)
 }
-/* Check for port carrier transistions. */
+/* Check for port carrier transitions. */
 void br_port_carrier_check(struct net_bridge_port *p)
 {
        struct net_device *dev = p->dev;
diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index cd8c3a44ab7d..a9a4a1b7863d 100644
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -381,7 +381,7 @@ int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
 {
        struct net_bridge *br = netdev_priv(dev);
-        switch(cmd) {
+        switch (cmd) {
        case SIOCDEVPRIVATE:
                return old_dev_ioctl(dev, rq, cmd);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 80cad2cf02a7..b008c59a92c4 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -1001,7 +1001,7 @@ static struct nf_hook_ops br_nf_ops[] __read_mostly = {
 #ifdef CONFIG_SYSCTL
 static
 int brnf_sysctl_call_tables(struct ctl_table *ctl, int write,
-                            void __user * buffer, size_t * lenp, loff_t * ppos)
+                            void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        int ret;
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index f75d92e4f96b..6526ac89bbfa 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -195,8 +195,7 @@ void br_ifinfo_notify(int event, struct net_bridge_port *port)
        rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
        return;
 errout:
-        if (err < 0)
+        rtnl_set_sk_err(net, RTNLGRP_LINK, err);
-                rtnl_set_sk_err(net, RTNLGRP_LINK, err);
 }
@@ -373,7 +372,7 @@ int br_setlink(struct net_device *dev, struct nlmsghdr *nlh)
        p = br_port_get_rtnl(dev);
        /* We want to accept dev as bridge itself if the AF_SPEC
-         * is set to see if someone is setting vlan info on the brigde
+         * is set to see if someone is setting vlan info on the bridge
         */
        if (!p && !afspec)
                return -EINVAL;
@@ -389,7 +388,7 @@ int br_setlink(struct net_device *dev, struct nlmsghdr *nlh)
                        err = br_setport(p, tb);
                        spin_unlock_bh(&p->br->lock);
                } else {
-                        /* Binary compatability with old RSTP */
+                        /* Binary compatibility with old RSTP */
                        if (nla_len(protinfo) < sizeof(u8))
                                return -EINVAL;
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 229d820bdf0b..2e77d923c8ee 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -426,6 +426,16 @@ netdev_features_t br_features_recompute(struct net_bridge *br,
 int br_handle_frame_finish(struct sk_buff *skb);
 rx_handler_result_t br_handle_frame(struct sk_buff **pskb);
+static inline bool br_rx_handler_check_rcu(const struct net_device *dev)
+{
+        return rcu_dereference(dev->rx_handler) == br_handle_frame;
+}
+static inline struct net_bridge_port *br_port_get_check_rcu(const struct net_device *dev)
+{
+        return br_rx_handler_check_rcu(dev) ? br_port_get_rcu(dev) : NULL;
+}
 /* br_ioctl.c */
 int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd,
@@ -711,7 +721,7 @@ void br_netfilter_fini(void);
 void br_netfilter_rtable_init(struct net_bridge *);
 #else
 #define br_netfilter_init()     (0)
-#define br_netfilter_fini()     do { } while(0)
+#define br_netfilter_fini()     do { } while (0)
 #define br_netfilter_rtable_init(x)
 #endif
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 8660ea3be705..bdb459d21ad8 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -153,7 +153,7 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
        if (buf[0] != 0 || buf[1] != 0 || buf[2] != 0)
                goto err;
-        p = br_port_get_rcu(dev);
+        p = br_port_get_check_rcu(dev);
        if (!p)
                goto err;
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index 950663d4d330..558c46d19e05 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -110,7 +110,7 @@ static void br_tcn_timer_expired(unsigned long arg)
        if (!br_is_root_bridge(br) && (br->dev->flags & IFF_UP)) {
                br_transmit_tcn(br);
-                mod_timer(&br->tcn_timer,jiffies + br->bridge_hello_time);
+                mod_timer(&br->tcn_timer, jiffies + br->bridge_hello_time);
        }
        spin_unlock(&br->lock);
 }
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index 2a2cdb756d51..dd595bd7fa82 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -26,7 +26,7 @@ struct brport_attribute {
        int (*store)(struct net_bridge_port *, unsigned long);
 };
-#define BRPORT_ATTR(_name,_mode,_show,_store)                   \
+#define BRPORT_ATTR(_name, _mode, _show, _store)                \
 const struct brport_attribute brport_attr_##_name = {           \
        .attr = {.name = __stringify(_name),                    \
                 .mode = _mode },                               \
@@ -209,21 +209,21 @@ static const struct brport_attribute *brport_attrs[] = {
 #define to_brport_attr(_at) container_of(_at, struct brport_attribute, attr)
 #define to_brport(obj)  container_of(obj, struct net_bridge_port, kobj)
-static ssize_t brport_show(struct kobject * kobj,
+static ssize_t brport_show(struct kobject *kobj,
-                           struct attribute * attr, char * buf)
+                           struct attribute *attr, char *buf)
 {
-        struct brport_attribute * brport_attr = to_brport_attr(attr);
+        struct brport_attribute *brport_attr = to_brport_attr(attr);
-        struct net_bridge_port * p = to_brport(kobj);
+        struct net_bridge_port *p = to_brport(kobj);
        return brport_attr->show(p, buf);
 }
-static ssize_t brport_store(struct kobject * kobj,
+static ssize_t brport_store(struct kobject *kobj,
-                            struct attribute * attr,
+                            struct attribute *attr,
-                            const char * buf, size_t count)
+                            const char *buf, size_t count)
 {
-        struct brport_attribute * brport_attr = to_brport_attr(attr);
+        struct brport_attribute *brport_attr = to_brport_attr(attr);
-        struct net_bridge_port * p = to_brport(kobj);
+        struct net_bridge_port *p = to_brport(kobj);
        ssize_t ret = -EINVAL;
        char *endp;
        unsigned long val;
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index af5ebd18d705..7ffc801467ec 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -146,7 +146,7 @@ struct sk_buff *br_handle_vlan(struct net_bridge *br,
        /* At this point, we know that the frame was filtered and contains
         * a valid vlan id.  If the vlan id is set in the untagged bitmap,
-         * send untagged; otherwise, send taged.
+         * send untagged; otherwise, send tagged.
         */
        br_vlan_get_tag(skb, &vid);
        if (test_bit(vid, pv->untagged_bitmap))
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index 19c37a4929bc..5322a36867a3 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -96,7 +96,7 @@ ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum,
                bitmask = NF_LOG_MASK;
        if ((bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto ==
-           htons(ETH_P_IP)){
+           htons(ETH_P_IP)) {
                const struct iphdr *ih;
                struct iphdr _iph;
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index f8f0bd1a1d51..0f6b118d6cb2 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -35,7 +35,7 @@ ebt_snat_tg(struct sk_buff *skb, const struct xt_action_param *par)
                        return EBT_DROP;
                if (ap->ar_hln != ETH_ALEN)
                        goto out;
-                if (skb_store_bits(skb, sizeof(_ah), info->mac,ETH_ALEN))
+                if (skb_store_bits(skb, sizeof(_ah), info->mac, ETH_ALEN))
                        return EBT_DROP;
        }
 out:
diff --git a/net/bridge/netfilter/ebt_vlan.c b/net/bridge/netfilter/ebt_vlan.c
index eae67bf0446c..8d3f8c7651f0 100644
--- a/net/bridge/netfilter/ebt_vlan.c
+++ b/net/bridge/netfilter/ebt_vlan.c
@@ -14,8 +14,7 @@
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 #include <linux/if_ether.h>
diff --git a/net/bridge/netfilter/ebtable_broute.c b/net/bridge/netfilter/ebtable_broute.c
index dbd1c783431b..d2cdf5d6e98c 100644
--- a/net/bridge/netfilter/ebtable_broute.c
+++ b/net/bridge/netfilter/ebtable_broute.c
@@ -23,8 +23,7 @@ static struct ebt_entries initial_chain = {
        .policy         = EBT_ACCEPT,
 };
-static struct ebt_replace_kernel initial_table =
+static struct ebt_replace_kernel initial_table = {
-{
        .name           = "broute",
        .valid_hooks    = 1 << NF_BR_BROUTING,
        .entries_size   = sizeof(struct ebt_entries),
@@ -41,8 +40,7 @@ static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
        return 0;
 }
-static const struct ebt_table broute_table =
+static const struct ebt_table broute_table = {
-{
        .name           = "broute",
        .table          = &initial_table,
        .valid_hooks    = 1 << NF_BR_BROUTING,
diff --git a/net/bridge/netfilter/ebtable_filter.c b/net/bridge/netfilter/ebtable_filter.c
index bb2da7b706e7..ce205aabf9c5 100644
--- a/net/bridge/netfilter/ebtable_filter.c
+++ b/net/bridge/netfilter/ebtable_filter.c
@@ -14,8 +14,7 @@
 #define FILTER_VALID_HOOKS ((1 << NF_BR_LOCAL_IN) | (1 << NF_BR_FORWARD) | \
   (1 << NF_BR_LOCAL_OUT))
-static struct ebt_entries initial_chains[] =
+static struct ebt_entries initial_chains[] = {
-{
        {
                .name   = "INPUT",
                .policy = EBT_ACCEPT,
@@ -30,8 +29,7 @@ static struct ebt_entries initial_chains[] =
        },
 };
-static struct ebt_replace_kernel initial_table =
+static struct ebt_replace_kernel initial_table = {
-{
        .name           = "filter",
        .valid_hooks    = FILTER_VALID_HOOKS,
        .entries_size   = 3 * sizeof(struct ebt_entries),
@@ -50,8 +48,7 @@ static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
        return 0;
 }
-static const struct ebt_table frame_filter =
+static const struct ebt_table frame_filter = {
-{
        .name           = "filter",
        .table          = &initial_table,
        .valid_hooks    = FILTER_VALID_HOOKS,
diff --git a/net/bridge/netfilter/ebtable_nat.c b/net/bridge/netfilter/ebtable_nat.c
index bd238f1f105b..a0ac2984fb6c 100644
--- a/net/bridge/netfilter/ebtable_nat.c
+++ b/net/bridge/netfilter/ebtable_nat.c
@@ -14,8 +14,7 @@
 #define NAT_VALID_HOOKS ((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT) | \
   (1 << NF_BR_POST_ROUTING))
-static struct ebt_entries initial_chains[] =
+static struct ebt_entries initial_chains[] = {
-{
        {
                .name   = "PREROUTING",
                .policy = EBT_ACCEPT,
@@ -30,8 +29,7 @@ static struct ebt_entries initial_chains[] =
        }
 };
-static struct ebt_replace_kernel initial_table =
+static struct ebt_replace_kernel initial_table = {
-{
        .name           = "nat",
        .valid_hooks    = NAT_VALID_HOOKS,
        .entries_size   = 3 * sizeof(struct ebt_entries),
@@ -50,8 +48,7 @@ static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
        return 0;
 }
-static struct ebt_table frame_nat =
+static struct ebt_table frame_nat = {
-{
        .name           = "nat",
        .table          = &initial_table,
        .valid_hooks    = NAT_VALID_HOOKS,
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index ac7802428384..0e474b13463b 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -118,10 +118,10 @@ ebt_dev_check(const char *entry, const struct net_device *device)
        /* 1 is the wildcard token */
        while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
                i++;
-        return (devname[i] != entry[i] && entry[i] != 1);
+        return devname[i] != entry[i] && entry[i] != 1;
 }
-#define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
+#define FWINV2(bool, invflg) ((bool) ^ !!(e->invflags & invflg))
 /* process standard matches */
 static inline int
 ebt_basic_match(const struct ebt_entry *e, const struct sk_buff *skb,
@@ -1441,7 +1441,7 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user,
                return -EFAULT;
        if (*len != sizeof(struct ebt_replace) + entries_size +
-           (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0))
+           (tmp.num_counters ? nentries * sizeof(struct ebt_counter) : 0))
                return -EINVAL;
        if (tmp.nentries != nentries) {
@@ -1477,7 +1477,7 @@ static int do_ebt_set_ctl(struct sock *sk,
        if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
                return -EPERM;
-        switch(cmd) {
+        switch (cmd) {
        case EBT_SO_SET_ENTRIES:
                ret = do_replace(net, user, len);
                break;
@@ -1507,10 +1507,10 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
        if (!t)
                return ret;
-        switch(cmd) {
+        switch (cmd) {
        case EBT_SO_GET_INFO:
        case EBT_SO_GET_INIT_INFO:
-                if (*len != sizeof(struct ebt_replace)){
+                if (*len != sizeof(struct ebt_replace)) {
                        ret = -EINVAL;
                        mutex_unlock(&ebt_mutex);
                        break;
@@ -1525,7 +1525,7 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
                        tmp.valid_hooks = t->table->valid_hooks;
                }
                mutex_unlock(&ebt_mutex);
-                if (copy_to_user(user, &tmp, *len) != 0){
+                if (copy_to_user(user, &tmp, *len) != 0) {
                        BUGPRINT("c2u Didn't work\n");
                        ret = -EFAULT;
                        break;
@@ -2375,8 +2375,7 @@ static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
 }
 #endif
-static struct nf_sockopt_ops ebt_sockopts =
+static struct nf_sockopt_ops ebt_sockopts = {
-{
        .pf             = PF_INET,
        .set_optmin     = EBT_BASE_CTL,
        .set_optmax     = EBT_SO_SET_MAX + 1,
diff --git a/net/can/gw.c b/net/can/gw.c
index 3f9b0f3a2818..88c8a39c173d 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -844,8 +844,7 @@ static int cgw_create_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
        if (!gwj->src.dev)
                goto out;
-        /* check for CAN netdev not using header_ops - see gw_rcv() */
+        if (gwj->src.dev->type != ARPHRD_CAN)
-        if (gwj->src.dev->type != ARPHRD_CAN || gwj->src.dev->header_ops)
                goto put_src_out;
        gwj->dst.dev = dev_get_by_index(&init_net, gwj->ccgw.dst_idx);
@@ -853,8 +852,7 @@ static int cgw_create_job(struct sk_buff *skb,  struct nlmsghdr *nlh)
        if (!gwj->dst.dev)
                goto put_src_out;
-        /* check for CAN netdev not using header_ops - see gw_rcv() */
+        if (gwj->dst.dev->type != ARPHRD_CAN)
-        if (gwj->dst.dev->type != ARPHRD_CAN || gwj->dst.dev->header_ops)
                goto put_src_dst_out;
        gwj->limit_hops = limhops;
diff --git a/net/compat.c b/net/compat.c
index 618c6a8a911b..dd32e34c1e2c 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -72,7 +72,7 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
            __get_user(kmsg->msg_flags, &umsg->msg_flags))
                return -EFAULT;
        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
-                return -EINVAL;
+                kmsg->msg_namelen = sizeof(struct sockaddr_storage);
        kmsg->msg_name = compat_ptr(tmp1);
        kmsg->msg_iov = compat_ptr(tmp2);
        kmsg->msg_control = compat_ptr(tmp3);
diff --git a/net/core/dev.c b/net/core/dev.c
index ba3b7ea5ebb3..cc9ab80581d7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2145,30 +2145,42 @@ void __netif_schedule(struct Qdisc *q)
 }
 EXPORT_SYMBOL(__netif_schedule);
-void dev_kfree_skb_irq(struct sk_buff *skb)
+struct dev_kfree_skb_cb {
+        enum skb_free_reason reason;
+};
+static struct dev_kfree_skb_cb *get_kfree_skb_cb(const struct sk_buff *skb)
+{
+        return (struct dev_kfree_skb_cb *)skb->cb;
+}
+void __dev_kfree_skb_irq(struct sk_buff *skb, enum skb_free_reason reason)
 {
-        if (atomic_dec_and_test(&skb->users)) {
+        unsigned long flags;
-                struct softnet_data *sd;
-                unsigned long flags;
-                local_irq_save(flags);
+        if (likely(atomic_read(&skb->users) == 1)) {
-                sd = &__get_cpu_var(softnet_data);
+                smp_rmb();
-                skb->next = sd->completion_queue;
+                atomic_set(&skb->users, 0);
-                sd->completion_queue = skb;
+        } else if (likely(!atomic_dec_and_test(&skb->users))) {
-                raise_softirq_irqoff(NET_TX_SOFTIRQ);
+                return;
-                local_irq_restore(flags);
        }
+        get_kfree_skb_cb(skb)->reason = reason;
+        local_irq_save(flags);
+        skb->next = __this_cpu_read(softnet_data.completion_queue);
+        __this_cpu_write(softnet_data.completion_queue, skb);
+        raise_softirq_irqoff(NET_TX_SOFTIRQ);
+        local_irq_restore(flags);
 }
-EXPORT_SYMBOL(dev_kfree_skb_irq);
+EXPORT_SYMBOL(__dev_kfree_skb_irq);
-void dev_kfree_skb_any(struct sk_buff *skb)
+void __dev_kfree_skb_any(struct sk_buff *skb, enum skb_free_reason reason)
 {
        if (in_irq() || irqs_disabled())
-                dev_kfree_skb_irq(skb);
+                __dev_kfree_skb_irq(skb, reason);
        else
                dev_kfree_skb(skb);
 }
-EXPORT_SYMBOL(dev_kfree_skb_any);
+EXPORT_SYMBOL(__dev_kfree_skb_any);
 /**
@@ -2442,13 +2454,8 @@ static void dev_gso_skb_destructor(struct sk_buff *skb)
 {
        struct dev_gso_cb *cb;
-        do {
+        kfree_skb_list(skb->next);
-                struct sk_buff *nskb = skb->next;
+        skb->next = NULL;
-                skb->next = nskb->next;
-                nskb->next = NULL;
-                kfree_skb(nskb);
-        } while (skb->next);
        cb = DEV_GSO_CB(skb);
        if (cb->destructor)
@@ -2523,21 +2530,6 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(netif_skb_features);
-/*
- * Returns true if either:
- *      1. skb has frag_list and the device doesn't support FRAGLIST, or
- *      2. skb is fragmented and the device does not support SG.
- */
-static inline int skb_needs_linearize(struct sk_buff *skb,
-                                      netdev_features_t features)
-{
-        return skb_is_nonlinear(skb) &&
-                        ((skb_has_frag_list(skb) &&
-                                !(features & NETIF_F_FRAGLIST)) ||
-                        (skb_shinfo(skb)->nr_frags &&
-                                !(features & NETIF_F_SG)));
-}
 int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                        struct netdev_queue *txq, void *accel_priv)
 {
@@ -3009,7 +3001,7 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
        }
        skb_reset_network_header(skb);
-        if (!skb_get_rxhash(skb))
+        if (!skb_get_hash(skb))
                goto done;
        flow_table = rcu_dereference(rxqueue->rps_flow_table);
@@ -3154,7 +3146,7 @@ static bool skb_flow_limit(struct sk_buff *skb, unsigned int qlen)
        rcu_read_lock();
        fl = rcu_dereference(sd->flow_limit);
        if (fl) {
-                new_flow = skb_get_rxhash(skb) & (fl->num_buckets - 1);
+                new_flow = skb_get_hash(skb) & (fl->num_buckets - 1);
                old_flow = fl->history[fl->history_head];
                fl->history[fl->history_head] = new_flow;
@@ -3306,7 +3298,10 @@ static void net_tx_action(struct softirq_action *h)
                        clist = clist->next;
                        WARN_ON(atomic_read(&skb->users));
-                        trace_kfree_skb(skb, net_tx_action);
+                        if (likely(get_kfree_skb_cb(skb)->reason == SKB_REASON_CONSUMED))
+                                trace_consume_skb(skb);
+                        else
+                                trace_kfree_skb(skb, net_tx_action);
                        __kfree_skb(skb);
                }
        }
@@ -3752,7 +3747,7 @@ static int napi_gro_complete(struct sk_buff *skb)
                if (ptype->type != type || !ptype->callbacks.gro_complete)
                        continue;
-                err = ptype->callbacks.gro_complete(skb);
+                err = ptype->callbacks.gro_complete(skb, 0);
                break;
        }
        rcu_read_unlock();
@@ -3818,6 +3813,23 @@ static void gro_list_prepare(struct napi_struct *napi, struct sk_buff *skb)
        }
 }
+static void skb_gro_reset_offset(struct sk_buff *skb)
+{
+        const struct skb_shared_info *pinfo = skb_shinfo(skb);
+        const skb_frag_t *frag0 = &pinfo->frags[0];
+        NAPI_GRO_CB(skb)->data_offset = 0;
+        NAPI_GRO_CB(skb)->frag0 = NULL;
+        NAPI_GRO_CB(skb)->frag0_len = 0;
+        if (skb_mac_header(skb) == skb_tail_pointer(skb) &&
+            pinfo->nr_frags &&
+            !PageHighMem(skb_frag_page(frag0))) {
+                NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
+                NAPI_GRO_CB(skb)->frag0_len = skb_frag_size(frag0);
+        }
+}
 static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
        struct sk_buff **pp = NULL;
@@ -3833,6 +3845,7 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff
        if (skb_is_gso(skb) || skb_has_frag_list(skb))
                goto normal;
+        skb_gro_reset_offset(skb);
        gro_list_prepare(napi, skb);
        rcu_read_lock();
@@ -3938,27 +3951,8 @@ static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb)
        return ret;
 }
-static void skb_gro_reset_offset(struct sk_buff *skb)
-{
-        const struct skb_shared_info *pinfo = skb_shinfo(skb);
-        const skb_frag_t *frag0 = &pinfo->frags[0];
-        NAPI_GRO_CB(skb)->data_offset = 0;
-        NAPI_GRO_CB(skb)->frag0 = NULL;
-        NAPI_GRO_CB(skb)->frag0_len = 0;
-        if (skb_mac_header(skb) == skb_tail_pointer(skb) &&
-            pinfo->nr_frags &&
-            !PageHighMem(skb_frag_page(frag0))) {
-                NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
-                NAPI_GRO_CB(skb)->frag0_len = skb_frag_size(frag0);
-        }
-}
 gro_result_t napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
-        skb_gro_reset_offset(skb);
        return napi_skb_finish(dev_gro_receive(napi, skb), skb);
 }
 EXPORT_SYMBOL(napi_gro_receive);
@@ -3981,8 +3975,7 @@ struct sk_buff *napi_get_frags(struct napi_struct *napi)
        if (!skb) {
                skb = netdev_alloc_skb_ip_align(napi->dev, GRO_MAX_HEAD);
-                if (skb)
+                napi->skb = skb;
-                        napi->skb = skb;
        }
        return skb;
 }
@@ -3993,12 +3986,7 @@ static gro_result_t napi_frags_finish(struct napi_struct *napi, struct sk_buff *
 {
        switch (ret) {
        case GRO_NORMAL:
-        case GRO_HELD:
+                if (netif_receive_skb(skb))
-                skb->protocol = eth_type_trans(skb, skb->dev);
-                if (ret == GRO_HELD)
-                        skb_gro_pull(skb, -ETH_HLEN);
-                else if (netif_receive_skb(skb))
                        ret = GRO_DROP;
                break;
@@ -4007,6 +3995,7 @@ static gro_result_t napi_frags_finish(struct napi_struct *napi, struct sk_buff *
                napi_reuse_skb(napi, skb);
                break;
+        case GRO_HELD:
        case GRO_MERGED:
                break;
        }
@@ -4017,36 +4006,15 @@ static gro_result_t napi_frags_finish(struct napi_struct *napi, struct sk_buff *
 static struct sk_buff *napi_frags_skb(struct napi_struct *napi)
 {
        struct sk_buff *skb = napi->skb;
-        struct ethhdr *eth;
-        unsigned int hlen;
-        unsigned int off;
        napi->skb = NULL;
-        skb_reset_mac_header(skb);
+        if (unlikely(!pskb_may_pull(skb, sizeof(struct ethhdr)))) {
-        skb_gro_reset_offset(skb);
+                napi_reuse_skb(napi, skb);
+                return NULL;
-        off = skb_gro_offset(skb);
-        hlen = off + sizeof(*eth);
-        eth = skb_gro_header_fast(skb, off);
-        if (skb_gro_header_hard(skb, hlen)) {
-                eth = skb_gro_header_slow(skb, hlen, off);
-                if (unlikely(!eth)) {
-                        napi_reuse_skb(napi, skb);
-                        skb = NULL;
-                        goto out;
-                }
        }
+        skb->protocol = eth_type_trans(skb, skb->dev);
-        skb_gro_pull(skb, sizeof(*eth));
-        /*
-         * This works because the only protocols we care about don't require
-         * special handling.  We'll fix it up properly at the end.
-         */
-        skb->protocol = eth->h_proto;
-out:
        return skb;
 }
@@ -4062,7 +4030,7 @@ gro_result_t napi_gro_frags(struct napi_struct *napi)
 EXPORT_SYMBOL(napi_gro_frags);
 /*
- * net_rps_action sends any pending IPI's for rps.
+ * net_rps_action_and_irq_enable sends any pending IPI's for rps.
 * Note: called with local irq disabled, but exits with local irq enabled.
 */
 static void net_rps_action_and_irq_enable(struct softnet_data *sd)
@@ -4267,17 +4235,10 @@ EXPORT_SYMBOL(netif_napi_add);
 void netif_napi_del(struct napi_struct *napi)
 {
-        struct sk_buff *skb, *next;
        list_del_init(&napi->dev_list);
        napi_free_frags(napi);
-        for (skb = napi->gro_list; skb; skb = next) {
+        kfree_skb_list(napi->gro_list);
-                next = skb->next;
-                skb->next = NULL;
-                kfree_skb(skb);
-        }
        napi->gro_list = NULL;
        napi->gro_count = 0;
 }
@@ -4571,6 +4532,27 @@ void *netdev_lower_get_next_private_rcu(struct net_device *dev,
 EXPORT_SYMBOL(netdev_lower_get_next_private_rcu);
 /**
+ * netdev_lower_get_first_private_rcu - Get the first ->private from the
+ *                                     lower neighbour list, RCU
+ *                                     variant
+ * @dev: device
+ *
+ * Gets the first netdev_adjacent->private from the dev's lower neighbour
+ * list. The caller must hold RCU read lock.
+ */
+void *netdev_lower_get_first_private_rcu(struct net_device *dev)
+{
+        struct netdev_adjacent *lower;
+        lower = list_first_or_null_rcu(&dev->adj_list.lower,
+                        struct netdev_adjacent, list);
+        if (lower)
+                return lower->private;
+        return NULL;
+}
+EXPORT_SYMBOL(netdev_lower_get_first_private_rcu);
+/**
 * netdev_master_upper_dev_get_rcu - Get master upper device
 * @dev: device
 *
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index ec40a849fc42..bb504a919e33 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -186,47 +186,6 @@ static int __hw_addr_sync_multiple(struct netdev_hw_addr_list *to_list,
        return err;
 }
-int __hw_addr_add_multiple(struct netdev_hw_addr_list *to_list,
-                           struct netdev_hw_addr_list *from_list,
-                           int addr_len, unsigned char addr_type)
-{
-        int err;
-        struct netdev_hw_addr *ha, *ha2;
-        unsigned char type;
-        list_for_each_entry(ha, &from_list->list, list) {
-                type = addr_type ? addr_type : ha->type;
-                err = __hw_addr_add(to_list, ha->addr, addr_len, type);
-                if (err)
-                        goto unroll;
-        }
-        return 0;
-unroll:
-        list_for_each_entry(ha2, &from_list->list, list) {
-                if (ha2 == ha)
-                        break;
-                type = addr_type ? addr_type : ha2->type;
-                __hw_addr_del(to_list, ha2->addr, addr_len, type);
-        }
-        return err;
-}
-EXPORT_SYMBOL(__hw_addr_add_multiple);
-void __hw_addr_del_multiple(struct netdev_hw_addr_list *to_list,
-                            struct netdev_hw_addr_list *from_list,
-                            int addr_len, unsigned char addr_type)
-{
-        struct netdev_hw_addr *ha;
-        unsigned char type;
-        list_for_each_entry(ha, &from_list->list, list) {
-                type = addr_type ? addr_type : ha->type;
-                __hw_addr_del(to_list, ha->addr, addr_len, type);
-        }
-}
-EXPORT_SYMBOL(__hw_addr_del_multiple);
 /* This function only works where there is a strict 1-1 relationship
 * between source and destionation of they synch. If you ever need to
 * sync addresses to more then 1 destination, you need to use
@@ -264,7 +223,7 @@ void __hw_addr_unsync(struct netdev_hw_addr_list *to_list,
 }
 EXPORT_SYMBOL(__hw_addr_unsync);
-void __hw_addr_flush(struct netdev_hw_addr_list *list)
+static void __hw_addr_flush(struct netdev_hw_addr_list *list)
 {
        struct netdev_hw_addr *ha, *tmp;
@@ -274,7 +233,6 @@ void __hw_addr_flush(struct netdev_hw_addr_list *list)
        }
        list->count = 0;
 }
-EXPORT_SYMBOL(__hw_addr_flush);
 void __hw_addr_init(struct netdev_hw_addr_list *list)
 {
@@ -400,59 +358,6 @@ int dev_addr_del(struct net_device *dev, const unsigned char *addr,
 }
 EXPORT_SYMBOL(dev_addr_del);
-/**
- *      dev_addr_add_multiple - Add device addresses from another device
- *      @to_dev: device to which addresses will be added
- *      @from_dev: device from which addresses will be added
- *      @addr_type: address type - 0 means type will be used from from_dev
- *
- *      Add device addresses of the one device to another.
- **
- *      The caller must hold the rtnl_mutex.
- */
-int dev_addr_add_multiple(struct net_device *to_dev,
-                          struct net_device *from_dev,
-                          unsigned char addr_type)
-{
-        int err;
-        ASSERT_RTNL();
-        if (from_dev->addr_len != to_dev->addr_len)
-                return -EINVAL;
-        err = __hw_addr_add_multiple(&to_dev->dev_addrs, &from_dev->dev_addrs,
-                                     to_dev->addr_len, addr_type);
-        if (!err)
-                call_netdevice_notifiers(NETDEV_CHANGEADDR, to_dev);
-        return err;
-}
-EXPORT_SYMBOL(dev_addr_add_multiple);
-/**
- *      dev_addr_del_multiple - Delete device addresses by another device
- *      @to_dev: device where the addresses will be deleted
- *      @from_dev: device supplying the addresses to be deleted
- *      @addr_type: address type - 0 means type will be used from from_dev
- *
- *      Deletes addresses in to device by the list of addresses in from device.
- *
- *      The caller must hold the rtnl_mutex.
- */
-int dev_addr_del_multiple(struct net_device *to_dev,
-                          struct net_device *from_dev,
-                          unsigned char addr_type)
-{
-        ASSERT_RTNL();
-        if (from_dev->addr_len != to_dev->addr_len)
-                return -EINVAL;
-        __hw_addr_del_multiple(&to_dev->dev_addrs, &from_dev->dev_addrs,
-                               to_dev->addr_len, addr_type);
-        call_netdevice_notifiers(NETDEV_CHANGEADDR, to_dev);
-        return 0;
-}
-EXPORT_SYMBOL(dev_addr_del_multiple);
 /*
 * Unicast list handling functions
 */
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 5b7d0e1d0664..cf999e09bcd2 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -327,6 +327,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                    cmd == SIOCBRADDIF ||
                    cmd == SIOCBRDELIF ||
                    cmd == SIOCSHWTSTAMP ||
+                    cmd == SIOCGHWTSTAMP ||
                    cmd == SIOCWANDEV) {
                        err = -EOPNOTSUPP;
                        if (ops->ndo_do_ioctl) {
@@ -546,6 +547,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         */
        default:
                if (cmd == SIOCWANDEV ||
+                    cmd == SIOCGHWTSTAMP ||
                    (cmd >= SIOCDEVPRIVATE &&
                     cmd <= SIOCDEVPRIVATE + 15)) {
                        dev_load(net, ifr.ifr_name);
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 95897183226e..e70301eb7a4a 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -64,7 +64,6 @@ static struct genl_family net_drop_monitor_family = {
        .hdrsize        = 0,
        .name           = "NET_DM",
        .version        = 2,
-        .maxattr        = NET_DM_CMD_MAX,
 };
 static DEFINE_PER_CPU(struct per_cpu_dm_data, dm_cpu_data);
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index d6ef17322500..b324bfa3485c 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -202,12 +202,12 @@ static __always_inline u32 __flow_hash_1word(u32 a)
 }
 /*
- * __skb_get_rxhash: calculate a flow hash based on src/dst addresses
+ * __skb_get_hash: calculate a flow hash based on src/dst addresses
 * and src/dst port numbers.  Sets rxhash in skb to non-zero hash value
 * on success, zero indicates no valid hash.  Also, sets l4_rxhash in skb
 * if hash is a canonical 4-tuple hash over transport ports.
 */
-void __skb_get_rxhash(struct sk_buff *skb)
+void __skb_get_hash(struct sk_buff *skb)
 {
        struct flow_keys keys;
        u32 hash;
@@ -234,7 +234,7 @@ void __skb_get_rxhash(struct sk_buff *skb)
        skb->rxhash = hash;
 }
-EXPORT_SYMBOL(__skb_get_rxhash);
+EXPORT_SYMBOL(__skb_get_hash);
 /*
 * Returns a Tx hash based on the given packet descriptor a Tx queues' number
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index ca15f32821fb..a666740051dc 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -38,6 +38,8 @@
 #include <linux/random.h>
 #include <linux/string.h>
 #include <linux/log2.h>
+#include <linux/inetdevice.h>
+#include <net/addrconf.h>
 #define DEBUG
 #define NEIGH_DEBUG 1
@@ -497,7 +499,7 @@ struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
                goto out_neigh_release;
        }
-        n->confirmed = jiffies - (n->parms->base_reachable_time << 1);
+        n->confirmed = jiffies - (NEIGH_VAR(n->parms, BASE_REACHABLE_TIME) << 1);
        write_lock_bh(&tbl->lock);
        nht = rcu_dereference_protected(tbl->nht,
@@ -776,7 +778,7 @@ static void neigh_periodic_work(struct work_struct *work)
                tbl->last_rand = jiffies;
                for (p = &tbl->parms; p; p = p->next)
                        p->reachable_time =
-                                neigh_rand_reach_time(p->base_reachable_time);
+                                neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
        }
        for (i = 0 ; i < (1 << nht->hash_shift); i++) {
@@ -799,7 +801,7 @@ static void neigh_periodic_work(struct work_struct *work)
                        if (atomic_read(&n->refcnt) == 1 &&
                            (state == NUD_FAILED ||
-                             time_after(jiffies, n->used + n->parms->gc_staletime))) {
+                             time_after(jiffies, n->used + NEIGH_VAR(n->parms, GC_STALETIME)))) {
                                *np = n->next;
                                n->dead = 1;
                                write_unlock(&n->lock);
@@ -822,12 +824,12 @@ next_elt:
                                                lockdep_is_held(&tbl->lock));
        }
 out:
-        /* Cycle through all hash buckets every base_reachable_time/2 ticks.
+        /* Cycle through all hash buckets every BASE_REACHABLE_TIME/2 ticks.
-         * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
+         * ARP entry timeouts range from 1/2 BASE_REACHABLE_TIME to 3/2
-         * base_reachable_time.
+         * BASE_REACHABLE_TIME.
         */
        schedule_delayed_work(&tbl->gc_work,
-                              tbl->parms.base_reachable_time >> 1);
+                              NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME) >> 1);
        write_unlock_bh(&tbl->lock);
 }
@@ -835,8 +837,9 @@ static __inline__ int neigh_max_probes(struct neighbour *n)
 {
        struct neigh_parms *p = n->parms;
        return (n->nud_state & NUD_PROBE) ?
-                p->ucast_probes :
+                NEIGH_VAR(p, UCAST_PROBES) :
-                p->ucast_probes + p->app_probes + p->mcast_probes;
+                NEIGH_VAR(p, UCAST_PROBES) + NEIGH_VAR(p, APP_PROBES) +
+                NEIGH_VAR(p, MCAST_PROBES);
 }
 static void neigh_invalidate(struct neighbour *neigh)
@@ -901,12 +904,13 @@ static void neigh_timer_handler(unsigned long arg)
                        neigh_dbg(2, "neigh %p is still alive\n", neigh);
                        next = neigh->confirmed + neigh->parms->reachable_time;
                } else if (time_before_eq(now,
-                                          neigh->used + neigh->parms->delay_probe_time)) {
+                                          neigh->used +
+                                          NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
                        neigh_dbg(2, "neigh %p is delayed\n", neigh);
                        neigh->nud_state = NUD_DELAY;
                        neigh->updated = jiffies;
                        neigh_suspect(neigh);
-                        next = now + neigh->parms->delay_probe_time;
+                        next = now + NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME);
                } else {
                        neigh_dbg(2, "neigh %p is suspected\n", neigh);
                        neigh->nud_state = NUD_STALE;
@@ -916,7 +920,8 @@ static void neigh_timer_handler(unsigned long arg)
                }
        } else if (state & NUD_DELAY) {
                if (time_before_eq(now,
-                                   neigh->confirmed + neigh->parms->delay_probe_time)) {
+                                   neigh->confirmed +
+                                   NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME))) {
                        neigh_dbg(2, "neigh %p is now reachable\n", neigh);
                        neigh->nud_state = NUD_REACHABLE;
                        neigh->updated = jiffies;
@@ -928,11 +933,11 @@ static void neigh_timer_handler(unsigned long arg)
                        neigh->nud_state = NUD_PROBE;
                        neigh->updated = jiffies;
                        atomic_set(&neigh->probes, 0);
-                        next = now + neigh->parms->retrans_time;
+                        next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
                }
        } else {
                /* NUD_PROBE|NUD_INCOMPLETE */
-                next = now + neigh->parms->retrans_time;
+                next = now + NEIGH_VAR(neigh->parms, RETRANS_TIME);
        }
        if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
@@ -973,13 +978,16 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
                goto out_unlock_bh;
        if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
-                if (neigh->parms->mcast_probes + neigh->parms->app_probes) {
+                if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
+                    NEIGH_VAR(neigh->parms, APP_PROBES)) {
                        unsigned long next, now = jiffies;
-                        atomic_set(&neigh->probes, neigh->parms->ucast_probes);
+                        atomic_set(&neigh->probes,
+                                   NEIGH_VAR(neigh->parms, UCAST_PROBES));
                        neigh->nud_state     = NUD_INCOMPLETE;
                        neigh->updated = now;
-                        next = now + max(neigh->parms->retrans_time, HZ/2);
+                        next = now + max(NEIGH_VAR(neigh->parms, RETRANS_TIME),
+                                         HZ/2);
                        neigh_add_timer(neigh, next);
                        immediate_probe = true;
                } else {
@@ -994,14 +1002,14 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
                neigh_dbg(2, "neigh %p is delayed\n", neigh);
                neigh->nud_state = NUD_DELAY;
                neigh->updated = jiffies;
-                neigh_add_timer(neigh,
+                neigh_add_timer(neigh, jiffies +
-                                jiffies + neigh->parms->delay_probe_time);
+                                NEIGH_VAR(neigh->parms, DELAY_PROBE_TIME));
        }
        if (neigh->nud_state == NUD_INCOMPLETE) {
                if (skb) {
                        while (neigh->arp_queue_len_bytes + skb->truesize >
-                               neigh->parms->queue_len_bytes) {
+                               NEIGH_VAR(neigh->parms, QUEUE_LEN_BYTES)) {
                                struct sk_buff *buff;
                                buff = __skb_dequeue(&neigh->arp_queue);
@@ -1161,6 +1169,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                                                 neigh->parms->reachable_time :
                                                 0)));
                neigh->nud_state = new;
+                notify = 1;
        }
        if (lladdr != neigh->ha) {
@@ -1170,7 +1179,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                neigh_update_hhs(neigh);
                if (!(new & NUD_CONNECTED))
                        neigh->confirmed = jiffies -
-                                      (neigh->parms->base_reachable_time << 1);
+                                      (NEIGH_VAR(neigh->parms, BASE_REACHABLE_TIME) << 1);
                notify = 1;
        }
        if (new == old)
@@ -1230,6 +1239,21 @@ out:
 }
 EXPORT_SYMBOL(neigh_update);
+/* Update the neigh to listen temporarily for probe responses, even if it is
+ * in a NUD_FAILED state. The caller has to hold neigh->lock for writing.
+ */
+void __neigh_set_probe_once(struct neighbour *neigh)
+{
+        neigh->updated = jiffies;
+        if (!(neigh->nud_state & NUD_FAILED))
+                return;
+        neigh->nud_state = NUD_PROBE;
+        atomic_set(&neigh->probes, NEIGH_VAR(neigh->parms, UCAST_PROBES));
+        neigh_add_timer(neigh,
+                        jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
+}
+EXPORT_SYMBOL(__neigh_set_probe_once);
 struct neighbour *neigh_event_ns(struct neigh_table *tbl,
                                 u8 *lladdr, void *saddr,
                                 struct net_device *dev)
@@ -1391,9 +1415,10 @@ void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
                    struct sk_buff *skb)
 {
        unsigned long now = jiffies;
-        unsigned long sched_next = now + (net_random() % p->proxy_delay);
+        unsigned long sched_next = now + (net_random() %
+                                          NEIGH_VAR(p, PROXY_DELAY));
-        if (tbl->proxy_queue.qlen > p->proxy_qlen) {
+        if (tbl->proxy_queue.qlen > NEIGH_VAR(p, PROXY_QLEN)) {
                kfree_skb(skb);
                return;
        }
@@ -1440,7 +1465,7 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
                p->tbl            = tbl;
                atomic_set(&p->refcnt, 1);
                p->reachable_time =
-                                neigh_rand_reach_time(p->base_reachable_time);
+                                neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
                dev_hold(dev);
                p->dev = dev;
                write_pnet(&p->net, hold_net(net));
@@ -1457,6 +1482,8 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
                p->next         = tbl->parms.next;
                tbl->parms.next = p;
                write_unlock_bh(&tbl->lock);
+                neigh_parms_data_state_cleanall(p);
        }
        return p;
 }
@@ -1509,7 +1536,7 @@ static void neigh_table_init_no_netlink(struct neigh_table *tbl)
        write_pnet(&tbl->parms.net, &init_net);
        atomic_set(&tbl->parms.refcnt, 1);
        tbl->parms.reachable_time =
-                          neigh_rand_reach_time(tbl->parms.base_reachable_time);
+                          neigh_rand_reach_time(NEIGH_VAR(&tbl->parms, BASE_REACHABLE_TIME));
        tbl->stats = alloc_percpu(struct neigh_statistics);
        if (!tbl->stats)
@@ -1777,24 +1804,32 @@ static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
        if ((parms->dev &&
             nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
            nla_put_u32(skb, NDTPA_REFCNT, atomic_read(&parms->refcnt)) ||
-            nla_put_u32(skb, NDTPA_QUEUE_LENBYTES, parms->queue_len_bytes) ||
+            nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
+                        NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
            /* approximative value for deprecated QUEUE_LEN (in packets) */
            nla_put_u32(skb, NDTPA_QUEUE_LEN,
-                        parms->queue_len_bytes / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
+                        NEIGH_VAR(parms, QUEUE_LEN_BYTES) / SKB_TRUESIZE(ETH_FRAME_LEN)) ||
-            nla_put_u32(skb, NDTPA_PROXY_QLEN, parms->proxy_qlen) ||
+            nla_put_u32(skb, NDTPA_PROXY_QLEN, NEIGH_VAR(parms, PROXY_QLEN)) ||
-            nla_put_u32(skb, NDTPA_APP_PROBES, parms->app_probes) ||
+            nla_put_u32(skb, NDTPA_APP_PROBES, NEIGH_VAR(parms, APP_PROBES)) ||
-            nla_put_u32(skb, NDTPA_UCAST_PROBES, parms->ucast_probes) ||
+            nla_put_u32(skb, NDTPA_UCAST_PROBES,
-            nla_put_u32(skb, NDTPA_MCAST_PROBES, parms->mcast_probes) ||
+                        NEIGH_VAR(parms, UCAST_PROBES)) ||
+            nla_put_u32(skb, NDTPA_MCAST_PROBES,
+                        NEIGH_VAR(parms, MCAST_PROBES)) ||
            nla_put_msecs(skb, NDTPA_REACHABLE_TIME, parms->reachable_time) ||
            nla_put_msecs(skb, NDTPA_BASE_REACHABLE_TIME,
-                          parms->base_reachable_time) ||
+                          NEIGH_VAR(parms, BASE_REACHABLE_TIME)) ||
-            nla_put_msecs(skb, NDTPA_GC_STALETIME, parms->gc_staletime) ||
+            nla_put_msecs(skb, NDTPA_GC_STALETIME,
+                          NEIGH_VAR(parms, GC_STALETIME)) ||
            nla_put_msecs(skb, NDTPA_DELAY_PROBE_TIME,
-                          parms->delay_probe_time) ||
+                          NEIGH_VAR(parms, DELAY_PROBE_TIME)) ||
-            nla_put_msecs(skb, NDTPA_RETRANS_TIME, parms->retrans_time) ||
+            nla_put_msecs(skb, NDTPA_RETRANS_TIME,
-            nla_put_msecs(skb, NDTPA_ANYCAST_DELAY, parms->anycast_delay) ||
+                          NEIGH_VAR(parms, RETRANS_TIME)) ||
-            nla_put_msecs(skb, NDTPA_PROXY_DELAY, parms->proxy_delay) ||
+            nla_put_msecs(skb, NDTPA_ANYCAST_DELAY,
-            nla_put_msecs(skb, NDTPA_LOCKTIME, parms->locktime))
+                          NEIGH_VAR(parms, ANYCAST_DELAY)) ||
+            nla_put_msecs(skb, NDTPA_PROXY_DELAY,
+                          NEIGH_VAR(parms, PROXY_DELAY)) ||
+            nla_put_msecs(skb, NDTPA_LOCKTIME,
+                          NEIGH_VAR(parms, LOCKTIME)))
                goto nla_put_failure;
        return nla_nest_end(skb, nest);
@@ -2010,44 +2045,54 @@ static int neightbl_set(struct sk_buff *skb, struct nlmsghdr *nlh)
                        switch (i) {
                        case NDTPA_QUEUE_LEN:
-                                p->queue_len_bytes = nla_get_u32(tbp[i]) *
+                                NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
-                                                     SKB_TRUESIZE(ETH_FRAME_LEN);
+                                              nla_get_u32(tbp[i]) *
+                                              SKB_TRUESIZE(ETH_FRAME_LEN));
                                break;
                        case NDTPA_QUEUE_LENBYTES:
-                                p->queue_len_bytes = nla_get_u32(tbp[i]);
+                                NEIGH_VAR_SET(p, QUEUE_LEN_BYTES,
+                                              nla_get_u32(tbp[i]));
                                break;
                        case NDTPA_PROXY_QLEN:
-                                p->proxy_qlen = nla_get_u32(tbp[i]);
+                                NEIGH_VAR_SET(p, PROXY_QLEN,
+                                              nla_get_u32(tbp[i]));
                                break;
                        case NDTPA_APP_PROBES:
-                                p->app_probes = nla_get_u32(tbp[i]);
+                                NEIGH_VAR_SET(p, APP_PROBES,
+                                              nla_get_u32(tbp[i]));
                                break;
                        case NDTPA_UCAST_PROBES:
-                                p->ucast_probes = nla_get_u32(tbp[i]);
+                                NEIGH_VAR_SET(p, UCAST_PROBES,
+                                              nla_get_u32(tbp[i]));
                                break;
                        case NDTPA_MCAST_PROBES:
-                                p->mcast_probes = nla_get_u32(tbp[i]);
+                                NEIGH_VAR_SET(p, MCAST_PROBES,
+                                              nla_get_u32(tbp[i]));
                                break;
                        case NDTPA_BASE_REACHABLE_TIME:
-                                p->base_reachable_time = nla_get_msecs(tbp[i]);
+                                NEIGH_VAR_SET(p, BASE_REACHABLE_TIME,
+                                              nla_get_msecs(tbp[i]));
                                break;
                        case NDTPA_GC_STALETIME:
-                                p->gc_staletime = nla_get_msecs(tbp[i]);
+                                NEIGH_VAR_SET(p, GC_STALETIME,
+                                              nla_get_msecs(tbp[i]));
                                break;
                        case NDTPA_DELAY_PROBE_TIME:
-                                p->delay_probe_time = nla_get_msecs(tbp[i]);
+                                NEIGH_VAR_SET(p, DELAY_PROBE_TIME,
+                                              nla_get_msecs(tbp[i]));
                                break;
                        case NDTPA_RETRANS_TIME:
-                                p->retrans_time = nla_get_msecs(tbp[i]);
+                                NEIGH_VAR_SET(p, RETRANS_TIME,
+                                              nla_get_msecs(tbp[i]));
                                break;
                        case NDTPA_ANYCAST_DELAY:
-                                p->anycast_delay = nla_get_msecs(tbp[i]);
+                                NEIGH_VAR_SET(p, ANYCAST_DELAY, nla_get_msecs(tbp[i]));
                                break;
                        case NDTPA_PROXY_DELAY:
-                                p->proxy_delay = nla_get_msecs(tbp[i]);
+                                NEIGH_VAR_SET(p, PROXY_DELAY, nla_get_msecs(tbp[i]));
                                break;
                        case NDTPA_LOCKTIME:
-                                p->locktime = nla_get_msecs(tbp[i]);
+                                NEIGH_VAR_SET(p, LOCKTIME, nla_get_msecs(tbp[i]));
                                break;
                        }
                }
@@ -2788,133 +2833,167 @@ static int proc_unres_qlen(struct ctl_table *ctl, int write,
        return ret;
 }
-enum {
+static struct neigh_parms *neigh_get_dev_parms_rcu(struct net_device *dev,
-        NEIGH_VAR_MCAST_PROBE,
+                                                   int family)
-        NEIGH_VAR_UCAST_PROBE,
+{
-        NEIGH_VAR_APP_PROBE,
+        switch (family) {
-        NEIGH_VAR_RETRANS_TIME,
+        case AF_INET:
-        NEIGH_VAR_BASE_REACHABLE_TIME,
+                return __in_dev_arp_parms_get_rcu(dev);
-        NEIGH_VAR_DELAY_PROBE_TIME,
+        case AF_INET6:
-        NEIGH_VAR_GC_STALETIME,
+                return __in6_dev_nd_parms_get_rcu(dev);
-        NEIGH_VAR_QUEUE_LEN,
+        }
-        NEIGH_VAR_QUEUE_LEN_BYTES,
+        return NULL;
-        NEIGH_VAR_PROXY_QLEN,
+}
-        NEIGH_VAR_ANYCAST_DELAY,
-        NEIGH_VAR_PROXY_DELAY,
+static void neigh_copy_dflt_parms(struct net *net, struct neigh_parms *p,
-        NEIGH_VAR_LOCKTIME,
+                                  int index)
-        NEIGH_VAR_RETRANS_TIME_MS,
+{
-        NEIGH_VAR_BASE_REACHABLE_TIME_MS,
+        struct net_device *dev;
-        NEIGH_VAR_GC_INTERVAL,
+        int family = neigh_parms_family(p);
-        NEIGH_VAR_GC_THRESH1,
-        NEIGH_VAR_GC_THRESH2,
+        rcu_read_lock();
-        NEIGH_VAR_GC_THRESH3,
+        for_each_netdev_rcu(net, dev) {
-        NEIGH_VAR_MAX
+                struct neigh_parms *dst_p =
-};
+                                neigh_get_dev_parms_rcu(dev, family);
+                if (dst_p && !test_bit(index, dst_p->data_state))
+                        dst_p->data[index] = p->data[index];
+        }
+        rcu_read_unlock();
+}
+static void neigh_proc_update(struct ctl_table *ctl, int write)
+{
+        struct net_device *dev = ctl->extra1;
+        struct neigh_parms *p = ctl->extra2;
+        struct net *net = neigh_parms_net(p);
+        int index = (int *) ctl->data - p->data;
+        if (!write)
+                return;
+        set_bit(index, p->data_state);
+        if (!dev) /* NULL dev means this is default value */
+                neigh_copy_dflt_parms(net, p, index);
+}
+static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
+                                           void __user *buffer,
+                                           size_t *lenp, loff_t *ppos)
+{
+        struct ctl_table tmp = *ctl;
+        int ret;
+        tmp.extra1 = &zero;
+        tmp.extra2 = &int_max;
+        ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
+        neigh_proc_update(ctl, write);
+        return ret;
+}
+int neigh_proc_dointvec(struct ctl_table *ctl, int write,
+                        void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+        neigh_proc_update(ctl, write);
+        return ret;
+}
+EXPORT_SYMBOL(neigh_proc_dointvec);
+int neigh_proc_dointvec_jiffies(struct ctl_table *ctl, int write,
+                                void __user *buffer,
+                                size_t *lenp, loff_t *ppos)
+{
+        int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
+        neigh_proc_update(ctl, write);
+        return ret;
+}
+EXPORT_SYMBOL(neigh_proc_dointvec_jiffies);
+static int neigh_proc_dointvec_userhz_jiffies(struct ctl_table *ctl, int write,
+                                              void __user *buffer,
+                                              size_t *lenp, loff_t *ppos)
+{
+        int ret = proc_dointvec_userhz_jiffies(ctl, write, buffer, lenp, ppos);
+        neigh_proc_update(ctl, write);
+        return ret;
+}
+int neigh_proc_dointvec_ms_jiffies(struct ctl_table *ctl, int write,
+                                   void __user *buffer,
+                                   size_t *lenp, loff_t *ppos)
+{
+        int ret = proc_dointvec_ms_jiffies(ctl, write, buffer, lenp, ppos);
+        neigh_proc_update(ctl, write);
+        return ret;
+}
+EXPORT_SYMBOL(neigh_proc_dointvec_ms_jiffies);
+static int neigh_proc_dointvec_unres_qlen(struct ctl_table *ctl, int write,
+                                          void __user *buffer,
+                                          size_t *lenp, loff_t *ppos)
+{
+        int ret = proc_unres_qlen(ctl, write, buffer, lenp, ppos);
+        neigh_proc_update(ctl, write);
+        return ret;
+}
+#define NEIGH_PARMS_DATA_OFFSET(index)  \
+        (&((struct neigh_parms *) 0)->data[index])
+#define NEIGH_SYSCTL_ENTRY(attr, data_attr, name, mval, proc) \
+        [NEIGH_VAR_ ## attr] = { \
+                .procname       = name, \
+                .data           = NEIGH_PARMS_DATA_OFFSET(NEIGH_VAR_ ## data_attr), \
+                .maxlen         = sizeof(int), \
+                .mode           = mval, \
+                .proc_handler   = proc, \
+        }
+#define NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(attr, name) \
+        NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_zero_intmax)
+#define NEIGH_SYSCTL_JIFFIES_ENTRY(attr, name) \
+        NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_jiffies)
+#define NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(attr, name) \
+        NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_userhz_jiffies)
+#define NEIGH_SYSCTL_MS_JIFFIES_ENTRY(attr, name) \
+        NEIGH_SYSCTL_ENTRY(attr, attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
+#define NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(attr, data_attr, name) \
+        NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_ms_jiffies)
+#define NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(attr, data_attr, name) \
+        NEIGH_SYSCTL_ENTRY(attr, data_attr, name, 0644, neigh_proc_dointvec_unres_qlen)
 static struct neigh_sysctl_table {
        struct ctl_table_header *sysctl_header;
        struct ctl_table neigh_vars[NEIGH_VAR_MAX + 1];
 } neigh_sysctl_template __read_mostly = {
        .neigh_vars = {
-                [NEIGH_VAR_MCAST_PROBE] = {
+                NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(MCAST_PROBES, "mcast_solicit"),
-                        .procname       = "mcast_solicit",
+                NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(UCAST_PROBES, "ucast_solicit"),
-                        .maxlen         = sizeof(int),
+                NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(APP_PROBES, "app_solicit"),
-                        .mode           = 0644,
+                NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(RETRANS_TIME, "retrans_time"),
-                        .extra1         = &zero,
+                NEIGH_SYSCTL_JIFFIES_ENTRY(BASE_REACHABLE_TIME, "base_reachable_time"),
-                        .extra2         = &int_max,
+                NEIGH_SYSCTL_JIFFIES_ENTRY(DELAY_PROBE_TIME, "delay_first_probe_time"),
-                        .proc_handler   = proc_dointvec_minmax,
+                NEIGH_SYSCTL_JIFFIES_ENTRY(GC_STALETIME, "gc_stale_time"),
-                },
+                NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(QUEUE_LEN_BYTES, "unres_qlen_bytes"),
-                [NEIGH_VAR_UCAST_PROBE] = {
+                NEIGH_SYSCTL_ZERO_INTMAX_ENTRY(PROXY_QLEN, "proxy_qlen"),
-                        .procname       = "ucast_solicit",
+                NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(ANYCAST_DELAY, "anycast_delay"),
-                        .maxlen         = sizeof(int),
+                NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(PROXY_DELAY, "proxy_delay"),
-                        .mode           = 0644,
+                NEIGH_SYSCTL_USERHZ_JIFFIES_ENTRY(LOCKTIME, "locktime"),
-                        .extra1         = &zero,
+                NEIGH_SYSCTL_UNRES_QLEN_REUSED_ENTRY(QUEUE_LEN, QUEUE_LEN_BYTES, "unres_qlen"),
-                        .extra2         = &int_max,
+                NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(RETRANS_TIME_MS, RETRANS_TIME, "retrans_time_ms"),
-                        .proc_handler   = proc_dointvec_minmax,
+                NEIGH_SYSCTL_MS_JIFFIES_REUSED_ENTRY(BASE_REACHABLE_TIME_MS, BASE_REACHABLE_TIME, "base_reachable_time_ms"),
-                },
-                [NEIGH_VAR_APP_PROBE] = {
-                        .procname       = "app_solicit",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .extra1         = &zero,
-                        .extra2         = &int_max,
-                        .proc_handler   = proc_dointvec_minmax,
-                },
-                [NEIGH_VAR_RETRANS_TIME] = {
-                        .procname       = "retrans_time",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec_userhz_jiffies,
-                },
-                [NEIGH_VAR_BASE_REACHABLE_TIME] = {
-                        .procname       = "base_reachable_time",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec_jiffies,
-                },
-                [NEIGH_VAR_DELAY_PROBE_TIME] = {
-                        .procname       = "delay_first_probe_time",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec_jiffies,
-                },
-                [NEIGH_VAR_GC_STALETIME] = {
-                        .procname       = "gc_stale_time",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec_jiffies,
-                },
-                [NEIGH_VAR_QUEUE_LEN] = {
-                        .procname       = "unres_qlen",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = proc_unres_qlen,
-                },
-                [NEIGH_VAR_QUEUE_LEN_BYTES] = {
-                        .procname       = "unres_qlen_bytes",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .extra1         = &zero,
-                        .proc_handler   = proc_dointvec_minmax,
-                },
-                [NEIGH_VAR_PROXY_QLEN] = {
-                        .procname       = "proxy_qlen",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .extra1         = &zero,
-                        .extra2         = &int_max,
-                        .proc_handler   = proc_dointvec_minmax,
-                },
-                [NEIGH_VAR_ANYCAST_DELAY] = {
-                        .procname       = "anycast_delay",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec_userhz_jiffies,
-                },
-                [NEIGH_VAR_PROXY_DELAY] = {
-                        .procname       = "proxy_delay",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec_userhz_jiffies,
-                },
-                [NEIGH_VAR_LOCKTIME] = {
-                        .procname       = "locktime",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec_userhz_jiffies,
-                },
-                [NEIGH_VAR_RETRANS_TIME_MS] = {
-                        .procname       = "retrans_time_ms",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec_ms_jiffies,
-                },
-                [NEIGH_VAR_BASE_REACHABLE_TIME_MS] = {
-                        .procname       = "base_reachable_time_ms",
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec_ms_jiffies,
-                },
                [NEIGH_VAR_GC_INTERVAL] = {
                        .procname       = "gc_interval",
                        .maxlen         = sizeof(int),
@@ -2950,31 +3029,23 @@ static struct neigh_sysctl_table {
 };
 int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
-                          char *p_name, proc_handler *handler)
+                          proc_handler *handler)
 {
+        int i;
        struct neigh_sysctl_table *t;
-        const char *dev_name_source = NULL;
+        const char *dev_name_source;
        char neigh_path[ sizeof("net//neigh/") + IFNAMSIZ + IFNAMSIZ ];
+        char *p_name;
        t = kmemdup(&neigh_sysctl_template, sizeof(*t), GFP_KERNEL);
        if (!t)
                goto err;
-        t->neigh_vars[NEIGH_VAR_MCAST_PROBE].data  = &p->mcast_probes;
+        for (i = 0; i < ARRAY_SIZE(t->neigh_vars); i++) {
-        t->neigh_vars[NEIGH_VAR_UCAST_PROBE].data  = &p->ucast_probes;
+                t->neigh_vars[i].data += (long) p;
-        t->neigh_vars[NEIGH_VAR_APP_PROBE].data  = &p->app_probes;
+                t->neigh_vars[i].extra1 = dev;
-        t->neigh_vars[NEIGH_VAR_RETRANS_TIME].data  = &p->retrans_time;
+                t->neigh_vars[i].extra2 = p;
-        t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].data  = &p->base_reachable_time;
+        }
-        t->neigh_vars[NEIGH_VAR_DELAY_PROBE_TIME].data  = &p->delay_probe_time;
-        t->neigh_vars[NEIGH_VAR_GC_STALETIME].data  = &p->gc_staletime;
-        t->neigh_vars[NEIGH_VAR_QUEUE_LEN].data  = &p->queue_len_bytes;
-        t->neigh_vars[NEIGH_VAR_QUEUE_LEN_BYTES].data  = &p->queue_len_bytes;
-        t->neigh_vars[NEIGH_VAR_PROXY_QLEN].data  = &p->proxy_qlen;
-        t->neigh_vars[NEIGH_VAR_ANYCAST_DELAY].data  = &p->anycast_delay;
-        t->neigh_vars[NEIGH_VAR_PROXY_DELAY].data = &p->proxy_delay;
-        t->neigh_vars[NEIGH_VAR_LOCKTIME].data = &p->locktime;
-        t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].data  = &p->retrans_time;
-        t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].data  = &p->base_reachable_time;
        if (dev) {
                dev_name_source = dev->name;
@@ -2989,26 +3060,32 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
                t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = (int *)(p + 1) + 3;
        }
        if (handler) {
                /* RetransTime */
                t->neigh_vars[NEIGH_VAR_RETRANS_TIME].proc_handler = handler;
-                t->neigh_vars[NEIGH_VAR_RETRANS_TIME].extra1 = dev;
                /* ReachableTime */
                t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].proc_handler = handler;
-                t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME].extra1 = dev;
                /* RetransTime (in milliseconds)*/
                t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].proc_handler = handler;
-                t->neigh_vars[NEIGH_VAR_RETRANS_TIME_MS].extra1 = dev;
                /* ReachableTime (in milliseconds) */
                t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].proc_handler = handler;
-                t->neigh_vars[NEIGH_VAR_BASE_REACHABLE_TIME_MS].extra1 = dev;
        }
        /* Don't export sysctls to unprivileged users */
        if (neigh_parms_net(p)->user_ns != &init_user_ns)
                t->neigh_vars[0].procname = NULL;
+        switch (neigh_parms_family(p)) {
+        case AF_INET:
+              p_name = "ipv4";
+              break;
+        case AF_INET6:
+              p_name = "ipv6";
+              break;
+        default:
+              BUG();
+        }
        snprintf(neigh_path, sizeof(neigh_path), "net/%s/neigh/%s",
                p_name, dev_name_source);
        t->sysctl_header =
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index f3edf9635e02..1a7b7b1df0d1 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -676,8 +676,8 @@ static ssize_t store_rps_dev_flow_table_cnt(struct netdev_rx_queue *queue,
                while ((mask | (mask >> 1)) != mask)
                        mask |= (mask >> 1);
                /* On 64 bit arches, must check mask fits in table->mask (u32),
-                 * and on 32bit arches, must check RPS_DEV_FLOW_TABLE_SIZE(mask + 1)
+                 * and on 32bit arches, must check
-                 * doesnt overflow.
+                 * RPS_DEV_FLOW_TABLE_SIZE(mask + 1) doesn't overflow.
                 */
 #if BITS_PER_LONG > 32
                if (mask > (unsigned long)(u32)mask)
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index 9b7cf6c85f82..1dda50c2e705 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -30,7 +30,7 @@
 #define PRIOMAP_MIN_SZ          128
 /*
- * Extend @dev->priomap so that it's large enough to accomodate
+ * Extend @dev->priomap so that it's large enough to accommodate
 * @target_idx.  @dev->priomap.priomap_len > @target_idx after successful
 * return.  Must be called under rtnl lock.
 */
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 261357a66300..a797fff7f222 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2527,6 +2527,8 @@ static int process_ipsec(struct pktgen_dev *pkt_dev,
                if (x) {
                        int ret;
                        __u8 *eth;
+                        struct iphdr *iph;
                        nhead = x->props.header_len - skb_headroom(skb);
                        if (nhead > 0) {
                                ret = pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
@@ -2548,6 +2550,11 @@ static int process_ipsec(struct pktgen_dev *pkt_dev,
                        eth = (__u8 *) skb_push(skb, ETH_HLEN);
                        memcpy(eth, pkt_dev->hh, 12);
                        *(u16 *) &eth[12] = protocol;
+                        /* Update IPv4 header len as well as checksum value */
+                        iph = ip_hdr(skb);
+                        iph->tot_len = htons(skb->len - ETH_HLEN);
+                        ip_send_check(iph);
                }
        }
        return 1;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 2718fed53d8c..eb96c2c22400 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -712,9 +712,8 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
        new->inner_network_header = old->inner_network_header;
        new->inner_mac_header = old->inner_mac_header;
        skb_dst_copy(new, old);
-        new->rxhash             = old->rxhash;
+        skb_copy_hash(new, old);
        new->ooo_okay           = old->ooo_okay;
-        new->l4_rxhash          = old->l4_rxhash;
        new->no_fcs             = old->no_fcs;
        new->encapsulation      = old->encapsulation;
 #ifdef CONFIG_XFRM
@@ -2982,10 +2981,7 @@ perform_csum_check:
        return segs;
 err:
-        while ((skb = segs)) {
+        kfree_skb_list(segs);
-                segs = skb->next;
-                kfree_skb(skb);
-        }
        return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(skb_segment);
@@ -3584,6 +3580,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
        skb->tstamp.tv64 = 0;
        skb->pkt_type = PACKET_HOST;
        skb->skb_iif = 0;
+        skb->local_df = 0;
        skb_dst_drop(skb);
        skb->mark = 0;
        secpath_reset(skb);
diff --git a/net/core/sock.c b/net/core/sock.c
index ab20ed9b0f31..5393b4b719d7 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -882,7 +882,7 @@ set_rcvbuf:
        case SO_PEEK_OFF:
                if (sock->ops->set_peek_off)
-                        sock->ops->set_peek_off(sk, val);
+                        ret = sock->ops->set_peek_off(sk, val);
                else
                        ret = -EOPNOTSUPP;
                break;
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index cca444190907..cf9cd13509a7 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -122,7 +122,8 @@ static int flow_limit_cpu_sysctl(struct ctl_table *table, int write,
                                synchronize_rcu();
                                kfree(cur);
                        } else if (!cur && cpumask_test_cpu(i, mask)) {
-                                cur = kzalloc(len, GFP_KERNEL);
+                                cur = kzalloc_node(len, GFP_KERNEL,
+                                                   cpu_to_node(i));
                                if (!cur) {
                                        /* not unwinding previous changes */
                                        ret = -ENOMEM;
diff --git a/net/dcb/dcbevent.c b/net/dcb/dcbevent.c
index 4f72fc40bf02..a520d8004d89 100644
--- a/net/dcb/dcbevent.c
+++ b/net/dcb/dcbevent.c
@@ -11,8 +11,7 @@
 * more details.
 *
 * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * this program; if not, see <http://www.gnu.org/licenses/>.
- * Place - Suite 330, Boston, MA 02111-1307 USA.
 *
 * Author: John Fastabend <john.r.fastabend@intel.com>
 */
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 40d5829ed36a..66fbe1948fb5 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -11,8 +11,7 @@
 * more details.
 *
 * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * this program; if not, see <http://www.gnu.org/licenses/>.
- * Place - Suite 330, Boston, MA 02111-1307 USA.
 *
 * Author: Lucy Liu <lucy.liu@intel.com>
 */
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index d9f65fc66db5..88299c29101d 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -75,7 +75,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        rt = ip_route_connect(fl4, nexthop, inet->inet_saddr,
                              RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                              IPPROTO_DCCP,
-                              orig_sport, orig_dport, sk, true);
+                              orig_sport, orig_dport, sk);
        if (IS_ERR(rt))
                return PTR_ERR(rt);
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 4ac71ff7c2e4..4db3c2a1679c 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -141,6 +141,9 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        if (type == ICMPV6_PKT_TOOBIG) {
                struct dst_entry *dst = NULL;
+                if (!ip6_sk_accept_pmtu(sk))
+                        goto out;
                if (sock_owned_by_user(sk))
                        goto out;
                if ((1 << sk->sk_state) & (DCCPF_LISTEN | DCCPF_CLOSED))
@@ -237,7 +240,7 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req)
        final_p = fl6_update_dst(&fl6, np->opt, &final);
-        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
        if (IS_ERR(dst)) {
                err = PTR_ERR(dst);
                dst = NULL;
@@ -301,7 +304,7 @@ static void dccp_v6_ctl_send_reset(struct sock *sk, struct sk_buff *rxskb)
        security_skb_classify_flow(rxskb, flowi6_to_flowi(&fl6));
        /* sk = NULL, but it is safe for now. RST socket required. */
-        dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
+        dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
        if (!IS_ERR(dst)) {
                skb_dst_set(skb, dst);
                ip6_xmit(ctl_sk, skb, &fl6, NULL, 0);
@@ -512,7 +515,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
                fl6.fl6_sport = htons(ireq->ir_num);
                security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
-                dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
+                dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
                if (IS_ERR(dst))
                        goto out;
        }
@@ -851,7 +854,6 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                        if (flowlabel == NULL)
                                return -EINVAL;
-                        usin->sin6_addr = flowlabel->dst;
                        fl6_sock_release(flowlabel);
                }
        }
@@ -932,7 +934,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        final_p = fl6_update_dst(&fl6, np->opt, &final);
-        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
        if (IS_ERR(dst)) {
                err = PTR_ERR(dst);
                goto failure;
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index dd0dfb25f4b1..a603823a3e27 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -561,6 +561,7 @@ static const struct nla_policy dn_ifa_policy[IFA_MAX+1] = {
        [IFA_LOCAL]             = { .type = NLA_U16 },
        [IFA_LABEL]             = { .type = NLA_STRING,
                                    .len = IFNAMSIZ - 1 },
+        [IFA_FLAGS]             = { .type = NLA_U32 },
 };
 static int dn_nl_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
@@ -648,7 +649,8 @@ static int dn_nl_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
        ifa->ifa_local = nla_get_le16(tb[IFA_LOCAL]);
        ifa->ifa_address = nla_get_le16(tb[IFA_ADDRESS]);
-        ifa->ifa_flags = ifm->ifa_flags;
+        ifa->ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) :
+                                         ifm->ifa_flags;
        ifa->ifa_scope = ifm->ifa_scope;
        ifa->ifa_dev = dn_db;
@@ -669,7 +671,8 @@ static inline size_t dn_ifaddr_nlmsg_size(void)
        return NLMSG_ALIGN(sizeof(struct ifaddrmsg))
               + nla_total_size(IFNAMSIZ) /* IFA_LABEL */
               + nla_total_size(2) /* IFA_ADDRESS */
-               + nla_total_size(2); /* IFA_LOCAL */
+               + nla_total_size(2) /* IFA_LOCAL */
+               + nla_total_size(4); /* IFA_FLAGS */
 }
 static int dn_nl_fill_ifaddr(struct sk_buff *skb, struct dn_ifaddr *ifa,
@@ -677,6 +680,7 @@ static int dn_nl_fill_ifaddr(struct sk_buff *skb, struct dn_ifaddr *ifa,
 {
        struct ifaddrmsg *ifm;
        struct nlmsghdr *nlh;
+        u32 ifa_flags = ifa->ifa_flags | IFA_F_PERMANENT;
        nlh = nlmsg_put(skb, portid, seq, event, sizeof(*ifm), flags);
        if (nlh == NULL)
@@ -685,7 +689,7 @@ static int dn_nl_fill_ifaddr(struct sk_buff *skb, struct dn_ifaddr *ifa,
        ifm = nlmsg_data(nlh);
        ifm->ifa_family = AF_DECnet;
        ifm->ifa_prefixlen = 16;
-        ifm->ifa_flags = ifa->ifa_flags | IFA_F_PERMANENT;
+        ifm->ifa_flags = ifa_flags;
        ifm->ifa_scope = ifa->ifa_scope;
        ifm->ifa_index = ifa->ifa_dev->dev->ifindex;
@@ -694,7 +698,8 @@ static int dn_nl_fill_ifaddr(struct sk_buff *skb, struct dn_ifaddr *ifa,
            (ifa->ifa_local &&
             nla_put_le16(skb, IFA_LOCAL, ifa->ifa_local)) ||
            (ifa->ifa_label[0] &&
-             nla_put_string(skb, IFA_LABEL, ifa->ifa_label)))
+             nla_put_string(skb, IFA_LABEL, ifa->ifa_label)) ||
+             nla_put_u32(skb, IFA_FLAGS, ifa_flags))
                goto nla_put_failure;
        return nlmsg_end(skb, nlh);
diff --git a/net/decnet/dn_neigh.c b/net/decnet/dn_neigh.c
index f8637f93d318..c8121ceddb9e 100644
--- a/net/decnet/dn_neigh.c
+++ b/net/decnet/dn_neigh.c
@@ -102,19 +102,21 @@ struct neigh_table dn_neigh_table = {
        .id =                           "dn_neigh_cache",
        .parms ={
                .tbl =                  &dn_neigh_table,
-                .base_reachable_time =  30 * HZ,
+                .reachable_time =       30 * HZ,
-                .retrans_time = 1 * HZ,
+                .data = {
-                .gc_staletime = 60 * HZ,
+                        [NEIGH_VAR_MCAST_PROBES] = 0,
-                .reachable_time =               30 * HZ,
+                        [NEIGH_VAR_UCAST_PROBES] = 0,
-                .delay_probe_time =     5 * HZ,
+                        [NEIGH_VAR_APP_PROBES] = 0,
-                .queue_len_bytes =      64*1024,
+                        [NEIGH_VAR_RETRANS_TIME] = 1 * HZ,
-                .ucast_probes = 0,
+                        [NEIGH_VAR_BASE_REACHABLE_TIME] = 30 * HZ,
-                .app_probes =           0,
+                        [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
-                .mcast_probes = 0,
+                        [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
-                .anycast_delay =        0,
+                        [NEIGH_VAR_QUEUE_LEN_BYTES] = 64*1024,
-                .proxy_delay =          0,
+                        [NEIGH_VAR_PROXY_QLEN] = 0,
-                .proxy_qlen =           0,
+                        [NEIGH_VAR_ANYCAST_DELAY] = 0,
-                .locktime =             1 * HZ,
+                        [NEIGH_VAR_PROXY_DELAY] = 0,
+                        [NEIGH_VAR_LOCKTIME] = 1 * HZ,
+                },
        },
        .gc_interval =                  30 * HZ,
        .gc_thresh1 =                   128,
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index fe32388ea24f..ad2efa5b861b 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1288,8 +1288,6 @@ int dn_route_output_sock(struct dst_entry __rcu **pprt, struct flowidn *fl, stru
        err = __dn_route_output_key(pprt, fl, flags & MSG_TRYHARD);
        if (err == 0 && fl->flowidn_proto) {
-                if (!(flags & MSG_DONTWAIT))
-                        fl->flowidn_flags |= FLOWI_FLAG_CAN_SLEEP;
                *pprt = xfrm_lookup(&init_net, *pprt,
                                    flowidn_to_flowi(fl), sk, 0);
                if (IS_ERR(*pprt)) {
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index f347a2ca7d7e..bf8584339048 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -19,8 +19,7 @@
 *   the GNU Lesser General Public License for more details.
 *
 *   You should have received a copy of the GNU Lesser General Public License
- *   along with this library; if not, write to the Free Software
+ *   along with this library; if not, see <http://www.gnu.org/licenses/>.
- *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */
 #include <linux/module.h>
 #include <linux/moduleparam.h>
diff --git a/net/dns_resolver/dns_query.c b/net/dns_resolver/dns_query.c
index c32be292c7e3..e7b6d53eef88 100644
--- a/net/dns_resolver/dns_query.c
+++ b/net/dns_resolver/dns_query.c
@@ -32,8 +32,7 @@
 *   the GNU Lesser General Public License for more details.
 *
 *   You should have received a copy of the GNU Lesser General Public License
- *   along with this library; if not, write to the Free Software
+ *   along with this library; if not, see <http://www.gnu.org/licenses/>.
- *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */
 #include <linux/module.h>
diff --git a/net/dns_resolver/internal.h b/net/dns_resolver/internal.h
index 17c7886b5b3a..7af1ed39c009 100644
--- a/net/dns_resolver/internal.h
+++ b/net/dns_resolver/internal.h
@@ -15,8 +15,7 @@
 *   the GNU Lesser General Public License for more details.
 *
 *   You should have received a copy of the GNU Lesser General Public License
- *   along with this library; if not, write to the Free Software
+ *   along with this library; if not, see <http://www.gnu.org/licenses/>.
- *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */
 #include <linux/compiler.h>
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 003f5bb3acd2..327060c6c874 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -127,11 +127,6 @@ int hsr_create_self_node(struct list_head *self_node_db,
        return 0;
 }
-static void node_entry_reclaim(struct rcu_head *rh)
-{
-        kfree(container_of(rh, struct node_entry, rcu_head));
-}
 /* Add/merge node to the database of nodes. 'skb' must contain an HSR
 * supervision frame.
@@ -175,7 +170,7 @@ struct node_entry *hsr_merge_node(struct hsr_priv *hsr_priv,
        if (node && !ether_addr_equal(node->MacAddressA, hsr_sp->MacAddressA)) {
                /* Node has changed its AddrA, frame was received from SlaveB */
                list_del_rcu(&node->mac_list);
-                call_rcu(&node->rcu_head, node_entry_reclaim);
+                kfree_rcu(node, rcu_head);
                node = NULL;
        }
@@ -183,7 +178,7 @@ struct node_entry *hsr_merge_node(struct hsr_priv *hsr_priv,
            !ether_addr_equal(node->MacAddressB, hsr_ethsup->ethhdr.h_source)) {
                /* Cables have been swapped */
                list_del_rcu(&node->mac_list);
-                call_rcu(&node->rcu_head, node_entry_reclaim);
+                kfree_rcu(node, rcu_head);
                node = NULL;
        }
@@ -192,7 +187,7 @@ struct node_entry *hsr_merge_node(struct hsr_priv *hsr_priv,
            !ether_addr_equal(node->MacAddressA, hsr_ethsup->ethhdr.h_source)) {
                /* Cables have been swapped */
                list_del_rcu(&node->mac_list);
-                call_rcu(&node->rcu_head, node_entry_reclaim);
+                kfree_rcu(node, rcu_head);
                node = NULL;
        }
@@ -288,7 +283,8 @@ void hsr_addr_subst_dest(struct hsr_priv *hsr_priv, struct ethhdr *ethhdr,
 static bool seq_nr_after(u16 a, u16 b)
 {
        /* Remove inconsistency where
-         * seq_nr_after(a, b) == seq_nr_before(a, b) */
+         * seq_nr_after(a, b) == seq_nr_before(a, b)
+         */
        if ((int) b - a == 32768)
                return false;
@@ -416,7 +412,7 @@ void hsr_prune_nodes(struct hsr_priv *hsr_priv)
                        hsr_nl_nodedown(hsr_priv, node->MacAddressA);
                        list_del_rcu(&node->mac_list);
                        /* Note that we need to free this entry later: */
-                        call_rcu(&node->rcu_head, node_entry_reclaim);
+                        kfree_rcu(node, rcu_head);
                }
        }
        rcu_read_unlock();
diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
index 5325af85eea6..01a5261ac7a5 100644
--- a/net/hsr/hsr_netlink.c
+++ b/net/hsr/hsr_netlink.c
@@ -23,6 +23,8 @@ static const struct nla_policy hsr_policy[IFLA_HSR_MAX + 1] = {
        [IFLA_HSR_SLAVE1]               = { .type = NLA_U32 },
        [IFLA_HSR_SLAVE2]               = { .type = NLA_U32 },
        [IFLA_HSR_MULTICAST_SPEC]       = { .type = NLA_U8 },
+        [IFLA_HSR_SUPERVISION_ADDR]     = { .type = NLA_BINARY, .len = ETH_ALEN },
+        [IFLA_HSR_SEQ_NR]               = { .type = NLA_U16 },
 };
@@ -59,6 +61,31 @@ static int hsr_newlink(struct net *src_net, struct net_device *dev,
        return hsr_dev_finalize(dev, link, multicast_spec);
 }
+static int hsr_fill_info(struct sk_buff *skb, const struct net_device *dev)
+{
+        struct hsr_priv *hsr_priv;
+        hsr_priv = netdev_priv(dev);
+        if (hsr_priv->slave[0])
+                if (nla_put_u32(skb, IFLA_HSR_SLAVE1, hsr_priv->slave[0]->ifindex))
+                        goto nla_put_failure;
+        if (hsr_priv->slave[1])
+                if (nla_put_u32(skb, IFLA_HSR_SLAVE2, hsr_priv->slave[1]->ifindex))
+                        goto nla_put_failure;
+        if (nla_put(skb, IFLA_HSR_SUPERVISION_ADDR, ETH_ALEN,
+                    hsr_priv->sup_multicast_addr) ||
+            nla_put_u16(skb, IFLA_HSR_SEQ_NR, hsr_priv->sequence_nr))
+                goto nla_put_failure;
+        return 0;
+nla_put_failure:
+        return -EMSGSIZE;
+}
 static struct rtnl_link_ops hsr_link_ops __read_mostly = {
        .kind           = "hsr",
        .maxtype        = IFLA_HSR_MAX,
@@ -66,6 +93,7 @@ static struct rtnl_link_ops hsr_link_ops __read_mostly = {
        .priv_size      = sizeof(struct hsr_priv),
        .setup          = hsr_dev_setup,
        .newlink        = hsr_newlink,
+        .fill_info      = hsr_fill_info,
 };
diff --git a/net/ieee802154/wpan-class.c b/net/ieee802154/wpan-class.c
index ef56ab5b35fe..4dd37615a749 100644
--- a/net/ieee802154/wpan-class.c
+++ b/net/ieee802154/wpan-class.c
@@ -46,7 +46,7 @@ MASTER_SHOW(current_channel, "%d");
 MASTER_SHOW(current_page, "%d");
 MASTER_SHOW_COMPLEX(transmit_power, "%d +- %d dB",
        ((signed char) (phy->transmit_power << 2)) >> 2,
-        (phy->transmit_power >> 6) ? (phy->transmit_power >> 6) * 3 : 1 );
+        (phy->transmit_power >> 6) ? (phy->transmit_power >> 6) * 3 : 1);
 MASTER_SHOW(cca_mode, "%d");
 static ssize_t channels_supported_show(struct device *dev,
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 70011e029ac1..b8bc1a3d5cf1 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -126,9 +126,6 @@
 static struct list_head inetsw[SOCK_MAX];
 static DEFINE_SPINLOCK(inetsw_lock);
-struct ipv4_config ipv4_config;
-EXPORT_SYMBOL(ipv4_config);
 /* New destruction routine */
 void inet_sock_destruct(struct sock *sk)
@@ -342,7 +339,7 @@ lookup_protocol:
                        inet->hdrincl = 1;
        }
-        if (ipv4_config.no_pmtu_disc)
+        if (net->ipv4.sysctl_ip_no_pmtu_disc)
                inet->pmtudisc = IP_PMTUDISC_DONT;
        else
                inet->pmtudisc = IP_PMTUDISC_WANT;
@@ -1133,7 +1130,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
        fl4 = &inet->cork.fl.u.ip4;
        rt = ip_route_connect(fl4, daddr, 0, RT_CONN_FLAGS(sk),
                              sk->sk_bound_dev_if, sk->sk_protocol,
-                              inet->inet_sport, inet->inet_dport, sk, false);
+                              inet->inet_sport, inet->inet_dport, sk);
        if (IS_ERR(rt))
                return PTR_ERR(rt);
@@ -1377,8 +1374,12 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
                if (!NAPI_GRO_CB(p)->same_flow)
                        continue;
-                iph2 = ip_hdr(p);
+                iph2 = (struct iphdr *)(p->data + off);
+                /* The above works because, with the exception of the top
+                 * (inner most) layer, we only aggregate pkts with the same
+                 * hdr length so all the hdrs we'll need to verify will start
+                 * at the same offset.
+                 */
                if ((iph->protocol ^ iph2->protocol) |
                    ((__force u32)iph->saddr ^ (__force u32)iph2->saddr) |
                    ((__force u32)iph->daddr ^ (__force u32)iph2->daddr)) {
@@ -1397,6 +1398,11 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
        }
        NAPI_GRO_CB(skb)->flush |= flush;
+        skb_set_network_header(skb, off);
+        /* The above will be needed by the transport layer if there is one
+         * immediately following this IP hdr.
+         */
        skb_gro_pull(skb, sizeof(*iph));
        skb_set_transport_header(skb, skb_gro_offset(skb));
@@ -1411,10 +1417,10 @@ out:
        return pp;
 }
-static int inet_gro_complete(struct sk_buff *skb)
+static int inet_gro_complete(struct sk_buff *skb, int nhoff)
 {
-        __be16 newlen = htons(skb->len - skb_network_offset(skb));
+        __be16 newlen = htons(skb->len - nhoff);
-        struct iphdr *iph = ip_hdr(skb);
+        struct iphdr *iph = (struct iphdr *)(skb->data + nhoff);
        const struct net_offload *ops;
        int proto = iph->protocol;
        int err = -ENOSYS;
@@ -1427,7 +1433,11 @@ static int inet_gro_complete(struct sk_buff *skb)
        if (WARN_ON(!ops || !ops->callbacks.gro_complete))
                goto out_unlock;
-        err = ops->callbacks.gro_complete(skb);
+        /* Only need to add sizeof(*iph) to get to the next hdr below
+         * because any hdr with option will have been flushed in
+         * inet_gro_receive().
+         */
+        err = ops->callbacks.gro_complete(skb, nhoff + sizeof(*iph));
 out_unlock:
        rcu_read_unlock();
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 7808093cede6..5bf408b466b1 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -166,18 +166,20 @@ struct neigh_table arp_tbl = {
        .id             = "arp_cache",
        .parms          = {
                .tbl                    = &arp_tbl,
-                .base_reachable_time    = 30 * HZ,
-                .retrans_time           = 1 * HZ,
-                .gc_staletime           = 60 * HZ,
                .reachable_time         = 30 * HZ,
-                .delay_probe_time       = 5 * HZ,
+                .data   = {
-                .queue_len_bytes        = 64*1024,
+                        [NEIGH_VAR_MCAST_PROBES] = 3,
-                .ucast_probes           = 3,
+                        [NEIGH_VAR_UCAST_PROBES] = 3,
-                .mcast_probes           = 3,
+                        [NEIGH_VAR_RETRANS_TIME] = 1 * HZ,
-                .anycast_delay          = 1 * HZ,
+                        [NEIGH_VAR_BASE_REACHABLE_TIME] = 30 * HZ,
-                .proxy_delay            = (8 * HZ) / 10,
+                        [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
-                .proxy_qlen             = 64,
+                        [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
-                .locktime               = 1 * HZ,
+                        [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
+                        [NEIGH_VAR_PROXY_QLEN] = 64,
+                        [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
+                        [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
+                        [NEIGH_VAR_LOCKTIME] = 1 * HZ,
+                },
        },
        .gc_interval    = 30 * HZ,
        .gc_thresh1     = 128,
@@ -359,14 +361,14 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
        if (!saddr)
                saddr = inet_select_addr(dev, target, RT_SCOPE_LINK);
-        probes -= neigh->parms->ucast_probes;
+        probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
        if (probes < 0) {
                if (!(neigh->nud_state & NUD_VALID))
                        pr_debug("trying to ucast probe in NUD_INVALID\n");
                neigh_ha_snapshot(dst_ha, neigh, dev);
                dst_hw = dst_ha;
        } else {
-                probes -= neigh->parms->app_probes;
+                probes -= NEIGH_VAR(neigh->parms, APP_PROBES);
                if (probes < 0) {
                        neigh_app_ns(neigh);
                        return;
@@ -379,6 +381,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
 static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
 {
+        struct net *net = dev_net(in_dev->dev);
        int scope;
        switch (IN_DEV_ARP_IGNORE(in_dev)) {
@@ -397,6 +400,7 @@ static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
        case 3: /* Do not reply for scope host addresses */
                sip = 0;
                scope = RT_SCOPE_LINK;
+                in_dev = NULL;
                break;
        case 4: /* Reserved */
        case 5:
@@ -408,7 +412,7 @@ static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
        default:
                return 0;
        }
-        return !inet_confirm_addr(in_dev, sip, tip, scope);
+        return !inet_confirm_addr(net, in_dev, sip, tip, scope);
 }
 static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
@@ -871,7 +875,7 @@ static int arp_process(struct sk_buff *skb)
                                if (NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED ||
                                    skb->pkt_type == PACKET_HOST ||
-                                    in_dev->arp_parms->proxy_delay == 0) {
+                                    NEIGH_VAR(in_dev->arp_parms, PROXY_DELAY) == 0) {
                                        arp_send(ARPOP_REPLY, ETH_P_ARP, sip,
                                                 dev, tip, sha, dev->dev_addr,
                                                 sha);
@@ -910,7 +914,8 @@ static int arp_process(struct sk_buff *skb)
                   agents are active. Taking the first reply prevents
                   arp trashing and chooses the fastest router.
                 */
-                override = time_after(jiffies, n->updated + n->parms->locktime);
+                override = time_after(jiffies, n->updated +
+                                               NEIGH_VAR(n->parms, LOCKTIME));
                /* Broadcast replies and request packets
                   do not assert neighbour reachability.
@@ -1107,7 +1112,7 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev)
        return err;
 }
-int arp_invalidate(struct net_device *dev, __be32 ip)
+static int arp_invalidate(struct net_device *dev, __be32 ip)
 {
        struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev);
        int err = -ENXIO;
@@ -1122,7 +1127,6 @@ int arp_invalidate(struct net_device *dev, __be32 ip)
        return err;
 }
-EXPORT_SYMBOL(arp_invalidate);
 static int arp_req_delete_public(struct net *net, struct arpreq *r,
                struct net_device *dev)
@@ -1284,7 +1288,7 @@ void __init arp_init(void)
        dev_add_pack(&arp_packet_type);
        arp_proc_init();
 #ifdef CONFIG_SYSCTL
-        neigh_sysctl_register(NULL, &arp_tbl.parms, "ipv4", NULL);
+        neigh_sysctl_register(NULL, &arp_tbl.parms, NULL);
 #endif
        register_netdevice_notifier(&arp_netdev_notifier);
 }
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 667c1d4ca984..69e77c8ff285 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -31,8 +31,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
@@ -1336,8 +1335,7 @@ static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
        secattr->flags |= NETLBL_SECATTR_MLS_LVL;
        if (tag_len > 4) {
-                secattr->attr.mls.cat =
+                secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
-                                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
                if (secattr->attr.mls.cat == NULL)
                        return -ENOMEM;
@@ -1432,8 +1430,7 @@ static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
        secattr->flags |= NETLBL_SECATTR_MLS_LVL;
        if (tag_len > 4) {
-                secattr->attr.mls.cat =
+                secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
-                                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
                if (secattr->attr.mls.cat == NULL)
                        return -ENOMEM;
@@ -1527,8 +1524,7 @@ static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
        secattr->flags |= NETLBL_SECATTR_MLS_LVL;
        if (tag_len > 4) {
-                secattr->attr.mls.cat =
+                secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
-                                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
                if (secattr->attr.mls.cat == NULL)
                        return -ENOMEM;
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 19e36376d2a0..8b5134c582f1 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -53,7 +53,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        rt = ip_route_connect(fl4, usin->sin_addr.s_addr, saddr,
                              RT_CONN_FLAGS(sk), oif,
                              sk->sk_protocol,
-                              inet->inet_sport, usin->sin_port, sk, true);
+                              inet->inet_sport, usin->sin_port, sk);
        if (IS_ERR(rt)) {
                err = PTR_ERR(rt);
                if (err == -ENETUNREACH)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a1b5bcbd04ae..0feebd5de295 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -99,6 +99,7 @@ static const struct nla_policy ifa_ipv4_policy[IFA_MAX+1] = {
        [IFA_BROADCAST]         = { .type = NLA_U32 },
        [IFA_LABEL]             = { .type = NLA_STRING, .len = IFNAMSIZ - 1 },
        [IFA_CACHEINFO]         = { .len = sizeof(struct ifa_cacheinfo) },
+        [IFA_FLAGS]             = { .type = NLA_U32 },
 };
 #define IN4_ADDR_HSIZE_SHIFT    8
@@ -500,6 +501,7 @@ static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
                return -ENOBUFS;
        }
        ipv4_devconf_setall(in_dev);
+        neigh_parms_data_state_setall(in_dev->arp_parms);
        if (ifa->ifa_dev != in_dev) {
                WARN_ON(ifa->ifa_dev);
                in_dev_hold(in_dev);
@@ -747,6 +749,7 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
                goto errout;
        ipv4_devconf_setall(in_dev);
+        neigh_parms_data_state_setall(in_dev->arp_parms);
        in_dev_hold(in_dev);
        if (tb[IFA_ADDRESS] == NULL)
@@ -755,7 +758,8 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
        INIT_HLIST_NODE(&ifa->hash);
        ifa->ifa_prefixlen = ifm->ifa_prefixlen;
        ifa->ifa_mask = inet_make_mask(ifm->ifa_prefixlen);
-        ifa->ifa_flags = ifm->ifa_flags;
+        ifa->ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) :
+                                         ifm->ifa_flags;
        ifa->ifa_scope = ifm->ifa_scope;
        ifa->ifa_dev = in_dev;
@@ -1236,22 +1240,21 @@ static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
 /*
 * Confirm that local IP address exists using wildcards:
- * - in_dev: only on this interface, 0=any interface
+ * - net: netns to check, cannot be NULL
+ * - in_dev: only on this interface, NULL=any interface
 * - dst: only in the same subnet as dst, 0=any dst
 * - local: address, 0=autoselect the local address
 * - scope: maximum allowed scope value for the local address
 */
-__be32 inet_confirm_addr(struct in_device *in_dev,
+__be32 inet_confirm_addr(struct net *net, struct in_device *in_dev,
                         __be32 dst, __be32 local, int scope)
 {
        __be32 addr = 0;
        struct net_device *dev;
-        struct net *net;
-        if (scope != RT_SCOPE_LINK)
+        if (in_dev != NULL)
                return confirm_addr_indev(in_dev, dst, local, scope);
-        net = dev_net(in_dev->dev);
        rcu_read_lock();
        for_each_netdev_rcu(net, dev) {
                in_dev = __in_dev_get_rcu(dev);
@@ -1435,7 +1438,8 @@ static size_t inet_nlmsg_size(void)
               + nla_total_size(4) /* IFA_ADDRESS */
               + nla_total_size(4) /* IFA_LOCAL */
               + nla_total_size(4) /* IFA_BROADCAST */
-               + nla_total_size(IFNAMSIZ); /* IFA_LABEL */
+               + nla_total_size(IFNAMSIZ) /* IFA_LABEL */
+               + nla_total_size(4);  /* IFA_FLAGS */
 }
 static inline u32 cstamp_delta(unsigned long cstamp)
@@ -1503,6 +1507,7 @@ static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
             nla_put_be32(skb, IFA_BROADCAST, ifa->ifa_broadcast)) ||
            (ifa->ifa_label[0] &&
             nla_put_string(skb, IFA_LABEL, ifa->ifa_label)) ||
+            nla_put_u32(skb, IFA_FLAGS, ifa->ifa_flags) ||
            put_cacheinfo(skb, ifa->ifa_cstamp, ifa->ifa_tstamp,
                          preferred, valid))
                goto nla_put_failure;
@@ -1691,6 +1696,8 @@ static int inet_netconf_msgsize_devconf(int type)
                size += nla_total_size(4);
        if (type == -1 || type == NETCONFA_MC_FORWARDING)
                size += nla_total_size(4);
+        if (type == -1 || type == NETCONFA_PROXY_NEIGH)
+                size += nla_total_size(4);
        return size;
 }
@@ -1727,6 +1734,10 @@ static int inet_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
            nla_put_s32(skb, NETCONFA_MC_FORWARDING,
                        IPV4_DEVCONF(*devconf, MC_FORWARDING)) < 0)
                goto nla_put_failure;
+        if ((type == -1 || type == NETCONFA_PROXY_NEIGH) &&
+            nla_put_s32(skb, NETCONFA_PROXY_NEIGH,
+                        IPV4_DEVCONF(*devconf, PROXY_ARP)) < 0)
+                goto nla_put_failure;
        return nlmsg_end(skb, nlh);
@@ -1764,6 +1775,7 @@ static const struct nla_policy devconf_ipv4_policy[NETCONFA_MAX+1] = {
        [NETCONFA_IFINDEX]      = { .len = sizeof(int) },
        [NETCONFA_FORWARDING]   = { .len = sizeof(int) },
        [NETCONFA_RP_FILTER]    = { .len = sizeof(int) },
+        [NETCONFA_PROXY_NEIGH]  = { .len = sizeof(int) },
 };
 static int inet_netconf_get_devconf(struct sk_buff *in_skb,
@@ -1945,6 +1957,19 @@ static void inet_forward_change(struct net *net)
        }
 }
+static int devinet_conf_ifindex(struct net *net, struct ipv4_devconf *cnf)
+{
+        if (cnf == net->ipv4.devconf_dflt)
+                return NETCONFA_IFINDEX_DEFAULT;
+        else if (cnf == net->ipv4.devconf_all)
+                return NETCONFA_IFINDEX_ALL;
+        else {
+                struct in_device *idev
+                        = container_of(cnf, struct in_device, cnf);
+                return idev->dev->ifindex;
+        }
+}
 static int devinet_conf_proc(struct ctl_table *ctl, int write,
                             void __user *buffer,
                             size_t *lenp, loff_t *ppos)
@@ -1957,6 +1982,7 @@ static int devinet_conf_proc(struct ctl_table *ctl, int write,
                struct ipv4_devconf *cnf = ctl->extra1;
                struct net *net = ctl->extra2;
                int i = (int *)ctl->data - cnf->data;
+                int ifindex;
                set_bit(i, cnf->state);
@@ -1966,23 +1992,19 @@ static int devinet_conf_proc(struct ctl_table *ctl, int write,
                    i == IPV4_DEVCONF_ROUTE_LOCALNET - 1)
                        if ((new_value == 0) && (old_value != 0))
                                rt_cache_flush(net);
                if (i == IPV4_DEVCONF_RP_FILTER - 1 &&
                    new_value != old_value) {
-                        int ifindex;
+                        ifindex = devinet_conf_ifindex(net, cnf);
-                        if (cnf == net->ipv4.devconf_dflt)
-                                ifindex = NETCONFA_IFINDEX_DEFAULT;
-                        else if (cnf == net->ipv4.devconf_all)
-                                ifindex = NETCONFA_IFINDEX_ALL;
-                        else {
-                                struct in_device *idev =
-                                        container_of(cnf, struct in_device,
-                                                     cnf);
-                                ifindex = idev->dev->ifindex;
-                        }
                        inet_netconf_notify_devconf(net, NETCONFA_RP_FILTER,
                                                    ifindex, cnf);
                }
+                if (i == IPV4_DEVCONF_PROXY_ARP - 1 &&
+                    new_value != old_value) {
+                        ifindex = devinet_conf_ifindex(net, cnf);
+                        inet_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
+                                                    ifindex, cnf);
+                }
        }
        return ret;
@@ -2160,7 +2182,7 @@ static void __devinet_sysctl_unregister(struct ipv4_devconf *cnf)
 static void devinet_sysctl_register(struct in_device *idev)
 {
-        neigh_sysctl_register(idev->dev, idev->arp_parms, "ipv4", NULL);
+        neigh_sysctl_register(idev->dev, idev->arp_parms, NULL);
        __devinet_sysctl_register(dev_net(idev->dev), idev->dev->name,
                                        &idev->cnf);
 }
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index 388d113fd289..1e4f6600b31d 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -33,8 +33,6 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event, u32 tb_id,
 void rtmsg_fib(int event, __be32 key, struct fib_alias *fa, int dst_len,
               u32 tb_id, const struct nl_info *info, unsigned int nlm_flags);
 struct fib_alias *fib_find_alias(struct list_head *fah, u8 tos, u32 prio);
-int fib_detect_death(struct fib_info *fi, int order,
-                     struct fib_info **last_resort, int *last_idx, int dflt);
 static inline void fib_result_assign(struct fib_result *res,
                                     struct fib_info *fi)
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 523be38e37de..f2e15738534d 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -104,7 +104,10 @@ errout:
 static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
 {
        struct fib_result *result = (struct fib_result *) arg->result;
-        struct net_device *dev = result->fi->fib_dev;
+        struct net_device *dev = NULL;
+        if (result->fi)
+                dev = result->fi->fib_dev;
        /* do not accept result if the route does
         * not meet the required prefix length
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index e63f47a4e651..b53f0bf84dca 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -426,8 +426,9 @@ struct fib_alias *fib_find_alias(struct list_head *fah, u8 tos, u32 prio)
        return NULL;
 }
-int fib_detect_death(struct fib_info *fi, int order,
+static int fib_detect_death(struct fib_info *fi, int order,
-                     struct fib_info **last_resort, int *last_idx, int dflt)
+                            struct fib_info **last_resort, int *last_idx,
+                            int dflt)
 {
        struct neighbour *n;
        int state = NUD_NONE;
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 5c0e8bc6e5ba..fb3c5637199d 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -705,7 +705,9 @@ static void icmp_unreach(struct sk_buff *skb)
                case ICMP_PORT_UNREACH:
                        break;
                case ICMP_FRAG_NEEDED:
-                        if (ipv4_config.no_pmtu_disc) {
+                        if (net->ipv4.sysctl_ip_no_pmtu_disc == 2) {
+                                goto out;
+                        } else if (net->ipv4.sysctl_ip_no_pmtu_disc) {
                                LIMIT_NETDEBUG(KERN_INFO pr_fmt("%pI4: fragmentation needed and DF set\n"),
                                               &iph->daddr);
                        } else {
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 7defdc9ba167..84c4329cbd30 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -310,7 +310,7 @@ igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
        struct ip_sf_list *psf;
        int scount = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (!is_in(pmc, psf, type, gdeleted, sdeleted))
                        continue;
                scount++;
@@ -463,7 +463,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
        }
        first = 1;
        psf_prev = NULL;
-        for (psf=*psf_list; psf; psf=psf_next) {
+        for (psf = *psf_list; psf; psf = psf_next) {
                __be32 *psrc;
                psf_next = psf->sf_next;
@@ -520,7 +520,7 @@ empty_source:
                        return skb;
                if (pmc->crcount || isquery) {
                        /* make sure we have room for group header */
-                        if (skb && AVAILABLE(skb)<sizeof(struct igmpv3_grec)) {
+                        if (skb && AVAILABLE(skb) < sizeof(struct igmpv3_grec)) {
                                igmpv3_sendpack(skb);
                                skb = NULL; /* add_grhead will get a new one */
                        }
@@ -576,7 +576,7 @@ static void igmpv3_clear_zeros(struct ip_sf_list **ppsf)
        struct ip_sf_list *psf_prev, *psf_next, *psf;
        psf_prev = NULL;
-        for (psf=*ppsf; psf; psf = psf_next) {
+        for (psf = *ppsf; psf; psf = psf_next) {
                psf_next = psf->sf_next;
                if (psf->sf_crcount == 0) {
                        if (psf_prev)
@@ -600,7 +600,7 @@ static void igmpv3_send_cr(struct in_device *in_dev)
        /* deleted MCA's */
        pmc_prev = NULL;
-        for (pmc=in_dev->mc_tomb; pmc; pmc=pmc_next) {
+        for (pmc = in_dev->mc_tomb; pmc; pmc = pmc_next) {
                pmc_next = pmc->next;
                if (pmc->sfmode == MCAST_INCLUDE) {
                        type = IGMPV3_BLOCK_OLD_SOURCES;
@@ -764,7 +764,7 @@ static void igmp_ifc_event(struct in_device *in_dev)
 static void igmp_timer_expire(unsigned long data)
 {
-        struct ip_mc_list *im=(struct ip_mc_list *)data;
+        struct ip_mc_list *im = (struct ip_mc_list *)data;
        struct in_device *in_dev = im->interface;
        spin_lock(&im->lock);
@@ -794,10 +794,10 @@ static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
        int i, scount;
        scount = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (scount == nsrcs)
                        break;
-                for (i=0; i<nsrcs; i++) {
+                for (i = 0; i < nsrcs; i++) {
                        /* skip inactive filters */
                        if (psf->sf_count[MCAST_INCLUDE] ||
                            pmc->sfcount[MCAST_EXCLUDE] !=
@@ -825,10 +825,10 @@ static int igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
        /* mark INCLUDE-mode sources */
        scount = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (scount == nsrcs)
                        break;
-                for (i=0; i<nsrcs; i++)
+                for (i = 0; i < nsrcs; i++)
                        if (srcs[i] == psf->sf_inaddr) {
                                psf->sf_gsresp = 1;
                                scount++;
@@ -1103,7 +1103,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
                pmc->tomb = im->tomb;
                pmc->sources = im->sources;
                im->tomb = im->sources = NULL;
-                for (psf=pmc->sources; psf; psf=psf->sf_next)
+                for (psf = pmc->sources; psf; psf = psf->sf_next)
                        psf->sf_crcount = pmc->crcount;
        }
        spin_unlock_bh(&im->lock);
@@ -1121,7 +1121,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr)
        spin_lock_bh(&in_dev->mc_tomb_lock);
        pmc_prev = NULL;
-        for (pmc=in_dev->mc_tomb; pmc; pmc=pmc->next) {
+        for (pmc = in_dev->mc_tomb; pmc; pmc = pmc->next) {
                if (pmc->multiaddr == multiaddr)
                        break;
                pmc_prev = pmc;
@@ -1134,7 +1134,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr)
        }
        spin_unlock_bh(&in_dev->mc_tomb_lock);
        if (pmc) {
-                for (psf=pmc->tomb; psf; psf=psf_next) {
+                for (psf = pmc->tomb; psf; psf = psf_next) {
                        psf_next = psf->sf_next;
                        kfree(psf);
                }
@@ -1167,7 +1167,7 @@ static void igmpv3_clear_delrec(struct in_device *in_dev)
                psf = pmc->tomb;
                pmc->tomb = NULL;
                spin_unlock_bh(&pmc->lock);
-                for (; psf; psf=psf_next) {
+                for (; psf; psf = psf_next) {
                        psf_next = psf->sf_next;
                        kfree(psf);
                }
@@ -1557,7 +1557,7 @@ static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
        int rv = 0;
        psf_prev = NULL;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (psf->sf_inaddr == *psfsrc)
                        break;
                psf_prev = psf;
@@ -1630,7 +1630,7 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                pmc->sfcount[sfmode]--;
        }
        err = 0;
-        for (i=0; i<sfcount; i++) {
+        for (i = 0; i < sfcount; i++) {
                int rv = ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
                changerec |= rv > 0;
@@ -1650,7 +1650,7 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
                        IGMP_Unsolicited_Report_Count;
                in_dev->mr_ifc_count = pmc->crcount;
-                for (psf=pmc->sources; psf; psf = psf->sf_next)
+                for (psf = pmc->sources; psf; psf = psf->sf_next)
                        psf->sf_crcount = 0;
                igmp_ifc_event(pmc->interface);
        } else if (sf_setstate(pmc) || changerec) {
@@ -1671,7 +1671,7 @@ static int ip_mc_add1_src(struct ip_mc_list *pmc, int sfmode,
        struct ip_sf_list *psf, *psf_prev;
        psf_prev = NULL;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (psf->sf_inaddr == *psfsrc)
                        break;
                psf_prev = psf;
@@ -1699,7 +1699,7 @@ static void sf_markstate(struct ip_mc_list *pmc)
        struct ip_sf_list *psf;
        int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
-        for (psf=pmc->sources; psf; psf=psf->sf_next)
+        for (psf = pmc->sources; psf; psf = psf->sf_next)
                if (pmc->sfcount[MCAST_EXCLUDE]) {
                        psf->sf_oldin = mca_xcount ==
                                psf->sf_count[MCAST_EXCLUDE] &&
@@ -1716,7 +1716,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
        int new_in, rv;
        rv = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (pmc->sfcount[MCAST_EXCLUDE]) {
                        new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
                                !psf->sf_count[MCAST_INCLUDE];
@@ -1726,7 +1726,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
                        if (!psf->sf_oldin) {
                                struct ip_sf_list *prev = NULL;
-                                for (dpsf=pmc->tomb; dpsf; dpsf=dpsf->sf_next) {
+                                for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next) {
                                        if (dpsf->sf_inaddr == psf->sf_inaddr)
                                                break;
                                        prev = dpsf;
@@ -1748,7 +1748,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
                         * add or update "delete" records if an active filter
                         * is now inactive
                         */
-                        for (dpsf=pmc->tomb; dpsf; dpsf=dpsf->sf_next)
+                        for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next)
                                if (dpsf->sf_inaddr == psf->sf_inaddr)
                                        break;
                        if (!dpsf) {
@@ -1800,7 +1800,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
        if (!delta)
                pmc->sfcount[sfmode]++;
        err = 0;
-        for (i=0; i<sfcount; i++) {
+        for (i = 0; i < sfcount; i++) {
                err = ip_mc_add1_src(pmc, sfmode, &psfsrc[i]);
                if (err)
                        break;
@@ -1810,7 +1810,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                if (!delta)
                        pmc->sfcount[sfmode]--;
-                for (j=0; j<i; j++)
+                for (j = 0; j < i; j++)
                        (void) ip_mc_del1_src(pmc, sfmode, &psfsrc[j]);
        } else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
 #ifdef CONFIG_IP_MULTICAST
@@ -1829,7 +1829,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
                        IGMP_Unsolicited_Report_Count;
                in_dev->mr_ifc_count = pmc->crcount;
-                for (psf=pmc->sources; psf; psf = psf->sf_next)
+                for (psf = pmc->sources; psf; psf = psf->sf_next)
                        psf->sf_crcount = 0;
                igmp_ifc_event(in_dev);
        } else if (sf_setstate(pmc)) {
@@ -1844,12 +1844,12 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc)
 {
        struct ip_sf_list *psf, *nextpsf;
-        for (psf=pmc->tomb; psf; psf=nextpsf) {
+        for (psf = pmc->tomb; psf; psf = nextpsf) {
                nextpsf = psf->sf_next;
                kfree(psf);
        }
        pmc->tomb = NULL;
-        for (psf=pmc->sources; psf; psf=nextpsf) {
+        for (psf = pmc->sources; psf; psf = nextpsf) {
                nextpsf = psf->sf_next;
                kfree(psf);
        }
@@ -2043,7 +2043,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                if (!psl)
                        goto done;      /* err = -EADDRNOTAVAIL */
                rv = !0;
-                for (i=0; i<psl->sl_count; i++) {
+                for (i = 0; i < psl->sl_count; i++) {
                        rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
                                sizeof(__be32));
                        if (rv == 0)
@@ -2062,7 +2062,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
                        &mreqs->imr_sourceaddr, 1);
-                for (j=i+1; j<psl->sl_count; j++)
+                for (j = i+1; j < psl->sl_count; j++)
                        psl->sl_addr[j-1] = psl->sl_addr[j];
                psl->sl_count--;
                err = 0;
@@ -2088,7 +2088,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                newpsl->sl_max = count;
                newpsl->sl_count = count - IP_SFBLOCK;
                if (psl) {
-                        for (i=0; i<psl->sl_count; i++)
+                        for (i = 0; i < psl->sl_count; i++)
                                newpsl->sl_addr[i] = psl->sl_addr[i];
                        /* decrease mem now to avoid the memleak warning */
                        atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
@@ -2098,7 +2098,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                psl = newpsl;
        }
        rv = 1; /* > 0 for insert logic below if sl_count is 0 */
-        for (i=0; i<psl->sl_count; i++) {
+        for (i = 0; i < psl->sl_count; i++) {
                rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
                        sizeof(__be32));
                if (rv == 0)
@@ -2106,7 +2106,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
        }
        if (rv == 0)            /* address already there is an error */
                goto done;
-        for (j=psl->sl_count-1; j>=i; j--)
+        for (j = psl->sl_count-1; j >= i; j--)
                psl->sl_addr[j+1] = psl->sl_addr[j];
        psl->sl_addr[i] = mreqs->imr_sourceaddr;
        psl->sl_count++;
@@ -2305,7 +2305,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
            copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) {
                return -EFAULT;
        }
-        for (i=0; i<copycount; i++) {
+        for (i = 0; i < copycount; i++) {
                struct sockaddr_storage ss;
                psin = (struct sockaddr_in *)&ss;
@@ -2350,7 +2350,7 @@ int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
        if (!psl)
                goto unlock;
-        for (i=0; i<psl->sl_count; i++) {
+        for (i = 0; i < psl->sl_count; i++) {
                if (psl->sl_addr[i] == rmt_addr)
                        break;
        }
@@ -2423,7 +2423,7 @@ int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u
                rv = 1;
        } else if (im) {
                if (src_addr) {
-                        for (psf=im->sources; psf; psf=psf->sf_next) {
+                        for (psf = im->sources; psf; psf = psf->sf_next) {
                                if (psf->sf_inaddr == src_addr)
                                        break;
                        }
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index 1975f52933c5..f17ea49b28fb 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -230,29 +230,6 @@ static void lro_add_packet(struct net_lro_desc *lro_desc, struct sk_buff *skb,
        lro_desc->last_skb = skb;
 }
-static void lro_add_frags(struct net_lro_desc *lro_desc,
-                          int len, int hlen, int truesize,
-                          struct skb_frag_struct *skb_frags,
-                          struct iphdr *iph, struct tcphdr *tcph)
-{
-        struct sk_buff *skb = lro_desc->parent;
-        int tcp_data_len = TCP_PAYLOAD_LENGTH(iph, tcph);
-        lro_add_common(lro_desc, iph, tcph, tcp_data_len);
-        skb->truesize += truesize;
-        skb_frags[0].page_offset += hlen;
-        skb_frag_size_sub(&skb_frags[0], hlen);
-        while (tcp_data_len > 0) {
-                *(lro_desc->next_frag) = *skb_frags;
-                tcp_data_len -= skb_frag_size(skb_frags);
-                lro_desc->next_frag++;
-                skb_frags++;
-                skb_shinfo(skb)->nr_frags++;
-        }
-}
 static int lro_check_tcp_conn(struct net_lro_desc *lro_desc,
                              struct iphdr *iph,
@@ -371,128 +348,6 @@ out:
        return 1;
 }
-static struct sk_buff *lro_gen_skb(struct net_lro_mgr *lro_mgr,
-                                   struct skb_frag_struct *frags,
-                                   int len, int true_size,
-                                   void *mac_hdr,
-                                   int hlen, __wsum sum,
-                                   u32 ip_summed)
-{
-        struct sk_buff *skb;
-        struct skb_frag_struct *skb_frags;
-        int data_len = len;
-        int hdr_len = min(len, hlen);
-        skb = netdev_alloc_skb(lro_mgr->dev, hlen + lro_mgr->frag_align_pad);
-        if (!skb)
-                return NULL;
-        skb_reserve(skb, lro_mgr->frag_align_pad);
-        skb->len = len;
-        skb->data_len = len - hdr_len;
-        skb->truesize += true_size;
-        skb->tail += hdr_len;
-        memcpy(skb->data, mac_hdr, hdr_len);
-        skb_frags = skb_shinfo(skb)->frags;
-        while (data_len > 0) {
-                *skb_frags = *frags;
-                data_len -= skb_frag_size(frags);
-                skb_frags++;
-                frags++;
-                skb_shinfo(skb)->nr_frags++;
-        }
-        skb_shinfo(skb)->frags[0].page_offset += hdr_len;
-        skb_frag_size_sub(&skb_shinfo(skb)->frags[0], hdr_len);
-        skb->ip_summed = ip_summed;
-        skb->csum = sum;
-        skb->protocol = eth_type_trans(skb, lro_mgr->dev);
-        return skb;
-}
-static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
-                                          struct skb_frag_struct *frags,
-                                          int len, int true_size,
-                                          void *priv, __wsum sum)
-{
-        struct net_lro_desc *lro_desc;
-        struct iphdr *iph;
-        struct tcphdr *tcph;
-        struct sk_buff *skb;
-        u64 flags;
-        void *mac_hdr;
-        int mac_hdr_len;
-        int hdr_len = LRO_MAX_PG_HLEN;
-        int vlan_hdr_len = 0;
-        if (!lro_mgr->get_frag_header ||
-            lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
-                                     (void *)&tcph, &flags, priv)) {
-                mac_hdr = skb_frag_address(frags);
-                goto out1;
-        }
-        if (!(flags & LRO_IPV4) || !(flags & LRO_TCP))
-                goto out1;
-        hdr_len = (int)((void *)(tcph) + TCP_HDR_LEN(tcph) - mac_hdr);
-        mac_hdr_len = (int)((void *)(iph) - mac_hdr);
-        lro_desc = lro_get_desc(lro_mgr, lro_mgr->lro_arr, iph, tcph);
-        if (!lro_desc)
-                goto out1;
-        if (!lro_desc->active) { /* start new lro session */
-                if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, NULL))
-                        goto out1;
-                skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
-                                  hdr_len, 0, lro_mgr->ip_summed_aggr);
-                if (!skb)
-                        goto out;
-                if ((skb->protocol == htons(ETH_P_8021Q)) &&
-                    !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
-                        vlan_hdr_len = VLAN_HLEN;
-                iph = (void *)(skb->data + vlan_hdr_len);
-                tcph = (void *)((u8 *)skb->data + vlan_hdr_len
-                                + IP_HDR_LEN(iph));
-                lro_init_desc(lro_desc, skb, iph, tcph);
-                LRO_INC_STATS(lro_mgr, aggregated);
-                return NULL;
-        }
-        if (lro_desc->tcp_next_seq != ntohl(tcph->seq))
-                goto out2;
-        if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, lro_desc))
-                goto out2;
-        lro_add_frags(lro_desc, len, hdr_len, true_size, frags, iph, tcph);
-        LRO_INC_STATS(lro_mgr, aggregated);
-        if ((skb_shinfo(lro_desc->parent)->nr_frags >= lro_mgr->max_aggr) ||
-            lro_desc->parent->len > (0xFFFF - lro_mgr->dev->mtu))
-                lro_flush(lro_mgr, lro_desc);
-        return NULL;
-out2: /* send aggregated packets to the stack */
-        lro_flush(lro_mgr, lro_desc);
-out1:  /* Original packet has to be posted to the stack */
-        skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
-                          hdr_len, sum, lro_mgr->ip_summed);
-out:
-        return skb;
-}
 void lro_receive_skb(struct net_lro_mgr *lro_mgr,
                     struct sk_buff *skb,
                     void *priv)
@@ -506,23 +361,6 @@ void lro_receive_skb(struct net_lro_mgr *lro_mgr,
 }
 EXPORT_SYMBOL(lro_receive_skb);
-void lro_receive_frags(struct net_lro_mgr *lro_mgr,
-                       struct skb_frag_struct *frags,
-                       int len, int true_size, void *priv, __wsum sum)
-{
-        struct sk_buff *skb;
-        skb = __lro_proc_segment(lro_mgr, frags, len, true_size, priv, sum);
-        if (!skb)
-                return;
-        if (lro_mgr->features & LRO_F_NAPI)
-                netif_receive_skb(skb);
-        else
-                netif_rx(skb);
-}
-EXPORT_SYMBOL(lro_receive_frags);
 void lro_flush_all(struct net_lro_mgr *lro_mgr)
 {
        int i;
@@ -534,14 +372,3 @@ void lro_flush_all(struct net_lro_mgr *lro_mgr)
        }
 }
 EXPORT_SYMBOL(lro_flush_all);
-void lro_flush_pkt(struct net_lro_mgr *lro_mgr,
-                  struct iphdr *iph, struct tcphdr *tcph)
-{
-        struct net_lro_desc *lro_desc;
-        lro_desc = lro_get_desc(lro_mgr, lro_mgr->lro_arr, iph, tcph);
-        if (lro_desc->active)
-                lro_flush(lro_mgr, lro_desc);
-}
-EXPORT_SYMBOL(lro_flush_pkt);
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 33d5537881ed..48f424465112 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -109,13 +109,6 @@ static inline void flush_check(struct inet_peer_base *base, int family)
        }
 }
-void inetpeer_invalidate_family(int family)
-{
-        atomic_t *fp = inetpeer_seq_ptr(family);
-        atomic_inc(fp);
-}
 #define PEER_MAXDEPTH 40 /* sufficient for about 2^27 nodes */
 /* Exported for sysctl_net_ipv4.  */
@@ -227,7 +220,7 @@ static int addr_compare(const struct inetpeer_addr *a,
        stackptr = _stack;                                      \
        *stackptr++ = &_base->root;                             \
        for (u = rcu_deref_locked(_base->root, _base);          \
-             u != peer_avl_empty; ) {                           \
+             u != peer_avl_empty;) {                            \
                int cmp = addr_compare(_daddr, &u->daddr);      \
                if (cmp == 0)                                   \
                        break;                                  \
@@ -282,7 +275,7 @@ static struct inet_peer *lookup_rcu(const struct inetpeer_addr *daddr,
        *stackptr++ = &start->avl_left;                         \
        v = &start->avl_left;                                   \
        for (u = rcu_deref_locked(*v, base);                    \
-             u->avl_right != peer_avl_empty_rcu; ) {            \
+             u->avl_right != peer_avl_empty_rcu;) {             \
                v = &u->avl_right;                              \
                *stackptr++ = v;                                \
                u = rcu_deref_locked(*v, base);                 \
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 2481993a4970..c10a3ce5cbff 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -704,7 +704,7 @@ struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
                        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
                        if (ip_defrag(skb, user))
                                return NULL;
-                        skb->rxhash = 0;
+                        skb_clear_hash(skb);
                }
        }
        return skb;
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index ec7264514a82..dd9d90b44f97 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -167,7 +167,7 @@ int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
                soffset -= 4;
                if (soffset > 3) {
                        memcpy(&faddr, &start[soffset-1], 4);
-                        for (soffset-=4, doffset=4; soffset > 3; soffset-=4, doffset+=4)
+                        for (soffset -= 4, doffset = 4; soffset > 3; soffset -= 4, doffset += 4)
                                memcpy(&dptr[doffset-1], &start[soffset-1], 4);
                        /*
                         * RFC1812 requires to fix illegal source routes.
@@ -227,7 +227,7 @@ void ip_options_fragment(struct sk_buff *skb)
                        continue;
                }
                optlen = optptr[1];
-                if (optlen<2 || optlen>l)
+                if (optlen < 2 || optlen > l)
                  return;
                if (!IPOPT_COPIED(*optptr))
                        memset(optptr, IPOPT_NOOP, optlen);
@@ -276,7 +276,7 @@ int ip_options_compile(struct net *net,
        for (l = opt->optlen; l > 0; ) {
                switch (*optptr) {
                      case IPOPT_END:
-                        for (optptr++, l--; l>0; optptr++, l--) {
+                        for (optptr++, l--; l > 0; optptr++, l--) {
                                if (*optptr != IPOPT_END) {
                                        *optptr = IPOPT_END;
                                        opt->is_changed = 1;
@@ -289,7 +289,7 @@ int ip_options_compile(struct net *net,
                        continue;
                }
                optlen = optptr[1];
-                if (optlen<2 || optlen>l) {
+                if (optlen < 2 || optlen > l) {
                        pp_ptr = optptr;
                        goto error;
                }
@@ -572,7 +572,7 @@ void ip_forward_options(struct sk_buff *skb)
                optptr = raw + opt->srr;
-                for ( srrptr=optptr[2], srrspace = optptr[1];
+                for ( srrptr = optptr[2], srrspace = optptr[1];
                     srrptr <= srrspace;
                     srrptr += 4
                     ) {
@@ -628,7 +628,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
        if (rt->rt_type != RTN_LOCAL)
                return -EINVAL;
-        for (srrptr=optptr[2], srrspace = optptr[1]; srrptr <= srrspace; srrptr += 4) {
+        for (srrptr = optptr[2], srrspace = optptr[1]; srrptr <= srrspace; srrptr += 4) {
                if (srrptr + 3 > srrspace) {
                        icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((opt->srr+2)<<24));
                        return -EINVAL;
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 3f858266fa7e..a9fc435dc89f 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -386,7 +386,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
 /*
 *      Handle MSG_ERRQUEUE
 */
-int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
+int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
        struct sock_exterr_skb *serr;
        struct sk_buff *skb, *skb2;
@@ -423,6 +423,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
                                                   serr->addr_offset);
                sin->sin_port = serr->port;
                memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
+                *addr_len = sizeof(*sin);
        }
        memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
@@ -1050,7 +1051,7 @@ e_inval:
 *
 * To support IP_CMSG_PKTINFO option, we store rt_iif and specific
 * destination in skb->cb[] before dst drop.
- * This way, receiver doesnt make cache line misses to read rtable.
+ * This way, receiver doesn't make cache line misses to read rtable.
 */
 void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
 {
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 42ffbc8d65c6..6156f4ef5e91 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -56,7 +56,7 @@ int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
        skb_scrub_packet(skb, xnet);
-        skb->rxhash = 0;
+        skb_clear_hash(skb);
        skb_dst_set(skb, &rt->dst);
        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
@@ -107,8 +107,7 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto)
        nf_reset(skb);
        secpath_reset(skb);
-        if (!skb->l4_rxhash)
+        skb_clear_hash_if_not_l4(skb);
-                skb->rxhash = 0;
        skb_dst_drop(skb);
        skb->vlan_tci = 0;
        skb_set_queue_mapping(skb, 0);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 62212c772a4b..421a24934ffd 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -425,6 +425,7 @@ struct net_device *ipmr_new_tunnel(struct net *net, struct vifctl *v)
                                goto failure;
                        ipv4_devconf_setall(in_dev);
+                        neigh_parms_data_state_setall(in_dev->arp_parms);
                        IPV4_DEVCONF(in_dev->cnf, RP_FILTER) = 0;
                        if (dev_open(dev))
@@ -517,6 +518,7 @@ static struct net_device *ipmr_reg_vif(struct net *net, struct mr_table *mrt)
        }
        ipv4_devconf_setall(in_dev);
+        neigh_parms_data_state_setall(in_dev->arp_parms);
        IPV4_DEVCONF(in_dev->cnf, RP_FILTER) = 0;
        rcu_read_unlock();
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index f13bd91d9a56..a313c3fbeb46 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -423,6 +423,7 @@ static void synproxy_tg4_destroy(const struct xt_tgdtor_param *par)
 static struct xt_target synproxy_tg4_reg __read_mostly = {
        .name           = "SYNPROXY",
        .family         = NFPROTO_IPV4,
+        .hooks          = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
        .target         = synproxy_tg4,
        .targetsize     = sizeof(struct xt_synproxy_info),
        .checkentry     = synproxy_tg4_check,
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 5f011cc89cd9..d551e31b416e 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -34,8 +34,7 @@
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 *
 * Author: James Morris <jmorris@intercode.com.au>
 *
@@ -462,14 +461,14 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
        }
        if (subid < 40) {
-                optr [0] = 0;
+                optr[0] = 0;
-                optr [1] = subid;
+                optr[1] = subid;
        } else if (subid < 80) {
-                optr [0] = 1;
+                optr[0] = 1;
-                optr [1] = subid - 40;
+                optr[1] = subid - 40;
        } else {
-                optr [0] = 2;
+                optr[0] = 2;
-                optr [1] = subid - 80;
+                optr[1] = subid - 80;
        }
        *len = 2;
diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
index fff5ba1a33b7..4a5e94ac314a 100644
--- a/net/ipv4/netfilter/nft_reject_ipv4.c
+++ b/net/ipv4/netfilter/nft_reject_ipv4.c
@@ -72,7 +72,7 @@ static int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
        const struct nft_reject *priv = nft_expr_priv(expr);
-        if (nla_put_be32(skb, NFTA_REJECT_TYPE, priv->type))
+        if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
                goto nla_put_failure;
        switch (priv->type) {
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 876c6ca2d8f9..cae5262a337c 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -53,8 +53,12 @@
 #include <net/transp_v6.h>
 #endif
+struct ping_table {
+        struct hlist_nulls_head hash[PING_HTABLE_SIZE];
+        rwlock_t                lock;
+};
-struct ping_table ping_table;
+static struct ping_table ping_table;
 struct pingv6_ops pingv6_ops;
 EXPORT_SYMBOL_GPL(pingv6_ops);
@@ -668,8 +672,8 @@ int ping_common_sendmsg(int family, struct msghdr *msg, size_t len,
 }
 EXPORT_SYMBOL_GPL(ping_common_sendmsg);
-int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+static int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
-                    size_t len)
+                           size_t len)
 {
        struct net *net = sock_net(sk);
        struct flowi4 fl4;
@@ -772,7 +776,7 @@ int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                err = PTR_ERR(rt);
                rt = NULL;
                if (err == -ENETUNREACH)
-                        IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
+                        IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
                goto out;
        }
@@ -841,10 +845,11 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        if (flags & MSG_ERRQUEUE) {
                if (family == AF_INET) {
-                        return ip_recv_error(sk, msg, len);
+                        return ip_recv_error(sk, msg, len, addr_len);
 #if IS_ENABLED(CONFIG_IPV6)
                } else if (family == AF_INET6) {
-                        return pingv6_ops.ipv6_recv_error(sk, msg, len);
+                        return pingv6_ops.ipv6_recv_error(sk, msg, len,
+                                                          addr_len);
 #endif
                }
        }
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 4a0335854b89..8ecd7ad959b4 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -279,6 +279,7 @@ static const struct snmp_mib snmp4_net_list[] = {
        SNMP_MIB_ITEM("TCPFastOpenCookieReqd", LINUX_MIB_TCPFASTOPENCOOKIEREQD),
        SNMP_MIB_ITEM("TCPSpuriousRtxHostQueues", LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES),
        SNMP_MIB_ITEM("BusyPollRxPackets", LINUX_MIB_BUSYPOLLRXPACKETS),
+        SNMP_MIB_ITEM("TCPAutoCorking", LINUX_MIB_TCPAUTOCORKING),
        SNMP_MIB_SENTINEL
 };
diff --git a/net/ipv4/protocol.c b/net/ipv4/protocol.c
index ce848461acbb..46d6a1c923a8 100644
--- a/net/ipv4/protocol.c
+++ b/net/ipv4/protocol.c
@@ -31,10 +31,6 @@
 const struct net_protocol __rcu *inet_protos[MAX_INET_PROTOS] __read_mostly;
 const struct net_offload __rcu *inet_offloads[MAX_INET_PROTOS] __read_mostly;
-/*
- *      Add a protocol handler to the hash tables
- */
 int inet_add_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
        if (!prot->netns_ok) {
@@ -55,10 +51,6 @@ int inet_add_offload(const struct net_offload *prot, unsigned char protocol)
 }
 EXPORT_SYMBOL(inet_add_offload);
-/*
- *      Remove a protocol from the hash tables.
- */
 int inet_del_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
        int ret;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 5cb8ddb505ee..81e6cfd5a365 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -575,7 +575,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                           RT_SCOPE_UNIVERSE,
                           inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
-                           inet_sk_flowi_flags(sk) | FLOWI_FLAG_CAN_SLEEP |
+                           inet_sk_flowi_flags(sk) |
                            (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
                           daddr, saddr, 0, 0);
@@ -697,7 +697,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                goto out;
        if (flags & MSG_ERRQUEUE) {
-                err = ip_recv_error(sk, msg, len);
+                err = ip_recv_error(sk, msg, len, addr_len);
                goto out;
        }
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index b95331e6c077..f2ed13c2125f 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -121,7 +121,7 @@ static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
        cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
        /* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
-        diff = (count - (cookie >> COOKIEBITS)) & ((__u32) - 1 >> COOKIEBITS);
+        diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
        if (diff >= MAX_SYNCOOKIE_AGE)
                return (__u32)-1;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 3d69ec8dac57..1d2480ac2bb6 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -286,13 +286,6 @@ static struct ctl_table ipv4_table[] = {
                .extra2         = &ip_ttl_max,
        },
        {
-                .procname       = "ip_no_pmtu_disc",
-                .data           = &ipv4_config.no_pmtu_disc,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
                .procname       = "ip_nonlocal_bind",
                .data           = &sysctl_ip_nonlocal_bind,
                .maxlen         = sizeof(int),
@@ -707,7 +700,7 @@ static struct ctl_table ipv4_table[] = {
                .mode           = 0644,
                .proc_handler   = proc_dointvec
        },
-        {
+        {
                .procname       = "tcp_thin_dupack",
                .data           = &sysctl_tcp_thin_dupack,
                .maxlen         = sizeof(int),
@@ -733,6 +726,15 @@ static struct ctl_table ipv4_table[] = {
                .extra2         = &gso_max_segs,
        },
        {
+                .procname       = "tcp_autocorking",
+                .data           = &sysctl_tcp_autocorking,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &one,
+        },
+        {
                .procname       = "udp_mem",
                .data           = &sysctl_udp_mem,
                .maxlen         = sizeof(sysctl_udp_mem),
@@ -822,6 +824,13 @@ static struct ctl_table ipv4_net_table[] = {
                .mode           = 0644,
                .proc_handler   = ipv4_local_port_range,
        },
+        {
+                .procname       = "ip_no_pmtu_disc",
+                .data           = &init_net.ipv4.sysctl_ip_no_pmtu_disc,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
        { }
 };
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 3dc0c6cf02a8..d099f9a055c6 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -285,6 +285,8 @@ int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
 int sysctl_tcp_min_tso_segs __read_mostly = 2;
+int sysctl_tcp_autocorking __read_mostly = 1;
 struct percpu_counter tcp_orphan_count;
 EXPORT_SYMBOL_GPL(tcp_orphan_count);
@@ -619,19 +621,58 @@ static inline void tcp_mark_urg(struct tcp_sock *tp, int flags)
                tp->snd_up = tp->write_seq;
 }
-static inline void tcp_push(struct sock *sk, int flags, int mss_now,
+/* If a not yet filled skb is pushed, do not send it if
-                            int nonagle)
+ * we have data packets in Qdisc or NIC queues :
+ * Because TX completion will happen shortly, it gives a chance
+ * to coalesce future sendmsg() payload into this skb, without
+ * need for a timer, and with no latency trade off.
+ * As packets containing data payload have a bigger truesize
+ * than pure acks (dataless) packets, the last checks prevent
+ * autocorking if we only have an ACK in Qdisc/NIC queues,
+ * or if TX completion was delayed after we processed ACK packet.
+ */
+static bool tcp_should_autocork(struct sock *sk, struct sk_buff *skb,
+                                int size_goal)
 {
-        if (tcp_send_head(sk)) {
+        return skb->len < size_goal &&
-                struct tcp_sock *tp = tcp_sk(sk);
+               sysctl_tcp_autocorking &&
+               skb != tcp_write_queue_head(sk) &&
+               atomic_read(&sk->sk_wmem_alloc) > skb->truesize;
+}
+static void tcp_push(struct sock *sk, int flags, int mss_now,
+                     int nonagle, int size_goal)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb;
-                if (!(flags & MSG_MORE) || forced_push(tp))
+        if (!tcp_send_head(sk))
-                        tcp_mark_push(tp, tcp_write_queue_tail(sk));
+                return;
+        skb = tcp_write_queue_tail(sk);
+        if (!(flags & MSG_MORE) || forced_push(tp))
+                tcp_mark_push(tp, skb);
+        tcp_mark_urg(tp, flags);
+        if (tcp_should_autocork(sk, skb, size_goal)) {
-                tcp_mark_urg(tp, flags);
+                /* avoid atomic op if TSQ_THROTTLED bit is already set */
-                __tcp_push_pending_frames(sk, mss_now,
+                if (!test_bit(TSQ_THROTTLED, &tp->tsq_flags)) {
-                                          (flags & MSG_MORE) ? TCP_NAGLE_CORK : nonagle);
+                        NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAUTOCORKING);
+                        set_bit(TSQ_THROTTLED, &tp->tsq_flags);
+                }
+                /* It is possible TX completion already happened
+                 * before we set TSQ_THROTTLED.
+                 */
+                if (atomic_read(&sk->sk_wmem_alloc) > skb->truesize)
+                        return;
        }
+        if (flags & MSG_MORE)
+                nonagle = TCP_NAGLE_CORK;
+        __tcp_push_pending_frames(sk, mss_now, nonagle);
 }
 static int tcp_splice_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb,
@@ -934,7 +975,8 @@ new_segment:
 wait_for_sndbuf:
                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
-                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+                tcp_push(sk, flags & ~MSG_MORE, mss_now,
+                         TCP_NAGLE_PUSH, size_goal);
                if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                        goto do_error;
@@ -944,7 +986,7 @@ wait_for_memory:
 out:
        if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
-                tcp_push(sk, flags, mss_now, tp->nonagle);
+                tcp_push(sk, flags, mss_now, tp->nonagle, size_goal);
        return copied;
 do_error:
@@ -1225,7 +1267,8 @@ wait_for_sndbuf:
                        set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
                        if (copied)
-                                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+                                tcp_push(sk, flags & ~MSG_MORE, mss_now,
+                                         TCP_NAGLE_PUSH, size_goal);
                        if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                                goto do_error;
@@ -1236,7 +1279,7 @@ wait_for_memory:
 out:
        if (copied)
-                tcp_push(sk, flags, mss_now, tp->nonagle);
+                tcp_push(sk, flags, mss_now, tp->nonagle, size_goal);
        release_sock(sk);
        return copied + copied_syn;
@@ -1425,7 +1468,7 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
        do {
                if (dma_async_is_tx_complete(tp->ucopy.dma_chan,
                                              last_issued, &done,
-                                              &used) == DMA_SUCCESS) {
+                                              &used) == DMA_COMPLETE) {
                        /* Safe to free early-copied skbs now */
                        __skb_queue_purge(&sk->sk_async_wait_queue);
                        break;
@@ -1433,7 +1476,7 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
                        struct sk_buff *skb;
                        while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
                               (dma_async_is_complete(skb->dma_cookie, done,
-                                                      used) == DMA_SUCCESS)) {
+                                                      used) == DMA_COMPLETE)) {
                                __skb_dequeue(&sk->sk_async_wait_queue);
                                kfree_skb(skb);
                        }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c53b7f35c51d..65cf90e063d5 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -766,7 +766,7 @@ static void tcp_update_pacing_rate(struct sock *sk)
 /* Calculate rto without backoff.  This is the second half of Van Jacobson's
 * routine referred to above.
 */
-void tcp_set_rto(struct sock *sk)
+static void tcp_set_rto(struct sock *sk)
 {
        const struct tcp_sock *tp = tcp_sk(sk);
        /* Old crap is replaced with new one. 8)
@@ -3686,7 +3686,7 @@ const u8 *tcp_parse_md5sig_option(const struct tcphdr *th)
                int opcode = *ptr++;
                int opsize;
-                switch(opcode) {
+                switch (opcode) {
                case TCPOPT_EOL:
                        return NULL;
                case TCPOPT_NOP:
@@ -4046,7 +4046,7 @@ static void tcp_sack_remove(struct tcp_sock *tp)
                        WARN_ON(before(tp->rcv_nxt, sp->end_seq));
                        /* Zap this SACK, by moving forward any other SACKS. */
-                        for (i=this_sack+1; i < num_sacks; i++)
+                        for (i = this_sack+1; i < num_sacks; i++)
                                tp->selective_acks[i-1] = tp->selective_acks[i];
                        num_sacks--;
                        continue;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 59a6f8b90cd9..7297b56c28c7 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -173,11 +173,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        rt = ip_route_connect(fl4, nexthop, inet->inet_saddr,
                              RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                              IPPROTO_TCP,
-                              orig_sport, orig_dport, sk, true);
+                              orig_sport, orig_dport, sk);
        if (IS_ERR(rt)) {
                err = PTR_ERR(rt);
                if (err == -ENETUNREACH)
-                        IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
+                        IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
                return err;
        }
@@ -827,7 +827,7 @@ static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
        const struct inet_request_sock *ireq = inet_rsk(req);
        struct flowi4 fl4;
        int err = -1;
-        struct sk_buff * skb;
+        struct sk_buff *skb;
        /* First, grab a route. */
        if (!dst && (dst = inet_csk_route_req(sk, &fl4, req)) == NULL)
diff --git a/net/ipv4/tcp_memcontrol.c b/net/ipv4/tcp_memcontrol.c
index 03e9154f7e68..f7e522c558ba 100644
--- a/net/ipv4/tcp_memcontrol.c
+++ b/net/ipv4/tcp_memcontrol.c
@@ -6,13 +6,6 @@
 #include <linux/memcontrol.h>
 #include <linux/module.h>
-static void memcg_tcp_enter_memory_pressure(struct sock *sk)
-{
-        if (sk->sk_cgrp->memory_pressure)
-                sk->sk_cgrp->memory_pressure = 1;
-}
-EXPORT_SYMBOL(memcg_tcp_enter_memory_pressure);
 int tcp_init_cgroup(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
 {
        /*
@@ -60,7 +53,6 @@ EXPORT_SYMBOL(tcp_destroy_cgroup);
 static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
 {
        struct cg_proto *cg_proto;
-        u64 old_lim;
        int i;
        int ret;
@@ -71,7 +63,6 @@ static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
        if (val > RES_COUNTER_MAX)
                val = RES_COUNTER_MAX;
-        old_lim = res_counter_read_u64(&cg_proto->memory_allocated, RES_LIMIT);
        ret = res_counter_set_limit(&cg_proto->memory_allocated, val);
        if (ret)
                return ret;
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index a2b68a108eae..2658a27f540d 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -240,7 +240,7 @@ int tcp_gro_complete(struct sk_buff *skb)
 {
        struct tcphdr *th = tcp_hdr(skb);
-        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_start = (unsigned char *)th - skb->head;
        skb->csum_offset = offsetof(struct tcphdr, check);
        skb->ip_summed = CHECKSUM_PARTIAL;
@@ -272,45 +272,45 @@ static int tcp_v4_gso_send_check(struct sk_buff *skb)
 static struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 {
+        /* Use the IP hdr immediately proceeding for this transport */
        const struct iphdr *iph = skb_gro_network_header(skb);
        __wsum wsum;
-        __sum16 sum;
+        /* Don't bother verifying checksum if we're going to flush anyway. */
+        if (NAPI_GRO_CB(skb)->flush)
+                goto skip_csum;
+        wsum = skb->csum;
        switch (skb->ip_summed) {
+        case CHECKSUM_NONE:
+                wsum = skb_checksum(skb, skb_gro_offset(skb), skb_gro_len(skb),
+                                    0);
+                /* fall through */
        case CHECKSUM_COMPLETE:
                if (!tcp_v4_check(skb_gro_len(skb), iph->saddr, iph->daddr,
-                                  skb->csum)) {
+                                  wsum)) {
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
                        break;
                }
-flush:
                NAPI_GRO_CB(skb)->flush = 1;
                return NULL;
-        case CHECKSUM_NONE:
-                wsum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
-                                          skb_gro_len(skb), IPPROTO_TCP, 0);
-                sum = csum_fold(skb_checksum(skb,
-                                             skb_gro_offset(skb),
-                                             skb_gro_len(skb),
-                                             wsum));
-                if (sum)
-                        goto flush;
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                break;
        }
+skip_csum:
        return tcp_gro_receive(head, skb);
 }
-static int tcp4_gro_complete(struct sk_buff *skb)
+static int tcp4_gro_complete(struct sk_buff *skb, int thoff)
 {
        const struct iphdr *iph = ip_hdr(skb);
        struct tcphdr *th = tcp_hdr(skb);
-        th->check = ~tcp_v4_check(skb->len - skb_transport_offset(skb),
+        th->check = ~tcp_v4_check(skb->len - thoff, iph->saddr,
-                                  iph->saddr, iph->daddr, 0);
+                                  iph->daddr, 0);
        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
        return tcp_gro_complete(skb);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7820f3a7dd70..03d26b85eab8 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -363,15 +363,17 @@ static inline void TCP_ECN_send(struct sock *sk, struct sk_buff *skb,
 */
 static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
 {
+        struct skb_shared_info *shinfo = skb_shinfo(skb);
        skb->ip_summed = CHECKSUM_PARTIAL;
        skb->csum = 0;
        TCP_SKB_CB(skb)->tcp_flags = flags;
        TCP_SKB_CB(skb)->sacked = 0;
-        skb_shinfo(skb)->gso_segs = 1;
+        shinfo->gso_segs = 1;
-        skb_shinfo(skb)->gso_size = 0;
+        shinfo->gso_size = 0;
-        skb_shinfo(skb)->gso_type = 0;
+        shinfo->gso_type = 0;
        TCP_SKB_CB(skb)->seq = seq;
        if (flags & (TCPHDR_SYN | TCPHDR_FIN))
@@ -406,7 +408,7 @@ struct tcp_out_options {
 * Beware: Something in the Internet is very sensitive to the ordering of
 * TCP options, we learned this through the hard way, so be careful here.
 * Luckily we can at least blame others for their non-compliance but from
- * inter-operatibility perspective it seems that we're somewhat stuck with
+ * inter-operability perspective it seems that we're somewhat stuck with
 * the ordering which we have been using if we want to keep working with
 * those broken things (not that it currently hurts anybody as there isn't
 * particular reason why the ordering would need to be changed).
@@ -679,7 +681,7 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
 *
 * Its important tcp_wfree() can be replaced by sock_wfree() in the event skb
 * needs to be reallocated in a driver.
- * The invariant being skb->truesize substracted from sk->sk_wmem_alloc
+ * The invariant being skb->truesize subtracted from sk->sk_wmem_alloc
 *
 * Since transmit from skb destructor is forbidden, we use a tasklet
 * to process all sockets that eventually need to send more skbs.
@@ -699,9 +701,9 @@ static void tcp_tsq_handler(struct sock *sk)
                tcp_write_xmit(sk, tcp_current_mss(sk), 0, 0, GFP_ATOMIC);
 }
 /*
- * One tasklest per cpu tries to send more skbs.
+ * One tasklet per cpu tries to send more skbs.
 * We run in tasklet context but need to disable irqs when
- * transfering tsq->head because tcp_wfree() might
+ * transferring tsq->head because tcp_wfree() might
 * interrupt us (non NAPI drivers)
 */
 static void tcp_tasklet_func(unsigned long data)
@@ -795,7 +797,7 @@ void __init tcp_tasklet_init(void)
 /*
 * Write buffer destructor automatically called from kfree_skb.
- * We cant xmit new skbs from this context, as we might already
+ * We can't xmit new skbs from this context, as we might already
 * hold qdisc lock.
 */
 void tcp_wfree(struct sk_buff *skb)
@@ -986,6 +988,8 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                                 unsigned int mss_now)
 {
+        struct skb_shared_info *shinfo = skb_shinfo(skb);
        /* Make sure we own this skb before messing gso_size/gso_segs */
        WARN_ON_ONCE(skb_cloned(skb));
@@ -993,13 +997,13 @@ static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                /* Avoid the costly divide in the normal
                 * non-TSO case.
                 */
-                skb_shinfo(skb)->gso_segs = 1;
+                shinfo->gso_segs = 1;
-                skb_shinfo(skb)->gso_size = 0;
+                shinfo->gso_size = 0;
-                skb_shinfo(skb)->gso_type = 0;
+                shinfo->gso_type = 0;
        } else {
-                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
+                shinfo->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
-                skb_shinfo(skb)->gso_size = mss_now;
+                shinfo->gso_size = mss_now;
-                skb_shinfo(skb)->gso_type = sk->sk_gso_type;
+                shinfo->gso_type = sk->sk_gso_type;
        }
 }
@@ -1146,6 +1150,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
 */
 static void __pskb_trim_head(struct sk_buff *skb, int len)
 {
+        struct skb_shared_info *shinfo;
        int i, k, eat;
        eat = min_t(int, len, skb_headlen(skb));
@@ -1157,23 +1162,24 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
        }
        eat = len;
        k = 0;
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+        shinfo = skb_shinfo(skb);
-                int size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
+        for (i = 0; i < shinfo->nr_frags; i++) {
+                int size = skb_frag_size(&shinfo->frags[i]);
                if (size <= eat) {
                        skb_frag_unref(skb, i);
                        eat -= size;
                } else {
-                        skb_shinfo(skb)->frags[k] = skb_shinfo(skb)->frags[i];
+                        shinfo->frags[k] = shinfo->frags[i];
                        if (eat) {
-                                skb_shinfo(skb)->frags[k].page_offset += eat;
+                                shinfo->frags[k].page_offset += eat;
-                                skb_frag_size_sub(&skb_shinfo(skb)->frags[k], eat);
+                                skb_frag_size_sub(&shinfo->frags[k], eat);
                                eat = 0;
                        }
                        k++;
                }
        }
-        skb_shinfo(skb)->nr_frags = k;
+        shinfo->nr_frags = k;
        skb_reset_tail_pointer(skb);
        skb->data_len -= len;
@@ -1378,23 +1384,51 @@ static void tcp_cwnd_validate(struct sock *sk)
        }
 }
-/* Returns the portion of skb which can be sent right away without
+/* Minshall's variant of the Nagle send check. */
- * introducing MSS oddities to segment boundaries. In rare cases where
+static bool tcp_minshall_check(const struct tcp_sock *tp)
- * mss_now != mss_cache, we will request caller to create a small skb
+{
- * per input skb which could be mostly avoided here (if desired).
+        return after(tp->snd_sml, tp->snd_una) &&
- *
+                !after(tp->snd_sml, tp->snd_nxt);
- * We explicitly want to create a request for splitting write queue tail
+}
- * to a small skb for Nagle purposes while avoiding unnecessary modulos,
- * thus all the complexity (cwnd_len is always MSS multiple which we
+/* Update snd_sml if this skb is under mss
- * return whenever allowed by the other factors). Basically we need the
+ * Note that a TSO packet might end with a sub-mss segment
- * modulo only when the receiver window alone is the limiting factor or
+ * The test is really :
- * when we would be allowed to send the split-due-to-Nagle skb fully.
+ * if ((skb->len % mss) != 0)
+ *        tp->snd_sml = TCP_SKB_CB(skb)->end_seq;
+ * But we can avoid doing the divide again given we already have
+ *  skb_pcount = skb->len / mss_now
+ */
+static void tcp_minshall_update(struct tcp_sock *tp, unsigned int mss_now,
+                                const struct sk_buff *skb)
+{
+        if (skb->len < tcp_skb_pcount(skb) * mss_now)
+                tp->snd_sml = TCP_SKB_CB(skb)->end_seq;
+}
+/* Return false, if packet can be sent now without violation Nagle's rules:
+ * 1. It is full sized. (provided by caller in %partial bool)
+ * 2. Or it contains FIN. (already checked by caller)
+ * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
+ * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
+ *    With Minshall's modification: all sent small packets are ACKed.
 */
-static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
+static bool tcp_nagle_check(bool partial, const struct tcp_sock *tp,
-                                        unsigned int mss_now, unsigned int max_segs)
+                            unsigned int mss_now, int nonagle)
+{
+        return partial &&
+                ((nonagle & TCP_NAGLE_CORK) ||
+                 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
+}
+/* Returns the portion of skb which can be sent right away */
+static unsigned int tcp_mss_split_point(const struct sock *sk,
+                                        const struct sk_buff *skb,
+                                        unsigned int mss_now,
+                                        unsigned int max_segs,
+                                        int nonagle)
 {
        const struct tcp_sock *tp = tcp_sk(sk);
-        u32 needed, window, max_len;
+        u32 partial, needed, window, max_len;
        window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
        max_len = mss_now * max_segs;
@@ -1407,7 +1441,15 @@ static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_b
        if (max_len <= needed)
                return max_len;
-        return needed - needed % mss_now;
+        partial = needed % mss_now;
+        /* If last segment is not a full MSS, check if Nagle rules allow us
+         * to include this last segment in this skb.
+         * Otherwise, we'll split the skb at last MSS boundary
+         */
+        if (tcp_nagle_check(partial != 0, tp, mss_now, nonagle))
+                return needed - partial;
+        return needed;
 }
 /* Can at least one segment of SKB be sent right now, according to the
@@ -1447,28 +1489,6 @@ static int tcp_init_tso_segs(const struct sock *sk, struct sk_buff *skb,
        return tso_segs;
 }
-/* Minshall's variant of the Nagle send check. */
-static inline bool tcp_minshall_check(const struct tcp_sock *tp)
-{
-        return after(tp->snd_sml, tp->snd_una) &&
-                !after(tp->snd_sml, tp->snd_nxt);
-}
-/* Return false, if packet can be sent now without violation Nagle's rules:
- * 1. It is full sized.
- * 2. Or it contains FIN. (already checked by caller)
- * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
- * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
- *    With Minshall's modification: all sent small packets are ACKed.
- */
-static inline bool tcp_nagle_check(const struct tcp_sock *tp,
-                                  const struct sk_buff *skb,
-                                  unsigned int mss_now, int nonagle)
-{
-        return skb->len < mss_now &&
-                ((nonagle & TCP_NAGLE_CORK) ||
-                 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
-}
 /* Return true if the Nagle test allows this packet to be
 * sent now.
@@ -1489,7 +1509,7 @@ static inline bool tcp_nagle_test(const struct tcp_sock *tp, const struct sk_buf
        if (tcp_urg_mode(tp) || (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN))
                return true;
-        if (!tcp_nagle_check(tp, skb, cur_mss, nonagle))
+        if (!tcp_nagle_check(skb->len < cur_mss, tp, cur_mss, nonagle))
                return true;
        return false;
@@ -1892,7 +1912,8 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                        limit = tcp_mss_split_point(sk, skb, mss_now,
                                                    min_t(unsigned int,
                                                          cwnd_quota,
-                                                          sk->sk_gso_max_segs));
+                                                          sk->sk_gso_max_segs),
+                                                    nonagle);
                if (skb->len > limit &&
                    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
@@ -2756,7 +2777,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 EXPORT_SYMBOL(tcp_make_synack);
 /* Do all connect socket setups that can be done AF independent. */
-void tcp_connect_init(struct sock *sk)
+static void tcp_connect_init(struct sock *sk)
 {
        const struct dst_entry *dst = __sk_dst_get(sk);
        struct tcp_sock *tp = tcp_sk(sk);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 8b97d71e193b..1f2d37613c9e 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -38,7 +38,7 @@ MODULE_DESCRIPTION("TCP cwnd snooper");
 MODULE_LICENSE("GPL");
 MODULE_VERSION("1.1");
-static int port __read_mostly = 0;
+static int port __read_mostly;
 MODULE_PARM_DESC(port, "Port to match (0=all)");
 module_param(port, int, 0);
@@ -46,7 +46,7 @@ static unsigned int bufsize __read_mostly = 4096;
 MODULE_PARM_DESC(bufsize, "Log buffer size in packets (4096)");
 module_param(bufsize, uint, 0);
-static unsigned int fwmark __read_mostly = 0;
+static unsigned int fwmark __read_mostly;
 MODULE_PARM_DESC(fwmark, "skb mark to match (0=no mark)");
 module_param(fwmark, uint, 0);
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index a347a078ee07..1a8d271f994d 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -3,7 +3,7 @@
 *   YeAH TCP
 *
 * For further details look at:
- *    http://wil.cs.caltech.edu/pfldnet2007/paper/YeAH_TCP.pdf
+ *   https://web.archive.org/web/20080316215752/http://wil.cs.caltech.edu/pfldnet2007/paper/YeAH_TCP.pdf
 *
 */
 #include <linux/mm.h>
@@ -15,13 +15,13 @@
 #include "tcp_vegas.h"
-#define TCP_YEAH_ALPHA       80 //lin number of packets queued at the bottleneck
+#define TCP_YEAH_ALPHA       80 /* number of packets queued at the bottleneck */
-#define TCP_YEAH_GAMMA        1 //lin fraction of queue to be removed per rtt
+#define TCP_YEAH_GAMMA        1 /* fraction of queue to be removed per rtt */
-#define TCP_YEAH_DELTA        3 //log minimum fraction of cwnd to be removed on loss
+#define TCP_YEAH_DELTA        3 /* log minimum fraction of cwnd to be removed on loss */
-#define TCP_YEAH_EPSILON      1 //log maximum fraction to be removed on early decongestion
+#define TCP_YEAH_EPSILON      1 /* log maximum fraction to be removed on early decongestion */
-#define TCP_YEAH_PHY          8 //lin maximum delta from base
+#define TCP_YEAH_PHY          8 /* maximum delta from base */
-#define TCP_YEAH_RHO         16 //lin minimum number of consecutive rtt to consider competition on loss
+#define TCP_YEAH_RHO         16 /* minimum number of consecutive rtt to consider competition on loss */
-#define TCP_YEAH_ZETA        50 //lin minimum number of state switchs to reset reno_count
+#define TCP_YEAH_ZETA        50 /* minimum number of state switches to reset reno_count */
 #define TCP_SCALABLE_AI_CNT      100U
@@ -214,9 +214,9 @@ static u32 tcp_yeah_ssthresh(struct sock *sk) {
        if (yeah->doing_reno_now < TCP_YEAH_RHO) {
                reduction = yeah->lastQ;
-                reduction = min( reduction, max(tp->snd_cwnd>>1, 2U) );
+                reduction = min(reduction, max(tp->snd_cwnd>>1, 2U));
-                reduction = max( reduction, tp->snd_cwnd >> TCP_YEAH_DELTA);
+                reduction = max(reduction, tp->snd_cwnd >> TCP_YEAH_DELTA);
        } else
                reduction = max(tp->snd_cwnd>>1, 2U);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 5944d7d668dd..d5d24ecde6a5 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -560,15 +560,11 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,
                                                 __be16 sport, __be16 dport,
                                                 struct udp_table *udptable)
 {
-        struct sock *sk;
        const struct iphdr *iph = ip_hdr(skb);
-        if (unlikely(sk = skb_steal_sock(skb)))
+        return __udp4_lib_lookup(dev_net(skb_dst(skb)->dev), iph->saddr, sport,
-                return sk;
+                                 iph->daddr, dport, inet_iif(skb),
-        else
+                                 udptable);
-                return __udp4_lib_lookup(dev_net(skb_dst(skb)->dev), iph->saddr, sport,
-                                         iph->daddr, dport, inet_iif(skb),
-                                         udptable);
 }
 struct sock *udp4_lib_lookup(struct net *net, __be32 saddr, __be16 sport,
@@ -990,7 +986,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                fl4 = &fl4_stack;
                flowi4_init_output(fl4, ipc.oif, sk->sk_mark, tos,
                                   RT_SCOPE_UNIVERSE, sk->sk_protocol,
-                                   inet_sk_flowi_flags(sk)|FLOWI_FLAG_CAN_SLEEP,
+                                   inet_sk_flowi_flags(sk),
                                   faddr, saddr, dport, inet->inet_sport);
                security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
@@ -999,7 +995,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        err = PTR_ERR(rt);
                        rt = NULL;
                        if (err == -ENETUNREACH)
-                                IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
+                                IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
                        goto out;
                }
@@ -1098,6 +1094,9 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset,
        struct udp_sock *up = udp_sk(sk);
        int ret;
+        if (flags & MSG_SENDPAGE_NOTLAST)
+                flags |= MSG_MORE;
        if (!up->pending) {
                struct msghdr msg = {   .msg_flags = flags|MSG_MORE };
@@ -1236,7 +1235,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        bool slow;
        if (flags & MSG_ERRQUEUE)
-                return ip_recv_error(sk, msg, len);
+                return ip_recv_error(sk, msg, len, addr_len);
 try_again:
        skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
@@ -1600,12 +1599,16 @@ static void flush_stack(struct sock **stack, unsigned int count,
                kfree_skb(skb1);
 }
-static void udp_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+/* For TCP sockets, sk_rx_dst is protected by socket lock
+ * For UDP, we use xchg() to guard against concurrent changes.
+ */
+static void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
 {
-        struct dst_entry *dst = skb_dst(skb);
+        struct dst_entry *old;
        dst_hold(dst);
-        sk->sk_rx_dst = dst;
+        old = xchg(&sk->sk_rx_dst, dst);
+        dst_release(old);
 }
 /*
@@ -1736,15 +1739,16 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        if (udp4_csum_init(skb, uh, proto))
                goto csum_error;
-        if (skb->sk) {
+        sk = skb_steal_sock(skb);
+        if (sk) {
+                struct dst_entry *dst = skb_dst(skb);
                int ret;
-                sk = skb->sk;
-                if (unlikely(sk->sk_rx_dst == NULL))
+                if (unlikely(sk->sk_rx_dst != dst))
-                        udp_sk_rx_dst_set(sk, skb);
+                        udp_sk_rx_dst_set(sk, dst);
                ret = udp_queue_rcv_skb(sk, skb);
+                sock_put(sk);
                /* a return value > 0 means to resubmit the input, but
                 * it wants the return to be -protocol, or 0
                 */
@@ -1910,17 +1914,20 @@ static struct sock *__udp4_lib_demux_lookup(struct net *net,
 void udp_v4_early_demux(struct sk_buff *skb)
 {
-        const struct iphdr *iph = ip_hdr(skb);
+        struct net *net = dev_net(skb->dev);
-        const struct udphdr *uh = udp_hdr(skb);
+        const struct iphdr *iph;
+        const struct udphdr *uh;
        struct sock *sk;
        struct dst_entry *dst;
-        struct net *net = dev_net(skb->dev);
        int dif = skb->dev->ifindex;
        /* validate the packet */
        if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr)))
                return;
+        iph = ip_hdr(skb);
+        uh = udp_hdr(skb);
        if (skb->pkt_type == PACKET_BROADCAST ||
            skb->pkt_type == PACKET_MULTICAST)
                sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index e3db3f915114..71acd0014f2d 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -48,7 +48,7 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
                hdrlen += IPV4_BEET_PHMAXLEN - (optlen & 4);
        skb_set_network_header(skb, -x->props.header_len -
-                                    hdrlen + (XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph)));
+                                    hdrlen + (XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph)));
        if (x->sel.family != AF_INET6)
                skb->network_header += IPV4_BEET_PHMAXLEN;
        skb->mac_header = skb->network_header +
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 0b2a0641526a..542074c00c78 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -16,7 +16,7 @@
 static int xfrm4_init_flags(struct xfrm_state *x)
 {
-        if (ipv4_config.no_pmtu_disc)
+        if (xs_net(x)->ipv4.sysctl_ip_no_pmtu_disc)
                x->props.flags |= XFRM_STATE_NOPMTUDISC;
        return 0;
 }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 12c97d8aa6bb..9418ca375132 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -442,6 +442,8 @@ static int inet6_netconf_msgsize_devconf(int type)
        if (type == -1 || type == NETCONFA_MC_FORWARDING)
                size += nla_total_size(4);
 #endif
+        if (type == -1 || type == NETCONFA_PROXY_NEIGH)
+                size += nla_total_size(4);
        return size;
 }
@@ -475,6 +477,10 @@ static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
                        devconf->mc_forwarding) < 0)
                goto nla_put_failure;
 #endif
+        if ((type == -1 || type == NETCONFA_PROXY_NEIGH) &&
+            nla_put_s32(skb, NETCONFA_PROXY_NEIGH, devconf->proxy_ndp) < 0)
+                goto nla_put_failure;
        return nlmsg_end(skb, nlh);
 nla_put_failure:
@@ -509,6 +515,7 @@ errout:
 static const struct nla_policy devconf_ipv6_policy[NETCONFA_MAX+1] = {
        [NETCONFA_IFINDEX]      = { .len = sizeof(int) },
        [NETCONFA_FORWARDING]   = { .len = sizeof(int) },
+        [NETCONFA_PROXY_NEIGH]  = { .len = sizeof(int) },
 };
 static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
@@ -834,6 +841,8 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
                goto out;
        }
+        neigh_parms_data_state_setall(idev->nd_parms);
        ifa->addr = *addr;
        if (peer_addr)
                ifa->peer_addr = *peer_addr;
@@ -986,12 +995,9 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
         * --yoshfuji
         */
        if ((ifp->flags & IFA_F_PERMANENT) && onlink < 1) {
-                struct in6_addr prefix;
                struct rt6_info *rt;
-                ipv6_addr_prefix(&prefix, &ifp->addr, ifp->prefix_len);
+                rt = addrconf_get_prefix_route(&ifp->addr,
-                rt = addrconf_get_prefix_route(&prefix,
                                               ifp->prefix_len,
                                               ifp->idev->dev,
                                               0, RTF_GATEWAY | RTF_DEFAULT);
@@ -1024,7 +1030,7 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *i
        u32 addr_flags;
        unsigned long now = jiffies;
-        write_lock(&idev->lock);
+        write_lock_bh(&idev->lock);
        if (ift) {
                spin_lock_bh(&ift->lock);
                memcpy(&addr.s6_addr[8], &ift->addr.s6_addr[8], 8);
@@ -1036,7 +1042,7 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *i
 retry:
        in6_dev_hold(idev);
        if (idev->cnf.use_tempaddr <= 0) {
-                write_unlock(&idev->lock);
+                write_unlock_bh(&idev->lock);
                pr_info("%s: use_tempaddr is disabled\n", __func__);
                in6_dev_put(idev);
                ret = -1;
@@ -1046,7 +1052,7 @@ retry:
        if (ifp->regen_count++ >= idev->cnf.regen_max_retry) {
                idev->cnf.use_tempaddr = -1;    /*XXX*/
                spin_unlock_bh(&ifp->lock);
-                write_unlock(&idev->lock);
+                write_unlock_bh(&idev->lock);
                pr_warn("%s: regeneration time exceeded - disabled temporary address support\n",
                        __func__);
                in6_dev_put(idev);
@@ -1071,8 +1077,8 @@ retry:
        regen_advance = idev->cnf.regen_max_retry *
                        idev->cnf.dad_transmits *
-                        idev->nd_parms->retrans_time / HZ;
+                        NEIGH_VAR(idev->nd_parms, RETRANS_TIME) / HZ;
-        write_unlock(&idev->lock);
+        write_unlock_bh(&idev->lock);
        /* A temporary address is created only if this calculated Preferred
         * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
@@ -1099,7 +1105,7 @@ retry:
                in6_dev_put(idev);
                pr_info("%s: retry temporary address regeneration\n", __func__);
                tmpaddr = &addr;
-                write_lock(&idev->lock);
+                write_lock_bh(&idev->lock);
                goto retry;
        }
@@ -1407,7 +1413,7 @@ try_nextdev:
 EXPORT_SYMBOL(ipv6_dev_get_saddr);
 int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
-                      unsigned char banned_flags)
+                      u32 banned_flags)
 {
        struct inet6_ifaddr *ifp;
        int err = -EADDRNOTAVAIL;
@@ -1424,7 +1430,7 @@ int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
 }
 int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
-                    unsigned char banned_flags)
+                    u32 banned_flags)
 {
        struct inet6_dev *idev;
        int err = -EADDRNOTAVAIL;
@@ -1888,7 +1894,8 @@ static void ipv6_regen_rndid(unsigned long data)
        expires = jiffies +
                idev->cnf.temp_prefered_lft * HZ -
-                idev->cnf.regen_max_retry * idev->cnf.dad_transmits * idev->nd_parms->retrans_time -
+                idev->cnf.regen_max_retry * idev->cnf.dad_transmits *
+                NEIGH_VAR(idev->nd_parms, RETRANS_TIME) -
                idev->cnf.max_desync_factor * HZ;
        if (time_before(expires, jiffies)) {
                pr_warn("%s: too short regeneration interval; timer disabled for %s\n",
@@ -2016,6 +2023,73 @@ static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
        return idev;
 }
+static void manage_tempaddrs(struct inet6_dev *idev,
+                             struct inet6_ifaddr *ifp,
+                             __u32 valid_lft, __u32 prefered_lft,
+                             bool create, unsigned long now)
+{
+        u32 flags;
+        struct inet6_ifaddr *ift;
+        read_lock_bh(&idev->lock);
+        /* update all temporary addresses in the list */
+        list_for_each_entry(ift, &idev->tempaddr_list, tmp_list) {
+                int age, max_valid, max_prefered;
+                if (ifp != ift->ifpub)
+                        continue;
+                /* RFC 4941 section 3.3:
+                 * If a received option will extend the lifetime of a public
+                 * address, the lifetimes of temporary addresses should
+                 * be extended, subject to the overall constraint that no
+                 * temporary addresses should ever remain "valid" or "preferred"
+                 * for a time longer than (TEMP_VALID_LIFETIME) or
+                 * (TEMP_PREFERRED_LIFETIME - DESYNC_FACTOR), respectively.
+                 */
+                age = (now - ift->cstamp) / HZ;
+                max_valid = idev->cnf.temp_valid_lft - age;
+                if (max_valid < 0)
+                        max_valid = 0;
+                max_prefered = idev->cnf.temp_prefered_lft -
+                               idev->cnf.max_desync_factor - age;
+                if (max_prefered < 0)
+                        max_prefered = 0;
+                if (valid_lft > max_valid)
+                        valid_lft = max_valid;
+                if (prefered_lft > max_prefered)
+                        prefered_lft = max_prefered;
+                spin_lock(&ift->lock);
+                flags = ift->flags;
+                ift->valid_lft = valid_lft;
+                ift->prefered_lft = prefered_lft;
+                ift->tstamp = now;
+                if (prefered_lft > 0)
+                        ift->flags &= ~IFA_F_DEPRECATED;
+                spin_unlock(&ift->lock);
+                if (!(flags&IFA_F_TENTATIVE))
+                        ipv6_ifa_notify(0, ift);
+        }
+        if ((create || list_empty(&idev->tempaddr_list)) &&
+            idev->cnf.use_tempaddr > 0) {
+                /* When a new public address is created as described
+                 * in [ADDRCONF], also create a new temporary address.
+                 * Also create a temporary address if it's enabled but
+                 * no temporary address currently exists.
+                 */
+                read_unlock_bh(&idev->lock);
+                ipv6_create_tempaddr(ifp, NULL);
+        } else {
+                read_unlock_bh(&idev->lock);
+        }
+}
 void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
 {
        struct prefix_info *pinfo;
@@ -2170,6 +2244,7 @@ ok:
                                return;
                        }
+                        ifp->flags |= IFA_F_MANAGETEMPADDR;
                        update_lft = 0;
                        create = 1;
                        ifp->cstamp = jiffies;
@@ -2178,9 +2253,8 @@ ok:
                }
                if (ifp) {
-                        int flags;
+                        u32 flags;
                        unsigned long now;
-                        struct inet6_ifaddr *ift;
                        u32 stored_lft;
                        /* update lifetime (RFC2462 5.5.3 e) */
@@ -2221,70 +2295,8 @@ ok:
                        } else
                                spin_unlock(&ifp->lock);
-                        read_lock_bh(&in6_dev->lock);
+                        manage_tempaddrs(in6_dev, ifp, valid_lft, prefered_lft,
-                        /* update all temporary addresses in the list */
+                                         create, now);
-                        list_for_each_entry(ift, &in6_dev->tempaddr_list,
-                                            tmp_list) {
-                                int age, max_valid, max_prefered;
-                                if (ifp != ift->ifpub)
-                                        continue;
-                                /*
-                                 * RFC 4941 section 3.3:
-                                 * If a received option will extend the lifetime
-                                 * of a public address, the lifetimes of
-                                 * temporary addresses should be extended,
-                                 * subject to the overall constraint that no
-                                 * temporary addresses should ever remain
-                                 * "valid" or "preferred" for a time longer than
-                                 * (TEMP_VALID_LIFETIME) or
-                                 * (TEMP_PREFERRED_LIFETIME - DESYNC_FACTOR),
-                                 * respectively.
-                                 */
-                                age = (now - ift->cstamp) / HZ;
-                                max_valid = in6_dev->cnf.temp_valid_lft - age;
-                                if (max_valid < 0)
-                                        max_valid = 0;
-                                max_prefered = in6_dev->cnf.temp_prefered_lft -
-                                               in6_dev->cnf.max_desync_factor -
-                                               age;
-                                if (max_prefered < 0)
-                                        max_prefered = 0;
-                                if (valid_lft > max_valid)
-                                        valid_lft = max_valid;
-                                if (prefered_lft > max_prefered)
-                                        prefered_lft = max_prefered;
-                                spin_lock(&ift->lock);
-                                flags = ift->flags;
-                                ift->valid_lft = valid_lft;
-                                ift->prefered_lft = prefered_lft;
-                                ift->tstamp = now;
-                                if (prefered_lft > 0)
-                                        ift->flags &= ~IFA_F_DEPRECATED;
-                                spin_unlock(&ift->lock);
-                                if (!(flags&IFA_F_TENTATIVE))
-                                        ipv6_ifa_notify(0, ift);
-                        }
-                        if ((create || list_empty(&in6_dev->tempaddr_list)) && in6_dev->cnf.use_tempaddr > 0) {
-                                /*
-                                 * When a new public address is created as
-                                 * described in [ADDRCONF], also create a new
-                                 * temporary address. Also create a temporary
-                                 * address if it's enabled but no temporary
-                                 * address currently exists.
-                                 */
-                                read_unlock_bh(&in6_dev->lock);
-                                ipv6_create_tempaddr(ifp, NULL);
-                        } else {
-                                read_unlock_bh(&in6_dev->lock);
-                        }
                        in6_ifa_put(ifp);
                        addrconf_verify(0);
@@ -2363,10 +2375,11 @@ err_exit:
 /*
 *      Manual configuration of address on an interface
 */
-static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *pfx,
+static int inet6_addr_add(struct net *net, int ifindex,
+                          const struct in6_addr *pfx,
                          const struct in6_addr *peer_pfx,
-                          unsigned int plen, __u8 ifa_flags, __u32 prefered_lft,
+                          unsigned int plen, __u32 ifa_flags,
-                          __u32 valid_lft)
+                          __u32 prefered_lft, __u32 valid_lft)
 {
        struct inet6_ifaddr *ifp;
        struct inet6_dev *idev;
@@ -2385,6 +2398,9 @@ static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *p
        if (!valid_lft || prefered_lft > valid_lft)
                return -EINVAL;
+        if (ifa_flags & IFA_F_MANAGETEMPADDR && plen != 64)
+                return -EINVAL;
        dev = __dev_get_by_index(net, ifindex);
        if (!dev)
                return -ENODEV;
@@ -2425,6 +2441,9 @@ static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *p
                 * manually configured addresses
                 */
                addrconf_dad_start(ifp);
+                if (ifa_flags & IFA_F_MANAGETEMPADDR)
+                        manage_tempaddrs(idev, ifp, valid_lft, prefered_lft,
+                                         true, jiffies);
                in6_ifa_put(ifp);
                addrconf_verify(0);
                return 0;
@@ -2613,7 +2632,7 @@ static void init_loopback(struct net_device *dev)
                        if (sp_ifa->rt)
                                continue;
-                        sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
+                        sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, false);
                        /* Failure cases are ignored */
                        if (!IS_ERR(sp_rt)) {
@@ -3176,7 +3195,8 @@ static void addrconf_dad_timer(unsigned long data)
        }
        ifp->dad_probes--;
-        addrconf_mod_dad_timer(ifp, ifp->idev->nd_parms->retrans_time);
+        addrconf_mod_dad_timer(ifp,
+                               NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME));
        spin_unlock(&ifp->lock);
        write_unlock(&idev->lock);
@@ -3356,7 +3376,7 @@ static int if6_seq_show(struct seq_file *seq, void *v)
                   ifp->idev->dev->ifindex,
                   ifp->prefix_len,
                   ifp->scope,
-                   ifp->flags,
+                   (u8) ifp->flags,
                   ifp->idev->dev->name);
        return 0;
 }
@@ -3497,7 +3517,7 @@ restart:
                                   !(ifp->flags&IFA_F_TENTATIVE)) {
                                unsigned long regen_advance = ifp->idev->cnf.regen_max_retry *
                                        ifp->idev->cnf.dad_transmits *
-                                        ifp->idev->nd_parms->retrans_time / HZ;
+                                        NEIGH_VAR(ifp->idev->nd_parms, RETRANS_TIME) / HZ;
                                if (age >= ifp->prefered_lft - regen_advance) {
                                        struct inet6_ifaddr *ifpub = ifp->ifpub;
@@ -3572,6 +3592,7 @@ static const struct nla_policy ifa_ipv6_policy[IFA_MAX+1] = {
        [IFA_ADDRESS]           = { .len = sizeof(struct in6_addr) },
        [IFA_LOCAL]             = { .len = sizeof(struct in6_addr) },
        [IFA_CACHEINFO]         = { .len = sizeof(struct ifa_cacheinfo) },
+        [IFA_FLAGS]             = { .len = sizeof(u32) },
 };
 static int
@@ -3595,16 +3616,21 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
        return inet6_addr_del(net, ifm->ifa_index, pfx, ifm->ifa_prefixlen);
 }
-static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
+static int inet6_addr_modify(struct inet6_ifaddr *ifp, u32 ifa_flags,
                             u32 prefered_lft, u32 valid_lft)
 {
        u32 flags;
        clock_t expires;
        unsigned long timeout;
+        bool was_managetempaddr;
        if (!valid_lft || (prefered_lft > valid_lft))
                return -EINVAL;
+        if (ifa_flags & IFA_F_MANAGETEMPADDR &&
+            (ifp->flags & IFA_F_TEMPORARY || ifp->prefix_len != 64))
+                return -EINVAL;
        timeout = addrconf_timeout_fixup(valid_lft, HZ);
        if (addrconf_finite_timeout(timeout)) {
                expires = jiffies_to_clock_t(timeout * HZ);
@@ -3624,7 +3650,10 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
        }
        spin_lock_bh(&ifp->lock);
-        ifp->flags = (ifp->flags & ~(IFA_F_DEPRECATED | IFA_F_PERMANENT | IFA_F_NODAD | IFA_F_HOMEADDRESS)) | ifa_flags;
+        was_managetempaddr = ifp->flags & IFA_F_MANAGETEMPADDR;
+        ifp->flags &= ~(IFA_F_DEPRECATED | IFA_F_PERMANENT | IFA_F_NODAD |
+                        IFA_F_HOMEADDRESS | IFA_F_MANAGETEMPADDR);
+        ifp->flags |= ifa_flags;
        ifp->tstamp = jiffies;
        ifp->valid_lft = valid_lft;
        ifp->prefered_lft = prefered_lft;
@@ -3635,6 +3664,14 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
        addrconf_prefix_route(&ifp->addr, ifp->prefix_len, ifp->idev->dev,
                              expires, flags);
+        if (was_managetempaddr || ifp->flags & IFA_F_MANAGETEMPADDR) {
+                if (was_managetempaddr && !(ifp->flags & IFA_F_MANAGETEMPADDR))
+                        valid_lft = prefered_lft = 0;
+                manage_tempaddrs(ifp->idev, ifp, valid_lft, prefered_lft,
+                                 !was_managetempaddr, jiffies);
+        }
        addrconf_verify(0);
        return 0;
@@ -3650,7 +3687,7 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
        struct inet6_ifaddr *ifa;
        struct net_device *dev;
        u32 valid_lft = INFINITY_LIFE_TIME, preferred_lft = INFINITY_LIFE_TIME;
-        u8 ifa_flags;
+        u32 ifa_flags;
        int err;
        err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
@@ -3677,8 +3714,10 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
        if (dev == NULL)
                return -ENODEV;
+        ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) : ifm->ifa_flags;
        /* We ignore other flags so far. */
-        ifa_flags = ifm->ifa_flags & (IFA_F_NODAD | IFA_F_HOMEADDRESS);
+        ifa_flags &= IFA_F_NODAD | IFA_F_HOMEADDRESS | IFA_F_MANAGETEMPADDR;
        ifa = ipv6_get_ifaddr(net, pfx, dev, 1);
        if (ifa == NULL) {
@@ -3702,7 +3741,7 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
        return err;
 }
-static void put_ifaddrmsg(struct nlmsghdr *nlh, u8 prefixlen, u8 flags,
+static void put_ifaddrmsg(struct nlmsghdr *nlh, u8 prefixlen, u32 flags,
                          u8 scope, int ifindex)
 {
        struct ifaddrmsg *ifm;
@@ -3745,7 +3784,8 @@ static inline int inet6_ifaddr_msgsize(void)
        return NLMSG_ALIGN(sizeof(struct ifaddrmsg))
               + nla_total_size(16) /* IFA_LOCAL */
               + nla_total_size(16) /* IFA_ADDRESS */
-               + nla_total_size(sizeof(struct ifa_cacheinfo));
+               + nla_total_size(sizeof(struct ifa_cacheinfo))
+               + nla_total_size(4)  /* IFA_FLAGS */;
 }
 static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
@@ -3793,6 +3833,9 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
        if (put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0)
                goto error;
+        if (nla_put_u32(skb, IFA_FLAGS, ifa->flags) < 0)
+                goto error;
        return nlmsg_end(skb, nlh);
 error:
@@ -4196,7 +4239,7 @@ static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev)
        ci.max_reasm_len = IPV6_MAXPLEN;
        ci.tstamp = cstamp_delta(idev->tstamp);
        ci.reachable_time = jiffies_to_msecs(idev->nd_parms->reachable_time);
-        ci.retrans_time = jiffies_to_msecs(idev->nd_parms->retrans_time);
+        ci.retrans_time = jiffies_to_msecs(NEIGH_VAR(idev->nd_parms, RETRANS_TIME));
        if (nla_put(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci))
                goto nla_put_failure;
        nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
@@ -4689,6 +4732,46 @@ int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
        return ret;
 }
+static
+int addrconf_sysctl_proxy_ndp(struct ctl_table *ctl, int write,
+                              void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        int *valp = ctl->data;
+        int ret;
+        int old, new;
+        old = *valp;
+        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+        new = *valp;
+        if (write && old != new) {
+                struct net *net = ctl->extra2;
+                if (!rtnl_trylock())
+                        return restart_syscall();
+                if (valp == &net->ipv6.devconf_dflt->proxy_ndp)
+                        inet6_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
+                                                     NETCONFA_IFINDEX_DEFAULT,
+                                                     net->ipv6.devconf_dflt);
+                else if (valp == &net->ipv6.devconf_all->proxy_ndp)
+                        inet6_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
+                                                     NETCONFA_IFINDEX_ALL,
+                                                     net->ipv6.devconf_all);
+                else {
+                        struct inet6_dev *idev = ctl->extra1;
+                        inet6_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
+                                                     idev->dev->ifindex,
+                                                     &idev->cnf);
+                }
+                rtnl_unlock();
+        }
+        return ret;
+}
 static struct addrconf_sysctl_table
 {
        struct ctl_table_header *sysctl_header;
@@ -4875,7 +4958,7 @@ static struct addrconf_sysctl_table
                        .data           = &ipv6_devconf.proxy_ndp,
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .proc_handler   = addrconf_sysctl_proxy_ndp,
                },
                {
                        .procname       = "accept_source_route",
@@ -4991,7 +5074,7 @@ static void __addrconf_sysctl_unregister(struct ipv6_devconf *p)
 static void addrconf_sysctl_register(struct inet6_dev *idev)
 {
-        neigh_sysctl_register(idev->dev, idev->nd_parms, "ipv6",
+        neigh_sysctl_register(idev->dev, idev->nd_parms,
                              &ndisc_ifinfo_sysctl_change);
        __addrconf_sysctl_register(dev_net(idev->dev), idev->dev->name,
                                        idev, &idev->cnf);
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 4fbdb7046d28..c921d5d38831 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -213,7 +213,7 @@ lookup_protocol:
        inet->mc_list   = NULL;
        inet->rcv_tos   = 0;
-        if (ipv4_config.no_pmtu_disc)
+        if (net->ipv4.sysctl_ip_no_pmtu_disc)
                inet->pmtudisc = IP_PMTUDISC_DONT;
        else
                inet->pmtudisc = IP_PMTUDISC_WANT;
@@ -661,7 +661,7 @@ int inet6_sk_rebuild_header(struct sock *sk)
                final_p = fl6_update_dst(&fl6, np->opt, &final);
-                dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
+                dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
                if (IS_ERR(dst)) {
                        sk->sk_route_caps = 0;
                        sk->sk_err_soft = -PTR_ERR(dst);
@@ -683,8 +683,7 @@ bool ipv6_opt_accepted(const struct sock *sk, const struct sk_buff *skb)
        if (np->rxopt.all) {
                if ((opt->hop && (np->rxopt.bits.hopopts ||
                                  np->rxopt.bits.ohopopts)) ||
-                    ((IPV6_FLOWINFO_MASK &
+                    (ip6_flowinfo((struct ipv6hdr *) skb_network_header(skb)) &&
-                      *(__be32 *)skb_network_header(skb)) &&
                     np->rxopt.bits.rxflow) ||
                    (opt->srcrt && (np->rxopt.bits.srcrt ||
                     np->rxopt.bits.osrcrt)) ||
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 82e1da3a40b9..81e496a2e008 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -12,8 +12,7 @@
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Authors
 *
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index a454b0ff57c7..6983058942ea 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -73,7 +73,6 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                        if (flowlabel == NULL)
                                return -EINVAL;
-                        usin->sin6_addr = flowlabel->dst;
                }
        }
@@ -171,7 +170,7 @@ ipv4_connected:
        opt = flowlabel ? flowlabel->opt : np->opt;
        final_p = fl6_update_dst(&fl6, opt, &final);
-        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
        err = 0;
        if (IS_ERR(dst)) {
                err = PTR_ERR(dst);
@@ -318,7 +317,7 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
 /*
 *      Handle MSG_ERRQUEUE
 */
-int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
+int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct sock_exterr_skb *serr;
@@ -369,6 +368,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                                               &sin->sin6_addr);
                        sin->sin6_scope_id = 0;
                }
+                *addr_len = sizeof(*sin);
        }
        memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
@@ -377,6 +377,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
        if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
                sin->sin6_family = AF_INET6;
                sin->sin6_flowinfo = 0;
+                sin->sin6_port = 0;
                if (skb->protocol == htons(ETH_P_IPV6)) {
                        sin->sin6_addr = ipv6_hdr(skb)->saddr;
                        if (np->rxopt.all)
@@ -423,7 +424,8 @@ EXPORT_SYMBOL_GPL(ipv6_recv_error);
 /*
 *      Handle IPV6_RECVPATHMTU
 */
-int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
+int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len,
+                     int *addr_len)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct sk_buff *skb;
@@ -457,6 +459,7 @@ int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
                sin->sin6_port = 0;
                sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id;
                sin->sin6_addr = mtu_info.ip6m_addr.sin6_addr;
+                *addr_len = sizeof(*sin);
        }
        put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info);
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index b8719df0366e..6eef8a7e35f2 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -12,8 +12,7 @@
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Authors
 *
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index e27591635f92..3fd0a578329e 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -122,7 +122,11 @@ out:
 static bool fib6_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
 {
        struct rt6_info *rt = (struct rt6_info *) arg->result;
-        struct net_device *dev = rt->rt6i_idev->dev;
+        struct net_device *dev = NULL;
+        if (rt->rt6i_idev)
+                dev = rt->rt6i_idev->dev;
        /* do not accept result if the route does
         * not meet the required prefix length
         */
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 77bb8afb141d..c9138189415a 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -86,7 +86,7 @@ struct dst_entry *inet6_csk_route_req(struct sock *sk,
        fl6->fl6_sport = htons(ireq->ir_num);
        security_req_classify_flow(req, flowi6_to_flowi(fl6));
-        dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
+        dst = ip6_dst_lookup_flow(sk, fl6, final_p);
        if (IS_ERR(dst))
                return NULL;
@@ -216,7 +216,7 @@ static struct dst_entry *inet6_csk_route_socket(struct sock *sk,
        dst = __inet6_csk_dst_check(sk, np->dst_cookie);
        if (!dst) {
-                dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
+                dst = ip6_dst_lookup_flow(sk, fl6, final_p);
                if (!IS_ERR(dst))
                        __inet6_csk_dst_store(sk, dst, NULL, NULL);
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 8acb28621f9c..e27fb78c61f2 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -61,7 +61,6 @@ static bool log_ecn_error = true;
 module_param(log_ecn_error, bool, 0644);
 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
-#define IPV6_TCLASS_MASK (IPV6_FLOWINFO_MASK & ~IPV6_FLOWLABEL_MASK)
 #define IPV6_TCLASS_SHIFT 20
 #define HASH_SIZE_SHIFT  5
@@ -846,7 +845,7 @@ static inline int ip6gre_xmit_ipv6(struct sk_buff *skb, struct net_device *dev)
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
-                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
+                fl6.flowlabel |= ip6_flowlabel(ipv6h);
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
                fl6.flowi6_mark = skb->mark;
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 4b851692b1f6..6fb4162fa785 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -154,6 +154,32 @@ out:
        return segs;
 }
+/* Return the total length of all the extension hdrs, following the same
+ * logic in ipv6_gso_pull_exthdrs() when parsing ext-hdrs.
+ */
+static int ipv6_exthdrs_len(struct ipv6hdr *iph,
+                            const struct net_offload **opps)
+{
+        struct ipv6_opt_hdr *opth = (void *)iph;
+        int len = 0, proto, optlen = sizeof(*iph);
+        proto = iph->nexthdr;
+        for (;;) {
+                if (proto != NEXTHDR_HOP) {
+                        *opps = rcu_dereference(inet6_offloads[proto]);
+                        if (unlikely(!(*opps)))
+                                break;
+                        if (!((*opps)->flags & INET6_PROTO_GSO_EXTHDR))
+                                break;
+                }
+                opth = (void *)opth + optlen;
+                optlen = ipv6_optlen(opth);
+                len += optlen;
+                proto = opth->nexthdr;
+        }
+        return len;
+}
 static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
                                         struct sk_buff *skb)
 {
@@ -177,6 +203,7 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
                        goto out;
        }
+        skb_set_network_header(skb, off);
        skb_gro_pull(skb, sizeof(*iph));
        skb_set_transport_header(skb, skb_gro_offset(skb));
@@ -211,12 +238,16 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
                if (!NAPI_GRO_CB(p)->same_flow)
                        continue;
-                iph2 = ipv6_hdr(p);
+                iph2 = (struct ipv6hdr *)(p->data + off);
                first_word = *(__be32 *)iph ^ *(__be32 *)iph2 ;
-                /* All fields must match except length and Traffic Class. */
+                /* All fields must match except length and Traffic Class.
-                if (nlen != skb_network_header_len(p) ||
+                 * XXX skbs on the gro_list have all been parsed and pulled
-                    (first_word & htonl(0xF00FFFFF)) ||
+                 * already so we don't need to compare nlen
+                 * (nlen != (sizeof(*iph2) + ipv6_exthdrs_len(iph2, &ops)))
+                 * memcmp() alone below is suffcient, right?
+                 */
+                 if ((first_word & htonl(0xF00FFFFF)) ||
                    memcmp(&iph->nexthdr, &iph2->nexthdr,
                           nlen - offsetof(struct ipv6hdr, nexthdr))) {
                        NAPI_GRO_CB(p)->same_flow = 0;
@@ -245,21 +276,21 @@ out:
        return pp;
 }
-static int ipv6_gro_complete(struct sk_buff *skb)
+static int ipv6_gro_complete(struct sk_buff *skb, int nhoff)
 {
        const struct net_offload *ops;
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + nhoff);
        int err = -ENOSYS;
-        iph->payload_len = htons(skb->len - skb_network_offset(skb) -
+        iph->payload_len = htons(skb->len - nhoff - sizeof(*iph));
-                                 sizeof(*iph));
        rcu_read_lock();
-        ops = rcu_dereference(inet6_offloads[NAPI_GRO_CB(skb)->proto]);
+        nhoff += sizeof(*iph) + ipv6_exthdrs_len(iph, &ops);
        if (WARN_ON(!ops || !ops->callbacks.gro_complete))
                goto out_unlock;
-        err = ops->callbacks.gro_complete(skb);
+        err = ops->callbacks.gro_complete(skb, nhoff);
 out_unlock:
        rcu_read_unlock();
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 59df872e2f4d..788c01a53593 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -116,8 +116,8 @@ static int ip6_finish_output2(struct sk_buff *skb)
        }
        rcu_read_unlock_bh();
-        IP6_INC_STATS_BH(dev_net(dst->dev),
+        IP6_INC_STATS(dev_net(dst->dev),
-                         ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
+                      ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
        kfree_skb(skb);
        return -EINVAL;
 }
@@ -336,7 +336,8 @@ int ip6_forward(struct sk_buff *skb)
                goto drop;
        if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
-                IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
+                IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
+                                 IPSTATS_MIB_INDISCARDS);
                goto drop;
        }
@@ -370,8 +371,8 @@ int ip6_forward(struct sk_buff *skb)
                /* Force OUTPUT device used as source address */
                skb->dev = dst->dev;
                icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
-                IP6_INC_STATS_BH(net,
+                IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
-                                 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
+                                 IPSTATS_MIB_INHDRERRORS);
                kfree_skb(skb);
                return -ETIMEDOUT;
@@ -384,14 +385,15 @@ int ip6_forward(struct sk_buff *skb)
                if (proxied > 0)
                        return ip6_input(skb);
                else if (proxied < 0) {
-                        IP6_INC_STATS(net, ip6_dst_idev(dst),
+                        IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
-                                      IPSTATS_MIB_INDISCARDS);
+                                         IPSTATS_MIB_INDISCARDS);
                        goto drop;
                }
        }
        if (!xfrm6_route_forward(skb)) {
-                IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
+                IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
+                                 IPSTATS_MIB_INDISCARDS);
                goto drop;
        }
        dst = skb_dst(skb);
@@ -448,16 +450,17 @@ int ip6_forward(struct sk_buff *skb)
                /* Again, force OUTPUT device used as source address */
                skb->dev = dst->dev;
                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
-                IP6_INC_STATS_BH(net,
+                IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
-                                 ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
+                                 IPSTATS_MIB_INTOOBIGERRORS);
-                IP6_INC_STATS_BH(net,
+                IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
-                                 ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
+                                 IPSTATS_MIB_FRAGFAILS);
                kfree_skb(skb);
                return -EMSGSIZE;
        }
        if (skb_cow(skb, dst->dev->hard_header_len)) {
-                IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
+                IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
+                                 IPSTATS_MIB_OUTDISCARDS);
                goto drop;
        }
@@ -938,7 +941,6 @@ EXPORT_SYMBOL_GPL(ip6_dst_lookup);
 *      @sk: socket which provides route info
 *      @fl6: flow to lookup
 *      @final_dst: final destination address for ipsec lookup
- *      @can_sleep: we are in a sleepable context
 *
 *      This function performs a route lookup on the given flow.
 *
@@ -946,8 +948,7 @@ EXPORT_SYMBOL_GPL(ip6_dst_lookup);
 *      error code.
 */
 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
-                                      const struct in6_addr *final_dst,
+                                      const struct in6_addr *final_dst)
-                                      bool can_sleep)
 {
        struct dst_entry *dst = NULL;
        int err;
@@ -957,8 +958,6 @@ struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
                return ERR_PTR(err);
        if (final_dst)
                fl6->daddr = *final_dst;
-        if (can_sleep)
-                fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
        return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
 }
@@ -969,7 +968,6 @@ EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
 *      @sk: socket which provides the dst cache and route info
 *      @fl6: flow to lookup
 *      @final_dst: final destination address for ipsec lookup
- *      @can_sleep: we are in a sleepable context
 *
 *      This function performs a route lookup on the given flow with the
 *      possibility of using the cached route in the socket if it is valid.
@@ -980,8 +978,7 @@ EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
 *      error code.
 */
 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
-                                         const struct in6_addr *final_dst,
+                                         const struct in6_addr *final_dst)
-                                         bool can_sleep)
 {
        struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
        int err;
@@ -993,8 +990,6 @@ struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
                return ERR_PTR(err);
        if (final_dst)
                fl6->daddr = *final_dst;
-        if (can_sleep)
-                fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
        return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
 }
@@ -1162,10 +1157,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                np->cork.hop_limit = hlimit;
                np->cork.tclass = tclass;
                if (rt->dst.flags & DST_XFRM_TUNNEL)
-                        mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
+                        mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
                              rt->dst.dev->mtu : dst_mtu(&rt->dst);
                else
-                        mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
+                        mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
                              rt->dst.dev->mtu : dst_mtu(rt->dst.path);
                if (np->frag_size < mtu) {
                        if (np->frag_size)
@@ -1267,7 +1262,7 @@ alloc_new_skb:
                        if (skb == NULL || skb_prev == NULL)
                                ip6_append_data_mtu(&mtu, &maxfraglen,
                                                    fragheaderlen, skb, rt,
-                                                    np->pmtudisc ==
+                                                    np->pmtudisc >=
                                                    IPV6_PMTUDISC_PROBE);
                        skb_prev = skb;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index d6062325db08..8d7c9867a445 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -70,7 +70,6 @@ MODULE_ALIAS_NETDEV("ip6tnl0");
 #define IP6_TNL_TRACE(x...) do {;} while(0)
 #endif
-#define IPV6_TCLASS_MASK (IPV6_FLOWINFO_MASK & ~IPV6_FLOWLABEL_MASK)
 #define IPV6_TCLASS_SHIFT 20
 #define HASH_SIZE_SHIFT  5
@@ -1131,7 +1130,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
-                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
+                fl6.flowlabel |= ip6_flowlabel(ipv6h);
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
                fl6.flowi6_mark = skb->mark;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index ce507d9e1c90..da9becb42e81 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -16,8 +16,7 @@
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 /*
 * [Memo]
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 1c6ce3119ff8..af0ecb94b3b4 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -722,7 +722,7 @@ done:
        case IPV6_MTU_DISCOVER:
                if (optlen < sizeof(int))
                        goto e_inval;
-                if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
+                if (val < IPV6_PMTUDISC_DONT || val > IPV6_PMTUDISC_INTERFACE)
                        goto e_inval;
                np->pmtudisc = val;
                retv = 0;
@@ -1019,7 +1019,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                                put_cmsg(&msg, SOL_IPV6, IPV6_HOPLIMIT, sizeof(hlim), &hlim);
                        }
                        if (np->rxopt.bits.rxtclass) {
-                                int tclass = np->rcv_tclass;
+                                int tclass = ntohl(np->rcv_flowinfo & IPV6_TCLASS_MASK) >> 20;
                                put_cmsg(&msg, SOL_IPV6, IPV6_TCLASS, sizeof(tclass), &tclass);
                        }
                        if (np->rxopt.bits.rxoinfo) {
@@ -1034,6 +1034,11 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                                int hlim = np->mcast_hops;
                                put_cmsg(&msg, SOL_IPV6, IPV6_2292HOPLIMIT, sizeof(hlim), &hlim);
                        }
+                        if (np->rxopt.bits.rxflow) {
+                                __be32 flowinfo = np->rcv_flowinfo;
+                                put_cmsg(&msg, SOL_IPV6, IPV6_FLOWINFO, sizeof(flowinfo), &flowinfo);
+                        }
                }
                len -= msg.msg_controllen;
                return put_user(len, optlen);
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 9ac01dc9402e..db9b6cbc9db3 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -13,8 +13,7 @@
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 /*
 * Authors:
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 3512177deb4d..09a22f4f36c9 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -125,17 +125,19 @@ struct neigh_table nd_tbl = {
        .id =           "ndisc_cache",
        .parms = {
                .tbl                    = &nd_tbl,
-                .base_reachable_time    = ND_REACHABLE_TIME,
-                .retrans_time           = ND_RETRANS_TIMER,
-                .gc_staletime           = 60 * HZ,
                .reachable_time         = ND_REACHABLE_TIME,
-                .delay_probe_time       = 5 * HZ,
+                .data = {
-                .queue_len_bytes        = 64*1024,
+                        [NEIGH_VAR_MCAST_PROBES] = 3,
-                .ucast_probes           = 3,
+                        [NEIGH_VAR_UCAST_PROBES] = 3,
-                .mcast_probes           = 3,
+                        [NEIGH_VAR_RETRANS_TIME] = ND_RETRANS_TIMER,
-                .anycast_delay          = 1 * HZ,
+                        [NEIGH_VAR_BASE_REACHABLE_TIME] = ND_REACHABLE_TIME,
-                .proxy_delay            = (8 * HZ) / 10,
+                        [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
-                .proxy_qlen             = 64,
+                        [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
+                        [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
+                        [NEIGH_VAR_PROXY_QLEN] = 64,
+                        [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
+                        [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
+                },
        },
        .gc_interval =    30 * HZ,
        .gc_thresh1 =    128,
@@ -656,14 +658,14 @@ static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
        if (skb && ipv6_chk_addr(dev_net(dev), &ipv6_hdr(skb)->saddr, dev, 1))
                saddr = &ipv6_hdr(skb)->saddr;
-        if ((probes -= neigh->parms->ucast_probes) < 0) {
+        if ((probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES)) < 0) {
                if (!(neigh->nud_state & NUD_VALID)) {
                        ND_PRINTK(1, dbg,
                                  "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
                                  __func__, target);
                }
                ndisc_send_ns(dev, neigh, target, target, saddr);
-        } else if ((probes -= neigh->parms->app_probes) < 0) {
+        } else if ((probes -= NEIGH_VAR(neigh->parms, APP_PROBES)) < 0) {
                neigh_app_ns(neigh);
        } else {
                addrconf_addr_solict_mult(target, &mcaddr);
@@ -790,7 +792,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                        if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
                            skb->pkt_type != PACKET_HOST &&
                            inc &&
-                            idev->nd_parms->proxy_delay != 0) {
+                            NEIGH_VAR(idev->nd_parms, PROXY_DELAY) != 0) {
                                /*
                                 * for anycast or proxy,
                                 * sender should delay its response
@@ -1210,7 +1212,7 @@ skip_defrtr:
                        rtime = (rtime*HZ)/1000;
                        if (rtime < HZ/10)
                                rtime = HZ/10;
-                        in6_dev->nd_parms->retrans_time = rtime;
+                        NEIGH_VAR_SET(in6_dev->nd_parms, RETRANS_TIME, rtime);
                        in6_dev->tstamp = jiffies;
                        inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
                }
@@ -1222,9 +1224,11 @@ skip_defrtr:
                        if (rtime < HZ/10)
                                rtime = HZ/10;
-                        if (rtime != in6_dev->nd_parms->base_reachable_time) {
+                        if (rtime != NEIGH_VAR(in6_dev->nd_parms, BASE_REACHABLE_TIME)) {
-                                in6_dev->nd_parms->base_reachable_time = rtime;
+                                NEIGH_VAR_SET(in6_dev->nd_parms,
-                                in6_dev->nd_parms->gc_staletime = 3 * rtime;
+                                              BASE_REACHABLE_TIME, rtime);
+                                NEIGH_VAR_SET(in6_dev->nd_parms,
+                                              GC_STALETIME, 3 * rtime);
                                in6_dev->nd_parms->reachable_time = neigh_rand_reach_time(rtime);
                                in6_dev->tstamp = jiffies;
                                inet6_ifinfo_notify(RTM_NEWLINK, in6_dev);
@@ -1277,6 +1281,9 @@ skip_linkparms:
                            ri->prefix_len == 0)
                                continue;
 #endif
+                        if (ri->prefix_len == 0 &&
+                            !in6_dev->cnf.accept_ra_defrtr)
+                                continue;
                        if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
                                continue;
                        rt6_route_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3,
@@ -1648,22 +1655,23 @@ int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *bu
                ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
        if (strcmp(ctl->procname, "retrans_time") == 0)
-                ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+                ret = neigh_proc_dointvec(ctl, write, buffer, lenp, ppos);
        else if (strcmp(ctl->procname, "base_reachable_time") == 0)
-                ret = proc_dointvec_jiffies(ctl, write,
+                ret = neigh_proc_dointvec_jiffies(ctl, write,
-                                            buffer, lenp, ppos);
+                                                  buffer, lenp, ppos);
        else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
                 (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
-                ret = proc_dointvec_ms_jiffies(ctl, write,
+                ret = neigh_proc_dointvec_ms_jiffies(ctl, write,
-                                               buffer, lenp, ppos);
+                                                     buffer, lenp, ppos);
        else
                ret = -1;
        if (write && ret == 0 && dev && (idev = in6_dev_get(dev)) != NULL) {
-                if (ctl->data == &idev->nd_parms->base_reachable_time)
+                if (ctl->data == &NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME))
-                        idev->nd_parms->reachable_time = neigh_rand_reach_time(idev->nd_parms->base_reachable_time);
+                        idev->nd_parms->reachable_time =
+                                        neigh_rand_reach_time(NEIGH_VAR(idev->nd_parms, BASE_REACHABLE_TIME));
                idev->tstamp = jiffies;
                inet6_ifinfo_notify(RTM_NEWLINK, idev);
                in6_dev_put(idev);
@@ -1722,7 +1730,7 @@ int __init ndisc_init(void)
        neigh_table_init(&nd_tbl);
 #ifdef CONFIG_SYSCTL
-        err = neigh_sysctl_register(NULL, &nd_tbl.parms, "ipv6",
+        err = neigh_sysctl_register(NULL, &nd_tbl.parms,
                                    &ndisc_ifinfo_sysctl_change);
        if (err)
                goto out_unregister_pernet;
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index f78f41aca8e9..a0d17270117c 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -446,6 +446,7 @@ static void synproxy_tg6_destroy(const struct xt_tgdtor_param *par)
 static struct xt_target synproxy_tg6_reg __read_mostly = {
        .name           = "SYNPROXY",
        .family         = NFPROTO_IPV6,
+        .hooks          = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
        .target         = synproxy_tg6,
        .targetsize     = sizeof(struct xt_synproxy_info),
        .checkentry     = synproxy_tg6_check,
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 8815e31a87fe..15d23b8c2129 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -57,7 +57,8 @@ static struct inet_protosw pingv6_protosw = {
 /* Compatibility glue so we can support IPv6 when it's compiled as a module */
-static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
+static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
+                                 int *addr_len)
 {
        return -EAFNOSUPPORT;
 }
@@ -144,7 +145,7 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        else if (!fl6.flowi6_oif)
                fl6.flowi6_oif = np->ucast_oif;
-        dst = ip6_sk_dst_lookup_flow(sk, &fl6,  daddr, 1);
+        dst = ip6_sk_dst_lookup_flow(sk, &fl6,  daddr);
        if (IS_ERR(dst))
                return PTR_ERR(dst);
        rt = (struct rt6_info *) dst;
diff --git a/net/ipv6/protocol.c b/net/ipv6/protocol.c
index 22d1bd4670da..e048cf1bb6a2 100644
--- a/net/ipv6/protocol.c
+++ b/net/ipv6/protocol.c
@@ -36,10 +36,6 @@ int inet6_add_protocol(const struct inet6_protocol *prot, unsigned char protocol
 }
 EXPORT_SYMBOL(inet6_add_protocol);
-/*
- *      Remove a protocol from the hash tables.
- */
 int inet6_del_protocol(const struct inet6_protocol *prot, unsigned char protocol)
 {
        int ret;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index e24ff1df0401..5f10b7ea7ccc 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -466,10 +466,10 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                return -EOPNOTSUPP;
        if (flags & MSG_ERRQUEUE)
-                return ipv6_recv_error(sk, msg, len);
+                return ipv6_recv_error(sk, msg, len, addr_len);
        if (np->rxpmtu && np->rxopt.bits.rxpmtu)
-                return ipv6_recv_rxpmtu(sk, msg, len);
+                return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
        skb = skb_recv_datagram(sk, flags, noblock, &err);
        if (!skb)
@@ -792,7 +792,6 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                                flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                                if (flowlabel == NULL)
                                        return -EINVAL;
-                                daddr = &flowlabel->dst;
                        }
                }
@@ -865,7 +864,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                fl6.flowi6_oif = np->ucast_oif;
        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
-        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
        if (IS_ERR(dst)) {
                err = PTR_ERR(dst);
                goto out;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7faa9d5e1503..89b2735cecf5 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -66,8 +66,9 @@
 #endif
 enum rt6_nud_state {
-        RT6_NUD_FAIL_HARD = -2,
+        RT6_NUD_FAIL_HARD = -3,
-        RT6_NUD_FAIL_SOFT = -1,
+        RT6_NUD_FAIL_PROBE = -2,
+        RT6_NUD_FAIL_DO_RR = -1,
        RT6_NUD_SUCCEED = 1
 };
@@ -84,6 +85,8 @@ static int		 ip6_dst_gc(struct dst_ops *ops);
 static int              ip6_pkt_discard(struct sk_buff *skb);
 static int              ip6_pkt_discard_out(struct sk_buff *skb);
+static int              ip6_pkt_prohibit(struct sk_buff *skb);
+static int              ip6_pkt_prohibit_out(struct sk_buff *skb);
 static void             ip6_link_failure(struct sk_buff *skb);
 static void             ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
                                           struct sk_buff *skb, u32 mtu);
@@ -234,9 +237,6 @@ static const struct rt6_info ip6_null_entry_template = {
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
-static int ip6_pkt_prohibit(struct sk_buff *skb);
-static int ip6_pkt_prohibit_out(struct sk_buff *skb);
 static const struct rt6_info ip6_prohibit_entry_template = {
        .dst = {
                .__refcnt       = ATOMIC_INIT(1),
@@ -522,7 +522,7 @@ static void rt6_probe(struct rt6_info *rt)
                work = kmalloc(sizeof(*work), GFP_ATOMIC);
                if (neigh && work)
-                        neigh->updated = jiffies;
+                        __neigh_set_probe_once(neigh);
                if (neigh)
                        write_unlock(&neigh->lock);
@@ -578,11 +578,13 @@ static inline enum rt6_nud_state rt6_check_neigh(struct rt6_info *rt)
 #ifdef CONFIG_IPV6_ROUTER_PREF
                else if (!(neigh->nud_state & NUD_FAILED))
                        ret = RT6_NUD_SUCCEED;
+                else
+                        ret = RT6_NUD_FAIL_PROBE;
 #endif
                read_unlock(&neigh->lock);
        } else {
                ret = IS_ENABLED(CONFIG_IPV6_ROUTER_PREF) ?
-                      RT6_NUD_SUCCEED : RT6_NUD_FAIL_SOFT;
+                      RT6_NUD_SUCCEED : RT6_NUD_FAIL_DO_RR;
        }
        rcu_read_unlock_bh();
@@ -619,16 +621,17 @@ static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
                goto out;
        m = rt6_score_route(rt, oif, strict);
-        if (m == RT6_NUD_FAIL_SOFT) {
+        if (m == RT6_NUD_FAIL_DO_RR) {
                match_do_rr = true;
                m = 0; /* lowest valid score */
-        } else if (m < 0) {
+        } else if (m == RT6_NUD_FAIL_HARD) {
                goto out;
        }
        if (strict & RT6_LOOKUP_F_REACHABLE)
                rt6_probe(rt);
+        /* note that m can be RT6_NUD_FAIL_PROBE at this point */
        if (m > *mpri) {
                *do_rr = match_do_rr;
                *mpri = m;
@@ -1565,21 +1568,24 @@ int ip6_route_add(struct fib6_config *cfg)
                                goto out;
                        }
                }
-                rt->dst.output = ip6_pkt_discard_out;
-                rt->dst.input = ip6_pkt_discard;
                rt->rt6i_flags = RTF_REJECT|RTF_NONEXTHOP;
                switch (cfg->fc_type) {
                case RTN_BLACKHOLE:
                        rt->dst.error = -EINVAL;
+                        rt->dst.output = dst_discard;
+                        rt->dst.input = dst_discard;
                        break;
                case RTN_PROHIBIT:
                        rt->dst.error = -EACCES;
+                        rt->dst.output = ip6_pkt_prohibit_out;
+                        rt->dst.input = ip6_pkt_prohibit;
                        break;
                case RTN_THROW:
-                        rt->dst.error = -EAGAIN;
-                        break;
                default:
-                        rt->dst.error = -ENETUNREACH;
+                        rt->dst.error = (cfg->fc_type == RTN_THROW) ? -EAGAIN
+                                        : -ENETUNREACH;
+                        rt->dst.output = ip6_pkt_discard_out;
+                        rt->dst.input = ip6_pkt_discard;
                        break;
                }
                goto install_route;
@@ -2144,8 +2150,6 @@ static int ip6_pkt_discard_out(struct sk_buff *skb)
        return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_OUTNOROUTES);
 }
-#ifdef CONFIG_IPV6_MULTIPLE_TABLES
 static int ip6_pkt_prohibit(struct sk_buff *skb)
 {
        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_INNOROUTES);
@@ -2157,8 +2161,6 @@ static int ip6_pkt_prohibit_out(struct sk_buff *skb)
        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
 }
-#endif
 /*
 *      Allocate a dst for local (unicast / anycast) address.
 */
@@ -2168,12 +2170,10 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
                                    bool anycast)
 {
        struct net *net = dev_net(idev->dev);
-        struct rt6_info *rt = ip6_dst_alloc(net, net->loopback_dev, 0, NULL);
+        struct rt6_info *rt = ip6_dst_alloc(net, net->loopback_dev,
+                                            DST_NOCOUNT, NULL);
-        if (!rt) {
+        if (!rt)
-                net_warn_ratelimited("Maximum number of routes reached, consider increasing route/max_size\n");
                return ERR_PTR(-ENOMEM);
-        }
        in6_dev_hold(idev);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 1b4a4a953675..366fbba3359a 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -478,14 +478,44 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
        dev_put(dev);
 }
+/* Generate icmpv6 with type/code ICMPV6_DEST_UNREACH/ICMPV6_ADDR_UNREACH
+ * if sufficient data bytes are available
+ */
+static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb)
+{
+        const struct iphdr *iph = (const struct iphdr *) skb->data;
+        struct rt6_info *rt;
+        struct sk_buff *skb2;
+        if (!pskb_may_pull(skb, iph->ihl * 4 + sizeof(struct ipv6hdr) + 8))
+                return 1;
+        skb2 = skb_clone(skb, GFP_ATOMIC);
+        if (!skb2)
+                return 1;
+        skb_dst_drop(skb2);
+        skb_pull(skb2, iph->ihl * 4);
+        skb_reset_network_header(skb2);
+        rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 0);
+        if (rt && rt->dst.dev)
+                skb2->dev = rt->dst.dev;
+        icmpv6_send(skb2, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
+        if (rt)
+                ip6_rt_put(rt);
+        kfree_skb(skb2);
+        return 0;
+}
 static int ipip6_err(struct sk_buff *skb, u32 info)
 {
-/* All the routers (except for Linux) return only
-   8 bytes of packet payload. It means, that precise relaying of
-   ICMP in the real Internet is absolutely infeasible.
- */
        const struct iphdr *iph = (const struct iphdr *)skb->data;
        const int type = icmp_hdr(skb)->type;
        const int code = icmp_hdr(skb)->code;
@@ -500,7 +530,6 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
        case ICMP_DEST_UNREACH:
                switch (code) {
                case ICMP_SR_FAILED:
-                case ICMP_PORT_UNREACH:
                        /* Impossible event. */
                        return 0;
                default:
@@ -545,6 +574,9 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
                goto out;
        err = 0;
+        if (!ipip6_err_gen_icmpv6_unreach(skb))
+                goto out;
        if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
                goto out;
@@ -919,7 +951,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                if (!new_skb) {
                        ip_rt_put(rt);
                        dev->stats.tx_dropped++;
-                        dev_kfree_skb(skb);
+                        kfree_skb(skb);
                        return NETDEV_TX_OK;
                }
                if (skb->sk)
@@ -945,7 +977,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
 tx_error_icmp:
        dst_link_failure(skb);
 tx_error:
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
 out:
        dev->stats.tx_errors++;
        return NETDEV_TX_OK;
@@ -985,7 +1017,7 @@ static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb,
 tx_err:
        dev->stats.tx_errors++;
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
        return NETDEV_TX_OK;
 }
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 535a3ad262f1..bb53a5e73c1a 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -247,7 +247,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                fl6.fl6_sport = inet_sk(sk)->inet_sport;
                security_req_classify_flow(req, flowi6_to_flowi(&fl6));
-                dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
+                dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
                if (IS_ERR(dst))
                        goto out_free;
        }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 0740f93a114a..ffd5fa8bdb15 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -156,7 +156,6 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                        if (flowlabel == NULL)
                                return -EINVAL;
-                        usin->sin6_addr = flowlabel->dst;
                        fl6_sock_release(flowlabel);
                }
        }
@@ -165,12 +164,12 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         *      connect() to INADDR_ANY means loopback (BSD'ism).
         */
-        if(ipv6_addr_any(&usin->sin6_addr))
+        if (ipv6_addr_any(&usin->sin6_addr))
                usin->sin6_addr.s6_addr[15] = 0x1;
        addr_type = ipv6_addr_type(&usin->sin6_addr);
-        if(addr_type & IPV6_ADDR_MULTICAST)
+        if (addr_type & IPV6_ADDR_MULTICAST)
                return -ENETUNREACH;
        if (addr_type&IPV6_ADDR_LINKLOCAL) {
@@ -258,7 +257,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
-        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
        if (IS_ERR(dst)) {
                err = PTR_ERR(dst);
                goto failure;
@@ -337,7 +336,7 @@ static void tcp_v6_mtu_reduced(struct sock *sk)
 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                u8 type, u8 code, int offset, __be32 info)
 {
-        const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
+        const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
        const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
        struct ipv6_pinfo *np;
        struct sock *sk;
@@ -398,6 +397,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                if (sk->sk_state == TCP_LISTEN)
                        goto out;
+                if (!ip6_sk_accept_pmtu(sk))
+                        goto out;
                tp->mtu_info = ntohl(info);
                if (!sock_owned_by_user(sk))
                        tcp_v6_mtu_reduced(sk);
@@ -467,7 +469,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
 {
        struct inet_request_sock *ireq = inet_rsk(req);
        struct ipv6_pinfo *np = inet6_sk(sk);
-        struct sk_buff * skb;
+        struct sk_buff *skb;
        int err = -ENOMEM;
        /* First, grab a route. */
@@ -801,7 +803,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         * Underlying function will use this to retrieve the network
         * namespace
         */
-        dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
+        dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL);
        if (!IS_ERR(dst)) {
                skb_dst_set(buff, dst);
                ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
@@ -910,7 +912,7 @@ static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 }
-static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
+static struct sock *tcp_v6_hnd_req(struct sock *sk, struct sk_buff *skb)
 {
        struct request_sock *req, **prev;
        const struct tcphdr *th = tcp_hdr(skb);
@@ -1083,9 +1085,9 @@ drop:
        return 0; /* don't send reset */
 }
-static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
+static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
-                                          struct request_sock *req,
+                                         struct request_sock *req,
-                                          struct dst_entry *dst)
+                                         struct dst_entry *dst)
 {
        struct inet_request_sock *ireq;
        struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
@@ -1135,7 +1137,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                newnp->opt         = NULL;
                newnp->mcast_oif   = inet6_iif(skb);
                newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
-                newnp->rcv_tclass  = ipv6_get_dsfield(ipv6_hdr(skb));
+                newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
                /*
                 * No need to charge this sock to the relevant IPv6 refcnt debug socks count
@@ -1215,7 +1217,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
        newnp->opt        = NULL;
        newnp->mcast_oif  = inet6_iif(skb);
        newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
-        newnp->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
+        newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
        /* Clone native IPv6 options from listening socket (if any)
@@ -1380,7 +1382,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 * otherwise we just shortcircuit this and continue with
                 * the new socket..
                 */
-                if(nsk != sk) {
+                if (nsk != sk) {
                        sock_rps_save_rxhash(nsk, skb);
                        if (tcp_child_process(sk, nsk, skb))
                                goto reset;
@@ -1425,8 +1427,8 @@ ipv6_pktoptions:
                        np->mcast_oif = inet6_iif(opt_skb);
                if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
                        np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
-                if (np->rxopt.bits.rxtclass)
+                if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
-                        np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(opt_skb));
+                        np->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(opt_skb));
                if (ipv6_opt_accepted(sk, opt_skb)) {
                        skb_set_owner_r(opt_skb, sk);
                        opt_skb = xchg(&np->pktoptions, opt_skb);
@@ -1740,7 +1742,7 @@ static void get_openreq6(struct seq_file *seq,
                   dest->s6_addr32[2], dest->s6_addr32[3],
                   ntohs(inet_rsk(req)->ir_rmt_port),
                   TCP_SYN_RECV,
-                   0,0, /* could print option size, but that is af dependent. */
+                   0, 0, /* could print option size, but that is af dependent. */
                   1,   /* timers active (only the expire timer) */
                   jiffies_to_clock_t(ttd),
                   req->num_timeout,
@@ -1799,7 +1801,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                   atomic_read(&sp->sk_refcnt), sp,
                   jiffies_to_clock_t(icsk->icsk_rto),
                   jiffies_to_clock_t(icsk->icsk_ack.ato),
-                   (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
+                   (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
                   tp->snd_cwnd,
                   tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
                   );
diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
index c1097c798900..0d78132ff18a 100644
--- a/net/ipv6/tcpv6_offload.c
+++ b/net/ipv6/tcpv6_offload.c
@@ -37,44 +37,42 @@ static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 {
        const struct ipv6hdr *iph = skb_gro_network_header(skb);
        __wsum wsum;
-        __sum16 sum;
+        /* Don't bother verifying checksum if we're going to flush anyway. */
+        if (NAPI_GRO_CB(skb)->flush)
+                goto skip_csum;
+        wsum = skb->csum;
        switch (skb->ip_summed) {
+        case CHECKSUM_NONE:
+                wsum = skb_checksum(skb, skb_gro_offset(skb), skb_gro_len(skb),
+                                    wsum);
+                /* fall through */
        case CHECKSUM_COMPLETE:
                if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
-                                  skb->csum)) {
+                                  wsum)) {
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
                        break;
                }
-flush:
                NAPI_GRO_CB(skb)->flush = 1;
                return NULL;
-        case CHECKSUM_NONE:
-                wsum = ~csum_unfold(csum_ipv6_magic(&iph->saddr, &iph->daddr,
-                                                    skb_gro_len(skb),
-                                                    IPPROTO_TCP, 0));
-                sum = csum_fold(skb_checksum(skb,
-                                             skb_gro_offset(skb),
-                                             skb_gro_len(skb),
-                                             wsum));
-                if (sum)
-                        goto flush;
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                break;
        }
+skip_csum:
        return tcp_gro_receive(head, skb);
 }
-static int tcp6_gro_complete(struct sk_buff *skb)
+static int tcp6_gro_complete(struct sk_buff *skb, int thoff)
 {
        const struct ipv6hdr *iph = ipv6_hdr(skb);
        struct tcphdr *th = tcp_hdr(skb);
-        th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
+        th->check = ~tcp_v6_check(skb->len - thoff, &iph->saddr,
-                                  &iph->saddr, &iph->daddr, 0);
+                                  &iph->daddr, 0);
        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
        return tcp_gro_complete(skb);
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 4b0f50d9a962..2c4e4c5c7614 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -12,8 +12,7 @@
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Authors      Mitsuru KANDA  <mk@linux-ipv6.org>
 *              YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 81eb8cf8389b..fa9d988f4012 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -393,10 +393,10 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
        bool slow;
        if (flags & MSG_ERRQUEUE)
-                return ipv6_recv_error(sk, msg, len);
+                return ipv6_recv_error(sk, msg, len, addr_len);
        if (np->rxpmtu && np->rxopt.bits.rxpmtu)
-                return ipv6_recv_rxpmtu(sk, msg, len);
+                return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 try_again:
        skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
@@ -538,8 +538,11 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        if (sk == NULL)
                return;
-        if (type == ICMPV6_PKT_TOOBIG)
+        if (type == ICMPV6_PKT_TOOBIG) {
+                if (!ip6_sk_accept_pmtu(sk))
+                        goto out;
                ip6_sk_update_pmtu(skb, sk, info);
+        }
        if (type == NDISC_REDIRECT) {
                ip6_sk_redirect(skb, sk);
                goto out;
@@ -1140,7 +1143,6 @@ do_udp_sendmsg:
                                flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                                if (flowlabel == NULL)
                                        return -EINVAL;
-                                daddr = &flowlabel->dst;
                        }
                }
@@ -1221,7 +1223,7 @@ do_udp_sendmsg:
        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
-        dst = ip6_sk_dst_lookup_flow(sk, &fl6, final_p, true);
+        dst = ip6_sk_dst_lookup_flow(sk, &fl6, final_p);
        if (IS_ERR(dst)) {
                err = PTR_ERR(dst);
                dst = NULL;
diff --git a/net/ipv6/xfrm6_mode_ro.c b/net/ipv6/xfrm6_mode_ro.c
index 63d5d493098a..0e015906f9ca 100644
--- a/net/ipv6/xfrm6_mode_ro.c
+++ b/net/ipv6/xfrm6_mode_ro.c
@@ -15,8 +15,7 @@
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 /*
 * Authors:
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index de2bcfaaf759..1c66465a42dd 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -12,8 +12,7 @@
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 * Authors      Mitsuru KANDA  <mk@linux-ipv6.org>
 *              YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index de7db23049f1..73baf9b346b6 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -25,9 +25,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 *     Linux-IrDA now supports four different types of IrDA sockets:
 *
diff --git a/net/irda/discovery.c b/net/irda/discovery.c
index b0b56a339a83..6786e7f193d2 100644
--- a/net/irda/discovery.c
+++ b/net/irda/discovery.c
@@ -24,9 +24,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/irda/ircomm/ircomm_core.c b/net/irda/ircomm/ircomm_core.c
index b797daac063c..4490a675b1bb 100644
--- a/net/irda/ircomm/ircomm_core.c
+++ b/net/irda/ircomm/ircomm_core.c
@@ -23,9 +23,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/irda/ircomm/ircomm_event.c b/net/irda/ircomm/ircomm_event.c
index d78554fedbac..b172c6522328 100644
--- a/net/irda/ircomm/ircomm_event.c
+++ b/net/irda/ircomm/ircomm_event.c
@@ -22,9 +22,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/irda/ircomm/ircomm_lmp.c b/net/irda/ircomm/ircomm_lmp.c
index 3b8095c771d4..6536114adf37 100644
--- a/net/irda/ircomm/ircomm_lmp.c
+++ b/net/irda/ircomm/ircomm_lmp.c
@@ -24,9 +24,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/irda/ircomm/ircomm_param.c b/net/irda/ircomm/ircomm_param.c
index 308939128359..f80b1a6a244b 100644
--- a/net/irda/ircomm/ircomm_param.c
+++ b/net/irda/ircomm/ircomm_param.c
@@ -22,9 +22,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/irda/ircomm/ircomm_ttp.c b/net/irda/ircomm/ircomm_ttp.c
index 6e6509f22f60..d362d711b79c 100644
--- a/net/irda/ircomm/ircomm_ttp.c
+++ b/net/irda/ircomm/ircomm_ttp.c
@@ -23,9 +23,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 41ac7938268b..2ba8b9705bb7 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -24,9 +24,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/irda/ircomm/ircomm_tty_attach.c b/net/irda/ircomm/ircomm_tty_attach.c
index a2a508f5f268..2ee87bf387cc 100644
--- a/net/irda/ircomm/ircomm_tty_attach.c
+++ b/net/irda/ircomm/ircomm_tty_attach.c
@@ -23,9 +23,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/irda/ircomm/ircomm_tty_ioctl.c b/net/irda/ircomm/ircomm_tty_ioctl.c
index b343f50dc8d7..ce943853c38d 100644
--- a/net/irda/ircomm/ircomm_tty_ioctl.c
+++ b/net/irda/ircomm/ircomm_tty_ioctl.c
@@ -22,9 +22,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/irda/irda_device.c b/net/irda/irda_device.c
index 14653b8d664d..365b895da84b 100644
--- a/net/irda/irda_device.c
+++ b/net/irda/irda_device.c
@@ -23,9 +23,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/irda/irlap.c b/net/irda/irlap.c
index 005b424494a0..a778df55f5d6 100644
--- a/net/irda/irlap.c
+++ b/net/irda/irlap.c
@@ -23,9 +23,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/irda/parameters.c b/net/irda/parameters.c
index 71cd38c1a67f..6d0869716bf6 100644
--- a/net/irda/parameters.c
+++ b/net/irda/parameters.c
@@ -22,9 +22,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/irda/qos.c b/net/irda/qos.c
index 798ffd9a705e..11a7cc0cbc28 100644
--- a/net/irda/qos.c
+++ b/net/irda/qos.c
@@ -24,9 +24,7 @@
 *     GNU General Public License for more details.
 *
 *     You should have received a copy of the GNU General Public License
- *     along with this program; if not, write to the Free Software
+ *     along with this program; if not, see <http://www.gnu.org/licenses/>.
- *     Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- *     MA 02111-1307 USA
 *
 ********************************************************************/
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 545f047868ad..1a04c1329362 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1340,6 +1340,12 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
                max_spi = range->sadb_spirange_max;
        }
+        err = verify_spi_info(x->id.proto, min_spi, max_spi);
+        if (err) {
+                xfrm_state_put(x);
+                return err;
+        }
        err = xfrm_alloc_spi(x, min_spi, max_spi);
        resp_skb = err ? ERR_PTR(err) : pfkey_xfrm_state2msg(x);
@@ -1380,10 +1386,9 @@ static int pfkey_acquire(struct sock *sk, struct sk_buff *skb, const struct sadb
                return 0;
        spin_lock_bh(&x->lock);
-        if (x->km.state == XFRM_STATE_ACQ) {
+        if (x->km.state == XFRM_STATE_ACQ)
                x->km.state = XFRM_STATE_ERROR;
-                wake_up(&net->xfrm.km_waitq);
-        }
        spin_unlock_bh(&x->lock);
        xfrm_state_put(x);
        return 0;
@@ -1785,7 +1790,9 @@ static int pfkey_dump_sa(struct pfkey_sock *pfk)
 static void pfkey_dump_sa_done(struct pfkey_sock *pfk)
 {
-        xfrm_state_walk_done(&pfk->dump.u.state);
+        struct net *net = sock_net(&pfk->sk);
+        xfrm_state_walk_done(&pfk->dump.u.state, net);
 }
 static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
@@ -1861,7 +1868,7 @@ static u32 gen_reqid(struct net *net)
                        reqid = IPSEC_MANUAL_REQID_MAX+1;
                xfrm_policy_walk_init(&walk, XFRM_POLICY_TYPE_MAIN);
                rc = xfrm_policy_walk(net, &walk, check_reqid, (void*)&reqid);
-                xfrm_policy_walk_done(&walk);
+                xfrm_policy_walk_done(&walk, net);
                if (rc != -EEXIST)
                        return reqid;
        } while (reqid != start);
@@ -2485,6 +2492,7 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
        struct xfrm_selector sel;
        struct xfrm_migrate m[XFRM_MAX_DEPTH];
        struct xfrm_kmaddress k;
+        struct net *net = sock_net(sk);
        if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
                                     ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
@@ -2558,7 +2566,7 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
        }
        return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i,
-                            kma ? &k : NULL);
+                            kma ? &k : NULL, net);
 out:
        return err;
@@ -2659,7 +2667,9 @@ static int pfkey_dump_sp(struct pfkey_sock *pfk)
 static void pfkey_dump_sp_done(struct pfkey_sock *pfk)
 {
-        xfrm_policy_walk_done(&pfk->dump.u.policy);
+        struct net *net = sock_net((struct sock *)pfk);
+        xfrm_policy_walk_done(&pfk->dump.u.policy, net);
 }
 static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, const struct sadb_msg *hdr, void * const *ext_hdrs)
@@ -3569,6 +3579,7 @@ static int pfkey_sendmsg(struct kiocb *kiocb,
        struct sk_buff *skb = NULL;
        struct sadb_msg *hdr = NULL;
        int err;
+        struct net *net = sock_net(sk);
        err = -EOPNOTSUPP;
        if (msg->msg_flags & MSG_OOB)
@@ -3591,9 +3602,9 @@ static int pfkey_sendmsg(struct kiocb *kiocb,
        if (!hdr)
                goto out;
-        mutex_lock(&xfrm_cfg_mutex);
+        mutex_lock(&net->xfrm.xfrm_cfg_mutex);
        err = pfkey_process(sk, skb, hdr);
-        mutex_unlock(&xfrm_cfg_mutex);
+        mutex_unlock(&net->xfrm.xfrm_cfg_mutex);
 out:
        if (err && hdr && pfkey_error(hdr, err, sk) == 0)
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index cfd65304be60..29487a8f7fa0 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -528,7 +528,6 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk,
                                flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                                if (flowlabel == NULL)
                                        return -EINVAL;
-                                daddr = &flowlabel->dst;
                        }
                }
@@ -598,7 +597,7 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk,
        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
-        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
        if (IS_ERR(dst)) {
                err = PTR_ERR(dst);
                goto out;
@@ -665,7 +664,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                *addr_len = sizeof(*lsa);
        if (flags & MSG_ERRQUEUE)
-                return ipv6_recv_error(sk, msg, len);
+                return ipv6_recv_error(sk, msg, len, addr_len);
        skb = skb_recv_datagram(sk, flags, noblock, &err);
        if (!skb)
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index cd8724177965..42dc2e45c921 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -753,7 +753,7 @@ void llc_sap_remove_socket(struct llc_sap *sap, struct sock *sk)
 *
 *      Sends received pdus to the connection state machine.
 */
-static int llc_conn_rcv(struct sock* sk, struct sk_buff *skb)
+static int llc_conn_rcv(struct sock *sk, struct sk_buff *skb)
 {
        struct llc_conn_state_ev *ev = llc_conn_ev(skb);
@@ -891,7 +891,7 @@ out_kfree_skb:
 *
 *     Initializes a socket with default llc values.
 */
-static void llc_sk_init(struct sock* sk)
+static void llc_sk_init(struct sock *sk)
 {
        struct llc_sock *llc = llc_sk(sk);
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index 2bb0ddff8c0f..e251c0493ac0 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -48,7 +48,7 @@ static struct llc_sap *llc_sap_alloc(void)
 static struct llc_sap *__llc_sap_find(unsigned char sap_value)
 {
-        struct llc_sap* sap;
+        struct llc_sap *sap;
        list_for_each_entry(sap, &llc_sap_list, node)
                if (sap->laddr.lsap == sap_value)
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index e5850699098e..06033f6c845f 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -66,7 +66,7 @@ struct sk_buff *llc_alloc_frame(struct sock *sk, struct net_device *dev,
        return skb;
 }
-void llc_save_primitive(struct sock *sk, struct sk_buff* skb, u8 prim)
+void llc_save_primitive(struct sock *sk, struct sk_buff *skb, u8 prim)
 {
        struct sockaddr_llc *addr;
@@ -114,7 +114,7 @@ void llc_sap_rtn_pdu(struct llc_sap *sap, struct sk_buff *skb)
 *      failure.
 */
 static struct llc_sap_state_trans *llc_find_sap_trans(struct llc_sap *sap,
-                                                      struct sk_buff* skb)
+                                                      struct sk_buff *skb)
 {
        int i = 0;
        struct llc_sap_state_trans *rc = NULL;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 3d2168c3269e..d624ed49a7d9 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1476,8 +1476,8 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
                        bool used = false;
                        list_for_each_entry(sdata, &local->interfaces, list) {
-                                if (memcmp(local->hw.wiphy->addresses[i].addr,
+                                if (ether_addr_equal(local->hw.wiphy->addresses[i].addr,
-                                           sdata->vif.addr, ETH_ALEN) == 0) {
+                                                     sdata->vif.addr)) {
                                        used = true;
                                        break;
                                }
@@ -1537,8 +1537,7 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
                        val += inc;
                        list_for_each_entry(sdata, &local->interfaces, list) {
-                                if (memcmp(tmp_addr, sdata->vif.addr,
+                                if (ether_addr_equal(tmp_addr, sdata->vif.addr)) {
-                                                        ETH_ALEN) == 0) {
                                        used = true;
                                        break;
                                }
diff --git a/net/mac802154/wpan.c b/net/mac802154/wpan.c
index e24bcf977296..372d8a222b91 100644
--- a/net/mac802154/wpan.c
+++ b/net/mac802154/wpan.c
@@ -444,8 +444,8 @@ mac802154_subif_frame(struct mac802154_sub_if_data *sdata, struct sk_buff *skb)
        case IEEE802154_FC_TYPE_DATA:
                return mac802154_process_data(sdata->dev, skb);
        default:
-                pr_warning("ieee802154: bad frame received (type = %d)\n",
+                pr_warn("ieee802154: bad frame received (type = %d)\n",
-                           mac_cb_type(skb));
+                        mac_cb_type(skb));
                kfree_skb(skb);
                return NET_RX_DROP;
        }
diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c
index 2bc2dec20b00..6226803fc490 100644
--- a/net/netfilter/ipset/ip_set_hash_netnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netnet.c
@@ -59,7 +59,7 @@ hash_netnet4_data_equal(const struct hash_netnet4_elem *ip1,
                     u32 *multi)
 {
        return ip1->ipcmp == ip2->ipcmp &&
-               ip2->ccmp == ip2->ccmp;
+               ip1->ccmp == ip2->ccmp;
 }
 static inline int
diff --git a/net/netfilter/ipvs/ip_vs_nfct.c b/net/netfilter/ipvs/ip_vs_nfct.c
index c8beafd401aa..d5f41514f577 100644
--- a/net/netfilter/ipvs/ip_vs_nfct.c
+++ b/net/netfilter/ipvs/ip_vs_nfct.c
@@ -19,8 +19,7 @@
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 *
 * Authors:
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index dcddc49c0e08..f93b7d06f4be 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1717,6 +1717,19 @@ nf_tables_delrule_one(struct nft_ctx *ctx, struct nft_rule *rule)
        return -ENOENT;
 }
+static int nf_table_delrule_by_chain(struct nft_ctx *ctx)
+{
+        struct nft_rule *rule;
+        int err;
+        list_for_each_entry(rule, &ctx->chain->rules, list) {
+                err = nf_tables_delrule_one(ctx, rule);
+                if (err < 0)
+                        return err;
+        }
+        return 0;
+}
 static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
                             const struct nlmsghdr *nlh,
                             const struct nlattr * const nla[])
@@ -1725,8 +1738,8 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
        const struct nft_af_info *afi;
        struct net *net = sock_net(skb->sk);
        const struct nft_table *table;
-        struct nft_chain *chain;
+        struct nft_chain *chain = NULL;
-        struct nft_rule *rule, *tmp;
+        struct nft_rule *rule;
        int family = nfmsg->nfgen_family, err = 0;
        struct nft_ctx ctx;
@@ -1738,22 +1751,29 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
        if (IS_ERR(table))
                return PTR_ERR(table);
-        chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
+        if (nla[NFTA_RULE_CHAIN]) {
-        if (IS_ERR(chain))
+                chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
-                return PTR_ERR(chain);
+                if (IS_ERR(chain))
+                        return PTR_ERR(chain);
+        }
        nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
-        if (nla[NFTA_RULE_HANDLE]) {
+        if (chain) {
-                rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
+                if (nla[NFTA_RULE_HANDLE]) {
-                if (IS_ERR(rule))
+                        rule = nf_tables_rule_lookup(chain,
-                        return PTR_ERR(rule);
+                                                     nla[NFTA_RULE_HANDLE]);
+                        if (IS_ERR(rule))
+                                return PTR_ERR(rule);
-                err = nf_tables_delrule_one(&ctx, rule);
-        } else {
-                /* Remove all rules in this chain */
-                list_for_each_entry_safe(rule, tmp, &chain->rules, list) {
                        err = nf_tables_delrule_one(&ctx, rule);
+                } else {
+                        err = nf_table_delrule_by_chain(&ctx);
+                }
+        } else {
+                list_for_each_entry(chain, &table->chains, list) {
+                        ctx.chain = chain;
+                        err = nf_table_delrule_by_chain(&ctx);
                        if (err < 0)
                                break;
                }
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 7278145e6a68..69f78e96fdb4 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -17,8 +17,7 @@
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 #include <linux/module.h>
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 9ff035c71403..a3910fc2122b 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -325,21 +325,24 @@ static void htable_gc(unsigned long htlong)
        add_timer(&ht->timer);
 }
-static void htable_destroy(struct xt_hashlimit_htable *hinfo)
+static void htable_remove_proc_entry(struct xt_hashlimit_htable *hinfo)
 {
        struct hashlimit_net *hashlimit_net = hashlimit_pernet(hinfo->net);
        struct proc_dir_entry *parent;
-        del_timer_sync(&hinfo->timer);
        if (hinfo->family == NFPROTO_IPV4)
                parent = hashlimit_net->ipt_hashlimit;
        else
                parent = hashlimit_net->ip6t_hashlimit;
-        if(parent != NULL)
+        if (parent != NULL)
                remove_proc_entry(hinfo->name, parent);
+}
+static void htable_destroy(struct xt_hashlimit_htable *hinfo)
+{
+        del_timer_sync(&hinfo->timer);
+        htable_remove_proc_entry(hinfo);
        htable_selective_cleanup(hinfo, select_all);
        kfree(hinfo->name);
        vfree(hinfo);
@@ -883,21 +886,15 @@ static int __net_init hashlimit_proc_net_init(struct net *net)
 static void __net_exit hashlimit_proc_net_exit(struct net *net)
 {
        struct xt_hashlimit_htable *hinfo;
-        struct proc_dir_entry *pde;
        struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
-        /* recent_net_exit() is called before recent_mt_destroy(). Make sure
+        /* hashlimit_net_exit() is called before hashlimit_mt_destroy().
-         * that the parent xt_recent proc entry is is empty before trying to
+         * Make sure that the parent ipt_hashlimit and ip6t_hashlimit proc
-         * remove it.
+         * entries is empty before trying to remove it.
         */
        mutex_lock(&hashlimit_mutex);
-        pde = hashlimit_net->ipt_hashlimit;
-        if (pde == NULL)
-                pde = hashlimit_net->ip6t_hashlimit;
        hlist_for_each_entry(hinfo, &hashlimit_net->htables, node)
-                remove_proc_entry(hinfo->name, pde);
+                htable_remove_proc_entry(hinfo);
        hashlimit_net->ipt_hashlimit = NULL;
        hashlimit_net->ip6t_hashlimit = NULL;
        mutex_unlock(&hashlimit_mutex);
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 647d989a01e6..7174611bd672 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -13,8 +13,7 @@
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
diff --git a/net/netlabel/netlabel_addrlist.c b/net/netlabel/netlabel_addrlist.c
index 6f1701322fb6..d0a3acfa5742 100644
--- a/net/netlabel/netlabel_addrlist.c
+++ b/net/netlabel/netlabel_addrlist.c
@@ -24,8 +24,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlabel/netlabel_addrlist.h b/net/netlabel/netlabel_addrlist.h
index a1287ce18130..d0f38bc9af6d 100644
--- a/net/netlabel/netlabel_addrlist.h
+++ b/net/netlabel/netlabel_addrlist.h
@@ -24,8 +24,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 69345cebe3a3..c2f2a53a4879 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -23,8 +23,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlabel/netlabel_cipso_v4.h b/net/netlabel/netlabel_cipso_v4.h
index d24d774bfd62..875826808b00 100644
--- a/net/netlabel/netlabel_cipso_v4.h
+++ b/net/netlabel/netlabel_cipso_v4.h
@@ -23,8 +23,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index 85d842e6e431..f0cb92f3ddaf 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -24,8 +24,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlabel/netlabel_domainhash.h b/net/netlabel/netlabel_domainhash.h
index b9be0eed8980..680caf4dff56 100644
--- a/net/netlabel/netlabel_domainhash.h
+++ b/net/netlabel/netlabel_domainhash.h
@@ -24,8 +24,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index dce1bebf7aec..3045a964f39c 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -23,8 +23,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index 8ef83ee97c6a..e66e977ef2fa 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -23,8 +23,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlabel/netlabel_mgmt.h b/net/netlabel/netlabel_mgmt.h
index 5a9f31ce5799..8b6e1ab62b48 100644
--- a/net/netlabel/netlabel_mgmt.h
+++ b/net/netlabel/netlabel_mgmt.h
@@ -23,8 +23,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 43817d73ccf9..78a63c18779e 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -23,8 +23,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlabel/netlabel_unlabeled.h b/net/netlabel/netlabel_unlabeled.h
index 700af49022a0..3a9e5dc9511b 100644
--- a/net/netlabel/netlabel_unlabeled.h
+++ b/net/netlabel/netlabel_unlabeled.h
@@ -23,8 +23,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c
index 9650c4ad5f88..1e779bb7fa43 100644
--- a/net/netlabel/netlabel_user.c
+++ b/net/netlabel/netlabel_user.c
@@ -23,8 +23,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlabel/netlabel_user.h b/net/netlabel/netlabel_user.h
index 81969785e279..4a397cde1a48 100644
--- a/net/netlabel/netlabel_user.h
+++ b/net/netlabel/netlabel_user.h
@@ -23,8 +23,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index bca50b95c182..3f75f1cd9eb3 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -204,6 +204,8 @@ static int __netlink_deliver_tap_skb(struct sk_buff *skb,
        if (nskb) {
                nskb->dev = dev;
                nskb->protocol = htons((u16) sk->sk_protocol);
+                nskb->pkt_type = netlink_is_kernel(sk) ?
+                                 PACKET_KERNEL : PACKET_USER;
                ret = dev_queue_xmit(nskb);
                if (unlikely(ret > 0))
@@ -239,6 +241,13 @@ static void netlink_deliver_tap(struct sk_buff *skb)
        rcu_read_unlock();
 }
+static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src,
+                                       struct sk_buff *skb)
+{
+        if (!(netlink_is_kernel(dst) && netlink_is_kernel(src)))
+                netlink_deliver_tap(skb);
+}
 static void netlink_overrun(struct sock *sk)
 {
        struct netlink_sock *nlk = nlk_sk(sk);
@@ -1697,14 +1706,10 @@ static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
        ret = -ECONNREFUSED;
        if (nlk->netlink_rcv != NULL) {
-                /* We could do a netlink_deliver_tap(skb) here as well
-                 * but since this is intended for the kernel only, we
-                 * should rather let it stay under the hood.
-                 */
                ret = skb->len;
                netlink_skb_set_owner_r(skb, sk);
                NETLINK_CB(skb).sk = ssk;
+                netlink_deliver_tap_kernel(sk, ssk, skb);
                nlk->netlink_rcv(skb);
                consume_skb(skb);
        } else {
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 4518a57aa5fe..713671ae45af 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -74,9 +74,12 @@ static struct list_head family_ht[GENL_FAM_TAB_SIZE];
 * Bit 17 is marked as already used since the VFS quota code
 * also abused this API and relied on family == group ID, we
 * cater to that by giving it a static family and group ID.
+ * Bit 18 is marked as already used since the PMCRAID driver
+ * did the same thing as the VFS quota code (maybe copied?)
 */
 static unsigned long mc_group_start = 0x3 | BIT(GENL_ID_CTRL) |
-                                      BIT(GENL_ID_VFS_DQUOT);
+                                      BIT(GENL_ID_VFS_DQUOT) |
+                                      BIT(GENL_ID_PMCRAID);
 static unsigned long *mc_groups = &mc_group_start;
 static unsigned long mc_groups_longs = 1;
@@ -139,6 +142,7 @@ static u16 genl_generate_id(void)
        for (i = 0; i <= GENL_MAX_ID - GENL_MIN_ID; i++) {
                if (id_gen_idx != GENL_ID_VFS_DQUOT &&
+                    id_gen_idx != GENL_ID_PMCRAID &&
                    !genl_family_find_byid(id_gen_idx))
                        return id_gen_idx;
                if (++id_gen_idx > GENL_MAX_ID)
@@ -214,7 +218,7 @@ static int genl_validate_assign_mc_groups(struct genl_family *family)
 {
        int first_id;
        int n_groups = family->n_mcgrps;
-        int err, i;
+        int err = 0, i;
        bool groups_allocated = false;
        if (!n_groups)
@@ -236,9 +240,12 @@ static int genl_validate_assign_mc_groups(struct genl_family *family)
        } else if (strcmp(family->name, "NET_DM") == 0) {
                first_id = 1;
                BUG_ON(n_groups != 1);
-        } else if (strcmp(family->name, "VFS_DQUOT") == 0) {
+        } else if (family->id == GENL_ID_VFS_DQUOT) {
                first_id = GENL_ID_VFS_DQUOT;
                BUG_ON(n_groups != 1);
+        } else if (family->id == GENL_ID_PMCRAID) {
+                first_id = GENL_ID_PMCRAID;
+                BUG_ON(n_groups != 1);
        } else {
                groups_allocated = true;
                err = genl_allocate_reserve_groups(n_groups, &first_id);
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 65cfaa816075..716b7eebfe70 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -165,7 +165,7 @@ static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh,
        }
        csum_replace4(&nh->check, *addr, new_addr);
-        skb->rxhash = 0;
+        skb_clear_hash(skb);
        *addr = new_addr;
 }
@@ -199,7 +199,7 @@ static void set_ipv6_addr(struct sk_buff *skb, u8 l4_proto,
        if (recalculate_csum)
                update_ipv6_checksum(skb, l4_proto, addr, new_addr);
-        skb->rxhash = 0;
+        skb_clear_hash(skb);
        memcpy(addr, new_addr, sizeof(__be32[4]));
 }
@@ -296,7 +296,7 @@ static void set_tp_port(struct sk_buff *skb, __be16 *port,
 {
        inet_proto_csum_replace2(check, skb, *port, new_port, 0);
        *port = new_port;
-        skb->rxhash = 0;
+        skb_clear_hash(skb);
 }
 static void set_udp_port(struct sk_buff *skb, __be16 *port, __be16 new_port)
@@ -310,7 +310,7 @@ static void set_udp_port(struct sk_buff *skb, __be16 *port, __be16 new_port)
                        uh->check = CSUM_MANGLED_0;
        } else {
                *port = new_port;
-                skb->rxhash = 0;
+                skb_clear_hash(skb);
        }
 }
@@ -381,7 +381,7 @@ static int set_sctp(struct sk_buff *skb,
                /* Carry any checksum errors through. */
                sh->checksum = old_csum ^ old_correct_csum ^ new_csum;
-                skb->rxhash = 0;
+                skb_clear_hash(skb);
        }
        return 0;
diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
index e42542706087..0e720c316070 100644
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -25,7 +25,7 @@
 #include <linux/if_vlan.h>
 #include <net/llc_pdu.h>
 #include <linux/kernel.h>
-#include <linux/jhash.h>
+#include <linux/hash.h>
 #include <linux/jiffies.h>
 #include <linux/llc.h>
 #include <linux/module.h>
@@ -362,7 +362,7 @@ static u32 flow_hash(const struct sw_flow_key *key, int key_start,
        /* Make sure number of hash bytes are multiple of u32. */
        BUILD_BUG_ON(sizeof(long) % sizeof(u32));
-        return jhash2(hash_key, hash_u32s, 0);
+        return arch_fast_hash2(hash_key, hash_u32s, 0);
 }
 static int flow_key_start(const struct sw_flow_key *key)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index ac27c86ef6d1..279467b74eb7 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -237,6 +237,82 @@ struct packet_skb_cb {
 static void __fanout_unlink(struct sock *sk, struct packet_sock *po);
 static void __fanout_link(struct sock *sk, struct packet_sock *po);
+static int packet_direct_xmit(struct sk_buff *skb)
+{
+        struct net_device *dev = skb->dev;
+        const struct net_device_ops *ops = dev->netdev_ops;
+        netdev_features_t features;
+        struct netdev_queue *txq;
+        u16 queue_map;
+        int ret;
+        if (unlikely(!netif_running(dev) ||
+                     !netif_carrier_ok(dev))) {
+                kfree_skb(skb);
+                return NET_XMIT_DROP;
+        }
+        features = netif_skb_features(skb);
+        if (skb_needs_linearize(skb, features) &&
+            __skb_linearize(skb)) {
+                kfree_skb(skb);
+                return NET_XMIT_DROP;
+        }
+        queue_map = skb_get_queue_mapping(skb);
+        txq = netdev_get_tx_queue(dev, queue_map);
+        __netif_tx_lock_bh(txq);
+        if (unlikely(netif_xmit_frozen_or_stopped(txq))) {
+                ret = NETDEV_TX_BUSY;
+                kfree_skb(skb);
+                goto out;
+        }
+        ret = ops->ndo_start_xmit(skb, dev);
+        if (likely(dev_xmit_complete(ret)))
+                txq_trans_update(txq);
+        else
+                kfree_skb(skb);
+out:
+        __netif_tx_unlock_bh(txq);
+        return ret;
+}
+static struct net_device *packet_cached_dev_get(struct packet_sock *po)
+{
+        struct net_device *dev;
+        rcu_read_lock();
+        dev = rcu_dereference(po->cached_dev);
+        if (likely(dev))
+                dev_hold(dev);
+        rcu_read_unlock();
+        return dev;
+}
+static void packet_cached_dev_assign(struct packet_sock *po,
+                                     struct net_device *dev)
+{
+        rcu_assign_pointer(po->cached_dev, dev);
+}
+static void packet_cached_dev_reset(struct packet_sock *po)
+{
+        RCU_INIT_POINTER(po->cached_dev, NULL);
+}
+static bool packet_use_direct_xmit(const struct packet_sock *po)
+{
+        return po->xmit == packet_direct_xmit;
+}
+static u16 packet_pick_tx_queue(struct net_device *dev)
+{
+        return (u16) raw_smp_processor_id() % dev->real_num_tx_queues;
+}
 /* register_prot_hook must be invoked with the po->bind_lock held,
 * or from a context in which asynchronous accesses to the packet
 * socket is not possible (packet_create()).
@@ -246,12 +322,10 @@ static void register_prot_hook(struct sock *sk)
        struct packet_sock *po = pkt_sk(sk);
        if (!po->running) {
-                if (po->fanout) {
+                if (po->fanout)
                        __fanout_link(sk, po);
-                } else {
+                else
                        dev_add_pack(&po->prot_hook);
-                        rcu_assign_pointer(po->cached_dev, po->prot_hook.dev);
-                }
                sock_hold(sk);
                po->running = 1;
@@ -270,12 +344,11 @@ static void __unregister_prot_hook(struct sock *sk, bool sync)
        struct packet_sock *po = pkt_sk(sk);
        po->running = 0;
-        if (po->fanout) {
+        if (po->fanout)
                __fanout_unlink(sk, po);
-        } else {
+        else
                __dev_remove_pack(&po->prot_hook);
-                RCU_INIT_POINTER(po->cached_dev, NULL);
-        }
        __sock_put(sk);
@@ -437,11 +510,12 @@ static void prb_shutdown_retire_blk_timer(struct packet_sock *po,
 {
        struct tpacket_kbdq_core *pkc;
-        pkc = tx_ring ? &po->tx_ring.prb_bdqc : &po->rx_ring.prb_bdqc;
+        pkc = tx_ring ? GET_PBDQC_FROM_RB(&po->tx_ring) :
+                        GET_PBDQC_FROM_RB(&po->rx_ring);
-        spin_lock(&rb_queue->lock);
+        spin_lock_bh(&rb_queue->lock);
        pkc->delete_blk_timer = 1;
-        spin_unlock(&rb_queue->lock);
+        spin_unlock_bh(&rb_queue->lock);
        prb_del_retire_blk_timer(pkc);
 }
@@ -463,7 +537,8 @@ static void prb_setup_retire_blk_timer(struct packet_sock *po, int tx_ring)
        if (tx_ring)
                BUG();
-        pkc = tx_ring ? &po->tx_ring.prb_bdqc : &po->rx_ring.prb_bdqc;
+        pkc = tx_ring ? GET_PBDQC_FROM_RB(&po->tx_ring) :
+                        GET_PBDQC_FROM_RB(&po->rx_ring);
        prb_init_blk_timer(po, pkc, prb_retire_rx_blk_timer_expired);
 }
@@ -521,7 +596,7 @@ static void init_prb_bdqc(struct packet_sock *po,
                        struct pgv *pg_vec,
                        union tpacket_req_u *req_u, int tx_ring)
 {
-        struct tpacket_kbdq_core *p1 = &rb->prb_bdqc;
+        struct tpacket_kbdq_core *p1 = GET_PBDQC_FROM_RB(rb);
        struct tpacket_block_desc *pbd;
        memset(p1, 0x0, sizeof(*p1));
@@ -585,7 +660,7 @@ static void _prb_refresh_rx_retire_blk_timer(struct tpacket_kbdq_core *pkc)
 static void prb_retire_rx_blk_timer_expired(unsigned long data)
 {
        struct packet_sock *po = (struct packet_sock *)data;
-        struct tpacket_kbdq_core *pkc = &po->rx_ring.prb_bdqc;
+        struct tpacket_kbdq_core *pkc = GET_PBDQC_FROM_RB(&po->rx_ring);
        unsigned int frozen;
        struct tpacket_block_desc *pbd;
@@ -888,7 +963,7 @@ static void prb_clear_blk_fill_status(struct packet_ring_buffer *rb)
 static void prb_fill_rxhash(struct tpacket_kbdq_core *pkc,
                        struct tpacket3_hdr *ppd)
 {
-        ppd->hv1.tp_rxhash = skb_get_rxhash(pkc->skb);
+        ppd->hv1.tp_rxhash = skb_get_hash(pkc->skb);
 }
 static void prb_clear_rxhash(struct tpacket_kbdq_core *pkc,
@@ -902,9 +977,11 @@ static void prb_fill_vlan_info(struct tpacket_kbdq_core *pkc,
 {
        if (vlan_tx_tag_present(pkc->skb)) {
                ppd->hv1.tp_vlan_tci = vlan_tx_tag_get(pkc->skb);
-                ppd->tp_status = TP_STATUS_VLAN_VALID;
+                ppd->hv1.tp_vlan_tpid = ntohs(pkc->skb->vlan_proto);
+                ppd->tp_status = TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID;
        } else {
                ppd->hv1.tp_vlan_tci = 0;
+                ppd->hv1.tp_vlan_tpid = 0;
                ppd->tp_status = TP_STATUS_AVAILABLE;
        }
 }
@@ -912,6 +989,7 @@ static void prb_fill_vlan_info(struct tpacket_kbdq_core *pkc,
 static void prb_run_all_ft_ops(struct tpacket_kbdq_core *pkc,
                        struct tpacket3_hdr *ppd)
 {
+        ppd->hv1.tp_padding = 0;
        prb_fill_vlan_info(pkc, ppd);
        if (pkc->feature_req_word & TP_FT_REQ_FILL_RXHASH)
@@ -1220,7 +1298,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
                        if (!skb)
                                return 0;
                }
-                skb_get_rxhash(skb);
+                skb_get_hash(skb);
                idx = fanout_demux_hash(f, skb, num);
                break;
        case PACKET_FANOUT_LB:
@@ -1278,9 +1356,9 @@ static void __fanout_unlink(struct sock *sk, struct packet_sock *po)
        spin_unlock(&f->lock);
 }
-static bool match_fanout_group(struct packet_type *ptype, struct sock * sk)
+static bool match_fanout_group(struct packet_type *ptype, struct sock *sk)
 {
-        if (ptype->af_packet_priv == (void*)((struct packet_sock *)sk)->fanout)
+        if (ptype->af_packet_priv == (void *)((struct packet_sock *)sk)->fanout)
                return true;
        return false;
@@ -1737,6 +1815,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
        struct timespec ts;
        __u32 ts_status;
+        /* struct tpacket{2,3}_hdr is aligned to a multiple of TPACKET_ALIGNMENT.
+         * We may add members to them until current aligned size without forcing
+         * userspace to call getsockopt(..., PACKET_HDRLEN, ...).
+         */
+        BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h2)) != 32);
+        BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h3)) != 48);
        if (skb->pkt_type == PACKET_LOOPBACK)
                goto drop;
@@ -1843,11 +1928,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
                h.h2->tp_nsec = ts.tv_nsec;
                if (vlan_tx_tag_present(skb)) {
                        h.h2->tp_vlan_tci = vlan_tx_tag_get(skb);
-                        status |= TP_STATUS_VLAN_VALID;
+                        h.h2->tp_vlan_tpid = ntohs(skb->vlan_proto);
+                        status |= TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID;
                } else {
                        h.h2->tp_vlan_tci = 0;
+                        h.h2->tp_vlan_tpid = 0;
                }
-                h.h2->tp_padding = 0;
+                memset(h.h2->tp_padding, 0, sizeof(h.h2->tp_padding));
                hdrlen = sizeof(*h.h2);
                break;
        case TPACKET_V3:
@@ -1861,6 +1948,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
                h.h3->tp_net = netoff;
                h.h3->tp_sec  = ts.tv_sec;
                h.h3->tp_nsec = ts.tv_nsec;
+                memset(h.h3->tp_padding, 0, sizeof(h.h3->tp_padding));
                hdrlen = sizeof(*h.h3);
                break;
        default:
@@ -1971,9 +2059,10 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
        skb_reserve(skb, hlen);
        skb_reset_network_header(skb);
-        skb_probe_transport_header(skb, 0);
-        if (po->tp_tx_has_off) {
+        if (!packet_use_direct_xmit(po))
+                skb_probe_transport_header(skb, 0);
+        if (unlikely(po->tp_tx_has_off)) {
                int off_min, off_max, off;
                off_min = po->tp_hdrlen - sizeof(struct sockaddr_ll);
                off_max = po->tx_ring.frame_size - tp_len;
@@ -2059,19 +2148,6 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
        return tp_len;
 }
-static struct net_device *packet_cached_dev_get(struct packet_sock *po)
-{
-        struct net_device *dev;
-        rcu_read_lock();
-        dev = rcu_dereference(po->cached_dev);
-        if (dev)
-                dev_hold(dev);
-        rcu_read_unlock();
-        return dev;
-}
 static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 {
        struct sk_buff *skb;
@@ -2088,7 +2164,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
        mutex_lock(&po->pg_vec_lock);
-        if (saddr == NULL) {
+        if (likely(saddr == NULL)) {
                dev     = packet_cached_dev_get(po);
                proto   = po->num;
                addr    = NULL;
@@ -2156,12 +2232,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                        }
                }
+                skb_set_queue_mapping(skb, packet_pick_tx_queue(dev));
                skb->destructor = tpacket_destruct_skb;
                __packet_set_status(po, ph, TP_STATUS_SENDING);
                atomic_inc(&po->tx_ring.pending);
                status = TP_STATUS_SEND_REQUEST;
-                err = dev_queue_xmit(skb);
+                err = po->xmit(skb);
                if (unlikely(err > 0)) {
                        err = net_xmit_errno(err);
                        if (err && __packet_get_status(po, ph) ==
@@ -2220,8 +2297,7 @@ static struct sk_buff *packet_alloc_skb(struct sock *sk, size_t prepad,
        return skb;
 }
-static int packet_snd(struct socket *sock,
+static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
-                          struct msghdr *msg, size_t len)
 {
        struct sock *sk = sock->sk;
        struct sockaddr_ll *saddr = (struct sockaddr_ll *)msg->msg_name;
@@ -2242,7 +2318,7 @@ static int packet_snd(struct socket *sock,
         *      Get and verify the address.
         */
-        if (saddr == NULL) {
+        if (likely(saddr == NULL)) {
                dev     = packet_cached_dev_get(po);
                proto   = po->num;
                addr    = NULL;
@@ -2366,6 +2442,7 @@ static int packet_snd(struct socket *sock,
        skb->dev = dev;
        skb->priority = sk->sk_priority;
        skb->mark = sk->sk_mark;
+        skb_set_queue_mapping(skb, packet_pick_tx_queue(dev));
        if (po->has_vnet_hdr) {
                if (vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
@@ -2386,16 +2463,12 @@ static int packet_snd(struct socket *sock,
                len += vnet_hdr_len;
        }
-        skb_probe_transport_header(skb, reserve);
+        if (!packet_use_direct_xmit(po))
+                skb_probe_transport_header(skb, reserve);
        if (unlikely(extra_len == 4))
                skb->no_fcs = 1;
-        /*
+        err = po->xmit(skb);
-         *      Now send it
-         */
-        err = dev_queue_xmit(skb);
        if (err > 0 && (err = net_xmit_errno(err)) != 0)
                goto out_unlock;
@@ -2417,6 +2490,7 @@ static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
 {
        struct sock *sk = sock->sk;
        struct packet_sock *po = pkt_sk(sk);
        if (po->tx_ring.pg_vec)
                return tpacket_snd(po, msg);
        else
@@ -2451,6 +2525,8 @@ static int packet_release(struct socket *sock)
        spin_lock(&po->bind_lock);
        unregister_prot_hook(sk, false);
+        packet_cached_dev_reset(po);
        if (po->prot_hook.dev) {
                dev_put(po->prot_hook.dev);
                po->prot_hook.dev = NULL;
@@ -2506,14 +2582,17 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protoc
        spin_lock(&po->bind_lock);
        unregister_prot_hook(sk, true);
        po->num = protocol;
        po->prot_hook.type = protocol;
        if (po->prot_hook.dev)
                dev_put(po->prot_hook.dev);
-        po->prot_hook.dev = dev;
+        po->prot_hook.dev = dev;
        po->ifindex = dev ? dev->ifindex : 0;
+        packet_cached_dev_assign(po, dev);
        if (protocol == 0)
                goto out_unlock;
@@ -2626,7 +2705,9 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
        po = pkt_sk(sk);
        sk->sk_family = PF_PACKET;
        po->num = proto;
-        RCU_INIT_POINTER(po->cached_dev, NULL);
+        po->xmit = dev_queue_xmit;
+        packet_cached_dev_reset(po);
        sk->sk_destruct = packet_sock_destruct;
        sk_refcnt_debug_inc(sk);
@@ -2799,11 +2880,12 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
                aux.tp_net = skb_network_offset(skb);
                if (vlan_tx_tag_present(skb)) {
                        aux.tp_vlan_tci = vlan_tx_tag_get(skb);
-                        aux.tp_status |= TP_STATUS_VLAN_VALID;
+                        aux.tp_vlan_tpid = ntohs(skb->vlan_proto);
+                        aux.tp_status |= TP_STATUS_VLAN_VALID | TP_STATUS_VLAN_TPID_VALID;
                } else {
                        aux.tp_vlan_tci = 0;
+                        aux.tp_vlan_tpid = 0;
                }
-                aux.tp_padding = 0;
                put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
        }
@@ -3204,6 +3286,18 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                po->tp_tx_has_off = !!val;
                return 0;
        }
+        case PACKET_QDISC_BYPASS:
+        {
+                int val;
+                if (optlen != sizeof(val))
+                        return -EINVAL;
+                if (copy_from_user(&val, optval, sizeof(val)))
+                        return -EFAULT;
+                po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
+                return 0;
+        }
        default:
                return -ENOPROTOOPT;
        }
@@ -3296,6 +3390,9 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
        case PACKET_TX_HAS_OFF:
                val = po->tp_tx_has_off;
                break;
+        case PACKET_QDISC_BYPASS:
+                val = packet_use_direct_xmit(po);
+                break;
        default:
                return -ENOPROTOOPT;
        }
@@ -3337,6 +3434,7 @@ static int packet_notifier(struct notifier_block *this,
                                                sk->sk_error_report(sk);
                                }
                                if (msg == NETDEV_UNREGISTER) {
+                                        packet_cached_dev_reset(po);
                                        po->ifindex = -1;
                                        if (po->prot_hook.dev)
                                                dev_put(po->prot_hook.dev);
diff --git a/net/packet/internal.h b/net/packet/internal.h
index 1035fa2d909c..0a87d7b36c9e 100644
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -114,6 +114,7 @@ struct packet_sock {
        unsigned int            tp_tx_has_off:1;
        unsigned int            tp_tstamp;
        struct net_device __rcu *cached_dev;
+        int                     (*xmit)(struct sk_buff *skb);
        struct packet_type      prot_hook ____cacheline_aligned_in_smp;
 };
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index e59094981175..37be6e226d1b 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -552,9 +552,8 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
            && rm->m_inc.i_hdr.h_flags & RDS_FLAG_CONG_BITMAP) {
                rds_cong_map_updated(conn->c_fcong, ~(u64) 0);
                scat = &rm->data.op_sg[sg];
-                ret = sizeof(struct rds_header) + RDS_CONG_MAP_BYTES;
+                ret = max_t(int, RDS_CONG_MAP_BYTES, scat->length);
-                ret = min_t(int, ret, scat->length - conn->c_xmit_data_off);
+                return sizeof(struct rds_header) + ret;
-                return ret;
        }
        /* FIXME we may overallocate here */
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 33af77246bfe..81f94b1ae1c7 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1012,7 +1012,7 @@ int rose_rx_call_request(struct sk_buff *skb, struct net_device *dev, struct ros
        make_rose->source_call   = facilities.source_call;
        make_rose->source_ndigis = facilities.source_ndigis;
        for (n = 0 ; n < facilities.source_ndigis ; n++)
-                make_rose->source_digis[n]= facilities.source_digis[n];
+                make_rose->source_digis[n] = facilities.source_digis[n];
        make_rose->neighbour     = neigh;
        make_rose->device        = dev;
        make_rose->facilities    = facilities;
diff --git a/net/rose/rose_dev.c b/net/rose/rose_dev.c
index 28dbdb911b85..50005888be57 100644
--- a/net/rose/rose_dev.c
+++ b/net/rose/rose_dev.c
@@ -146,7 +146,7 @@ static netdev_tx_t rose_xmit(struct sk_buff *skb, struct net_device *dev)
 static const struct header_ops rose_header_ops = {
        .create = rose_header,
-        .rebuild= rose_rebuild_header,
+        .rebuild = rose_rebuild_header,
 };
 static const struct net_device_ops rose_netdev_ops = {
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index ad1f1d819203..919847beec39 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -286,6 +286,15 @@ config NET_SCH_FQ
          If unsure, say N.
+config NET_SCH_HHF
+        tristate "Heavy-Hitter Filter (HHF)"
+        help
+          Say Y here if you want to use the Heavy-Hitter Filter (HHF)
+          packet scheduling algorithm.
+          To compile this driver as a module, choose M here: the module
+          will be called sch_hhf.
 config NET_SCH_INGRESS
        tristate "Ingress Qdisc"
        depends on NET_CLS_ACT
diff --git a/net/sched/Makefile b/net/sched/Makefile
index 35fa47a494ab..3442e5fbc4d7 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -40,6 +40,7 @@ obj-$(CONFIG_NET_SCH_QFQ)	+= sch_qfq.o
 obj-$(CONFIG_NET_SCH_CODEL)     += sch_codel.o
 obj-$(CONFIG_NET_SCH_FQ_CODEL)  += sch_fq_codel.o
 obj-$(CONFIG_NET_SCH_FQ)        += sch_fq.o
+obj-$(CONFIG_NET_SCH_HHF)       += sch_hhf.o
 obj-$(CONFIG_NET_CLS_U32)       += cls_u32.o
 obj-$(CONFIG_NET_CLS_ROUTE4)    += cls_route.o
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index fd7072827a40..dce2b6ecdbd8 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -29,25 +29,16 @@
 void tcf_hash_destroy(struct tcf_common *p, struct tcf_hashinfo *hinfo)
 {
-        unsigned int h = tcf_hash(p->tcfc_index, hinfo->hmask);
+        spin_lock_bh(&hinfo->lock);
-        struct tcf_common **p1p;
+        hlist_del(&p->tcfc_head);
+        spin_unlock_bh(&hinfo->lock);
-        for (p1p = &hinfo->htab[h]; *p1p; p1p = &(*p1p)->tcfc_next) {
+        gen_kill_estimator(&p->tcfc_bstats,
-                if (*p1p == p) {
+                           &p->tcfc_rate_est);
-                        write_lock_bh(hinfo->lock);
+        /*
-                        *p1p = p->tcfc_next;
+         * gen_estimator est_timer() might access p->tcfc_lock
-                        write_unlock_bh(hinfo->lock);
+         * or bstats, wait a RCU grace period before freeing p
-                        gen_kill_estimator(&p->tcfc_bstats,
+         */
-                                           &p->tcfc_rate_est);
+        kfree_rcu(p, tcfc_rcu);
-                        /*
-                         * gen_estimator est_timer() might access p->tcfc_lock
-                         * or bstats, wait a RCU grace period before freeing p
-                         */
-                        kfree_rcu(p, tcfc_rcu);
-                        return;
-                }
-        }
-        WARN_ON(1);
 }
 EXPORT_SYMBOL(tcf_hash_destroy);
@@ -73,18 +64,19 @@ EXPORT_SYMBOL(tcf_hash_release);
 static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb,
                           struct tc_action *a, struct tcf_hashinfo *hinfo)
 {
+        struct hlist_head *head;
        struct tcf_common *p;
        int err = 0, index = -1, i = 0, s_i = 0, n_i = 0;
        struct nlattr *nest;
-        read_lock_bh(hinfo->lock);
+        spin_lock_bh(&hinfo->lock);
        s_i = cb->args[0];
        for (i = 0; i < (hinfo->hmask + 1); i++) {
-                p = hinfo->htab[tcf_hash(i, hinfo->hmask)];
+                head = &hinfo->htab[tcf_hash(i, hinfo->hmask)];
-                for (; p; p = p->tcfc_next) {
+                hlist_for_each_entry_rcu(p, head, tcfc_head) {
                        index++;
                        if (index < s_i)
                                continue;
@@ -107,7 +99,7 @@ static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb,
                }
        }
 done:
-        read_unlock_bh(hinfo->lock);
+        spin_unlock_bh(&hinfo->lock);
        if (n_i)
                cb->args[0] += n_i;
        return n_i;
@@ -120,7 +112,9 @@ nla_put_failure:
 static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a,
                          struct tcf_hashinfo *hinfo)
 {
-        struct tcf_common *p, *s_p;
+        struct hlist_head *head;
+        struct hlist_node *n;
+        struct tcf_common *p;
        struct nlattr *nest;
        int i = 0, n_i = 0;
@@ -130,14 +124,11 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a,
        if (nla_put_string(skb, TCA_KIND, a->ops->kind))
                goto nla_put_failure;
        for (i = 0; i < (hinfo->hmask + 1); i++) {
-                p = hinfo->htab[tcf_hash(i, hinfo->hmask)];
+                head = &hinfo->htab[tcf_hash(i, hinfo->hmask)];
+                hlist_for_each_entry_safe(p, n, head, tcfc_head) {
-                while (p != NULL) {
-                        s_p = p->tcfc_next;
                        if (ACT_P_DELETED == tcf_hash_release(p, 0, hinfo))
                                module_put(a->ops->owner);
                        n_i++;
-                        p = s_p;
                }
        }
        if (nla_put_u32(skb, TCA_FCNT, n_i))
@@ -168,15 +159,15 @@ EXPORT_SYMBOL(tcf_generic_walker);
 struct tcf_common *tcf_hash_lookup(u32 index, struct tcf_hashinfo *hinfo)
 {
-        struct tcf_common *p;
+        struct tcf_common *p = NULL;
+        struct hlist_head *head;
-        read_lock_bh(hinfo->lock);
+        spin_lock_bh(&hinfo->lock);
-        for (p = hinfo->htab[tcf_hash(index, hinfo->hmask)]; p;
+        head = &hinfo->htab[tcf_hash(index, hinfo->hmask)];
-             p = p->tcfc_next) {
+        hlist_for_each_entry_rcu(p, head, tcfc_head)
                if (p->tcfc_index == index)
                        break;
-        }
+        spin_unlock_bh(&hinfo->lock);
-        read_unlock_bh(hinfo->lock);
        return p;
 }
@@ -191,7 +182,8 @@ u32 tcf_hash_new_index(u32 *idx_gen, struct tcf_hashinfo *hinfo)
                        val = 1;
        } while (tcf_hash_lookup(val, hinfo));
-        return (*idx_gen = val);
+        *idx_gen = val;
+        return val;
 }
 EXPORT_SYMBOL(tcf_hash_new_index);
@@ -235,6 +227,7 @@ struct tcf_common *tcf_hash_create(u32 index, struct nlattr *est,
                p->tcfc_bindcnt = 1;
        spin_lock_init(&p->tcfc_lock);
+        INIT_HLIST_NODE(&p->tcfc_head);
        p->tcfc_index = index ? index : tcf_hash_new_index(idx_gen, hinfo);
        p->tcfc_tm.install = jiffies;
        p->tcfc_tm.lastuse = jiffies;
@@ -256,29 +249,37 @@ void tcf_hash_insert(struct tcf_common *p, struct tcf_hashinfo *hinfo)
 {
        unsigned int h = tcf_hash(p->tcfc_index, hinfo->hmask);
-        write_lock_bh(hinfo->lock);
+        spin_lock_bh(&hinfo->lock);
-        p->tcfc_next = hinfo->htab[h];
+        hlist_add_head(&p->tcfc_head, &hinfo->htab[h]);
-        hinfo->htab[h] = p;
+        spin_unlock_bh(&hinfo->lock);
-        write_unlock_bh(hinfo->lock);
 }
 EXPORT_SYMBOL(tcf_hash_insert);
-static struct tc_action_ops *act_base = NULL;
+static LIST_HEAD(act_base);
 static DEFINE_RWLOCK(act_mod_lock);
 int tcf_register_action(struct tc_action_ops *act)
 {
-        struct tc_action_ops *a, **ap;
+        struct tc_action_ops *a;
+        /* Must supply act, dump, cleanup and init */
+        if (!act->act || !act->dump || !act->cleanup || !act->init)
+                return -EINVAL;
+        /* Supply defaults */
+        if (!act->lookup)
+                act->lookup = tcf_hash_search;
+        if (!act->walk)
+                act->walk = tcf_generic_walker;
        write_lock(&act_mod_lock);
-        for (ap = &act_base; (a = *ap) != NULL; ap = &a->next) {
+        list_for_each_entry(a, &act_base, head) {
                if (act->type == a->type || (strcmp(act->kind, a->kind) == 0)) {
                        write_unlock(&act_mod_lock);
                        return -EEXIST;
                }
        }
-        act->next = NULL;
+        list_add_tail(&act->head, &act_base);
-        *ap = act;
        write_unlock(&act_mod_lock);
        return 0;
 }
@@ -286,17 +287,16 @@ EXPORT_SYMBOL(tcf_register_action);
 int tcf_unregister_action(struct tc_action_ops *act)
 {
-        struct tc_action_ops *a, **ap;
+        struct tc_action_ops *a;
        int err = -ENOENT;
        write_lock(&act_mod_lock);
-        for (ap = &act_base; (a = *ap) != NULL; ap = &a->next)
+        list_for_each_entry(a, &act_base, head) {
-                if (a == act)
+                if (a == act) {
+                        list_del(&act->head);
+                        err = 0;
                        break;
-        if (a) {
+                }
-                *ap = a->next;
-                a->next = NULL;
-                err = 0;
        }
        write_unlock(&act_mod_lock);
        return err;
@@ -306,69 +306,42 @@ EXPORT_SYMBOL(tcf_unregister_action);
 /* lookup by name */
 static struct tc_action_ops *tc_lookup_action_n(char *kind)
 {
-        struct tc_action_ops *a = NULL;
+        struct tc_action_ops *a, *res = NULL;
        if (kind) {
                read_lock(&act_mod_lock);
-                for (a = act_base; a; a = a->next) {
+                list_for_each_entry(a, &act_base, head) {
                        if (strcmp(kind, a->kind) == 0) {
-                                if (!try_module_get(a->owner)) {
+                                if (try_module_get(a->owner))
-                                        read_unlock(&act_mod_lock);
+                                        res = a;
-                                        return NULL;
-                                }
                                break;
                        }
                }
                read_unlock(&act_mod_lock);
        }
-        return a;
+        return res;
 }
 /* lookup by nlattr */
 static struct tc_action_ops *tc_lookup_action(struct nlattr *kind)
 {
-        struct tc_action_ops *a = NULL;
+        struct tc_action_ops *a, *res = NULL;
        if (kind) {
                read_lock(&act_mod_lock);
-                for (a = act_base; a; a = a->next) {
+                list_for_each_entry(a, &act_base, head) {
                        if (nla_strcmp(kind, a->kind) == 0) {
-                                if (!try_module_get(a->owner)) {
+                                if (try_module_get(a->owner))
-                                        read_unlock(&act_mod_lock);
+                                        res = a;
-                                        return NULL;
-                                }
-                                break;
-                        }
-                }
-                read_unlock(&act_mod_lock);
-        }
-        return a;
-}
-#if 0
-/* lookup by id */
-static struct tc_action_ops *tc_lookup_action_id(u32 type)
-{
-        struct tc_action_ops *a = NULL;
-        if (type) {
-                read_lock(&act_mod_lock);
-                for (a = act_base; a; a = a->next) {
-                        if (a->type == type) {
-                                if (!try_module_get(a->owner)) {
-                                        read_unlock(&act_mod_lock);
-                                        return NULL;
-                                }
                                break;
                        }
                }
                read_unlock(&act_mod_lock);
        }
-        return a;
+        return res;
 }
-#endif
-int tcf_action_exec(struct sk_buff *skb, const struct tc_action *act,
+int tcf_action_exec(struct sk_buff *skb, const struct list_head *actions,
                    struct tcf_result *res)
 {
        const struct tc_action *a;
@@ -379,9 +352,9 @@ int tcf_action_exec(struct sk_buff *skb, const struct tc_action *act,
                ret = TC_ACT_OK;
                goto exec_done;
        }
-        while ((a = act) != NULL) {
+        list_for_each_entry(a, actions, list) {
 repeat:
-                if (a->ops && a->ops->act) {
+                if (a->ops) {
                        ret = a->ops->act(skb, a, res);
                        if (TC_MUNGED & skb->tc_verd) {
                                /* copied already, allow trampling */
@@ -393,27 +366,26 @@ repeat:
                        if (ret != TC_ACT_PIPE)
                                goto exec_done;
                }
-                act = a->next;
        }
 exec_done:
        return ret;
 }
 EXPORT_SYMBOL(tcf_action_exec);
-void tcf_action_destroy(struct tc_action *act, int bind)
+void tcf_action_destroy(struct list_head *actions, int bind)
 {
-        struct tc_action *a;
+        struct tc_action *a, *tmp;
-        for (a = act; a; a = act) {
+        list_for_each_entry_safe(a, tmp, actions, list) {
-                if (a->ops && a->ops->cleanup) {
+                if (a->ops) {
                        if (a->ops->cleanup(a, bind) == ACT_P_DELETED)
                                module_put(a->ops->owner);
-                        act = act->next;
+                        list_del(&a->list);
                        kfree(a);
                } else {
                        /*FIXME: Remove later - catch insertion bugs*/
                        WARN(1, "tcf_action_destroy: BUG? destroying NULL ops\n");
-                        act = act->next;
+                        list_del(&a->list);
                        kfree(a);
                }
        }
@@ -424,7 +396,7 @@ tcf_action_dump_old(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
        int err = -EINVAL;
-        if (a->ops == NULL || a->ops->dump == NULL)
+        if (a->ops == NULL)
                return err;
        return a->ops->dump(skb, a, bind, ref);
 }
@@ -436,7 +408,7 @@ tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
        unsigned char *b = skb_tail_pointer(skb);
        struct nlattr *nest;
-        if (a->ops == NULL || a->ops->dump == NULL)
+        if (a->ops == NULL)
                return err;
        if (nla_put_string(skb, TCA_KIND, a->ops->kind))
@@ -459,14 +431,13 @@ nla_put_failure:
 EXPORT_SYMBOL(tcf_action_dump_1);
 int
-tcf_action_dump(struct sk_buff *skb, struct tc_action *act, int bind, int ref)
+tcf_action_dump(struct sk_buff *skb, struct list_head *actions, int bind, int ref)
 {
        struct tc_action *a;
        int err = -EINVAL;
        struct nlattr *nest;
-        while ((a = act) != NULL) {
+        list_for_each_entry(a, actions, list) {
-                act = a->next;
                nest = nla_nest_start(skb, a->order);
                if (nest == NULL)
                        goto nla_put_failure;
@@ -541,6 +512,7 @@ struct tc_action *tcf_action_init_1(struct net *net, struct nlattr *nla,
        if (a == NULL)
                goto err_mod;
+        INIT_LIST_HEAD(&a->list);
        /* backward compatibility for policer */
        if (name == NULL)
                err = a_o->init(net, tb[TCA_ACT_OPTIONS], est, a, ovr, bind);
@@ -567,37 +539,33 @@ err_out:
        return ERR_PTR(err);
 }
-struct tc_action *tcf_action_init(struct net *net, struct nlattr *nla,
+int tcf_action_init(struct net *net, struct nlattr *nla,
                                  struct nlattr *est, char *name, int ovr,
-                                  int bind)
+                                  int bind, struct list_head *actions)
 {
        struct nlattr *tb[TCA_ACT_MAX_PRIO + 1];
-        struct tc_action *head = NULL, *act, *act_prev = NULL;
+        struct tc_action *act;
        int err;
        int i;
        err = nla_parse_nested(tb, TCA_ACT_MAX_PRIO, nla, NULL);
        if (err < 0)
-                return ERR_PTR(err);
+                return err;
        for (i = 1; i <= TCA_ACT_MAX_PRIO && tb[i]; i++) {
                act = tcf_action_init_1(net, tb[i], est, name, ovr, bind);
-                if (IS_ERR(act))
+                if (IS_ERR(act)) {
+                        err = PTR_ERR(act);
                        goto err;
+                }
                act->order = i;
+                list_add_tail(&act->list, actions);
-                if (head == NULL)
-                        head = act;
-                else
-                        act_prev->next = act;
-                act_prev = act;
        }
-        return head;
+        return 0;
 err:
-        if (head != NULL)
+        tcf_action_destroy(actions, bind);
-                tcf_action_destroy(head, bind);
+        return err;
-        return act;
 }
 int tcf_action_copy_stats(struct sk_buff *skb, struct tc_action *a,
@@ -626,10 +594,6 @@ int tcf_action_copy_stats(struct sk_buff *skb, struct tc_action *a,
        if (err < 0)
                goto errout;
-        if (a->ops != NULL && a->ops->get_stats != NULL)
-                if (a->ops->get_stats(skb, a) < 0)
-                        goto errout;
        if (gnet_stats_copy_basic(&d, &h->tcf_bstats) < 0 ||
            gnet_stats_copy_rate_est(&d, &h->tcf_bstats,
                                     &h->tcf_rate_est) < 0 ||
@@ -646,7 +610,7 @@ errout:
 }
 static int
-tca_get_fill(struct sk_buff *skb, struct tc_action *a, u32 portid, u32 seq,
+tca_get_fill(struct sk_buff *skb, struct list_head *actions, u32 portid, u32 seq,
             u16 flags, int event, int bind, int ref)
 {
        struct tcamsg *t;
@@ -666,7 +630,7 @@ tca_get_fill(struct sk_buff *skb, struct tc_action *a, u32 portid, u32 seq,
        if (nest == NULL)
                goto out_nlmsg_trim;
-        if (tcf_action_dump(skb, a, bind, ref) < 0)
+        if (tcf_action_dump(skb, actions, bind, ref) < 0)
                goto out_nlmsg_trim;
        nla_nest_end(skb, nest);
@@ -681,14 +645,14 @@ out_nlmsg_trim:
 static int
 act_get_notify(struct net *net, u32 portid, struct nlmsghdr *n,
-               struct tc_action *a, int event)
+               struct list_head *actions, int event)
 {
        struct sk_buff *skb;
        skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
        if (!skb)
                return -ENOBUFS;
-        if (tca_get_fill(skb, a, portid, n->nlmsg_seq, 0, event, 0, 0) <= 0) {
+        if (tca_get_fill(skb, actions, portid, n->nlmsg_seq, 0, event, 0, 0) <= 0) {
                kfree_skb(skb);
                return -EINVAL;
        }
@@ -719,12 +683,11 @@ tcf_action_get_1(struct nlattr *nla, struct nlmsghdr *n, u32 portid)
        if (a == NULL)
                goto err_out;
+        INIT_LIST_HEAD(&a->list);
        err = -EINVAL;
        a->ops = tc_lookup_action(tb[TCA_ACT_KIND]);
        if (a->ops == NULL)
                goto err_free;
-        if (a->ops->lookup == NULL)
-                goto err_mod;
        err = -ENOENT;
        if (a->ops->lookup(a, index) == 0)
                goto err_mod;
@@ -740,12 +703,12 @@ err_out:
        return ERR_PTR(err);
 }
-static void cleanup_a(struct tc_action *act)
+static void cleanup_a(struct list_head *actions)
 {
-        struct tc_action *a;
+        struct tc_action *a, *tmp;
-        for (a = act; a; a = act) {
+        list_for_each_entry_safe(a, tmp, actions, list) {
-                act = a->next;
+                list_del(&a->list);
                kfree(a);
        }
 }
@@ -760,6 +723,7 @@ static struct tc_action *create_a(int i)
                return NULL;
        }
        act->order = i;
+        INIT_LIST_HEAD(&act->list);
        return act;
 }
@@ -847,7 +811,8 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
 {
        int i, ret;
        struct nlattr *tb[TCA_ACT_MAX_PRIO + 1];
-        struct tc_action *head = NULL, *act, *act_prev = NULL;
+        struct tc_action *act;
+        LIST_HEAD(actions);
        ret = nla_parse_nested(tb, TCA_ACT_MAX_PRIO, nla, NULL);
        if (ret < 0)
@@ -867,16 +832,11 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
                        goto err;
                }
                act->order = i;
+                list_add_tail(&act->list, &actions);
-                if (head == NULL)
-                        head = act;
-                else
-                        act_prev->next = act;
-                act_prev = act;
        }
        if (event == RTM_GETACTION)
-                ret = act_get_notify(net, portid, n, head, event);
+                ret = act_get_notify(net, portid, n, &actions, event);
        else { /* delete */
                struct sk_buff *skb;
@@ -886,7 +846,7 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
                        goto err;
                }
-                if (tca_get_fill(skb, head, portid, n->nlmsg_seq, 0, event,
+                if (tca_get_fill(skb, &actions, portid, n->nlmsg_seq, 0, event,
                                 0, 1) <= 0) {
                        kfree_skb(skb);
                        ret = -EINVAL;
@@ -894,7 +854,7 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
                }
                /* now do the delete */
-                tcf_action_destroy(head, 0);
+                tcf_action_destroy(&actions, 0);
                ret = rtnetlink_send(skb, net, portid, RTNLGRP_TC,
                                     n->nlmsg_flags & NLM_F_ECHO);
                if (ret > 0)
@@ -902,11 +862,11 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
                return ret;
        }
 err:
-        cleanup_a(head);
+        cleanup_a(&actions);
        return ret;
 }
-static int tcf_add_notify(struct net *net, struct tc_action *a,
+static int tcf_add_notify(struct net *net, struct list_head *actions,
                          u32 portid, u32 seq, int event, u16 flags)
 {
        struct tcamsg *t;
@@ -934,7 +894,7 @@ static int tcf_add_notify(struct net *net, struct tc_action *a,
        if (nest == NULL)
                goto out_kfree_skb;
-        if (tcf_action_dump(skb, a, 0, 0) < 0)
+        if (tcf_action_dump(skb, actions, 0, 0) < 0)
                goto out_kfree_skb;
        nla_nest_end(skb, nest);
@@ -958,26 +918,18 @@ tcf_action_add(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
               u32 portid, int ovr)
 {
        int ret = 0;
-        struct tc_action *act;
+        LIST_HEAD(actions);
-        struct tc_action *a;
        u32 seq = n->nlmsg_seq;
-        act = tcf_action_init(net, nla, NULL, NULL, ovr, 0);
+        ret = tcf_action_init(net, nla, NULL, NULL, ovr, 0, &actions);
-        if (act == NULL)
+        if (ret)
                goto done;
-        if (IS_ERR(act)) {
-                ret = PTR_ERR(act);
-                goto done;
-        }
        /* dump then free all the actions after update; inserted policy
         * stays intact
         */
-        ret = tcf_add_notify(net, act, portid, seq, RTM_NEWACTION, n->nlmsg_flags);
+        ret = tcf_add_notify(net, &actions, portid, seq, RTM_NEWACTION, n->nlmsg_flags);
-        for (a = act; a; a = act) {
+        cleanup_a(&actions);
-                act = a->next;
-                kfree(a);
-        }
 done:
        return ret;
 }
@@ -1084,12 +1036,6 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
        memset(&a, 0, sizeof(struct tc_action));
        a.ops = a_o;
-        if (a_o->walk == NULL) {
-                WARN(1, "tc_dump_action: %s !capable of dumping table\n",
-                     a_o->kind);
-                goto out_module_put;
-        }
        nlh = nlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
                        cb->nlh->nlmsg_type, sizeof(*t), 0);
        if (!nlh)
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 3a4c0caa1f7d..9cc6717c5f19 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -37,15 +37,8 @@
 #include <net/tc_act/tc_csum.h>
 #define CSUM_TAB_MASK 15
-static struct tcf_common *tcf_csum_ht[CSUM_TAB_MASK + 1];
 static u32 csum_idx_gen;
-static DEFINE_RWLOCK(csum_lock);
+static struct tcf_hashinfo csum_hash_info;
-static struct tcf_hashinfo csum_hash_info = {
-        .htab   = tcf_csum_ht,
-        .hmask  = CSUM_TAB_MASK,
-        .lock   = &csum_lock,
-};
 static const struct nla_policy csum_policy[TCA_CSUM_MAX + 1] = {
        [TCA_CSUM_PARMS] = { .len = sizeof(struct tc_csum), },
@@ -585,9 +578,7 @@ static struct tc_action_ops act_csum_ops = {
        .act            = tcf_csum,
        .dump           = tcf_csum_dump,
        .cleanup        = tcf_csum_cleanup,
-        .lookup         = tcf_hash_search,
        .init           = tcf_csum_init,
-        .walk           = tcf_generic_walker
 };
 MODULE_DESCRIPTION("Checksum updating actions");
@@ -595,6 +586,10 @@ MODULE_LICENSE("GPL");
 static int __init csum_init_module(void)
 {
+        int err = tcf_hashinfo_init(&csum_hash_info, CSUM_TAB_MASK);
+        if (err)
+                return err;
        return tcf_register_action(&act_csum_ops);
 }
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index fd2b3cff5fa2..dea927343bf4 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -24,15 +24,8 @@
 #include <net/tc_act/tc_gact.h>
 #define GACT_TAB_MASK   15
-static struct tcf_common *tcf_gact_ht[GACT_TAB_MASK + 1];
 static u32 gact_idx_gen;
-static DEFINE_RWLOCK(gact_lock);
+static struct tcf_hashinfo gact_hash_info;
-static struct tcf_hashinfo gact_hash_info = {
-        .htab   =       tcf_gact_ht,
-        .hmask  =       GACT_TAB_MASK,
-        .lock   =       &gact_lock,
-};
 #ifdef CONFIG_GACT_PROB
 static int gact_net_rand(struct tcf_gact *gact)
@@ -206,9 +199,7 @@ static struct tc_action_ops act_gact_ops = {
        .act            =       tcf_gact,
        .dump           =       tcf_gact_dump,
        .cleanup        =       tcf_gact_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_gact_init,
-        .walk           =       tcf_generic_walker
 };
 MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
@@ -217,6 +208,9 @@ MODULE_LICENSE("GPL");
 static int __init gact_init_module(void)
 {
+        int err = tcf_hashinfo_init(&gact_hash_info, GACT_TAB_MASK);
+        if (err)
+                return err;
 #ifdef CONFIG_GACT_PROB
        pr_info("GACT probability on\n");
 #else
@@ -228,6 +222,7 @@ static int __init gact_init_module(void)
 static void __exit gact_cleanup_module(void)
 {
        tcf_unregister_action(&act_gact_ops);
+        tcf_hashinfo_destroy(&gact_hash_info);
 }
 module_init(gact_init_module);
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 60d88b6b9560..e13ecbbfe8c4 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -29,15 +29,8 @@
 #define IPT_TAB_MASK     15
-static struct tcf_common *tcf_ipt_ht[IPT_TAB_MASK + 1];
 static u32 ipt_idx_gen;
-static DEFINE_RWLOCK(ipt_lock);
+static struct tcf_hashinfo ipt_hash_info;
-static struct tcf_hashinfo ipt_hash_info = {
-        .htab   =       tcf_ipt_ht,
-        .hmask  =       IPT_TAB_MASK,
-        .lock   =       &ipt_lock,
-};
 static int ipt_init_target(struct xt_entry_target *t, char *table, unsigned int hook)
 {
@@ -298,9 +291,7 @@ static struct tc_action_ops act_ipt_ops = {
        .act            =       tcf_ipt,
        .dump           =       tcf_ipt_dump,
        .cleanup        =       tcf_ipt_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_ipt_init,
-        .walk           =       tcf_generic_walker
 };
 static struct tc_action_ops act_xt_ops = {
@@ -312,9 +303,7 @@ static struct tc_action_ops act_xt_ops = {
        .act            =       tcf_ipt,
        .dump           =       tcf_ipt_dump,
        .cleanup        =       tcf_ipt_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_ipt_init,
-        .walk           =       tcf_generic_walker
 };
 MODULE_AUTHOR("Jamal Hadi Salim(2002-13)");
@@ -324,7 +313,11 @@ MODULE_ALIAS("act_xt");
 static int __init ipt_init_module(void)
 {
-        int ret1, ret2;
+        int ret1, ret2, err;
+        err = tcf_hashinfo_init(&ipt_hash_info, IPT_TAB_MASK);
+        if (err)
+                return err;
        ret1 = tcf_register_action(&act_xt_ops);
        if (ret1 < 0)
                printk("Failed to load xt action\n");
@@ -332,9 +325,10 @@ static int __init ipt_init_module(void)
        if (ret2 < 0)
                printk("Failed to load ipt action\n");
-        if (ret1 < 0 && ret2 < 0)
+        if (ret1 < 0 && ret2 < 0) {
+                tcf_hashinfo_destroy(&ipt_hash_info);
                return ret1;
-        else
+        } else
                return 0;
 }
@@ -342,6 +336,7 @@ static void __exit ipt_cleanup_module(void)
 {
        tcf_unregister_action(&act_xt_ops);
        tcf_unregister_action(&act_ipt_ops);
+        tcf_hashinfo_destroy(&ipt_hash_info);
 }
 module_init(ipt_init_module);
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 977c10e0631b..9dbb8cd64cb0 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -30,16 +30,9 @@
 #include <linux/if_arp.h>
 #define MIRRED_TAB_MASK     7
-static struct tcf_common *tcf_mirred_ht[MIRRED_TAB_MASK + 1];
 static u32 mirred_idx_gen;
-static DEFINE_RWLOCK(mirred_lock);
 static LIST_HEAD(mirred_list);
+static struct tcf_hashinfo mirred_hash_info;
-static struct tcf_hashinfo mirred_hash_info = {
-        .htab   =       tcf_mirred_ht,
-        .hmask  =       MIRRED_TAB_MASK,
-        .lock   =       &mirred_lock,
-};
 static int tcf_mirred_release(struct tcf_mirred *m, int bind)
 {
@@ -261,7 +254,6 @@ static struct notifier_block mirred_device_notifier = {
        .notifier_call = mirred_device_event,
 };
 static struct tc_action_ops act_mirred_ops = {
        .kind           =       "mirred",
        .hinfo          =       &mirred_hash_info,
@@ -271,9 +263,7 @@ static struct tc_action_ops act_mirred_ops = {
        .act            =       tcf_mirred,
        .dump           =       tcf_mirred_dump,
        .cleanup        =       tcf_mirred_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_mirred_init,
-        .walk           =       tcf_generic_walker
 };
 MODULE_AUTHOR("Jamal Hadi Salim(2002)");
@@ -286,14 +276,20 @@ static int __init mirred_init_module(void)
        if (err)
                return err;
+        err = tcf_hashinfo_init(&mirred_hash_info, MIRRED_TAB_MASK);
+        if (err) {
+                unregister_netdevice_notifier(&mirred_device_notifier);
+                return err;
+        }
        pr_info("Mirror/redirect action on\n");
        return tcf_register_action(&act_mirred_ops);
 }
 static void __exit mirred_cleanup_module(void)
 {
-        unregister_netdevice_notifier(&mirred_device_notifier);
        tcf_unregister_action(&act_mirred_ops);
+        tcf_hashinfo_destroy(&mirred_hash_info);
+        unregister_netdevice_notifier(&mirred_device_notifier);
 }
 module_init(mirred_init_module);
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 876f0ef29694..921fea43fca2 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -30,15 +30,9 @@
 #define NAT_TAB_MASK    15
-static struct tcf_common *tcf_nat_ht[NAT_TAB_MASK + 1];
 static u32 nat_idx_gen;
-static DEFINE_RWLOCK(nat_lock);
-static struct tcf_hashinfo nat_hash_info = {
+static struct tcf_hashinfo nat_hash_info;
-        .htab   =       tcf_nat_ht,
-        .hmask  =       NAT_TAB_MASK,
-        .lock   =       &nat_lock,
-};
 static const struct nla_policy nat_policy[TCA_NAT_MAX + 1] = {
        [TCA_NAT_PARMS] = { .len = sizeof(struct tc_nat) },
@@ -308,9 +302,7 @@ static struct tc_action_ops act_nat_ops = {
        .act            =       tcf_nat,
        .dump           =       tcf_nat_dump,
        .cleanup        =       tcf_nat_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_nat_init,
-        .walk           =       tcf_generic_walker
 };
 MODULE_DESCRIPTION("Stateless NAT actions");
@@ -318,12 +310,16 @@ MODULE_LICENSE("GPL");
 static int __init nat_init_module(void)
 {
+        int err = tcf_hashinfo_init(&nat_hash_info, NAT_TAB_MASK);
+        if (err)
+                return err;
        return tcf_register_action(&act_nat_ops);
 }
 static void __exit nat_cleanup_module(void)
 {
        tcf_unregister_action(&act_nat_ops);
+        tcf_hashinfo_destroy(&nat_hash_info);
 }
 module_init(nat_init_module);
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 7ed78c9e505c..e2520e90a10d 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -24,15 +24,9 @@
 #include <net/tc_act/tc_pedit.h>
 #define PEDIT_TAB_MASK  15
-static struct tcf_common *tcf_pedit_ht[PEDIT_TAB_MASK + 1];
 static u32 pedit_idx_gen;
-static DEFINE_RWLOCK(pedit_lock);
-static struct tcf_hashinfo pedit_hash_info = {
+static struct tcf_hashinfo pedit_hash_info;
-        .htab   =       tcf_pedit_ht,
-        .hmask  =       PEDIT_TAB_MASK,
-        .lock   =       &pedit_lock,
-};
 static const struct nla_policy pedit_policy[TCA_PEDIT_MAX + 1] = {
        [TCA_PEDIT_PARMS]       = { .len = sizeof(struct tc_pedit) },
@@ -243,9 +237,7 @@ static struct tc_action_ops act_pedit_ops = {
        .act            =       tcf_pedit,
        .dump           =       tcf_pedit_dump,
        .cleanup        =       tcf_pedit_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_pedit_init,
-        .walk           =       tcf_generic_walker
 };
 MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
@@ -254,11 +246,15 @@ MODULE_LICENSE("GPL");
 static int __init pedit_init_module(void)
 {
+        int err = tcf_hashinfo_init(&pedit_hash_info, PEDIT_TAB_MASK);
+        if (err)
+                return err;
        return tcf_register_action(&act_pedit_ops);
 }
 static void __exit pedit_cleanup_module(void)
 {
+        tcf_hashinfo_destroy(&pedit_hash_info);
        tcf_unregister_action(&act_pedit_ops);
 }
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 272d8e924cf6..819a9a4d1987 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -41,15 +41,8 @@ struct tcf_police {
        container_of(pc, struct tcf_police, common)
 #define POL_TAB_MASK     15
-static struct tcf_common *tcf_police_ht[POL_TAB_MASK + 1];
 static u32 police_idx_gen;
-static DEFINE_RWLOCK(police_lock);
+static struct tcf_hashinfo police_hash_info;
-static struct tcf_hashinfo police_hash_info = {
-        .htab   =       tcf_police_ht,
-        .hmask  =       POL_TAB_MASK,
-        .lock   =       &police_lock,
-};
 /* old policer structure from before tc actions */
 struct tc_police_compat {
@@ -67,18 +60,19 @@ struct tc_police_compat {
 static int tcf_act_police_walker(struct sk_buff *skb, struct netlink_callback *cb,
                              int type, struct tc_action *a)
 {
+        struct hlist_head *head;
        struct tcf_common *p;
        int err = 0, index = -1, i = 0, s_i = 0, n_i = 0;
        struct nlattr *nest;
-        read_lock_bh(&police_lock);
+        spin_lock_bh(&police_hash_info.lock);
        s_i = cb->args[0];
        for (i = 0; i < (POL_TAB_MASK + 1); i++) {
-                p = tcf_police_ht[tcf_hash(i, POL_TAB_MASK)];
+                head = &police_hash_info.htab[tcf_hash(i, POL_TAB_MASK)];
-                for (; p; p = p->tcfc_next) {
+                hlist_for_each_entry_rcu(p, head, tcfc_head) {
                        index++;
                        if (index < s_i)
                                continue;
@@ -101,7 +95,7 @@ static int tcf_act_police_walker(struct sk_buff *skb, struct netlink_callback *c
                }
        }
 done:
-        read_unlock_bh(&police_lock);
+        spin_unlock_bh(&police_hash_info.lock);
        if (n_i)
                cb->args[0] += n_i;
        return n_i;
@@ -113,25 +107,16 @@ nla_put_failure:
 static void tcf_police_destroy(struct tcf_police *p)
 {
-        unsigned int h = tcf_hash(p->tcf_index, POL_TAB_MASK);
+        spin_lock_bh(&police_hash_info.lock);
-        struct tcf_common **p1p;
+        hlist_del(&p->tcf_head);
+        spin_unlock_bh(&police_hash_info.lock);
-        for (p1p = &tcf_police_ht[h]; *p1p; p1p = &(*p1p)->tcfc_next) {
+        gen_kill_estimator(&p->tcf_bstats,
-                if (*p1p == &p->common) {
+                           &p->tcf_rate_est);
-                        write_lock_bh(&police_lock);
+        /*
-                        *p1p = p->tcf_next;
+         * gen_estimator est_timer() might access p->tcf_lock
-                        write_unlock_bh(&police_lock);
+         * or bstats, wait a RCU grace period before freeing p
-                        gen_kill_estimator(&p->tcf_bstats,
+         */
-                                           &p->tcf_rate_est);
+        kfree_rcu(p, tcf_rcu);
-                        /*
-                         * gen_estimator est_timer() might access p->tcf_lock
-                         * or bstats, wait a RCU grace period before freeing p
-                         */
-                        kfree_rcu(p, tcf_rcu);
-                        return;
-                }
-        }
-        WARN_ON(1);
 }
 static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = {
@@ -266,10 +251,9 @@ override:
        police->tcf_index = parm->index ? parm->index :
                tcf_hash_new_index(&police_idx_gen, &police_hash_info);
        h = tcf_hash(police->tcf_index, POL_TAB_MASK);
-        write_lock_bh(&police_lock);
+        spin_lock_bh(&police_hash_info.lock);
-        police->tcf_next = tcf_police_ht[h];
+        hlist_add_head(&police->tcf_head, &police_hash_info.htab[h]);
-        tcf_police_ht[h] = &police->common;
+        spin_unlock_bh(&police_hash_info.lock);
-        write_unlock_bh(&police_lock);
        a->priv = police;
        return ret;
@@ -277,10 +261,8 @@ override:
 failure_unlock:
        spin_unlock_bh(&police->tcf_lock);
 failure:
-        if (P_tab)
+        qdisc_put_rtab(P_tab);
-                qdisc_put_rtab(P_tab);
+        qdisc_put_rtab(R_tab);
-        if (R_tab)
-                qdisc_put_rtab(R_tab);
        if (ret == ACT_P_CREATED)
                kfree(police);
        return err;
@@ -407,7 +389,6 @@ static struct tc_action_ops act_police_ops = {
        .act            =       tcf_act_police,
        .dump           =       tcf_act_police_dump,
        .cleanup        =       tcf_act_police_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_act_police_locate,
        .walk           =       tcf_act_police_walker
 };
@@ -415,12 +396,19 @@ static struct tc_action_ops act_police_ops = {
 static int __init
 police_init_module(void)
 {
-        return tcf_register_action(&act_police_ops);
+        int err = tcf_hashinfo_init(&police_hash_info, POL_TAB_MASK);
+        if (err)
+                return err;
+        err = tcf_register_action(&act_police_ops);
+        if (err)
+                tcf_hashinfo_destroy(&police_hash_info);
+        return err;
 }
 static void __exit
 police_cleanup_module(void)
 {
+        tcf_hashinfo_destroy(&police_hash_info);
        tcf_unregister_action(&act_police_ops);
 }
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 7725eb4ab756..81aebc162e5c 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -25,15 +25,8 @@
 #include <net/tc_act/tc_defact.h>
 #define SIMP_TAB_MASK     7
-static struct tcf_common *tcf_simp_ht[SIMP_TAB_MASK + 1];
 static u32 simp_idx_gen;
-static DEFINE_RWLOCK(simp_lock);
+static struct tcf_hashinfo simp_hash_info;
-static struct tcf_hashinfo simp_hash_info = {
-        .htab   =       tcf_simp_ht,
-        .hmask  =       SIMP_TAB_MASK,
-        .lock   =       &simp_lock,
-};
 #define SIMP_MAX_DATA   32
 static int tcf_simp(struct sk_buff *skb, const struct tc_action *a,
@@ -201,7 +194,6 @@ static struct tc_action_ops act_simp_ops = {
        .dump           =       tcf_simp_dump,
        .cleanup        =       tcf_simp_cleanup,
        .init           =       tcf_simp_init,
-        .walk           =       tcf_generic_walker,
 };
 MODULE_AUTHOR("Jamal Hadi Salim(2005)");
@@ -210,14 +202,23 @@ MODULE_LICENSE("GPL");
 static int __init simp_init_module(void)
 {
-        int ret = tcf_register_action(&act_simp_ops);
+        int err, ret;
+        err = tcf_hashinfo_init(&simp_hash_info, SIMP_TAB_MASK);
+        if (err)
+                return err;
+        ret = tcf_register_action(&act_simp_ops);
        if (!ret)
                pr_info("Simple TC action Loaded\n");
+        else
+                tcf_hashinfo_destroy(&simp_hash_info);
        return ret;
 }
 static void __exit simp_cleanup_module(void)
 {
+        tcf_hashinfo_destroy(&simp_hash_info);
        tcf_unregister_action(&act_simp_ops);
 }
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index cb4221171f93..aa0a4c056f31 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -11,8 +11,7 @@
 * more details.
 *
 * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * this program; if not, see <http://www.gnu.org/licenses/>.
- * Place - Suite 330, Boston, MA 02111-1307 USA.
 *
 * Author: Alexander Duyck <alexander.h.duyck@intel.com>
 */
@@ -29,15 +28,8 @@
 #include <net/tc_act/tc_skbedit.h>
 #define SKBEDIT_TAB_MASK     15
-static struct tcf_common *tcf_skbedit_ht[SKBEDIT_TAB_MASK + 1];
 static u32 skbedit_idx_gen;
-static DEFINE_RWLOCK(skbedit_lock);
+static struct tcf_hashinfo skbedit_hash_info;
-static struct tcf_hashinfo skbedit_hash_info = {
-        .htab   =       tcf_skbedit_ht,
-        .hmask  =       SKBEDIT_TAB_MASK,
-        .lock   =       &skbedit_lock,
-};
 static int tcf_skbedit(struct sk_buff *skb, const struct tc_action *a,
                       struct tcf_result *res)
@@ -203,7 +195,6 @@ static struct tc_action_ops act_skbedit_ops = {
        .dump           =       tcf_skbedit_dump,
        .cleanup        =       tcf_skbedit_cleanup,
        .init           =       tcf_skbedit_init,
-        .walk           =       tcf_generic_walker,
 };
 MODULE_AUTHOR("Alexander Duyck, <alexander.h.duyck@intel.com>");
@@ -212,11 +203,15 @@ MODULE_LICENSE("GPL");
 static int __init skbedit_init_module(void)
 {
+        int err = tcf_hashinfo_init(&skbedit_hash_info, SKBEDIT_TAB_MASK);
+        if (err)
+                return err;
        return tcf_register_action(&act_skbedit_ops);
 }
 static void __exit skbedit_cleanup_module(void)
 {
+        tcf_hashinfo_destroy(&skbedit_hash_info);
        tcf_unregister_action(&act_skbedit_ops);
 }
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 8e118af90973..12e882ef596b 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -31,8 +31,7 @@
 #include <net/pkt_cls.h>
 /* The list of all installed classifier types */
+static LIST_HEAD(tcf_proto_base);
-static struct tcf_proto_ops *tcf_proto_base __read_mostly;
 /* Protects list of registered TC modules. It is pure SMP lock. */
 static DEFINE_RWLOCK(cls_mod_lock);
@@ -41,36 +40,35 @@ static DEFINE_RWLOCK(cls_mod_lock);
 static const struct tcf_proto_ops *tcf_proto_lookup_ops(struct nlattr *kind)
 {
-        const struct tcf_proto_ops *t = NULL;
+        const struct tcf_proto_ops *t, *res = NULL;
        if (kind) {
                read_lock(&cls_mod_lock);
-                for (t = tcf_proto_base; t; t = t->next) {
+                list_for_each_entry(t, &tcf_proto_base, head) {
                        if (nla_strcmp(kind, t->kind) == 0) {
-                                if (!try_module_get(t->owner))
+                                if (try_module_get(t->owner))
-                                        t = NULL;
+                                        res = t;
                                break;
                        }
                }
                read_unlock(&cls_mod_lock);
        }
-        return t;
+        return res;
 }
 /* Register(unregister) new classifier type */
 int register_tcf_proto_ops(struct tcf_proto_ops *ops)
 {
-        struct tcf_proto_ops *t, **tp;
+        struct tcf_proto_ops *t;
        int rc = -EEXIST;
        write_lock(&cls_mod_lock);
-        for (tp = &tcf_proto_base; (t = *tp) != NULL; tp = &t->next)
+        list_for_each_entry(t, &tcf_proto_base, head)
                if (!strcmp(ops->kind, t->kind))
                        goto out;
-        ops->next = NULL;
+        list_add_tail(&ops->head, &tcf_proto_base);
-        *tp = ops;
        rc = 0;
 out:
        write_unlock(&cls_mod_lock);
@@ -80,19 +78,17 @@ EXPORT_SYMBOL(register_tcf_proto_ops);
 int unregister_tcf_proto_ops(struct tcf_proto_ops *ops)
 {
-        struct tcf_proto_ops *t, **tp;
+        struct tcf_proto_ops *t;
        int rc = -ENOENT;
        write_lock(&cls_mod_lock);
-        for (tp = &tcf_proto_base; (t = *tp) != NULL; tp = &t->next)
+        list_for_each_entry(t, &tcf_proto_base, head) {
-                if (t == ops)
+                if (t == ops) {
+                        list_del(&t->head);
+                        rc = 0;
                        break;
+                }
-        if (!t)
+        }
-                goto out;
-        *tp = t->next;
-        rc = 0;
-out:
        write_unlock(&cls_mod_lock);
        return rc;
 }
@@ -500,46 +496,41 @@ out:
 void tcf_exts_destroy(struct tcf_proto *tp, struct tcf_exts *exts)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        if (exts->action) {
+        tcf_action_destroy(&exts->actions, TCA_ACT_UNBIND);
-                tcf_action_destroy(exts->action, TCA_ACT_UNBIND);
+        INIT_LIST_HEAD(&exts->actions);
-                exts->action = NULL;
-        }
 #endif
 }
 EXPORT_SYMBOL(tcf_exts_destroy);
 int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb,
-                  struct nlattr *rate_tlv, struct tcf_exts *exts,
+                  struct nlattr *rate_tlv, struct tcf_exts *exts)
-                  const struct tcf_ext_map *map)
 {
-        memset(exts, 0, sizeof(*exts));
 #ifdef CONFIG_NET_CLS_ACT
        {
                struct tc_action *act;
-                if (map->police && tb[map->police]) {
+                INIT_LIST_HEAD(&exts->actions);
-                        act = tcf_action_init_1(net, tb[map->police], rate_tlv,
+                if (exts->police && tb[exts->police]) {
+                        act = tcf_action_init_1(net, tb[exts->police], rate_tlv,
                                                "police", TCA_ACT_NOREPLACE,
                                                TCA_ACT_BIND);
                        if (IS_ERR(act))
                                return PTR_ERR(act);
-                        act->type = TCA_OLD_COMPAT;
+                        act->type = exts->type = TCA_OLD_COMPAT;
-                        exts->action = act;
+                        list_add(&act->list, &exts->actions);
-                } else if (map->action && tb[map->action]) {
+                } else if (exts->action && tb[exts->action]) {
-                        act = tcf_action_init(net, tb[map->action], rate_tlv,
+                        int err;
+                        err = tcf_action_init(net, tb[exts->action], rate_tlv,
                                              NULL, TCA_ACT_NOREPLACE,
-                                              TCA_ACT_BIND);
+                                              TCA_ACT_BIND, &exts->actions);
-                        if (IS_ERR(act))
+                        if (err)
-                                return PTR_ERR(act);
+                                return err;
-                        exts->action = act;
                }
        }
 #else
-        if ((map->action && tb[map->action]) ||
+        if ((exts->action && tb[exts->action]) ||
-            (map->police && tb[map->police]))
+            (exts->police && tb[exts->police]))
                return -EOPNOTSUPP;
 #endif
@@ -551,43 +542,44 @@ void tcf_exts_change(struct tcf_proto *tp, struct tcf_exts *dst,
                     struct tcf_exts *src)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        if (src->action) {
+        if (!list_empty(&src->actions)) {
-                struct tc_action *act;
+                LIST_HEAD(tmp);
                tcf_tree_lock(tp);
-                act = dst->action;
+                list_splice_init(&dst->actions, &tmp);
-                dst->action = src->action;
+                list_splice(&src->actions, &dst->actions);
                tcf_tree_unlock(tp);
-                if (act)
+                tcf_action_destroy(&tmp, TCA_ACT_UNBIND);
-                        tcf_action_destroy(act, TCA_ACT_UNBIND);
        }
 #endif
 }
 EXPORT_SYMBOL(tcf_exts_change);
-int tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts,
+#define tcf_exts_first_act(ext) \
-                  const struct tcf_ext_map *map)
+                list_first_entry(&(exts)->actions, struct tc_action, list)
+int tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        if (map->action && exts->action) {
+        if (exts->action && !list_empty(&exts->actions)) {
                /*
                 * again for backward compatible mode - we want
                 * to work with both old and new modes of entering
                 * tc data even if iproute2  was newer - jhs
                 */
                struct nlattr *nest;
+                if (exts->type != TCA_OLD_COMPAT) {
-                if (exts->action->type != TCA_OLD_COMPAT) {
+                        nest = nla_nest_start(skb, exts->action);
-                        nest = nla_nest_start(skb, map->action);
                        if (nest == NULL)
                                goto nla_put_failure;
-                        if (tcf_action_dump(skb, exts->action, 0, 0) < 0)
+                        if (tcf_action_dump(skb, &exts->actions, 0, 0) < 0)
                                goto nla_put_failure;
                        nla_nest_end(skb, nest);
-                } else if (map->police) {
+                } else if (exts->police) {
-                        nest = nla_nest_start(skb, map->police);
+                        struct tc_action *act = tcf_exts_first_act(exts);
+                        nest = nla_nest_start(skb, exts->police);
                        if (nest == NULL)
                                goto nla_put_failure;
-                        if (tcf_action_dump_old(skb, exts->action, 0, 0) < 0)
+                        if (tcf_action_dump_old(skb, act, 0, 0) < 0)
                                goto nla_put_failure;
                        nla_nest_end(skb, nest);
                }
@@ -600,17 +592,14 @@ nla_put_failure: __attribute__ ((unused))
 EXPORT_SYMBOL(tcf_exts_dump);
-int tcf_exts_dump_stats(struct sk_buff *skb, struct tcf_exts *exts,
+int tcf_exts_dump_stats(struct sk_buff *skb, struct tcf_exts *exts)
-                        const struct tcf_ext_map *map)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        if (exts->action)
+        struct tc_action *a = tcf_exts_first_act(exts);
-                if (tcf_action_copy_stats(skb, exts->action, 1) < 0)
+        if (tcf_action_copy_stats(skb, a, 1) < 0)
-                        goto nla_put_failure;
+                return -1;
 #endif
        return 0;
-nla_put_failure: __attribute__ ((unused))
-        return -1;
 }
 EXPORT_SYMBOL(tcf_exts_dump_stats);
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 636d9131d870..b6552035d1f4 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -34,11 +34,6 @@ struct basic_filter {
        struct list_head        link;
 };
-static const struct tcf_ext_map basic_ext_map = {
-        .action = TCA_BASIC_ACT,
-        .police = TCA_BASIC_POLICE
-};
 static int basic_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                          struct tcf_result *res)
 {
@@ -141,7 +136,8 @@ static int basic_set_parms(struct net *net, struct tcf_proto *tp,
        struct tcf_exts e;
        struct tcf_ematch_tree t;
-        err = tcf_exts_validate(net, tp, tb, est, &e, &basic_ext_map);
+        tcf_exts_init(&e, TCA_BASIC_ACT, TCA_BASIC_POLICE);
+        err = tcf_exts_validate(net, tp, tb, est, &e);
        if (err < 0)
                return err;
@@ -191,6 +187,7 @@ static int basic_change(struct net *net, struct sk_buff *in_skb,
        if (f == NULL)
                goto errout;
+        tcf_exts_init(&f->exts, TCA_BASIC_ACT, TCA_BASIC_POLICE);
        err = -EINVAL;
        if (handle)
                f->handle = handle;
@@ -263,13 +260,13 @@ static int basic_dump(struct tcf_proto *tp, unsigned long fh,
            nla_put_u32(skb, TCA_BASIC_CLASSID, f->res.classid))
                goto nla_put_failure;
-        if (tcf_exts_dump(skb, &f->exts, &basic_ext_map) < 0 ||
+        if (tcf_exts_dump(skb, &f->exts) < 0 ||
            tcf_em_tree_dump(skb, &f->ematches, TCA_BASIC_EMATCHES) < 0)
                goto nla_put_failure;
        nla_nest_end(skb, nest);
-        if (tcf_exts_dump_stats(skb, &f->exts, &basic_ext_map) < 0)
+        if (tcf_exts_dump_stats(skb, &f->exts) < 0)
                goto nla_put_failure;
        return skb->len;
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 1002a8226281..00a5a585e5f1 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -46,11 +46,6 @@ static const struct nla_policy bpf_policy[TCA_BPF_MAX + 1] = {
                                    .len = sizeof(struct sock_filter) * BPF_MAXINSNS },
 };
-static const struct tcf_ext_map bpf_ext_map = {
-        .action = TCA_BPF_ACT,
-        .police = TCA_BPF_POLICE,
-};
 static int cls_bpf_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                            struct tcf_result *res)
 {
@@ -174,7 +169,8 @@ static int cls_bpf_modify_existing(struct net *net, struct tcf_proto *tp,
        if (!tb[TCA_BPF_OPS_LEN] || !tb[TCA_BPF_OPS] || !tb[TCA_BPF_CLASSID])
                return -EINVAL;
-        ret = tcf_exts_validate(net, tp, tb, est, &exts, &bpf_ext_map);
+        tcf_exts_init(&exts, TCA_BPF_ACT, TCA_BPF_POLICE);
+        ret = tcf_exts_validate(net, tp, tb, est, &exts);
        if (ret < 0)
                return ret;
@@ -271,6 +267,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
        if (prog == NULL)
                return -ENOBUFS;
+        tcf_exts_init(&prog->exts, TCA_BPF_ACT, TCA_BPF_POLICE);
        if (handle == 0)
                prog->handle = cls_bpf_grab_new_handle(tp, head);
        else
@@ -323,14 +320,14 @@ static int cls_bpf_dump(struct tcf_proto *tp, unsigned long fh,
        if (nla == NULL)
                goto nla_put_failure;
-        memcpy(nla_data(nla), prog->bpf_ops, nla_len(nla));
+        memcpy(nla_data(nla), prog->bpf_ops, nla_len(nla));
-        if (tcf_exts_dump(skb, &prog->exts, &bpf_ext_map) < 0)
+        if (tcf_exts_dump(skb, &prog->exts) < 0)
                goto nla_put_failure;
        nla_nest_end(skb, nest);
-        if (tcf_exts_dump_stats(skb, &prog->exts, &bpf_ext_map) < 0)
+        if (tcf_exts_dump_stats(skb, &prog->exts) < 0)
                goto nla_put_failure;
        return skb->len;
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 16006c92c3fd..f9d212583ea2 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -172,11 +172,6 @@ static int cls_cgroup_init(struct tcf_proto *tp)
        return 0;
 }
-static const struct tcf_ext_map cgroup_ext_map = {
-        .action = TCA_CGROUP_ACT,
-        .police = TCA_CGROUP_POLICE,
-};
 static const struct nla_policy cgroup_policy[TCA_CGROUP_MAX + 1] = {
        [TCA_CGROUP_EMATCHES]   = { .type = NLA_NESTED },
 };
@@ -203,6 +198,7 @@ static int cls_cgroup_change(struct net *net, struct sk_buff *in_skb,
                if (head == NULL)
                        return -ENOBUFS;
+                tcf_exts_init(&head->exts, TCA_CGROUP_ACT, TCA_CGROUP_POLICE);
                head->handle = handle;
                tcf_tree_lock(tp);
@@ -218,8 +214,8 @@ static int cls_cgroup_change(struct net *net, struct sk_buff *in_skb,
        if (err < 0)
                return err;
-        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e,
+        tcf_exts_init(&e, TCA_CGROUP_ACT, TCA_CGROUP_POLICE);
-                                &cgroup_ext_map);
+        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e);
        if (err < 0)
                return err;
@@ -277,13 +273,13 @@ static int cls_cgroup_dump(struct tcf_proto *tp, unsigned long fh,
        if (nest == NULL)
                goto nla_put_failure;
-        if (tcf_exts_dump(skb, &head->exts, &cgroup_ext_map) < 0 ||
+        if (tcf_exts_dump(skb, &head->exts) < 0 ||
            tcf_em_tree_dump(skb, &head->ematches, TCA_CGROUP_EMATCHES) < 0)
                goto nla_put_failure;
        nla_nest_end(skb, nest);
-        if (tcf_exts_dump_stats(skb, &head->exts, &cgroup_ext_map) < 0)
+        if (tcf_exts_dump_stats(skb, &head->exts) < 0)
                goto nla_put_failure;
        return skb->len;
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 7881e2fccbc2..dfd18a5c3e81 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -56,11 +56,6 @@ struct flow_filter {
        u32                     hashrnd;
 };
-static const struct tcf_ext_map flow_ext_map = {
-        .action = TCA_FLOW_ACT,
-        .police = TCA_FLOW_POLICE,
-};
 static inline u32 addr_fold(void *addr)
 {
        unsigned long a = (unsigned long)addr;
@@ -220,7 +215,7 @@ static u32 flow_get_vlan_tag(const struct sk_buff *skb)
 static u32 flow_get_rxhash(struct sk_buff *skb)
 {
-        return skb_get_rxhash(skb);
+        return skb_get_hash(skb);
 }
 static u32 flow_key_get(struct sk_buff *skb, int key, struct flow_keys *flow)
@@ -397,7 +392,8 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
                        return -EOPNOTSUPP;
        }
-        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e, &flow_ext_map);
+        tcf_exts_init(&e, TCA_FLOW_ACT, TCA_FLOW_POLICE);
+        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e);
        if (err < 0)
                return err;
@@ -455,6 +451,7 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
                f->handle = handle;
                f->mask   = ~0U;
+                tcf_exts_init(&f->exts, TCA_FLOW_ACT, TCA_FLOW_POLICE);
                get_random_bytes(&f->hashrnd, 4);
                f->perturb_timer.function = flow_perturbation;
@@ -608,7 +605,7 @@ static int flow_dump(struct tcf_proto *tp, unsigned long fh,
            nla_put_u32(skb, TCA_FLOW_PERTURB, f->perturb_period / HZ))
                goto nla_put_failure;
-        if (tcf_exts_dump(skb, &f->exts, &flow_ext_map) < 0)
+        if (tcf_exts_dump(skb, &f->exts) < 0)
                goto nla_put_failure;
 #ifdef CONFIG_NET_EMATCH
        if (f->ematches.hdr.nmatches &&
@@ -617,7 +614,7 @@ static int flow_dump(struct tcf_proto *tp, unsigned long fh,
 #endif
        nla_nest_end(skb, nest);
-        if (tcf_exts_dump_stats(skb, &f->exts, &flow_ext_map) < 0)
+        if (tcf_exts_dump_stats(skb, &f->exts) < 0)
                goto nla_put_failure;
        return skb->len;
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 9b97172db84a..3f9cece13807 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -46,11 +46,6 @@ struct fw_filter {
        struct tcf_exts         exts;
 };
-static const struct tcf_ext_map fw_ext_map = {
-        .action = TCA_FW_ACT,
-        .police = TCA_FW_POLICE
-};
 static inline int fw_hash(u32 handle)
 {
        if (HTSIZE == 4096)
@@ -200,7 +195,8 @@ fw_change_attrs(struct net *net, struct tcf_proto *tp, struct fw_filter *f,
        u32 mask;
        int err;
-        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e, &fw_ext_map);
+        tcf_exts_init(&e, TCA_FW_ACT, TCA_FW_POLICE);
+        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e);
        if (err < 0)
                return err;
@@ -280,6 +276,7 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,
        if (f == NULL)
                return -ENOBUFS;
+        tcf_exts_init(&f->exts, TCA_FW_ACT, TCA_FW_POLICE);
        f->id = handle;
        err = fw_change_attrs(net, tp, f, tb, tca, base);
@@ -359,12 +356,12 @@ static int fw_dump(struct tcf_proto *tp, unsigned long fh,
            nla_put_u32(skb, TCA_FW_MASK, head->mask))
                goto nla_put_failure;
-        if (tcf_exts_dump(skb, &f->exts, &fw_ext_map) < 0)
+        if (tcf_exts_dump(skb, &f->exts) < 0)
                goto nla_put_failure;
        nla_nest_end(skb, nest);
-        if (tcf_exts_dump_stats(skb, &f->exts, &fw_ext_map) < 0)
+        if (tcf_exts_dump_stats(skb, &f->exts) < 0)
                goto nla_put_failure;
        return skb->len;
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index 37da567d833e..2473953a5948 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -59,11 +59,6 @@ struct route4_filter {
 #define ROUTE4_FAILURE ((struct route4_filter *)(-1L))
-static const struct tcf_ext_map route_ext_map = {
-        .police = TCA_ROUTE4_POLICE,
-        .action = TCA_ROUTE4_ACT
-};
 static inline int route4_fastmap_hash(u32 id, int iif)
 {
        return id & 0xF;
@@ -347,7 +342,8 @@ static int route4_set_parms(struct net *net, struct tcf_proto *tp,
        struct route4_bucket *b;
        struct tcf_exts e;
-        err = tcf_exts_validate(net, tp, tb, est, &e, &route_ext_map);
+        tcf_exts_init(&e, TCA_ROUTE4_ACT, TCA_ROUTE4_POLICE);
+        err = tcf_exts_validate(net, tp, tb, est, &e);
        if (err < 0)
                return err;
@@ -481,6 +477,7 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,
        if (f == NULL)
                goto errout;
+        tcf_exts_init(&f->exts, TCA_ROUTE4_ACT, TCA_ROUTE4_POLICE);
        err = route4_set_parms(net, tp, base, f, handle, head, tb,
                tca[TCA_RATE], 1);
        if (err < 0)
@@ -589,12 +586,12 @@ static int route4_dump(struct tcf_proto *tp, unsigned long fh,
            nla_put_u32(skb, TCA_ROUTE4_CLASSID, f->res.classid))
                goto nla_put_failure;
-        if (tcf_exts_dump(skb, &f->exts, &route_ext_map) < 0)
+        if (tcf_exts_dump(skb, &f->exts) < 0)
                goto nla_put_failure;
        nla_nest_end(skb, nest);
-        if (tcf_exts_dump_stats(skb, &f->exts, &route_ext_map) < 0)
+        if (tcf_exts_dump_stats(skb, &f->exts) < 0)
                goto nla_put_failure;
        return skb->len;
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 252d8b05872e..4f25c2ac825b 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -116,11 +116,6 @@ static inline unsigned int hash_src(__be32 *src)
        return h & 0xF;
 }
-static struct tcf_ext_map rsvp_ext_map = {
-        .police = TCA_RSVP_POLICE,
-        .action = TCA_RSVP_ACT
-};
 #define RSVP_APPLY_RESULT()                             \
 {                                                       \
        int r = tcf_exts_exec(skb, &f->exts, res);      \
@@ -440,7 +435,8 @@ static int rsvp_change(struct net *net, struct sk_buff *in_skb,
        if (err < 0)
                return err;
-        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e, &rsvp_ext_map);
+        tcf_exts_init(&e, TCA_RSVP_ACT, TCA_RSVP_POLICE);
+        err = tcf_exts_validate(net, tp, tb, tca[TCA_RATE], &e);
        if (err < 0)
                return err;
@@ -471,6 +467,7 @@ static int rsvp_change(struct net *net, struct sk_buff *in_skb,
        if (f == NULL)
                goto errout2;
+        tcf_exts_init(&f->exts, TCA_RSVP_ACT, TCA_RSVP_POLICE);
        h2 = 16;
        if (tb[TCA_RSVP_SRC]) {
                memcpy(f->src, nla_data(tb[TCA_RSVP_SRC]), sizeof(f->src));
@@ -633,12 +630,12 @@ static int rsvp_dump(struct tcf_proto *tp, unsigned long fh,
            nla_put(skb, TCA_RSVP_SRC, sizeof(f->src), f->src))
                goto nla_put_failure;
-        if (tcf_exts_dump(skb, &f->exts, &rsvp_ext_map) < 0)
+        if (tcf_exts_dump(skb, &f->exts) < 0)
                goto nla_put_failure;
        nla_nest_end(skb, nest);
-        if (tcf_exts_dump_stats(skb, &f->exts, &rsvp_ext_map) < 0)
+        if (tcf_exts_dump_stats(skb, &f->exts) < 0)
                goto nla_put_failure;
        return skb->len;
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index b86535a40169..ffad18791c93 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -50,11 +50,6 @@ struct tcindex_data {
        int fall_through;       /* 0: only classify if explicit match */
 };
-static const struct tcf_ext_map tcindex_ext_map = {
-        .police = TCA_TCINDEX_POLICE,
-        .action = TCA_TCINDEX_ACT
-};
 static inline int
 tcindex_filter_is_set(struct tcindex_filter_result *r)
 {
@@ -209,17 +204,21 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
        struct tcindex_filter *f = NULL; /* make gcc behave */
        struct tcf_exts e;
-        err = tcf_exts_validate(net, tp, tb, est, &e, &tcindex_ext_map);
+        tcf_exts_init(&e, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
+        err = tcf_exts_validate(net, tp, tb, est, &e);
        if (err < 0)
                return err;
        memcpy(&cp, p, sizeof(cp));
        memset(&new_filter_result, 0, sizeof(new_filter_result));
+        tcf_exts_init(&new_filter_result.exts, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
        if (old_r)
                memcpy(&cr, r, sizeof(cr));
-        else
+        else {
                memset(&cr, 0, sizeof(cr));
+                tcf_exts_init(&cr.exts, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
+        }
        if (tb[TCA_TCINDEX_HASH])
                cp.hash = nla_get_u32(tb[TCA_TCINDEX_HASH]);
@@ -468,11 +467,11 @@ static int tcindex_dump(struct tcf_proto *tp, unsigned long fh,
                    nla_put_u32(skb, TCA_TCINDEX_CLASSID, r->res.classid))
                        goto nla_put_failure;
-                if (tcf_exts_dump(skb, &r->exts, &tcindex_ext_map) < 0)
+                if (tcf_exts_dump(skb, &r->exts) < 0)
                        goto nla_put_failure;
                nla_nest_end(skb, nest);
-                if (tcf_exts_dump_stats(skb, &r->exts, &tcindex_ext_map) < 0)
+                if (tcf_exts_dump_stats(skb, &r->exts) < 0)
                        goto nla_put_failure;
        }
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index eb07a1e536e6..20f2fb79c747 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -79,11 +79,6 @@ struct tc_u_common {
        u32                     hgenerator;
 };
-static const struct tcf_ext_map u32_ext_map = {
-        .action = TCA_U32_ACT,
-        .police = TCA_U32_POLICE
-};
 static inline unsigned int u32_hash_fold(__be32 key,
                                         const struct tc_u32_sel *sel,
                                         u8 fshift)
@@ -352,7 +347,7 @@ static int u32_destroy_key(struct tcf_proto *tp, struct tc_u_knode *n)
        return 0;
 }
-static int u32_delete_key(struct tcf_proto *tp, struct tc_u_knode* key)
+static int u32_delete_key(struct tcf_proto *tp, struct tc_u_knode *key)
 {
        struct tc_u_knode **kp;
        struct tc_u_hnode *ht = key->ht_up;
@@ -496,7 +491,8 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp,
        int err;
        struct tcf_exts e;
-        err = tcf_exts_validate(net, tp, tb, est, &e, &u32_ext_map);
+        tcf_exts_init(&e, TCA_U32_ACT, TCA_U32_POLICE);
+        err = tcf_exts_validate(net, tp, tb, est, &e);
        if (err < 0)
                return err;
@@ -646,6 +642,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
        n->ht_up = ht;
        n->handle = handle;
        n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0;
+        tcf_exts_init(&n->exts, TCA_U32_ACT, TCA_U32_POLICE);
 #ifdef CONFIG_CLS_U32_MARK
        if (tb[TCA_U32_MARK]) {
@@ -759,7 +756,7 @@ static int u32_dump(struct tcf_proto *tp, unsigned long fh,
                        goto nla_put_failure;
 #endif
-                if (tcf_exts_dump(skb, &n->exts, &u32_ext_map) < 0)
+                if (tcf_exts_dump(skb, &n->exts) < 0)
                        goto nla_put_failure;
 #ifdef CONFIG_NET_CLS_IND
@@ -778,7 +775,7 @@ static int u32_dump(struct tcf_proto *tp, unsigned long fh,
        nla_nest_end(skb, nest);
        if (TC_U32_KEY(n->handle))
-                if (tcf_exts_dump_stats(skb, &n->exts, &u32_ext_map) < 0)
+                if (tcf_exts_dump_stats(skb, &n->exts) < 0)
                        goto nla_put_failure;
        return skb->len;
diff --git a/net/sched/em_meta.c b/net/sched/em_meta.c
index e5cef9567225..9b8c0b0e60d7 100644
--- a/net/sched/em_meta.c
+++ b/net/sched/em_meta.c
@@ -222,7 +222,7 @@ META_COLLECTOR(int_maclen)
 META_COLLECTOR(int_rxhash)
 {
-        dst->value = skb_get_rxhash(skb);
+        dst->value = skb_get_hash(skb);
 }
 /**************************************************************************
@@ -271,40 +271,52 @@ META_COLLECTOR(int_rtiif)
 * Socket Attributes
 **************************************************************************/
-#define SKIP_NONLOCAL(skb)                      \
+#define skip_nonlocal(skb) \
-        if (unlikely(skb->sk == NULL)) {        \
+        (unlikely(skb->sk == NULL))
-                *err = -1;                      \
-                return;                         \
-        }
 META_COLLECTOR(int_sk_family)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_family;
 }
 META_COLLECTOR(int_sk_state)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_state;
 }
 META_COLLECTOR(int_sk_reuse)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_reuse;
 }
 META_COLLECTOR(int_sk_bound_if)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        /* No error if bound_dev_if is 0, legal userspace check */
        dst->value = skb->sk->sk_bound_dev_if;
 }
 META_COLLECTOR(var_sk_bound_if)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        if (skb->sk->sk_bound_dev_if == 0) {
                dst->value = (unsigned long) "any";
@@ -322,151 +334,226 @@ META_COLLECTOR(var_sk_bound_if)
 META_COLLECTOR(int_sk_refcnt)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = atomic_read(&skb->sk->sk_refcnt);
 }
 META_COLLECTOR(int_sk_rcvbuf)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_rcvbuf;
 }
 META_COLLECTOR(int_sk_shutdown)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_shutdown;
 }
 META_COLLECTOR(int_sk_proto)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_protocol;
 }
 META_COLLECTOR(int_sk_type)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_type;
 }
 META_COLLECTOR(int_sk_rmem_alloc)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = sk_rmem_alloc_get(skb->sk);
 }
 META_COLLECTOR(int_sk_wmem_alloc)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = sk_wmem_alloc_get(skb->sk);
 }
 META_COLLECTOR(int_sk_omem_alloc)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = atomic_read(&skb->sk->sk_omem_alloc);
 }
 META_COLLECTOR(int_sk_rcv_qlen)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_receive_queue.qlen;
 }
 META_COLLECTOR(int_sk_snd_qlen)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_write_queue.qlen;
 }
 META_COLLECTOR(int_sk_wmem_queued)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_wmem_queued;
 }
 META_COLLECTOR(int_sk_fwd_alloc)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_forward_alloc;
 }
 META_COLLECTOR(int_sk_sndbuf)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_sndbuf;
 }
 META_COLLECTOR(int_sk_alloc)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = (__force int) skb->sk->sk_allocation;
 }
 META_COLLECTOR(int_sk_hash)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_hash;
 }
 META_COLLECTOR(int_sk_lingertime)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_lingertime / HZ;
 }
 META_COLLECTOR(int_sk_err_qlen)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_error_queue.qlen;
 }
 META_COLLECTOR(int_sk_ack_bl)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_ack_backlog;
 }
 META_COLLECTOR(int_sk_max_ack_bl)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_max_ack_backlog;
 }
 META_COLLECTOR(int_sk_prio)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_priority;
 }
 META_COLLECTOR(int_sk_rcvlowat)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_rcvlowat;
 }
 META_COLLECTOR(int_sk_rcvtimeo)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_rcvtimeo / HZ;
 }
 META_COLLECTOR(int_sk_sndtimeo)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_sndtimeo / HZ;
 }
 META_COLLECTOR(int_sk_sendmsg_off)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_frag.offset;
 }
 META_COLLECTOR(int_sk_write_pend)
 {
-        SKIP_NONLOCAL(skb);
+        if (skip_nonlocal(skb)) {
+                *err = -1;
+                return;
+        }
        dst->value = skb->sk->sk_write_pending;
 }
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index cd81505662b8..1313145e3b86 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -135,7 +135,7 @@ static DEFINE_RWLOCK(qdisc_mod_lock);
 static struct Qdisc_ops *qdisc_base;
-/* Register/uregister queueing discipline */
+/* Register/unregister queueing discipline */
 int register_qdisc(struct Qdisc_ops *qops)
 {
@@ -271,11 +271,15 @@ static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
        return NULL;
 }
-static void qdisc_list_add(struct Qdisc *q)
+void qdisc_list_add(struct Qdisc *q)
 {
+        struct Qdisc *root = qdisc_dev(q)->qdisc;
+        WARN_ON_ONCE(root == &noop_qdisc);
        if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS))
-                list_add_tail(&q->list, &qdisc_dev(q)->qdisc->list);
+                list_add_tail(&q->list, &root->list);
 }
+EXPORT_SYMBOL(qdisc_list_add);
 void qdisc_list_del(struct Qdisc *q)
 {
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 7a42c81a19eb..2f80d01d42a6 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1058,9 +1058,10 @@ static void cbq_normalize_quanta(struct cbq_sched_data *q, int prio)
                                cl->quantum = (cl->weight*cl->allot*q->nclasses[prio])/
                                        q->quanta[prio];
                        }
-                        if (cl->quantum <= 0 || cl->quantum>32*qdisc_dev(cl->qdisc)->mtu) {
+                        if (cl->quantum <= 0 ||
-                                pr_warning("CBQ: class %08x has bad quantum==%ld, repaired.\n",
+                            cl->quantum > 32*qdisc_dev(cl->qdisc)->mtu) {
-                                           cl->common.classid, cl->quantum);
+                                pr_warn("CBQ: class %08x has bad quantum==%ld, repaired.\n",
+                                        cl->common.classid, cl->quantum);
                                cl->quantum = qdisc_dev(cl->qdisc)->mtu/2 + 1;
                        }
                }
@@ -1782,8 +1783,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
                                                    qdisc_root_sleeping_lock(sch),
                                                    tca[TCA_RATE]);
                        if (err) {
-                                if (rtab)
+                                qdisc_put_rtab(rtab);
-                                        qdisc_put_rtab(rtab);
                                return err;
                        }
                }
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 3886365cc207..49d6ef338b55 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -47,7 +47,7 @@ struct dsmark_qdisc_data {
 static inline int dsmark_valid_index(struct dsmark_qdisc_data *p, u16 index)
 {
-        return (index <= p->indices && index > 0);
+        return index <= p->indices && index > 0;
 }
 /* ------------------------- Class/flow operations ------------------------- */
@@ -57,8 +57,8 @@ static int dsmark_graft(struct Qdisc *sch, unsigned long arg,
 {
        struct dsmark_qdisc_data *p = qdisc_priv(sch);
-        pr_debug("dsmark_graft(sch %p,[qdisc %p],new %p,old %p)\n",
+        pr_debug("%s(sch %p,[qdisc %p],new %p,old %p)\n",
-                sch, p, new, old);
+                 __func__, sch, p, new, old);
        if (new == NULL) {
                new = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
@@ -85,8 +85,8 @@ static struct Qdisc *dsmark_leaf(struct Qdisc *sch, unsigned long arg)
 static unsigned long dsmark_get(struct Qdisc *sch, u32 classid)
 {
-        pr_debug("dsmark_get(sch %p,[qdisc %p],classid %x)\n",
+        pr_debug("%s(sch %p,[qdisc %p],classid %x)\n",
-                sch, qdisc_priv(sch), classid);
+                 __func__, sch, qdisc_priv(sch), classid);
        return TC_H_MIN(classid) + 1;
 }
@@ -118,8 +118,8 @@ static int dsmark_change(struct Qdisc *sch, u32 classid, u32 parent,
        int err = -EINVAL;
        u8 mask = 0;
-        pr_debug("dsmark_change(sch %p,[qdisc %p],classid %x,parent %x),"
+        pr_debug("%s(sch %p,[qdisc %p],classid %x,parent %x), arg 0x%lx\n",
-                "arg 0x%lx\n", sch, p, classid, parent, *arg);
+                 __func__, sch, p, classid, parent, *arg);
        if (!dsmark_valid_index(p, *arg)) {
                err = -ENOENT;
@@ -166,7 +166,8 @@ static void dsmark_walk(struct Qdisc *sch, struct qdisc_walker *walker)
        struct dsmark_qdisc_data *p = qdisc_priv(sch);
        int i;
-        pr_debug("dsmark_walk(sch %p,[qdisc %p],walker %p)\n", sch, p, walker);
+        pr_debug("%s(sch %p,[qdisc %p],walker %p)\n",
+                 __func__, sch, p, walker);
        if (walker->stop)
                return;
@@ -199,7 +200,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        struct dsmark_qdisc_data *p = qdisc_priv(sch);
        int err;
-        pr_debug("dsmark_enqueue(skb %p,sch %p,[qdisc %p])\n", skb, sch, p);
+        pr_debug("%s(skb %p,sch %p,[qdisc %p])\n", __func__, skb, sch, p);
        if (p->set_tc_index) {
                switch (skb->protocol) {
@@ -275,7 +276,7 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
        struct sk_buff *skb;
        u32 index;
-        pr_debug("dsmark_dequeue(sch %p,[qdisc %p])\n", sch, p);
+        pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
        skb = p->q->ops->dequeue(p->q);
        if (skb == NULL)
@@ -303,8 +304,8 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
                 * and don't need yet another qdisc as a bypass.
                 */
                if (p->mask[index] != 0xff || p->value[index])
-                        pr_warning("dsmark_dequeue: unsupported protocol %d\n",
+                        pr_warn("%s: unsupported protocol %d\n",
-                                   ntohs(skb->protocol));
+                                __func__, ntohs(skb->protocol));
                break;
        }
@@ -315,7 +316,7 @@ static struct sk_buff *dsmark_peek(struct Qdisc *sch)
 {
        struct dsmark_qdisc_data *p = qdisc_priv(sch);
-        pr_debug("dsmark_peek(sch %p,[qdisc %p])\n", sch, p);
+        pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
        return p->q->ops->peek(p->q);
 }
@@ -325,7 +326,7 @@ static unsigned int dsmark_drop(struct Qdisc *sch)
        struct dsmark_qdisc_data *p = qdisc_priv(sch);
        unsigned int len;
-        pr_debug("dsmark_reset(sch %p,[qdisc %p])\n", sch, p);
+        pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
        if (p->q->ops->drop == NULL)
                return 0;
@@ -346,7 +347,7 @@ static int dsmark_init(struct Qdisc *sch, struct nlattr *opt)
        u16 indices;
        u8 *mask;
-        pr_debug("dsmark_init(sch %p,[qdisc %p],opt %p)\n", sch, p, opt);
+        pr_debug("%s(sch %p,[qdisc %p],opt %p)\n", __func__, sch, p, opt);
        if (!opt)
                goto errout;
@@ -384,7 +385,7 @@ static int dsmark_init(struct Qdisc *sch, struct nlattr *opt)
        if (p->q == NULL)
                p->q = &noop_qdisc;
-        pr_debug("dsmark_init: qdisc %p\n", p->q);
+        pr_debug("%s: qdisc %p\n", __func__, p->q);
        err = 0;
 errout:
@@ -395,7 +396,7 @@ static void dsmark_reset(struct Qdisc *sch)
 {
        struct dsmark_qdisc_data *p = qdisc_priv(sch);
-        pr_debug("dsmark_reset(sch %p,[qdisc %p])\n", sch, p);
+        pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
        qdisc_reset(p->q);
        sch->q.qlen = 0;
 }
@@ -404,7 +405,7 @@ static void dsmark_destroy(struct Qdisc *sch)
 {
        struct dsmark_qdisc_data *p = qdisc_priv(sch);
-        pr_debug("dsmark_destroy(sch %p,[qdisc %p])\n", sch, p);
+        pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p);
        tcf_destroy_chain(&p->filter_list);
        qdisc_destroy(p->q);
@@ -417,7 +418,7 @@ static int dsmark_dump_class(struct Qdisc *sch, unsigned long cl,
        struct dsmark_qdisc_data *p = qdisc_priv(sch);
        struct nlattr *opts = NULL;
-        pr_debug("dsmark_dump_class(sch %p,[qdisc %p],class %ld\n", sch, p, cl);
+        pr_debug("%s(sch %p,[qdisc %p],class %ld\n", __func__, sch, p, cl);
        if (!dsmark_valid_index(p, cl))
                return -EINVAL;
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index 95d843961907..08ef7a42c0e4 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -47,6 +47,7 @@
 #include <linux/rbtree.h>
 #include <linux/hash.h>
 #include <linux/prefetch.h>
+#include <linux/vmalloc.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
 #include <net/sock.h>
@@ -225,7 +226,7 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q)
                /* By forcing low order bit to 1, we make sure to not
                 * collide with a local flow (socket pointers are word aligned)
                 */
-                sk = (struct sock *)(skb_get_rxhash(skb) | 1L);
+                sk = (struct sock *)(skb_get_hash(skb) | 1L);
        }
        root = &q->fq_root[hash_32((u32)(long)sk, q->fq_trees_log)];
@@ -578,15 +579,36 @@ static void fq_rehash(struct fq_sched_data *q,
        q->stat_gc_flows += fcnt;
 }
-static int fq_resize(struct fq_sched_data *q, u32 log)
+static void *fq_alloc_node(size_t sz, int node)
 {
+        void *ptr;
+        ptr = kmalloc_node(sz, GFP_KERNEL | __GFP_REPEAT | __GFP_NOWARN, node);
+        if (!ptr)
+                ptr = vmalloc_node(sz, node);
+        return ptr;
+}
+static void fq_free(void *addr)
+{
+        if (addr && is_vmalloc_addr(addr))
+                vfree(addr);
+        else
+                kfree(addr);
+}
+static int fq_resize(struct Qdisc *sch, u32 log)
+{
+        struct fq_sched_data *q = qdisc_priv(sch);
        struct rb_root *array;
        u32 idx;
        if (q->fq_root && log == q->fq_trees_log)
                return 0;
-        array = kmalloc(sizeof(struct rb_root) << log, GFP_KERNEL);
+        /* If XPS was setup, we can allocate memory on right NUMA node */
+        array = fq_alloc_node(sizeof(struct rb_root) << log,
+                              netdev_queue_numa_node_read(sch->dev_queue));
        if (!array)
                return -ENOMEM;
@@ -595,7 +617,7 @@ static int fq_resize(struct fq_sched_data *q, u32 log)
        if (q->fq_root) {
                fq_rehash(q, q->fq_root, q->fq_trees_log, array, log);
-                kfree(q->fq_root);
+                fq_free(q->fq_root);
        }
        q->fq_root = array;
        q->fq_trees_log = log;
@@ -676,7 +698,7 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
        }
        if (!err)
-                err = fq_resize(q, fq_log);
+                err = fq_resize(sch, fq_log);
        while (sch->q.qlen > sch->limit) {
                struct sk_buff *skb = fq_dequeue(sch);
@@ -697,7 +719,7 @@ static void fq_destroy(struct Qdisc *sch)
        struct fq_sched_data *q = qdisc_priv(sch);
        fq_reset(sch);
-        kfree(q->fq_root);
+        fq_free(q->fq_root);
        qdisc_watchdog_cancel(&q->watchdog);
 }
@@ -723,7 +745,7 @@ static int fq_init(struct Qdisc *sch, struct nlattr *opt)
        if (opt)
                err = fq_change(sch, opt);
        else
-                err = fq_resize(q, q->fq_trees_log);
+                err = fq_resize(sch, q->fq_trees_log);
        return err;
 }
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 922a09406ba7..32bb942d2faa 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -338,13 +338,13 @@ EXPORT_SYMBOL(netif_carrier_off);
   cheaper.
 */
-static int noop_enqueue(struct sk_buff *skb, struct Qdisc * qdisc)
+static int noop_enqueue(struct sk_buff *skb, struct Qdisc *qdisc)
 {
        kfree_skb(skb);
        return NET_XMIT_CN;
 }
-static struct sk_buff *noop_dequeue(struct Qdisc * qdisc)
+static struct sk_buff *noop_dequeue(struct Qdisc *qdisc)
 {
        return NULL;
 }
@@ -718,8 +718,8 @@ static void attach_default_qdiscs(struct net_device *dev)
        } else {
                qdisc = qdisc_create_dflt(txq, &mq_qdisc_ops, TC_H_ROOT);
                if (qdisc) {
-                        qdisc->ops->attach(qdisc);
                        dev->qdisc = qdisc;
+                        qdisc->ops->attach(qdisc);
                }
        }
 }
diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
index d42234c0f13b..12cbc09157fc 100644
--- a/net/sched/sch_gred.c
+++ b/net/sched/sch_gred.c
@@ -370,8 +370,8 @@ static inline int gred_change_table_def(struct Qdisc *sch, struct nlattr *dps)
        for (i = table->DPs; i < MAX_DPs; i++) {
                if (table->tab[i]) {
-                        pr_warning("GRED: Warning: Destroying "
+                        pr_warn("GRED: Warning: Destroying shadowed VQ 0x%x\n",
-                                   "shadowed VQ 0x%x\n", i);
+                                i);
                        gred_destroy_vq(table->tab[i]);
                        table->tab[i] = NULL;
                }
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
new file mode 100644
index 000000000000..cf7f614e841b
--- /dev/null
+++ b/net/sched/sch_hhf.c
@@ -0,0 +1,745 @@
+/* net/sched/sch_hhf.c          Heavy-Hitter Filter (HHF)
+ *
+ * Copyright (C) 2013 Terry Lam <vtlam@google.com>
+ * Copyright (C) 2013 Nandita Dukkipati <nanditad@google.com>
+ */
+#include <linux/jhash.h>
+#include <linux/jiffies.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/vmalloc.h>
+#include <net/flow_keys.h>
+#include <net/pkt_sched.h>
+#include <net/sock.h>
+/*      Heavy-Hitter Filter (HHF)
+ *
+ * Principles :
+ * Flows are classified into two buckets: non-heavy-hitter and heavy-hitter
+ * buckets. Initially, a new flow starts as non-heavy-hitter. Once classified
+ * as heavy-hitter, it is immediately switched to the heavy-hitter bucket.
+ * The buckets are dequeued by a Weighted Deficit Round Robin (WDRR) scheduler,
+ * in which the heavy-hitter bucket is served with less weight.
+ * In other words, non-heavy-hitters (e.g., short bursts of critical traffic)
+ * are isolated from heavy-hitters (e.g., persistent bulk traffic) and also have
+ * higher share of bandwidth.
+ *
+ * To capture heavy-hitters, we use the "multi-stage filter" algorithm in the
+ * following paper:
+ * [EV02] C. Estan and G. Varghese, "New Directions in Traffic Measurement and
+ * Accounting", in ACM SIGCOMM, 2002.
+ *
+ * Conceptually, a multi-stage filter comprises k independent hash functions
+ * and k counter arrays. Packets are indexed into k counter arrays by k hash
+ * functions, respectively. The counters are then increased by the packet sizes.
+ * Therefore,
+ *    - For a heavy-hitter flow: *all* of its k array counters must be large.
+ *    - For a non-heavy-hitter flow: some of its k array counters can be large
+ *      due to hash collision with other small flows; however, with high
+ *      probability, not *all* k counters are large.
+ *
+ * By the design of the multi-stage filter algorithm, the false negative rate
+ * (heavy-hitters getting away uncaptured) is zero. However, the algorithm is
+ * susceptible to false positives (non-heavy-hitters mistakenly classified as
+ * heavy-hitters).
+ * Therefore, we also implement the following optimizations to reduce false
+ * positives by avoiding unnecessary increment of the counter values:
+ *    - Optimization O1: once a heavy-hitter is identified, its bytes are not
+ *        accounted in the array counters. This technique is called "shielding"
+ *        in Section 3.3.1 of [EV02].
+ *    - Optimization O2: conservative update of counters
+ *                       (Section 3.3.2 of [EV02]),
+ *        New counter value = max {old counter value,
+ *                                 smallest counter value + packet bytes}
+ *
+ * Finally, we refresh the counters periodically since otherwise the counter
+ * values will keep accumulating.
+ *
+ * Once a flow is classified as heavy-hitter, we also save its per-flow state
+ * in an exact-matching flow table so that its subsequent packets can be
+ * dispatched to the heavy-hitter bucket accordingly.
+ *
+ *
+ * At a high level, this qdisc works as follows:
+ * Given a packet p:
+ *   - If the flow-id of p (e.g., TCP 5-tuple) is already in the exact-matching
+ *     heavy-hitter flow table, denoted table T, then send p to the heavy-hitter
+ *     bucket.
+ *   - Otherwise, forward p to the multi-stage filter, denoted filter F
+ *        + If F decides that p belongs to a non-heavy-hitter flow, then send p
+ *          to the non-heavy-hitter bucket.
+ *        + Otherwise, if F decides that p belongs to a new heavy-hitter flow,
+ *          then set up a new flow entry for the flow-id of p in the table T and
+ *          send p to the heavy-hitter bucket.
+ *
+ * In this implementation:
+ *   - T is a fixed-size hash-table with 1024 entries. Hash collision is
+ *     resolved by linked-list chaining.
+ *   - F has four counter arrays, each array containing 1024 32-bit counters.
+ *     That means 4 * 1024 * 32 bits = 16KB of memory.
+ *   - Since each array in F contains 1024 counters, 10 bits are sufficient to
+ *     index into each array.
+ *     Hence, instead of having four hash functions, we chop the 32-bit
+ *     skb-hash into three 10-bit chunks, and the remaining 10-bit chunk is
+ *     computed as XOR sum of those three chunks.
+ *   - We need to clear the counter arrays periodically; however, directly
+ *     memsetting 16KB of memory can lead to cache eviction and unwanted delay.
+ *     So by representing each counter by a valid bit, we only need to reset
+ *     4K of 1 bit (i.e. 512 bytes) instead of 16KB of memory.
+ *   - The Deficit Round Robin engine is taken from fq_codel implementation
+ *     (net/sched/sch_fq_codel.c). Note that wdrr_bucket corresponds to
+ *     fq_codel_flow in fq_codel implementation.
+ *
+ */
+/* Non-configurable parameters */
+#define HH_FLOWS_CNT     1024  /* number of entries in exact-matching table T */
+#define HHF_ARRAYS_CNT   4     /* number of arrays in multi-stage filter F */
+#define HHF_ARRAYS_LEN   1024  /* number of counters in each array of F */
+#define HHF_BIT_MASK_LEN 10    /* masking 10 bits */
+#define HHF_BIT_MASK     0x3FF /* bitmask of 10 bits */
+#define WDRR_BUCKET_CNT  2     /* two buckets for Weighted DRR */
+enum wdrr_bucket_idx {
+        WDRR_BUCKET_FOR_HH      = 0, /* bucket id for heavy-hitters */
+        WDRR_BUCKET_FOR_NON_HH  = 1  /* bucket id for non-heavy-hitters */
+};
+#define hhf_time_before(a, b)   \
+        (typecheck(u32, a) && typecheck(u32, b) && ((s32)((a) - (b)) < 0))
+/* Heavy-hitter per-flow state */
+struct hh_flow_state {
+        u32              hash_id;       /* hash of flow-id (e.g. TCP 5-tuple) */
+        u32              hit_timestamp; /* last time heavy-hitter was seen */
+        struct list_head flowchain;     /* chaining under hash collision */
+};
+/* Weighted Deficit Round Robin (WDRR) scheduler */
+struct wdrr_bucket {
+        struct sk_buff    *head;
+        struct sk_buff    *tail;
+        struct list_head  bucketchain;
+        int               deficit;
+};
+struct hhf_sched_data {
+        struct wdrr_bucket buckets[WDRR_BUCKET_CNT];
+        u32                perturbation;   /* hash perturbation */
+        u32                quantum;        /* psched_mtu(qdisc_dev(sch)); */
+        u32                drop_overlimit; /* number of times max qdisc packet
+                                            * limit was hit
+                                            */
+        struct list_head   *hh_flows;       /* table T (currently active HHs) */
+        u32                hh_flows_limit;            /* max active HH allocs */
+        u32                hh_flows_overlimit; /* num of disallowed HH allocs */
+        u32                hh_flows_total_cnt;          /* total admitted HHs */
+        u32                hh_flows_current_cnt;        /* total current HHs  */
+        u32                *hhf_arrays[HHF_ARRAYS_CNT]; /* HH filter F */
+        u32                hhf_arrays_reset_timestamp;  /* last time hhf_arrays
+                                                         * was reset
+                                                         */
+        unsigned long      *hhf_valid_bits[HHF_ARRAYS_CNT]; /* shadow valid bits
+                                                             * of hhf_arrays
+                                                             */
+        /* Similar to the "new_flows" vs. "old_flows" concept in fq_codel DRR */
+        struct list_head   new_buckets; /* list of new buckets */
+        struct list_head   old_buckets; /* list of old buckets */
+        /* Configurable HHF parameters */
+        u32                hhf_reset_timeout; /* interval to reset counter
+                                               * arrays in filter F
+                                               * (default 40ms)
+                                               */
+        u32                hhf_admit_bytes;   /* counter thresh to classify as
+                                               * HH (default 128KB).
+                                               * With these default values,
+                                               * 128KB / 40ms = 25 Mbps
+                                               * i.e., we expect to capture HHs
+                                               * sending > 25 Mbps.
+                                               */
+        u32                hhf_evict_timeout; /* aging threshold to evict idle
+                                               * HHs out of table T. This should
+                                               * be large enough to avoid
+                                               * reordering during HH eviction.
+                                               * (default 1s)
+                                               */
+        u32                hhf_non_hh_weight; /* WDRR weight for non-HHs
+                                               * (default 2,
+                                               *  i.e., non-HH : HH = 2 : 1)
+                                               */
+};
+static u32 hhf_time_stamp(void)
+{
+        return jiffies;
+}
+static unsigned int skb_hash(const struct hhf_sched_data *q,
+                             const struct sk_buff *skb)
+{
+        struct flow_keys keys;
+        unsigned int hash;
+        if (skb->sk && skb->sk->sk_hash)
+                return skb->sk->sk_hash;
+        skb_flow_dissect(skb, &keys);
+        hash = jhash_3words((__force u32)keys.dst,
+                            (__force u32)keys.src ^ keys.ip_proto,
+                            (__force u32)keys.ports, q->perturbation);
+        return hash;
+}
+/* Looks up a heavy-hitter flow in a chaining list of table T. */
+static struct hh_flow_state *seek_list(const u32 hash,
+                                       struct list_head *head,
+                                       struct hhf_sched_data *q)
+{
+        struct hh_flow_state *flow, *next;
+        u32 now = hhf_time_stamp();
+        if (list_empty(head))
+                return NULL;
+        list_for_each_entry_safe(flow, next, head, flowchain) {
+                u32 prev = flow->hit_timestamp + q->hhf_evict_timeout;
+                if (hhf_time_before(prev, now)) {
+                        /* Delete expired heavy-hitters, but preserve one entry
+                         * to avoid kzalloc() when next time this slot is hit.
+                         */
+                        if (list_is_last(&flow->flowchain, head))
+                                return NULL;
+                        list_del(&flow->flowchain);
+                        kfree(flow);
+                        q->hh_flows_current_cnt--;
+                } else if (flow->hash_id == hash) {
+                        return flow;
+                }
+        }
+        return NULL;
+}
+/* Returns a flow state entry for a new heavy-hitter.  Either reuses an expired
+ * entry or dynamically alloc a new entry.
+ */
+static struct hh_flow_state *alloc_new_hh(struct list_head *head,
+                                          struct hhf_sched_data *q)
+{
+        struct hh_flow_state *flow;
+        u32 now = hhf_time_stamp();
+        if (!list_empty(head)) {
+                /* Find an expired heavy-hitter flow entry. */
+                list_for_each_entry(flow, head, flowchain) {
+                        u32 prev = flow->hit_timestamp + q->hhf_evict_timeout;
+                        if (hhf_time_before(prev, now))
+                                return flow;
+                }
+        }
+        if (q->hh_flows_current_cnt >= q->hh_flows_limit) {
+                q->hh_flows_overlimit++;
+                return NULL;
+        }
+        /* Create new entry. */
+        flow = kzalloc(sizeof(struct hh_flow_state), GFP_ATOMIC);
+        if (!flow)
+                return NULL;
+        q->hh_flows_current_cnt++;
+        INIT_LIST_HEAD(&flow->flowchain);
+        list_add_tail(&flow->flowchain, head);
+        return flow;
+}
+/* Assigns packets to WDRR buckets.  Implements a multi-stage filter to
+ * classify heavy-hitters.
+ */
+static enum wdrr_bucket_idx hhf_classify(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct hhf_sched_data *q = qdisc_priv(sch);
+        u32 tmp_hash, hash;
+        u32 xorsum, filter_pos[HHF_ARRAYS_CNT], flow_pos;
+        struct hh_flow_state *flow;
+        u32 pkt_len, min_hhf_val;
+        int i;
+        u32 prev;
+        u32 now = hhf_time_stamp();
+        /* Reset the HHF counter arrays if this is the right time. */
+        prev = q->hhf_arrays_reset_timestamp + q->hhf_reset_timeout;
+        if (hhf_time_before(prev, now)) {
+                for (i = 0; i < HHF_ARRAYS_CNT; i++)
+                        bitmap_zero(q->hhf_valid_bits[i], HHF_ARRAYS_LEN);
+                q->hhf_arrays_reset_timestamp = now;
+        }
+        /* Get hashed flow-id of the skb. */
+        hash = skb_hash(q, skb);
+        /* Check if this packet belongs to an already established HH flow. */
+        flow_pos = hash & HHF_BIT_MASK;
+        flow = seek_list(hash, &q->hh_flows[flow_pos], q);
+        if (flow) { /* found its HH flow */
+                flow->hit_timestamp = now;
+                return WDRR_BUCKET_FOR_HH;
+        }
+        /* Now pass the packet through the multi-stage filter. */
+        tmp_hash = hash;
+        xorsum = 0;
+        for (i = 0; i < HHF_ARRAYS_CNT - 1; i++) {
+                /* Split the skb_hash into three 10-bit chunks. */
+                filter_pos[i] = tmp_hash & HHF_BIT_MASK;
+                xorsum ^= filter_pos[i];
+                tmp_hash >>= HHF_BIT_MASK_LEN;
+        }
+        /* The last chunk is computed as XOR sum of other chunks. */
+        filter_pos[HHF_ARRAYS_CNT - 1] = xorsum ^ tmp_hash;
+        pkt_len = qdisc_pkt_len(skb);
+        min_hhf_val = ~0U;
+        for (i = 0; i < HHF_ARRAYS_CNT; i++) {
+                u32 val;
+                if (!test_bit(filter_pos[i], q->hhf_valid_bits[i])) {
+                        q->hhf_arrays[i][filter_pos[i]] = 0;
+                        __set_bit(filter_pos[i], q->hhf_valid_bits[i]);
+                }
+                val = q->hhf_arrays[i][filter_pos[i]] + pkt_len;
+                if (min_hhf_val > val)
+                        min_hhf_val = val;
+        }
+        /* Found a new HH iff all counter values > HH admit threshold. */
+        if (min_hhf_val > q->hhf_admit_bytes) {
+                /* Just captured a new heavy-hitter. */
+                flow = alloc_new_hh(&q->hh_flows[flow_pos], q);
+                if (!flow) /* memory alloc problem */
+                        return WDRR_BUCKET_FOR_NON_HH;
+                flow->hash_id = hash;
+                flow->hit_timestamp = now;
+                q->hh_flows_total_cnt++;
+                /* By returning without updating counters in q->hhf_arrays,
+                 * we implicitly implement "shielding" (see Optimization O1).
+                 */
+                return WDRR_BUCKET_FOR_HH;
+        }
+        /* Conservative update of HHF arrays (see Optimization O2). */
+        for (i = 0; i < HHF_ARRAYS_CNT; i++) {
+                if (q->hhf_arrays[i][filter_pos[i]] < min_hhf_val)
+                        q->hhf_arrays[i][filter_pos[i]] = min_hhf_val;
+        }
+        return WDRR_BUCKET_FOR_NON_HH;
+}
+/* Removes one skb from head of bucket. */
+static struct sk_buff *dequeue_head(struct wdrr_bucket *bucket)
+{
+        struct sk_buff *skb = bucket->head;
+        bucket->head = skb->next;
+        skb->next = NULL;
+        return skb;
+}
+/* Tail-adds skb to bucket. */
+static void bucket_add(struct wdrr_bucket *bucket, struct sk_buff *skb)
+{
+        if (bucket->head == NULL)
+                bucket->head = skb;
+        else
+                bucket->tail->next = skb;
+        bucket->tail = skb;
+        skb->next = NULL;
+}
+static unsigned int hhf_drop(struct Qdisc *sch)
+{
+        struct hhf_sched_data *q = qdisc_priv(sch);
+        struct wdrr_bucket *bucket;
+        /* Always try to drop from heavy-hitters first. */
+        bucket = &q->buckets[WDRR_BUCKET_FOR_HH];
+        if (!bucket->head)
+                bucket = &q->buckets[WDRR_BUCKET_FOR_NON_HH];
+        if (bucket->head) {
+                struct sk_buff *skb = dequeue_head(bucket);
+                sch->q.qlen--;
+                sch->qstats.drops++;
+                sch->qstats.backlog -= qdisc_pkt_len(skb);
+                kfree_skb(skb);
+        }
+        /* Return id of the bucket from which the packet was dropped. */
+        return bucket - q->buckets;
+}
+static int hhf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct hhf_sched_data *q = qdisc_priv(sch);
+        enum wdrr_bucket_idx idx;
+        struct wdrr_bucket *bucket;
+        idx = hhf_classify(skb, sch);
+        bucket = &q->buckets[idx];
+        bucket_add(bucket, skb);
+        sch->qstats.backlog += qdisc_pkt_len(skb);
+        if (list_empty(&bucket->bucketchain)) {
+                unsigned int weight;
+                /* The logic of new_buckets vs. old_buckets is the same as
+                 * new_flows vs. old_flows in the implementation of fq_codel,
+                 * i.e., short bursts of non-HHs should have strict priority.
+                 */
+                if (idx == WDRR_BUCKET_FOR_HH) {
+                        /* Always move heavy-hitters to old bucket. */
+                        weight = 1;
+                        list_add_tail(&bucket->bucketchain, &q->old_buckets);
+                } else {
+                        weight = q->hhf_non_hh_weight;
+                        list_add_tail(&bucket->bucketchain, &q->new_buckets);
+                }
+                bucket->deficit = weight * q->quantum;
+        }
+        if (++sch->q.qlen < sch->limit)
+                return NET_XMIT_SUCCESS;
+        q->drop_overlimit++;
+        /* Return Congestion Notification only if we dropped a packet from this
+         * bucket.
+         */
+        if (hhf_drop(sch) == idx)
+                return NET_XMIT_CN;
+        /* As we dropped a packet, better let upper stack know this. */
+        qdisc_tree_decrease_qlen(sch, 1);
+        return NET_XMIT_SUCCESS;
+}
+static struct sk_buff *hhf_dequeue(struct Qdisc *sch)
+{
+        struct hhf_sched_data *q = qdisc_priv(sch);
+        struct sk_buff *skb = NULL;
+        struct wdrr_bucket *bucket;
+        struct list_head *head;
+begin:
+        head = &q->new_buckets;
+        if (list_empty(head)) {
+                head = &q->old_buckets;
+                if (list_empty(head))
+                        return NULL;
+        }
+        bucket = list_first_entry(head, struct wdrr_bucket, bucketchain);
+        if (bucket->deficit <= 0) {
+                int weight = (bucket - q->buckets == WDRR_BUCKET_FOR_HH) ?
+                              1 : q->hhf_non_hh_weight;
+                bucket->deficit += weight * q->quantum;
+                list_move_tail(&bucket->bucketchain, &q->old_buckets);
+                goto begin;
+        }
+        if (bucket->head) {
+                skb = dequeue_head(bucket);
+                sch->q.qlen--;
+                sch->qstats.backlog -= qdisc_pkt_len(skb);
+        }
+        if (!skb) {
+                /* Force a pass through old_buckets to prevent starvation. */
+                if ((head == &q->new_buckets) && !list_empty(&q->old_buckets))
+                        list_move_tail(&bucket->bucketchain, &q->old_buckets);
+                else
+                        list_del_init(&bucket->bucketchain);
+                goto begin;
+        }
+        qdisc_bstats_update(sch, skb);
+        bucket->deficit -= qdisc_pkt_len(skb);
+        return skb;
+}
+static void hhf_reset(struct Qdisc *sch)
+{
+        struct sk_buff *skb;
+        while ((skb = hhf_dequeue(sch)) != NULL)
+                kfree_skb(skb);
+}
+static void *hhf_zalloc(size_t sz)
+{
+        void *ptr = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN);
+        if (!ptr)
+                ptr = vzalloc(sz);
+        return ptr;
+}
+static void hhf_free(void *addr)
+{
+        if (addr) {
+                if (is_vmalloc_addr(addr))
+                        vfree(addr);
+                else
+                        kfree(addr);
+        }
+}
+static void hhf_destroy(struct Qdisc *sch)
+{
+        int i;
+        struct hhf_sched_data *q = qdisc_priv(sch);
+        for (i = 0; i < HHF_ARRAYS_CNT; i++) {
+                hhf_free(q->hhf_arrays[i]);
+                hhf_free(q->hhf_valid_bits[i]);
+        }
+        for (i = 0; i < HH_FLOWS_CNT; i++) {
+                struct hh_flow_state *flow, *next;
+                struct list_head *head = &q->hh_flows[i];
+                if (list_empty(head))
+                        continue;
+                list_for_each_entry_safe(flow, next, head, flowchain) {
+                        list_del(&flow->flowchain);
+                        kfree(flow);
+                }
+        }
+        hhf_free(q->hh_flows);
+}
+static const struct nla_policy hhf_policy[TCA_HHF_MAX + 1] = {
+        [TCA_HHF_BACKLOG_LIMIT]  = { .type = NLA_U32 },
+        [TCA_HHF_QUANTUM]        = { .type = NLA_U32 },
+        [TCA_HHF_HH_FLOWS_LIMIT] = { .type = NLA_U32 },
+        [TCA_HHF_RESET_TIMEOUT]  = { .type = NLA_U32 },
+        [TCA_HHF_ADMIT_BYTES]    = { .type = NLA_U32 },
+        [TCA_HHF_EVICT_TIMEOUT]  = { .type = NLA_U32 },
+        [TCA_HHF_NON_HH_WEIGHT]  = { .type = NLA_U32 },
+};
+static int hhf_change(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct hhf_sched_data *q = qdisc_priv(sch);
+        struct nlattr *tb[TCA_HHF_MAX + 1];
+        unsigned int qlen;
+        int err;
+        u64 non_hh_quantum;
+        u32 new_quantum = q->quantum;
+        u32 new_hhf_non_hh_weight = q->hhf_non_hh_weight;
+        if (!opt)
+                return -EINVAL;
+        err = nla_parse_nested(tb, TCA_HHF_MAX, opt, hhf_policy);
+        if (err < 0)
+                return err;
+        sch_tree_lock(sch);
+        if (tb[TCA_HHF_BACKLOG_LIMIT])
+                sch->limit = nla_get_u32(tb[TCA_HHF_BACKLOG_LIMIT]);
+        if (tb[TCA_HHF_QUANTUM])
+                new_quantum = nla_get_u32(tb[TCA_HHF_QUANTUM]);
+        if (tb[TCA_HHF_NON_HH_WEIGHT])
+                new_hhf_non_hh_weight = nla_get_u32(tb[TCA_HHF_NON_HH_WEIGHT]);
+        non_hh_quantum = (u64)new_quantum * new_hhf_non_hh_weight;
+        if (non_hh_quantum > INT_MAX)
+                return -EINVAL;
+        q->quantum = new_quantum;
+        q->hhf_non_hh_weight = new_hhf_non_hh_weight;
+        if (tb[TCA_HHF_HH_FLOWS_LIMIT])
+                q->hh_flows_limit = nla_get_u32(tb[TCA_HHF_HH_FLOWS_LIMIT]);
+        if (tb[TCA_HHF_RESET_TIMEOUT]) {
+                u32 ms = nla_get_u32(tb[TCA_HHF_RESET_TIMEOUT]);
+                q->hhf_reset_timeout = msecs_to_jiffies(ms);
+        }
+        if (tb[TCA_HHF_ADMIT_BYTES])
+                q->hhf_admit_bytes = nla_get_u32(tb[TCA_HHF_ADMIT_BYTES]);
+        if (tb[TCA_HHF_EVICT_TIMEOUT]) {
+                u32 ms = nla_get_u32(tb[TCA_HHF_EVICT_TIMEOUT]);
+                q->hhf_evict_timeout = msecs_to_jiffies(ms);
+        }
+        qlen = sch->q.qlen;
+        while (sch->q.qlen > sch->limit) {
+                struct sk_buff *skb = hhf_dequeue(sch);
+                kfree_skb(skb);
+        }
+        qdisc_tree_decrease_qlen(sch, qlen - sch->q.qlen);
+        sch_tree_unlock(sch);
+        return 0;
+}
+static int hhf_init(struct Qdisc *sch, struct nlattr *opt)
+{
+        struct hhf_sched_data *q = qdisc_priv(sch);
+        int i;
+        sch->limit = 1000;
+        q->quantum = psched_mtu(qdisc_dev(sch));
+        q->perturbation = net_random();
+        INIT_LIST_HEAD(&q->new_buckets);
+        INIT_LIST_HEAD(&q->old_buckets);
+        /* Configurable HHF parameters */
+        q->hhf_reset_timeout = HZ / 25; /* 40  ms */
+        q->hhf_admit_bytes = 131072;    /* 128 KB */
+        q->hhf_evict_timeout = HZ;      /* 1  sec */
+        q->hhf_non_hh_weight = 2;
+        if (opt) {
+                int err = hhf_change(sch, opt);
+                if (err)
+                        return err;
+        }
+        if (!q->hh_flows) {
+                /* Initialize heavy-hitter flow table. */
+                q->hh_flows = hhf_zalloc(HH_FLOWS_CNT *
+                                         sizeof(struct list_head));
+                if (!q->hh_flows)
+                        return -ENOMEM;
+                for (i = 0; i < HH_FLOWS_CNT; i++)
+                        INIT_LIST_HEAD(&q->hh_flows[i]);
+                /* Cap max active HHs at twice len of hh_flows table. */
+                q->hh_flows_limit = 2 * HH_FLOWS_CNT;
+                q->hh_flows_overlimit = 0;
+                q->hh_flows_total_cnt = 0;
+                q->hh_flows_current_cnt = 0;
+                /* Initialize heavy-hitter filter arrays. */
+                for (i = 0; i < HHF_ARRAYS_CNT; i++) {
+                        q->hhf_arrays[i] = hhf_zalloc(HHF_ARRAYS_LEN *
+                                                      sizeof(u32));
+                        if (!q->hhf_arrays[i]) {
+                                hhf_destroy(sch);
+                                return -ENOMEM;
+                        }
+                }
+                q->hhf_arrays_reset_timestamp = hhf_time_stamp();
+                /* Initialize valid bits of heavy-hitter filter arrays. */
+                for (i = 0; i < HHF_ARRAYS_CNT; i++) {
+                        q->hhf_valid_bits[i] = hhf_zalloc(HHF_ARRAYS_LEN /
+                                                          BITS_PER_BYTE);
+                        if (!q->hhf_valid_bits[i]) {
+                                hhf_destroy(sch);
+                                return -ENOMEM;
+                        }
+                }
+                /* Initialize Weighted DRR buckets. */
+                for (i = 0; i < WDRR_BUCKET_CNT; i++) {
+                        struct wdrr_bucket *bucket = q->buckets + i;
+                        INIT_LIST_HEAD(&bucket->bucketchain);
+                }
+        }
+        return 0;
+}
+static int hhf_dump(struct Qdisc *sch, struct sk_buff *skb)
+{
+        struct hhf_sched_data *q = qdisc_priv(sch);
+        struct nlattr *opts;
+        opts = nla_nest_start(skb, TCA_OPTIONS);
+        if (opts == NULL)
+                goto nla_put_failure;
+        if (nla_put_u32(skb, TCA_HHF_BACKLOG_LIMIT, sch->limit) ||
+            nla_put_u32(skb, TCA_HHF_QUANTUM, q->quantum) ||
+            nla_put_u32(skb, TCA_HHF_HH_FLOWS_LIMIT, q->hh_flows_limit) ||
+            nla_put_u32(skb, TCA_HHF_RESET_TIMEOUT,
+                        jiffies_to_msecs(q->hhf_reset_timeout)) ||
+            nla_put_u32(skb, TCA_HHF_ADMIT_BYTES, q->hhf_admit_bytes) ||
+            nla_put_u32(skb, TCA_HHF_EVICT_TIMEOUT,
+                        jiffies_to_msecs(q->hhf_evict_timeout)) ||
+            nla_put_u32(skb, TCA_HHF_NON_HH_WEIGHT, q->hhf_non_hh_weight))
+                goto nla_put_failure;
+        nla_nest_end(skb, opts);
+        return skb->len;
+nla_put_failure:
+        return -1;
+}
+static int hhf_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
+{
+        struct hhf_sched_data *q = qdisc_priv(sch);
+        struct tc_hhf_xstats st = {
+                .drop_overlimit = q->drop_overlimit,
+                .hh_overlimit   = q->hh_flows_overlimit,
+                .hh_tot_count   = q->hh_flows_total_cnt,
+                .hh_cur_count   = q->hh_flows_current_cnt,
+        };
+        return gnet_stats_copy_app(d, &st, sizeof(st));
+}
+static struct Qdisc_ops hhf_qdisc_ops __read_mostly = {
+        .id             =       "hhf",
+        .priv_size      =       sizeof(struct hhf_sched_data),
+        .enqueue        =       hhf_enqueue,
+        .dequeue        =       hhf_dequeue,
+        .peek           =       qdisc_peek_dequeued,
+        .drop           =       hhf_drop,
+        .init           =       hhf_init,
+        .reset          =       hhf_reset,
+        .destroy        =       hhf_destroy,
+        .change         =       hhf_change,
+        .dump           =       hhf_dump,
+        .dump_stats     =       hhf_dump_stats,
+        .owner          =       THIS_MODULE,
+};
+static int __init hhf_module_init(void)
+{
+        return register_qdisc(&hhf_qdisc_ops);
+}
+static void __exit hhf_module_exit(void)
+{
+        unregister_qdisc(&hhf_qdisc_ops);
+}
+module_init(hhf_module_init)
+module_exit(hhf_module_exit)
+MODULE_AUTHOR("Terry Lam");
+MODULE_AUTHOR("Nandita Dukkipati");
+MODULE_LICENSE("GPL");
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 0e1e38b40025..0db5a6eae87f 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -712,7 +712,7 @@ static s64 htb_do_events(struct htb_sched *q, const int level,
        /* too much load - let's continue after a break for scheduling */
        if (!(q->warned & HTB_WARN_TOOMANYEVENTS)) {
-                pr_warning("htb: too many events!\n");
+                pr_warn("htb: too many events!\n");
                q->warned |= HTB_WARN_TOOMANYEVENTS;
        }
@@ -1276,9 +1276,10 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
        struct Qdisc *new_q = NULL;
        int last_child = 0;
-        // TODO: why don't allow to delete subtree ? references ? does
+        /* TODO: why don't allow to delete subtree ? references ? does
-        // tc subsys quarantee us that in htb_destroy it holds no class
+         * tc subsys guarantee us that in htb_destroy it holds no class
-        // refs so that we can remove children safely there ?
+         * refs so that we can remove children safely there ?
+         */
        if (cl->children || cl->filter_cnt)
                return -EBUSY;
@@ -1337,7 +1338,6 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
        struct htb_sched *q = qdisc_priv(sch);
        struct htb_class *cl = (struct htb_class *)*arg, *parent;
        struct nlattr *opt = tca[TCA_OPTIONS];
-        struct qdisc_rate_table *rtab = NULL, *ctab = NULL;
        struct nlattr *tb[TCA_HTB_MAX + 1];
        struct tc_htb_opt *hopt;
        u64 rate64, ceil64;
@@ -1361,16 +1361,11 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                goto failure;
        /* Keeping backward compatible with rate_table based iproute2 tc */
-        if (hopt->rate.linklayer == TC_LINKLAYER_UNAWARE) {
+        if (hopt->rate.linklayer == TC_LINKLAYER_UNAWARE)
-                rtab = qdisc_get_rtab(&hopt->rate, tb[TCA_HTB_RTAB]);
+                qdisc_put_rtab(qdisc_get_rtab(&hopt->rate, tb[TCA_HTB_RTAB]));
-                if (rtab)
-                        qdisc_put_rtab(rtab);
+        if (hopt->ceil.linklayer == TC_LINKLAYER_UNAWARE)
-        }
+                qdisc_put_rtab(qdisc_get_rtab(&hopt->ceil, tb[TCA_HTB_CTAB]));
-        if (hopt->ceil.linklayer == TC_LINKLAYER_UNAWARE) {
-                ctab = qdisc_get_rtab(&hopt->ceil, tb[TCA_HTB_CTAB]);
-                if (ctab)
-                        qdisc_put_rtab(ctab);
-        }
        if (!cl) {              /* new class */
                struct Qdisc *new_q;
@@ -1477,21 +1472,30 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                sch_tree_lock(sch);
        }
+        rate64 = tb[TCA_HTB_RATE64] ? nla_get_u64(tb[TCA_HTB_RATE64]) : 0;
+        ceil64 = tb[TCA_HTB_CEIL64] ? nla_get_u64(tb[TCA_HTB_CEIL64]) : 0;
+        psched_ratecfg_precompute(&cl->rate, &hopt->rate, rate64);
+        psched_ratecfg_precompute(&cl->ceil, &hopt->ceil, ceil64);
        /* it used to be a nasty bug here, we have to check that node
         * is really leaf before changing cl->un.leaf !
         */
        if (!cl->level) {
-                cl->quantum = hopt->rate.rate / q->rate2quantum;
+                u64 quantum = cl->rate.rate_bytes_ps;
+                do_div(quantum, q->rate2quantum);
+                cl->quantum = min_t(u64, quantum, INT_MAX);
                if (!hopt->quantum && cl->quantum < 1000) {
-                        pr_warning(
+                        pr_warn("HTB: quantum of class %X is small. Consider r2q change.\n",
-                               "HTB: quantum of class %X is small. Consider r2q change.\n",
+                                cl->common.classid);
-                               cl->common.classid);
                        cl->quantum = 1000;
                }
                if (!hopt->quantum && cl->quantum > 200000) {
-                        pr_warning(
+                        pr_warn("HTB: quantum of class %X is big. Consider r2q change.\n",
-                               "HTB: quantum of class %X is big. Consider r2q change.\n",
+                                cl->common.classid);
-                               cl->common.classid);
                        cl->quantum = 200000;
                }
                if (hopt->quantum)
@@ -1500,13 +1504,6 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                        cl->prio = TC_HTB_NUMPRIO - 1;
        }
-        rate64 = tb[TCA_HTB_RATE64] ? nla_get_u64(tb[TCA_HTB_RATE64]) : 0;
-        ceil64 = tb[TCA_HTB_CEIL64] ? nla_get_u64(tb[TCA_HTB_CEIL64]) : 0;
-        psched_ratecfg_precompute(&cl->rate, &hopt->rate, rate64);
-        psched_ratecfg_precompute(&cl->ceil, &hopt->ceil, ceil64);
        cl->buffer = PSCHED_TICKS2NS(hopt->buffer);
        cl->cbuffer = PSCHED_TICKS2NS(hopt->cbuffer);
diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
index 2e56185736d6..a8b2864a696b 100644
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -78,14 +78,19 @@ static void mq_attach(struct Qdisc *sch)
 {
        struct net_device *dev = qdisc_dev(sch);
        struct mq_sched *priv = qdisc_priv(sch);
-        struct Qdisc *qdisc;
+        struct Qdisc *qdisc, *old;
        unsigned int ntx;
        for (ntx = 0; ntx < dev->num_tx_queues; ntx++) {
                qdisc = priv->qdiscs[ntx];
-                qdisc = dev_graft_qdisc(qdisc->dev_queue, qdisc);
+                old = dev_graft_qdisc(qdisc->dev_queue, qdisc);
-                if (qdisc)
+                if (old)
-                        qdisc_destroy(qdisc);
+                        qdisc_destroy(old);
+#ifdef CONFIG_NET_SCHED
+                if (ntx < dev->real_num_tx_queues)
+                        qdisc_list_add(qdisc);
+#endif
        }
        kfree(priv->qdiscs);
        priv->qdiscs = NULL;
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index d44c868cb537..6749e2f540d0 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -167,15 +167,17 @@ static void mqprio_attach(struct Qdisc *sch)
 {
        struct net_device *dev = qdisc_dev(sch);
        struct mqprio_sched *priv = qdisc_priv(sch);
-        struct Qdisc *qdisc;
+        struct Qdisc *qdisc, *old;
        unsigned int ntx;
        /* Attach underlying qdisc */
        for (ntx = 0; ntx < dev->num_tx_queues; ntx++) {
                qdisc = priv->qdiscs[ntx];
-                qdisc = dev_graft_qdisc(qdisc->dev_queue, qdisc);
+                old = dev_graft_qdisc(qdisc->dev_queue, qdisc);
-                if (qdisc)
+                if (old)
-                        qdisc_destroy(qdisc);
+                        qdisc_destroy(old);
+                if (ntx < dev->real_num_tx_queues)
+                        qdisc_list_add(qdisc);
        }
        kfree(priv->qdiscs);
        priv->qdiscs = NULL;
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 2a2b096d9a66..afb050a735fa 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -11,8 +11,7 @@
 * more details.
 *
 * You should have received a copy of the GNU General Public License along with
- * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * this program; if not, see <http://www.gnu.org/licenses/>.
- * Place - Suite 330, Boston, MA 02111-1307 USA.
 *
 * Author: Alexander Duyck <alexander.h.duyck@intel.com>
 */
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 75c94e59a3bd..090a4e3ecd0d 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -88,7 +88,7 @@ struct netem_sched_data {
        u32 duplicate;
        u32 reorder;
        u32 corrupt;
-        u32 rate;
+        u64 rate;
        s32 packet_overhead;
        u32 cell_size;
        u32 cell_size_reciprocal;
@@ -215,10 +215,10 @@ static bool loss_4state(struct netem_sched_data *q)
                if (rnd < clg->a4) {
                        clg->state = 4;
                        return true;
-                } else if (clg->a4 < rnd && rnd < clg->a1) {
+                } else if (clg->a4 < rnd && rnd < clg->a1 + clg->a4) {
                        clg->state = 3;
                        return true;
-                } else if (clg->a1 < rnd)
+                } else if (clg->a1 + clg->a4 < rnd)
                        clg->state = 1;
                break;
@@ -268,10 +268,11 @@ static bool loss_gilb_ell(struct netem_sched_data *q)
                        clg->state = 2;
                if (net_random() < clg->a4)
                        return true;
+                break;
        case 2:
                if (net_random() < clg->a2)
                        clg->state = 1;
-                if (clg->a3 > net_random())
+                if (net_random() > clg->a3)
                        return true;
        }
@@ -494,7 +495,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                                now = netem_skb_cb(last)->time_to_send;
                        }
-                        delay += packet_len_2_sched_time(skb->len, q);
+                        delay += packet_len_2_sched_time(qdisc_pkt_len(skb), q);
                }
                cb->time_to_send = now + delay;
@@ -728,7 +729,7 @@ static int get_loss_clg(struct Qdisc *sch, const struct nlattr *attr)
        nla_for_each_nested(la, attr, rem) {
                u16 type = nla_type(la);
-                switch(type) {
+                switch (type) {
                case NETEM_LOSS_GI: {
                        const struct tc_netem_gimodel *gi = nla_data(la);
@@ -781,6 +782,7 @@ static const struct nla_policy netem_policy[TCA_NETEM_MAX + 1] = {
        [TCA_NETEM_RATE]        = { .len = sizeof(struct tc_netem_rate) },
        [TCA_NETEM_LOSS]        = { .type = NLA_NESTED },
        [TCA_NETEM_ECN]         = { .type = NLA_U32 },
+        [TCA_NETEM_RATE64]      = { .type = NLA_U64 },
 };
 static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla,
@@ -851,6 +853,10 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt)
        if (tb[TCA_NETEM_RATE])
                get_rate(sch, tb[TCA_NETEM_RATE]);
+        if (tb[TCA_NETEM_RATE64])
+                q->rate = max_t(u64, q->rate,
+                                nla_get_u64(tb[TCA_NETEM_RATE64]));
        if (tb[TCA_NETEM_ECN])
                q->ecn = nla_get_u32(tb[TCA_NETEM_ECN]);
@@ -973,7 +979,13 @@ static int netem_dump(struct Qdisc *sch, struct sk_buff *skb)
        if (nla_put(skb, TCA_NETEM_CORRUPT, sizeof(corrupt), &corrupt))
                goto nla_put_failure;
-        rate.rate = q->rate;
+        if (q->rate >= (1ULL << 32)) {
+                if (nla_put_u64(skb, TCA_NETEM_RATE64, q->rate))
+                        goto nla_put_failure;
+                rate.rate = ~0U;
+        } else {
+                rate.rate = q->rate;
+        }
        rate.packet_overhead = q->packet_overhead;
        rate.cell_size = q->cell_size;
        rate.cell_overhead = q->cell_overhead;
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index d3a1bc26dbfc..76f01e0258df 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -237,10 +237,12 @@ static inline void sfq_link(struct sfq_sched_data *q, sfq_index x)
 }
 #define sfq_unlink(q, x, n, p)                  \
-        n = q->slots[x].dep.next;               \
+        do {                                    \
-        p = q->slots[x].dep.prev;               \
+                n = q->slots[x].dep.next;       \
-        sfq_dep_head(q, p)->next = n;           \
+                p = q->slots[x].dep.prev;       \
-        sfq_dep_head(q, n)->prev = p
+                sfq_dep_head(q, p)->next = n;   \
+                sfq_dep_head(q, n)->prev = p;   \
+        } while (0)
 static inline void sfq_dec(struct sfq_sched_data *q, sfq_index x)
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 68f98595819c..fbba5b0ec121 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -21,6 +21,7 @@
 #include <net/netlink.h>
 #include <net/sch_generic.h>
 #include <net/pkt_sched.h>
+#include <net/tcp.h>
 /*      Simple Token Bucket Filter.
@@ -117,6 +118,48 @@ struct tbf_sched_data {
 };
+/* Time to Length, convert time in ns to length in bytes
+ * to determinate how many bytes can be sent in given time.
+ */
+static u64 psched_ns_t2l(const struct psched_ratecfg *r,
+                         u64 time_in_ns)
+{
+        /* The formula is :
+         * len = (time_in_ns * r->rate_bytes_ps) / NSEC_PER_SEC
+         */
+        u64 len = time_in_ns * r->rate_bytes_ps;
+        do_div(len, NSEC_PER_SEC);
+        if (unlikely(r->linklayer == TC_LINKLAYER_ATM)) {
+                do_div(len, 53);
+                len = len * 48;
+        }
+        if (len > r->overhead)
+                len -= r->overhead;
+        else
+                len = 0;
+        return len;
+}
+/*
+ * Return length of individual segments of a gso packet,
+ * including all headers (MAC, IP, TCP/UDP)
+ */
+static unsigned int skb_gso_seglen(const struct sk_buff *skb)
+{
+        unsigned int hdr_len = skb_transport_header(skb) - skb_mac_header(skb);
+        const struct skb_shared_info *shinfo = skb_shinfo(skb);
+        if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
+                hdr_len += tcp_hdrlen(skb);
+        else
+                hdr_len += sizeof(struct udphdr);
+        return hdr_len + shinfo->gso_size;
+}
 /* GSO packet is too big, segment it so that tbf can transmit
 * each segment in time
 */
@@ -136,12 +179,8 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch)
        while (segs) {
                nskb = segs->next;
                segs->next = NULL;
-                if (likely(segs->len <= q->max_size)) {
+                qdisc_skb_cb(segs)->pkt_len = segs->len;
-                        qdisc_skb_cb(segs)->pkt_len = segs->len;
+                ret = qdisc_enqueue(segs, q->qdisc);
-                        ret = qdisc_enqueue(segs, q->qdisc);
-                } else {
-                        ret = qdisc_reshape_fail(skb, sch);
-                }
                if (ret != NET_XMIT_SUCCESS) {
                        if (net_xmit_drop_count(ret))
                                sch->qstats.drops++;
@@ -163,7 +202,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        int ret;
        if (qdisc_pkt_len(skb) > q->max_size) {
-                if (skb_is_gso(skb))
+                if (skb_is_gso(skb) && skb_gso_seglen(skb) <= q->max_size)
                        return tbf_segment(skb, sch);
                return qdisc_reshape_fail(skb, sch);
        }
@@ -268,6 +307,8 @@ static const struct nla_policy tbf_policy[TCA_TBF_MAX + 1] = {
        [TCA_TBF_PTAB]  = { .type = NLA_BINARY, .len = TC_RTAB_SIZE },
        [TCA_TBF_RATE64]        = { .type = NLA_U64 },
        [TCA_TBF_PRATE64]       = { .type = NLA_U64 },
+        [TCA_TBF_BURST] = { .type = NLA_U32 },
+        [TCA_TBF_PBURST] = { .type = NLA_U32 },
 };
 static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
@@ -276,10 +317,11 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
        struct tbf_sched_data *q = qdisc_priv(sch);
        struct nlattr *tb[TCA_TBF_MAX + 1];
        struct tc_tbf_qopt *qopt;
-        struct qdisc_rate_table *rtab = NULL;
-        struct qdisc_rate_table *ptab = NULL;
        struct Qdisc *child = NULL;
-        int max_size, n;
+        struct psched_ratecfg rate;
+        struct psched_ratecfg peak;
+        u64 max_size;
+        s64 buffer, mtu;
        u64 rate64 = 0, prate64 = 0;
        err = nla_parse_nested(tb, TCA_TBF_MAX, opt, tbf_policy);
@@ -291,33 +333,13 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                goto done;
        qopt = nla_data(tb[TCA_TBF_PARMS]);
-        rtab = qdisc_get_rtab(&qopt->rate, tb[TCA_TBF_RTAB]);
+        if (qopt->rate.linklayer == TC_LINKLAYER_UNAWARE)
-        if (rtab == NULL)
+                qdisc_put_rtab(qdisc_get_rtab(&qopt->rate,
-                goto done;
+                                              tb[TCA_TBF_RTAB]));
-        if (qopt->peakrate.rate) {
+        if (qopt->peakrate.linklayer == TC_LINKLAYER_UNAWARE)
-                if (qopt->peakrate.rate > qopt->rate.rate)
+                        qdisc_put_rtab(qdisc_get_rtab(&qopt->peakrate,
-                        ptab = qdisc_get_rtab(&qopt->peakrate, tb[TCA_TBF_PTAB]);
+                                                      tb[TCA_TBF_PTAB]));
-                if (ptab == NULL)
-                        goto done;
-        }
-        for (n = 0; n < 256; n++)
-                if (rtab->data[n] > qopt->buffer)
-                        break;
-        max_size = (n << qopt->rate.cell_log) - 1;
-        if (ptab) {
-                int size;
-                for (n = 0; n < 256; n++)
-                        if (ptab->data[n] > qopt->mtu)
-                                break;
-                size = (n << qopt->peakrate.cell_log) - 1;
-                if (size < max_size)
-                        max_size = size;
-        }
-        if (max_size < 0)
-                goto done;
        if (q->qdisc != &noop_qdisc) {
                err = fifo_set_limit(q->qdisc, qopt->limit);
@@ -331,6 +353,50 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                }
        }
+        buffer = min_t(u64, PSCHED_TICKS2NS(qopt->buffer), ~0U);
+        mtu = min_t(u64, PSCHED_TICKS2NS(qopt->mtu), ~0U);
+        if (tb[TCA_TBF_RATE64])
+                rate64 = nla_get_u64(tb[TCA_TBF_RATE64]);
+        psched_ratecfg_precompute(&rate, &qopt->rate, rate64);
+        if (tb[TCA_TBF_BURST]) {
+                max_size = nla_get_u32(tb[TCA_TBF_BURST]);
+                buffer = psched_l2t_ns(&rate, max_size);
+        } else {
+                max_size = min_t(u64, psched_ns_t2l(&rate, buffer), ~0U);
+        }
+        if (qopt->peakrate.rate) {
+                if (tb[TCA_TBF_PRATE64])
+                        prate64 = nla_get_u64(tb[TCA_TBF_PRATE64]);
+                psched_ratecfg_precompute(&peak, &qopt->peakrate, prate64);
+                if (peak.rate_bytes_ps <= rate.rate_bytes_ps) {
+                        pr_warn_ratelimited("sch_tbf: peakrate %llu is lower than or equals to rate %llu !\n",
+                                        peak.rate_bytes_ps, rate.rate_bytes_ps);
+                        err = -EINVAL;
+                        goto done;
+                }
+                if (tb[TCA_TBF_PBURST]) {
+                        u32 pburst = nla_get_u32(tb[TCA_TBF_PBURST]);
+                        max_size = min_t(u32, max_size, pburst);
+                        mtu = psched_l2t_ns(&peak, pburst);
+                } else {
+                        max_size = min_t(u64, max_size, psched_ns_t2l(&peak, mtu));
+                }
+        }
+        if (max_size < psched_mtu(qdisc_dev(sch)))
+                pr_warn_ratelimited("sch_tbf: burst %llu is lower than device %s mtu (%u) !\n",
+                                    max_size, qdisc_dev(sch)->name,
+                                    psched_mtu(qdisc_dev(sch)));
+        if (!max_size) {
+                err = -EINVAL;
+                goto done;
+        }
        sch_tree_lock(sch);
        if (child) {
                qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
@@ -338,19 +404,21 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                q->qdisc = child;
        }
        q->limit = qopt->limit;
-        q->mtu = PSCHED_TICKS2NS(qopt->mtu);
+        if (tb[TCA_TBF_PBURST])
+                q->mtu = mtu;
+        else
+                q->mtu = PSCHED_TICKS2NS(qopt->mtu);
        q->max_size = max_size;
-        q->buffer = PSCHED_TICKS2NS(qopt->buffer);
+        if (tb[TCA_TBF_BURST])
+                q->buffer = buffer;
+        else
+                q->buffer = PSCHED_TICKS2NS(qopt->buffer);
        q->tokens = q->buffer;
        q->ptokens = q->mtu;
-        if (tb[TCA_TBF_RATE64])
+        memcpy(&q->rate, &rate, sizeof(struct psched_ratecfg));
-                rate64 = nla_get_u64(tb[TCA_TBF_RATE64]);
+        if (qopt->peakrate.rate) {
-        psched_ratecfg_precompute(&q->rate, &rtab->rate, rate64);
+                memcpy(&q->peak, &peak, sizeof(struct psched_ratecfg));
-        if (ptab) {
-                if (tb[TCA_TBF_PRATE64])
-                        prate64 = nla_get_u64(tb[TCA_TBF_PRATE64]);
-                psched_ratecfg_precompute(&q->peak, &ptab->rate, prate64);
                q->peak_present = true;
        } else {
                q->peak_present = false;
@@ -359,10 +427,6 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
        sch_tree_unlock(sch);
        err = 0;
 done:
-        if (rtab)
-                qdisc_put_rtab(rtab);
-        if (ptab)
-                qdisc_put_rtab(ptab);
        return err;
 }
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 68a27f9796d2..5ae609200674 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -22,9 +22,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -90,14 +89,12 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
        /* Initialize the object handling fields.  */
        atomic_set(&asoc->base.refcnt, 1);
-        asoc->base.dead = false;
        /* Initialize the bind addr area.  */
        sctp_bind_addr_init(&asoc->base.bind_addr, ep->base.bind_addr.port);
        asoc->state = SCTP_STATE_CLOSED;
        asoc->cookie_life = ms_to_ktime(sp->assocparams.sasoc_cookie_life);
-        asoc->frag_point = 0;
        asoc->user_frag = sp->user_frag;
        /* Set the association max_retrans and RTO values from the
@@ -110,8 +107,6 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
        asoc->rto_max = msecs_to_jiffies(sp->rtoinfo.srto_max);
        asoc->rto_min = msecs_to_jiffies(sp->rtoinfo.srto_min);
-        asoc->overall_error_count = 0;
        /* Initialize the association's heartbeat interval based on the
         * sock configured value.
         */
@@ -132,18 +127,15 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         */
        asoc->param_flags = sp->param_flags;
-        /* Initialize the maximum mumber of new data packets that can be sent
+        /* Initialize the maximum number of new data packets that can be sent
         * in a burst.
         */
        asoc->max_burst = sp->max_burst;
        /* initialize association timers */
-        asoc->timeouts[SCTP_EVENT_TIMEOUT_NONE] = 0;
        asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_COOKIE] = asoc->rto_initial;
        asoc->timeouts[SCTP_EVENT_TIMEOUT_T1_INIT] = asoc->rto_initial;
        asoc->timeouts[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN] = asoc->rto_initial;
-        asoc->timeouts[SCTP_EVENT_TIMEOUT_T3_RTX] = 0;
-        asoc->timeouts[SCTP_EVENT_TIMEOUT_T4_RTO] = 0;
        /* sctpimpguide Section 2.12.2
         * If the 'T5-shutdown-guard' timer is used, it SHOULD be set to the
@@ -152,10 +144,8 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
        asoc->timeouts[SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD]
                = 5 * asoc->rto_max;
-        asoc->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] = 0;
        asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay;
-        asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
+        asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] = sp->autoclose * HZ;
-                min_t(unsigned long, sp->autoclose, net->sctp.max_autoclose) * HZ;
        /* Initializes the timers */
        for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i)
@@ -173,11 +163,6 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
        asoc->max_init_timeo =
                 msecs_to_jiffies(sp->initmsg.sinit_max_init_timeo);
-        /* Allocate storage for the ssnmap after the inbound and outbound
-         * streams have been negotiated during Init.
-         */
-        asoc->ssnmap = NULL;
        /* Set the local window size for receive.
         * This is also the rcvbuf space per association.
         * RFC 6 - A SCTP receiver MUST be able to receive a minimum of
@@ -190,25 +175,15 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
        asoc->a_rwnd = asoc->rwnd;
-        asoc->rwnd_over = 0;
-        asoc->rwnd_press = 0;
        /* Use my own max window until I learn something better.  */
        asoc->peer.rwnd = SCTP_DEFAULT_MAXWINDOW;
-        /* Set the sndbuf size for transmit.  */
-        asoc->sndbuf_used = 0;
        /* Initialize the receive memory counter */
        atomic_set(&asoc->rmem_alloc, 0);
        init_waitqueue_head(&asoc->wait);
        asoc->c.my_vtag = sctp_generate_tag(ep);
-        asoc->peer.i.init_tag = 0;     /* INIT needs a vtag of 0. */
-        asoc->c.peer_vtag = 0;
-        asoc->c.my_ttag   = 0;
-        asoc->c.peer_ttag = 0;
        asoc->c.my_port = ep->base.bind_addr.port;
        asoc->c.initial_tsn = sctp_generate_tsn(ep);
@@ -219,7 +194,6 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
        asoc->adv_peer_ack_point = asoc->ctsn_ack_point;
        asoc->highest_sacked = asoc->ctsn_ack_point;
        asoc->last_cwr_tsn = asoc->ctsn_ack_point;
-        asoc->unack_data = 0;
        /* ADDIP Section 4.1 Asconf Chunk Procedures
         *
@@ -238,7 +212,6 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
        /* Make an empty list of remote transport addresses.  */
        INIT_LIST_HEAD(&asoc->peer.transport_addr_list);
-        asoc->peer.transport_count = 0;
        /* RFC 2960 5.1 Normal Establishment of an Association
         *
@@ -252,20 +225,15 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         * already received one packet.]
         */
        asoc->peer.sack_needed = 1;
-        asoc->peer.sack_cnt = 0;
        asoc->peer.sack_generation = 1;
        /* Assume that the peer will tell us if he recognizes ASCONF
         * as part of INIT exchange.
-         * The sctp_addip_noauth option is there for backward compatibilty
+         * The sctp_addip_noauth option is there for backward compatibility
         * and will revert old behavior.
         */
-        asoc->peer.asconf_capable = 0;
        if (net->sctp.addip_noauth)
                asoc->peer.asconf_capable = 1;
-        asoc->asconf_addr_del_pending = NULL;
-        asoc->src_out_of_asoc_ok = 0;
-        asoc->new_transport = NULL;
        /* Create an input queue.  */
        sctp_inq_init(&asoc->base.inqueue);
@@ -277,12 +245,6 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
        if (!sctp_ulpq_init(&asoc->ulpq, asoc))
                goto fail_init;
-        memset(&asoc->peer.tsn_map, 0, sizeof(struct sctp_tsnmap));
-        asoc->need_ecne = 0;
-        asoc->assoc_id = 0;
        /* Assume that peer would support both address types unless we are
         * told otherwise.
         */
@@ -291,8 +253,6 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
                asoc->peer.ipv6_address = 1;
        INIT_LIST_HEAD(&asoc->asocs);
-        asoc->autoclose = sp->autoclose;
        asoc->default_stream = sp->default_stream;
        asoc->default_ppid = sp->default_ppid;
        asoc->default_flags = sp->default_flags;
@@ -300,9 +260,6 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
        asoc->default_timetolive = sp->default_timetolive;
        asoc->default_rcv_context = sp->default_rcv_context;
-        /* SCTP_GET_ASSOC_STATS COUNTERS */
-        memset(&asoc->stats, 0, sizeof(struct sctp_priv_assoc_stats));
        /* AUTH related initializations */
        INIT_LIST_HEAD(&asoc->endpoint_shared_keys);
        err = sctp_auth_asoc_copy_shkeys(ep, asoc, gfp);
@@ -310,9 +267,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
                goto fail_init;
        asoc->active_key_id = ep->active_key_id;
-        asoc->asoc_shared_key = NULL;
-        asoc->default_hmac_id = 0;
        /* Save the hmacs and chunks list into this association */
        if (ep->auth_hmacs_list)
                memcpy(asoc->c.auth_hmacs, ep->auth_hmacs_list,
@@ -997,17 +952,13 @@ int sctp_cmp_addr_exact(const union sctp_addr *ss1,
 */
 struct sctp_chunk *sctp_get_ecne_prepend(struct sctp_association *asoc)
 {
-        struct sctp_chunk *chunk;
+        if (!asoc->need_ecne)
+                return NULL;
        /* Send ECNE if needed.
         * Not being able to allocate a chunk here is not deadly.
         */
-        if (asoc->need_ecne)
+        return sctp_make_ecne(asoc, asoc->last_ecne_tsn);
-                chunk = sctp_make_ecne(asoc, asoc->last_ecne_tsn);
-        else
-                chunk = NULL;
-        return chunk;
 }
 /*
@@ -1268,7 +1219,7 @@ void sctp_assoc_update(struct sctp_association *asoc,
                }
        }
-        /* SCTP-AUTH: Save the peer parameters from the new assocaitions
+        /* SCTP-AUTH: Save the peer parameters from the new associations
         * and also move the association shared keys over
         */
        kfree(asoc->peer.peer_random);
@@ -1396,7 +1347,7 @@ void sctp_assoc_sync_pmtu(struct sock *sk, struct sctp_association *asoc)
 }
 /* Should we send a SACK to update our peer? */
-static inline int sctp_peer_needs_update(struct sctp_association *asoc)
+static inline bool sctp_peer_needs_update(struct sctp_association *asoc)
 {
        struct net *net = sock_net(asoc->base.sk);
        switch (asoc->state) {
@@ -1408,12 +1359,12 @@ static inline int sctp_peer_needs_update(struct sctp_association *asoc)
                    ((asoc->rwnd - asoc->a_rwnd) >= max_t(__u32,
                           (asoc->base.sk->sk_rcvbuf >> net->sctp.rwnd_upd_shift),
                           asoc->pathmtu)))
-                        return 1;
+                        return true;
                break;
        default:
                break;
        }
-        return 0;
+        return false;
 }
 /* Increase asoc's rwnd by len and send any window update SACK if needed. */
@@ -1493,7 +1444,7 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
        /* If we've reached or overflowed our receive buffer, announce
         * a 0 rwnd if rwnd would still be positive.  Store the
-         * the pottential pressure overflow so that the window can be restored
+         * the potential pressure overflow so that the window can be restored
         * back to original value.
         */
        if (rx_count >= asoc->base.sk->sk_rcvbuf)
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 46b5977978a1..683c7d1b1306 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -16,9 +16,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -42,7 +41,7 @@ static struct sctp_hmac sctp_hmac_list[SCTP_AUTH_NUM_HMACS] = {
        },
        {
                .hmac_id = SCTP_AUTH_HMAC_ID_SHA1,
-                .hmac_name="hmac(sha1)",
+                .hmac_name = "hmac(sha1)",
                .hmac_len = SCTP_SHA1_SIG_SIZE,
        },
        {
@@ -52,7 +51,7 @@ static struct sctp_hmac sctp_hmac_list[SCTP_AUTH_NUM_HMACS] = {
 #if defined (CONFIG_CRYPTO_SHA256) || defined (CONFIG_CRYPTO_SHA256_MODULE)
        {
                .hmac_id = SCTP_AUTH_HMAC_ID_SHA256,
-                .hmac_name="hmac(sha256)",
+                .hmac_name = "hmac(sha256)",
                .hmac_len = SCTP_SHA256_SIG_SIZE,
        }
 #endif
@@ -164,7 +163,7 @@ static int sctp_auth_compare_vectors(struct sctp_auth_bytes *vector1,
                 * lead-zero padded.  If it is not, it
                 * is automatically larger numerically.
                 */
-                for (i = 0; i < abs(diff); i++ ) {
+                for (i = 0; i < abs(diff); i++) {
                        if (longer[i] != 0)
                                return diff;
                }
@@ -227,9 +226,9 @@ static struct sctp_auth_bytes *sctp_auth_make_local_vector(
                                    gfp_t gfp)
 {
        return sctp_auth_make_key_vector(
-                                    (sctp_random_param_t*)asoc->c.auth_random,
+                                    (sctp_random_param_t *)asoc->c.auth_random,
-                                    (sctp_chunks_param_t*)asoc->c.auth_chunks,
+                                    (sctp_chunks_param_t *)asoc->c.auth_chunks,
-                                    (sctp_hmac_algo_param_t*)asoc->c.auth_hmacs,
+                                    (sctp_hmac_algo_param_t *)asoc->c.auth_hmacs,
                                    gfp);
 }
@@ -500,8 +499,7 @@ void sctp_auth_destroy_hmacs(struct crypto_hash *auth_hmacs[])
        if (!auth_hmacs)
                return;
-        for (i = 0; i < SCTP_AUTH_NUM_HMACS; i++)
+        for (i = 0; i < SCTP_AUTH_NUM_HMACS; i++) {
-        {
                if (auth_hmacs[i])
                        crypto_free_hash(auth_hmacs[i]);
        }
@@ -648,15 +646,15 @@ static int __sctp_auth_cid(sctp_cid_t chunk, struct sctp_chunks_param *param)
         */
        for (i = 0; !found && i < len; i++) {
                switch (param->chunks[i]) {
-                    case SCTP_CID_INIT:
+                case SCTP_CID_INIT:
-                    case SCTP_CID_INIT_ACK:
+                case SCTP_CID_INIT_ACK:
-                    case SCTP_CID_SHUTDOWN_COMPLETE:
+                case SCTP_CID_SHUTDOWN_COMPLETE:
-                    case SCTP_CID_AUTH:
+                case SCTP_CID_AUTH:
                        break;
-                    default:
+                default:
                        if (param->chunks[i] == chunk)
-                            found = 1;
+                                found = 1;
                        break;
                }
        }
diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index 077bb070052b..871cdf9567e6 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -21,9 +21,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index f2044fcb9dd1..158701da2d31 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -18,9 +18,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -255,7 +254,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
                SCTP_INC_STATS_USER(sock_net(asoc->base.sk), SCTP_MIB_FRAGUSRMSGS);
        /* Create chunks for all the full sized DATA chunks. */
-        for (i=0, len=first_len; i < whole; i++) {
+        for (i = 0, len = first_len; i < whole; i++) {
                frag = SCTP_DATA_MIDDLE_FRAG;
                if (0 == i)
@@ -318,7 +317,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
                        goto errout;
                }
-                err = sctp_user_addto_chunk(chunk, offset, over,msgh->msg_iov);
+                err = sctp_user_addto_chunk(chunk, offset, over, msgh->msg_iov);
                /* Put the chunk->skb back into the form expected by send.  */
                __skb_pull(chunk->skb, (__u8 *)chunk->chunk_hdr
diff --git a/net/sctp/command.c b/net/sctp/command.c
index 3d9a9ff69c03..dd7375851618 100644
--- a/net/sctp/command.c
+++ b/net/sctp/command.c
@@ -19,9 +19,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
diff --git a/net/sctp/debug.c b/net/sctp/debug.c
index e89015d8935a..95d7b15dad21 100644
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -22,9 +22,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 09b8daac87c8..6ffb6c1b13b7 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -23,9 +23,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 98b69bbecdd9..1f4eeb43fbd6 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -23,9 +23,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -120,7 +119,7 @@ int sctp_rcv(struct sk_buff *skb)
        struct sctp_af *af;
        struct net *net = dev_net(skb->dev);
-        if (skb->pkt_type!=PACKET_HOST)
+        if (skb->pkt_type != PACKET_HOST)
                goto discard_it;
        SCTP_INC_STATS_BH(net, SCTP_MIB_INSCTPPACKS);
@@ -181,8 +180,7 @@ int sctp_rcv(struct sk_buff *skb)
         * If a frame arrives on an interface and the receiving socket is
         * bound to another interface, via SO_BINDTODEVICE, treat it as OOTB
         */
-        if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif(skb)))
+        if (sk->sk_bound_dev_if && (sk->sk_bound_dev_if != af->skb_iif(skb))) {
-        {
                if (asoc) {
                        sctp_association_put(asoc);
                        asoc = NULL;
@@ -537,8 +535,7 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
        return sk;
 out:
-        if (asoc)
+        sctp_association_put(asoc);
-                sctp_association_put(asoc);
        return NULL;
 }
@@ -546,8 +543,7 @@ out:
 void sctp_err_finish(struct sock *sk, struct sctp_association *asoc)
 {
        sctp_bh_unlock_sock(sk);
-        if (asoc)
+        sctp_association_put(asoc);
-                sctp_association_put(asoc);
 }
 /*
@@ -613,8 +609,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
                if (ICMP_FRAG_NEEDED == code) {
                        sctp_icmp_frag_needed(sk, asoc, transport, info);
                        goto out_unlock;
-                }
+                } else {
-                else {
                        if (ICMP_PROT_UNREACH == code) {
                                sctp_icmp_proto_unreachable(sk, asoc,
                                                            transport);
@@ -1058,31 +1053,31 @@ static struct sctp_association *__sctp_rcv_walk_lookup(struct net *net,
                if (ch_end > skb_tail_pointer(skb))
                        break;
-                switch(ch->type) {
+                switch (ch->type) {
-                    case SCTP_CID_AUTH:
+                case SCTP_CID_AUTH:
-                            have_auth = chunk_num;
+                        have_auth = chunk_num;
-                            break;
+                        break;
-                    case SCTP_CID_COOKIE_ECHO:
+                case SCTP_CID_COOKIE_ECHO:
-                            /* If a packet arrives containing an AUTH chunk as
+                        /* If a packet arrives containing an AUTH chunk as
-                             * a first chunk, a COOKIE-ECHO chunk as the second
+                         * a first chunk, a COOKIE-ECHO chunk as the second
-                             * chunk, and possibly more chunks after them, and
+                         * chunk, and possibly more chunks after them, and
-                             * the receiver does not have an STCB for that
+                         * the receiver does not have an STCB for that
-                             * packet, then authentication is based on
+                         * packet, then authentication is based on
-                             * the contents of the COOKIE- ECHO chunk.
+                         * the contents of the COOKIE- ECHO chunk.
-                             */
+                         */
-                            if (have_auth == 1 && chunk_num == 2)
+                        if (have_auth == 1 && chunk_num == 2)
-                                    return NULL;
+                                return NULL;
-                            break;
+                        break;
-                    case SCTP_CID_ASCONF:
+                case SCTP_CID_ASCONF:
-                            if (have_auth || net->sctp.addip_noauth)
+                        if (have_auth || net->sctp.addip_noauth)
-                                    asoc = __sctp_rcv_asconf_lookup(
+                                asoc = __sctp_rcv_asconf_lookup(
-                                                        net, ch, laddr,
+                                                net, ch, laddr,
-                                                        sctp_hdr(skb)->source,
+                                                sctp_hdr(skb)->source,
-                                                        transportp);
+                                                transportp);
-                    default:
+                default:
-                            break;
+                        break;
                }
                if (asoc)
@@ -1119,19 +1114,10 @@ static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net,
                return NULL;
        /* If this is INIT/INIT-ACK look inside the chunk too. */
-        switch (ch->type) {
+        if (ch->type == SCTP_CID_INIT || ch->type == SCTP_CID_INIT_ACK)
-        case SCTP_CID_INIT:
-        case SCTP_CID_INIT_ACK:
                return __sctp_rcv_init_lookup(net, skb, laddr, transportp);
-                break;
-        default:
+        return __sctp_rcv_walk_lookup(net, skb, laddr, transportp);
-                return __sctp_rcv_walk_lookup(net, skb, laddr, transportp);
-                break;
-        }
-        return NULL;
 }
 /* Lookup an association for an inbound skb. */
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 5856932fdc38..4de12afa13d4 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -24,9 +24,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 7567e6f1a920..0f6259a6a932 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -21,9 +21,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -173,7 +172,8 @@ static void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        switch (type) {
        case ICMPV6_PKT_TOOBIG:
-                sctp_icmp_frag_needed(sk, asoc, transport, ntohl(info));
+                if (ip6_sk_accept_pmtu(sk))
+                        sctp_icmp_frag_needed(sk, asoc, transport, ntohl(info));
                goto out_unlock;
        case ICMPV6_PARAMPROB:
                if (ICMPV6_UNK_NEXTHDR == code) {
@@ -263,7 +263,7 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
        }
        final_p = fl6_update_dst(fl6, np->opt, &final);
-        dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
+        dst = ip6_dst_lookup_flow(sk, fl6, final_p);
        if (!asoc || saddr)
                goto out;
@@ -322,7 +322,7 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
                fl6->saddr = baddr->v6.sin6_addr;
                fl6->fl6_sport = baddr->v6.sin6_port;
                final_p = fl6_update_dst(fl6, np->opt, &final);
-                dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
+                dst = ip6_dst_lookup_flow(sk, fl6, final_p);
        }
 out:
@@ -402,7 +402,7 @@ static void sctp_v6_copy_addrlist(struct list_head *addrlist,
 }
 /* Initialize a sockaddr_storage from in incoming skb. */
-static void sctp_v6_from_skb(union sctp_addr *addr,struct sk_buff *skb,
+static void sctp_v6_from_skb(union sctp_addr *addr, struct sk_buff *skb,
                             int is_saddr)
 {
        __be16 *port;
diff --git a/net/sctp/objcnt.c b/net/sctp/objcnt.c
index 647396baa56f..40e7fac96c41 100644
--- a/net/sctp/objcnt.c
+++ b/net/sctp/objcnt.c
@@ -20,9 +20,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -98,7 +97,7 @@ static void sctp_objcnt_seq_stop(struct seq_file *seq, void *v)
 {
 }
-static void * sctp_objcnt_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static void *sctp_objcnt_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
        ++*pos;
        return (*pos >= ARRAY_SIZE(sctp_dbg_objcnt)) ? NULL : (void *)pos;
diff --git a/net/sctp/output.c b/net/sctp/output.c
index e650978daf27..0f4d15fc2627 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -20,9 +20,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -281,7 +280,7 @@ static sctp_xmit_t __sctp_packet_append_chunk(struct sctp_packet *packet,
        /* We believe that this chunk is OK to add to the packet */
        switch (chunk->chunk_hdr->type) {
-            case SCTP_CID_DATA:
+        case SCTP_CID_DATA:
                /* Account for the data being in the packet */
                sctp_packet_append_data(packet, chunk);
                /* Disallow SACK bundling after DATA. */
@@ -293,17 +292,17 @@ static sctp_xmit_t __sctp_packet_append_chunk(struct sctp_packet *packet,
                /* timestamp the chunk for rtx purposes */
                chunk->sent_at = jiffies;
                break;
-            case SCTP_CID_COOKIE_ECHO:
+        case SCTP_CID_COOKIE_ECHO:
                packet->has_cookie_echo = 1;
                break;
-            case SCTP_CID_SACK:
+        case SCTP_CID_SACK:
                packet->has_sack = 1;
                if (chunk->asoc)
                        chunk->asoc->stats.osacks++;
                break;
-            case SCTP_CID_AUTH:
+        case SCTP_CID_AUTH:
                packet->has_auth = 1;
                packet->auth = chunk;
                break;
@@ -388,7 +387,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
        int err = 0;
        int padding;            /* How much padding do we need?  */
        __u8 has_data = 0;
-        struct dst_entry *dst = tp->dst;
+        struct dst_entry *dst;
        unsigned char *auth = NULL;     /* pointer to auth in skb data */
        pr_debug("%s: packet:%p\n", __func__, packet);
@@ -421,9 +420,9 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                }
        }
        dst = dst_clone(tp->dst);
-        skb_dst_set(nskb, dst);
        if (!dst)
                goto no_route;
+        skb_dst_set(nskb, dst);
        /* Build the SCTP header.  */
        sh = (struct sctphdr *)skb_push(nskb, sizeof(struct sctphdr));
@@ -474,10 +473,11 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                         * for a given destination transport address.
                         */
-                        if (!tp->rto_pending) {
+                        if (!chunk->resent && !tp->rto_pending) {
                                chunk->rtt_in_progress = 1;
                                tp->rto_pending = 1;
                        }
                        has_data = 1;
                }
@@ -540,8 +540,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                } else {
                        /* no need to seed pseudo checksum for SCTP */
                        nskb->ip_summed = CHECKSUM_PARTIAL;
-                        nskb->csum_start = (skb_transport_header(nskb) -
+                        nskb->csum_start = skb_transport_header(nskb) - nskb->head;
-                                            nskb->head);
                        nskb->csum_offset = offsetof(struct sctphdr, checksum);
                }
        }
@@ -558,7 +557,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         * Note: The works for IPv6 layer checks this bit too later
         * in transmission.  See IP6_ECN_flow_xmit().
         */
-        (*tp->af_specific->ecn_capable)(nskb->sk);
+        tp->af_specific->ecn_capable(nskb->sk);
        /* Set up the IP options.  */
        /* BUG: not implemented
@@ -580,7 +579,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                unsigned long timeout;
                /* Restart the AUTOCLOSE timer when sending data. */
-                if (sctp_state(asoc, ESTABLISHED) && asoc->autoclose) {
+                if (sctp_state(asoc, ESTABLISHED) &&
+                    asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
                        timer = &asoc->timers[SCTP_EVENT_TIMEOUT_AUTOCLOSE];
                        timeout = asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE];
@@ -592,7 +592,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
        pr_debug("***sctp_transmit_packet*** skb->len:%d\n", nskb->len);
        nskb->local_df = packet->ipfragok;
-        (*tp->af_specific->sctp_xmit)(nskb, tp);
+        tp->af_specific->sctp_xmit(nskb, tp);
 out:
        sctp_packet_reset(packet);
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 94df75877869..111516c3d34c 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -22,9 +22,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -111,7 +110,7 @@ static inline int sctp_cacc_skip_3_1_d(struct sctp_transport *primary,
                                       struct sctp_transport *transport,
                                       int count_of_newacks)
 {
-        if (count_of_newacks >=2 && transport != primary)
+        if (count_of_newacks >= 2 && transport != primary)
                return 1;
        return 0;
 }
@@ -446,6 +445,8 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                                transport->rto_pending = 0;
                        }
+                        chunk->resent = 1;
                        /* Move the chunk to the retransmit queue. The chunks
                         * on the retransmit queue are always kept in order.
                         */
@@ -469,7 +470,7 @@ void sctp_retransmit(struct sctp_outq *q, struct sctp_transport *transport,
        struct net *net = sock_net(q->asoc->base.sk);
        int error = 0;
-        switch(reason) {
+        switch (reason) {
        case SCTP_RTXR_T3_RTX:
                SCTP_INC_STATS(net, SCTP_MIB_T3_RETRANSMITS);
                sctp_transport_lower_cwnd(transport, SCTP_LOWER_CWND_T3_RTX);
@@ -1087,7 +1088,7 @@ sctp_flush_out:
         *
         * --xguo
         */
-        while ((ltransport = sctp_list_dequeue(&transport_list)) != NULL ) {
+        while ((ltransport = sctp_list_dequeue(&transport_list)) != NULL) {
                struct sctp_transport *t = list_entry(ltransport,
                                                      struct sctp_transport,
                                                      send_ready);
@@ -1216,7 +1217,7 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_chunk *chunk)
                 * destinations for which cacc_saw_newack is set.
                 */
                if (transport->cacc.cacc_saw_newack)
-                        count_of_newacks ++;
+                        count_of_newacks++;
        }
        /* Move the Cumulative TSN Ack Point if appropriate.  */
@@ -1375,6 +1376,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                 * instance).
                                 */
                                if (!tchunk->tsn_gap_acked &&
+                                    !tchunk->resent &&
                                    tchunk->rtt_in_progress) {
                                        tchunk->rtt_in_progress = 0;
                                        rtt = jiffies - tchunk->sent_at;
@@ -1391,7 +1393,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                         */
                        if (!tchunk->tsn_gap_acked) {
                                tchunk->tsn_gap_acked = 1;
-                                *highest_new_tsn_in_sack = tsn;
+                                if (TSN_lt(*highest_new_tsn_in_sack, tsn))
+                                        *highest_new_tsn_in_sack = tsn;
                                bytes_acked += sctp_data_size(tchunk);
                                if (!tchunk->transport)
                                        migrate_bytes += sctp_data_size(tchunk);
diff --git a/net/sctp/primitive.c b/net/sctp/primitive.c
index ce1ffd811775..ab8d9f96a177 100644
--- a/net/sctp/primitive.c
+++ b/net/sctp/primitive.c
@@ -23,9 +23,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
diff --git a/net/sctp/probe.c b/net/sctp/probe.c
index 53c452efb40b..5e68b94ee640 100644
--- a/net/sctp/probe.c
+++ b/net/sctp/probe.c
@@ -38,6 +38,7 @@
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
+MODULE_SOFTDEP("pre: sctp");
 MODULE_AUTHOR("Wei Yongjun <yjwei@cn.fujitsu.com>");
 MODULE_DESCRIPTION("SCTP snooper");
 MODULE_LICENSE("GPL");
@@ -182,6 +183,20 @@ static struct jprobe sctp_recv_probe = {
        .entry  = jsctp_sf_eat_sack,
 };
+static __init int sctp_setup_jprobe(void)
+{
+        int ret = register_jprobe(&sctp_recv_probe);
+        if (ret) {
+                if (request_module("sctp"))
+                        goto out;
+                ret = register_jprobe(&sctp_recv_probe);
+        }
+out:
+        return ret;
+}
 static __init int sctpprobe_init(void)
 {
        int ret = -ENOMEM;
@@ -202,7 +217,7 @@ static __init int sctpprobe_init(void)
                         &sctpprobe_fops))
                goto free_kfifo;
-        ret = register_jprobe(&sctp_recv_probe);
+        ret = sctp_setup_jprobe();
        if (ret)
                goto remove_proc;
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 0c0642156842..63ba0bdc867a 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -16,9 +16,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -178,7 +177,7 @@ static void sctp_seq_dump_remote_addrs(struct seq_file *seq, struct sctp_associa
        rcu_read_unlock();
 }
-static void * sctp_eps_seq_start(struct seq_file *seq, loff_t *pos)
+static void *sctp_eps_seq_start(struct seq_file *seq, loff_t *pos)
 {
        if (*pos >= sctp_ep_hashsize)
                return NULL;
@@ -197,7 +196,7 @@ static void sctp_eps_seq_stop(struct seq_file *seq, void *v)
 }
-static void * sctp_eps_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static void *sctp_eps_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
        if (++*pos >= sctp_ep_hashsize)
                return NULL;
@@ -283,7 +282,7 @@ void sctp_eps_proc_exit(struct net *net)
 }
-static void * sctp_assocs_seq_start(struct seq_file *seq, loff_t *pos)
+static void *sctp_assocs_seq_start(struct seq_file *seq, loff_t *pos)
 {
        if (*pos >= sctp_assoc_hashsize)
                return NULL;
@@ -306,7 +305,7 @@ static void sctp_assocs_seq_stop(struct seq_file *seq, void *v)
 }
-static void * sctp_assocs_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static void *sctp_assocs_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
        if (++*pos >= sctp_assoc_hashsize)
                return NULL;
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 5e17092f4ada..34b7726bcd7f 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -23,9 +23,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -1066,8 +1065,8 @@ static struct sctp_af sctp_af_inet = {
 #endif
 };
-struct sctp_pf *sctp_get_pf_specific(sa_family_t family) {
+struct sctp_pf *sctp_get_pf_specific(sa_family_t family)
+{
        switch (family) {
        case PF_INET:
                return sctp_pf_inet_specific;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index fe690320b1e4..e5f7cdb42a85 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -23,9 +23,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -1968,13 +1967,13 @@ static int sctp_verify_ext_param(struct net *net, union sctp_params param)
        for (i = 0; i < num_ext; i++) {
                switch (param.ext->chunks[i]) {
-                    case SCTP_CID_AUTH:
+                case SCTP_CID_AUTH:
-                            have_auth = 1;
+                        have_auth = 1;
-                            break;
+                        break;
-                    case SCTP_CID_ASCONF:
+                case SCTP_CID_ASCONF:
-                    case SCTP_CID_ASCONF_ACK:
+                case SCTP_CID_ASCONF_ACK:
-                            have_asconf = 1;
+                        have_asconf = 1;
-                            break;
+                        break;
                }
        }
@@ -2001,25 +2000,24 @@ static void sctp_process_ext_param(struct sctp_association *asoc,
        for (i = 0; i < num_ext; i++) {
                switch (param.ext->chunks[i]) {
-                    case SCTP_CID_FWD_TSN:
+                case SCTP_CID_FWD_TSN:
-                            if (net->sctp.prsctp_enable &&
+                        if (net->sctp.prsctp_enable && !asoc->peer.prsctp_capable)
-                                !asoc->peer.prsctp_capable)
                                    asoc->peer.prsctp_capable = 1;
-                            break;
+                        break;
-                    case SCTP_CID_AUTH:
+                case SCTP_CID_AUTH:
-                            /* if the peer reports AUTH, assume that he
+                        /* if the peer reports AUTH, assume that he
-                             * supports AUTH.
+                         * supports AUTH.
-                             */
+                         */
-                            if (net->sctp.auth_enable)
+                        if (net->sctp.auth_enable)
-                                    asoc->peer.auth_capable = 1;
+                                asoc->peer.auth_capable = 1;
-                            break;
+                        break;
-                    case SCTP_CID_ASCONF:
+                case SCTP_CID_ASCONF:
-                    case SCTP_CID_ASCONF_ACK:
+                case SCTP_CID_ASCONF_ACK:
-                            if (net->sctp.addip_enable)
+                        if (net->sctp.addip_enable)
-                                    asoc->peer.asconf_capable = 1;
+                                asoc->peer.asconf_capable = 1;
-                            break;
+                        break;
-                    default:
+                default:
-                            break;
+                        break;
                }
        }
 }
@@ -2252,7 +2250,7 @@ int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
         * VIOLATION error.  We build the ERROR chunk here and let the normal
         * error handling code build and send the packet.
         */
-        if (param.v != (void*)chunk->chunk_end)
+        if (param.v != (void *)chunk->chunk_end)
                return sctp_process_inv_paramlength(asoc, param.p, chunk, errp);
        /* The only missing mandatory param possible today is
@@ -2267,14 +2265,14 @@ int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
                result = sctp_verify_param(net, asoc, param, cid, chunk, errp);
                switch (result) {
-                    case SCTP_IERROR_ABORT:
+                case SCTP_IERROR_ABORT:
-                    case SCTP_IERROR_NOMEM:
+                case SCTP_IERROR_NOMEM:
-                                return 0;
+                        return 0;
-                    case SCTP_IERROR_ERROR:
+                case SCTP_IERROR_ERROR:
-                                return 1;
+                        return 1;
-                    case SCTP_IERROR_NO_ERROR:
+                case SCTP_IERROR_NO_ERROR:
-                    default:
+                default:
-                                break;
+                        break;
                }
        } /* for (loop through all parameters) */
@@ -2309,7 +2307,7 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
         * added as the primary transport.  The source address seems to
         * be a a better choice than any of the embedded addresses.
         */
-        if(!sctp_assoc_add_peer(asoc, peer_addr, gfp, SCTP_ACTIVE))
+        if (!sctp_assoc_add_peer(asoc, peer_addr, gfp, SCTP_ACTIVE))
                goto nomem;
        if (sctp_cmp_addr_exact(sctp_source(chunk), peer_addr))
@@ -3335,7 +3333,7 @@ static __be16 sctp_get_asconf_response(struct sctp_chunk *asconf_ack,
        while (asconf_ack_len > 0) {
                if (asconf_ack_param->crr_id == asconf_param->crr_id) {
-                        switch(asconf_ack_param->param_hdr.type) {
+                        switch (asconf_ack_param->param_hdr.type) {
                        case SCTP_PARAM_SUCCESS_REPORT:
                                return SCTP_ERROR_NO_ERROR;
                        case SCTP_PARAM_ERR_CAUSE:
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 1a6eef39ab2f..ded6db66fb24 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -22,9 +22,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -405,7 +404,7 @@ void sctp_generate_proto_unreach_event(unsigned long data)
        struct sctp_transport *transport = (struct sctp_transport *) data;
        struct sctp_association *asoc = transport->asoc;
        struct net *net = sock_net(asoc->base.sk);
-        
        sctp_bh_lock_sock(asoc->base.sk);
        if (sock_owned_by_user(asoc->base.sk)) {
                pr_debug("%s: sock is busy\n", __func__);
@@ -544,7 +543,7 @@ static void sctp_cmd_init_failed(sctp_cmd_seq_t *commands,
 {
        struct sctp_ulpevent *event;
-        event = sctp_ulpevent_make_assoc_change(asoc,0, SCTP_CANT_STR_ASSOC,
+        event = sctp_ulpevent_make_assoc_change(asoc, 0, SCTP_CANT_STR_ASSOC,
                                                (__u16)error, 0, 0, NULL,
                                                GFP_ATOMIC);
@@ -1116,7 +1115,7 @@ int sctp_do_sm(struct net *net, sctp_event_t event_type, sctp_subtype_t subtype,
        sctp_init_cmd_seq(&commands);
        debug_pre_sfn();
-        status = (*state_fn->fn)(net, ep, asoc, subtype, event_arg, &commands);
+        status = state_fn->fn(net, ep, asoc, subtype, event_arg, &commands);
        debug_post_sfn();
        error = sctp_side_effects(event_type, subtype, state,
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index dfe3f36ff2aa..483dcd71b3c5 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -22,9 +22,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -820,7 +819,7 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
        SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS);
        sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
-        if (new_asoc->autoclose)
+        if (new_asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
@@ -908,7 +907,7 @@ sctp_disposition_t sctp_sf_do_5_1E_ca(struct net *net,
        SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
        SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS);
        sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
-        if (asoc->autoclose)
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
@@ -2946,7 +2945,7 @@ sctp_disposition_t sctp_sf_eat_data_6_2(struct net *net,
                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                  commands);
-        error = sctp_eat_data(asoc, chunk, commands );
+        error = sctp_eat_data(asoc, chunk, commands);
        switch (error) {
        case SCTP_IERROR_NO_ERROR:
                break;
@@ -2970,7 +2969,7 @@ sctp_disposition_t sctp_sf_eat_data_6_2(struct net *net,
        if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
                force = SCTP_FORCE();
-        if (asoc->autoclose) {
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
        }
@@ -3067,7 +3066,7 @@ sctp_disposition_t sctp_sf_eat_data_fast_4_4(struct net *net,
                return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
                                                  commands);
-        error = sctp_eat_data(asoc, chunk, commands );
+        error = sctp_eat_data(asoc, chunk, commands);
        switch (error) {
        case SCTP_IERROR_NO_ERROR:
        case SCTP_IERROR_HIGH_TSN:
@@ -3682,8 +3681,7 @@ sctp_disposition_t sctp_sf_do_asconf(struct net *net,
        asconf_ack->dest = chunk->source;
        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(asconf_ack));
        if (asoc->new_transport) {
-                sctp_sf_heartbeat(ep, asoc, type, asoc->new_transport,
+                sctp_sf_heartbeat(ep, asoc, type, asoc->new_transport, commands);
-                    commands);
                ((struct sctp_association *)asoc)->new_transport = NULL;
        }
@@ -3766,7 +3764,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(struct net *net,
                 */
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
-                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
                                SCTP_ERROR(ECONNABORTED));
                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
@@ -3800,7 +3798,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(struct net *net,
                /* We are going to ABORT, so we might as well stop
                 * processing the rest of the chunks in the packet.
                 */
-                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
                                SCTP_ERROR(ECONNABORTED));
                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
@@ -3878,7 +3876,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(struct net *net,
                                SCTP_CHUNK(chunk));
        /* Count this as receiving DATA. */
-        if (asoc->autoclose) {
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
        }
@@ -4452,7 +4450,7 @@ static sctp_disposition_t sctp_sf_violation_chunklen(
                                     void *arg,
                                     sctp_cmd_seq_t *commands)
 {
-        static const char err_str[]="The following chunk had invalid length:";
+        static const char err_str[] = "The following chunk had invalid length:";
        return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
                                        sizeof(err_str));
@@ -4515,7 +4513,7 @@ static sctp_disposition_t sctp_sf_violation_ctsn(
                                     void *arg,
                                     sctp_cmd_seq_t *commands)
 {
-        static const char err_str[]="The cumulative tsn ack beyond the max tsn currently sent:";
+        static const char err_str[] = "The cumulative tsn ack beyond the max tsn currently sent:";
        return sctp_sf_abort_violation(net, ep, asoc, arg, commands, err_str,
                                        sizeof(err_str));
@@ -4535,7 +4533,7 @@ static sctp_disposition_t sctp_sf_violation_chunk(
                                     void *arg,
                                     sctp_cmd_seq_t *commands)
 {
-        static const char err_str[]="The following chunk violates protocol:";
+        static const char err_str[] = "The following chunk violates protocol:";
        if (!asoc)
                return sctp_sf_violation(net, ep, asoc, type, arg, commands);
@@ -4611,7 +4609,7 @@ sctp_disposition_t sctp_sf_do_prm_asoc(struct net *net,
                                       sctp_cmd_seq_t *commands)
 {
        struct sctp_chunk *repl;
-        struct sctp_association* my_asoc;
+        struct sctp_association *my_asoc;
        /* The comment below says that we enter COOKIE-WAIT AFTER
         * sending the INIT, but that doesn't actually work in our
@@ -5267,7 +5265,7 @@ sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                        SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
-        if (asoc->autoclose)
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
@@ -5346,7 +5344,7 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                        SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
-        if (asoc->autoclose)
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
@@ -6001,7 +5999,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
                /* Special case the INIT-ACK as there is no peer's vtag
                 * yet.
                 */
-                switch(chunk->chunk_hdr->type) {
+                switch (chunk->chunk_hdr->type) {
                case SCTP_CID_INIT_ACK:
                {
                        sctp_initack_chunk_t *initack;
@@ -6018,7 +6016,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(struct net *net,
                /* Special case the INIT and stale COOKIE_ECHO as there is no
                 * vtag yet.
                 */
-                switch(chunk->chunk_hdr->type) {
+                switch (chunk->chunk_hdr->type) {
                case SCTP_CID_INIT:
                {
                        sctp_init_chunk_t *init;
@@ -6208,7 +6206,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
         */
        if (*sk->sk_prot_creator->memory_pressure) {
                if (sctp_tsnmap_has_gap(map) &&
-                   (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
+                    (sctp_tsnmap_get_ctsn(map) + 1) == tsn) {
                        pr_debug("%s: under pressure, reneging for tsn:%u\n",
                                 __func__, tsn);
                        deliver = SCTP_CMD_RENEGE;
@@ -6232,7 +6230,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
                /* We are going to ABORT, so we might as well stop
                 * processing the rest of the chunks in the packet.
                 */
-                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
+                sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET, SCTP_NULL());
                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
                                SCTP_ERROR(ECONNABORTED));
                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index c5999b2dde7d..a987d54b379c 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -22,9 +22,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -70,7 +69,7 @@ static const sctp_sm_table_entry_t bug = {
        if ((event_subtype._type > (_max))) {                           \
                pr_warn("table %p possible attack: event %d exceeds max %d\n", \
                        _table, event_subtype._type, _max);             \
-                rtn = &bug;                                             \
+                rtn = &bug;                                             \
        } else                                                          \
                rtn = &_table[event_subtype._type][(int)state];         \
                                                                        \
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 72046b9729a8..e9c5121e0fbf 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -28,9 +28,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -83,7 +82,7 @@ static int sctp_writeable(struct sock *sk);
 static void sctp_wfree(struct sk_buff *skb);
 static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p,
                                size_t msg_len);
-static int sctp_wait_for_packet(struct sock * sk, int *err, long *timeo_p);
+static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
 static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
 static int sctp_wait_for_accept(struct sock *sk, long timeo);
 static void sctp_wait_for_close(struct sock *sk, long timeo);
@@ -953,7 +952,7 @@ int sctp_asconf_mgmt(struct sctp_sock *sp, struct sctp_sockaddr_entry *addrw)
 *
 * Returns 0 if ok, <0 errno code on error.
 */
-static int sctp_setsockopt_bindx(struct sock* sk,
+static int sctp_setsockopt_bindx(struct sock *sk,
                                 struct sockaddr __user *addrs,
                                 int addrs_size, int op)
 {
@@ -1040,7 +1039,7 @@ out:
 * Common routine for handling connect() and sctp_connectx().
 * Connect will come in with just a single address.
 */
-static int __sctp_connect(struct sock* sk,
+static int __sctp_connect(struct sock *sk,
                          struct sockaddr *kaddrs,
                          int addrs_size,
                          sctp_assoc_t *assoc_id)
@@ -1300,7 +1299,7 @@ out_free:
 *
 * Returns >=0 if ok, <0 errno code on error.
 */
-static int __sctp_setsockopt_connectx(struct sock* sk,
+static int __sctp_setsockopt_connectx(struct sock *sk,
                                      struct sockaddr __user *addrs,
                                      int addrs_size,
                                      sctp_assoc_t *assoc_id)
@@ -1338,7 +1337,7 @@ static int __sctp_setsockopt_connectx(struct sock* sk,
 * This is an older interface.  It's kept for backward compatibility
 * to the option that doesn't provide association id.
 */
-static int sctp_setsockopt_connectx_old(struct sock* sk,
+static int sctp_setsockopt_connectx_old(struct sock *sk,
                                        struct sockaddr __user *addrs,
                                        int addrs_size)
 {
@@ -1351,7 +1350,7 @@ static int sctp_setsockopt_connectx_old(struct sock* sk,
 * indication to the call.  Error is always negative and association id is
 * always positive.
 */
-static int sctp_setsockopt_connectx(struct sock* sk,
+static int sctp_setsockopt_connectx(struct sock *sk,
                                    struct sockaddr __user *addrs,
                                    int addrs_size)
 {
@@ -1374,7 +1373,7 @@ static int sctp_setsockopt_connectx(struct sock* sk,
 * addrs_num structure member.  That way we can re-use the existing
 * code.
 */
-static int sctp_getsockopt_connectx3(struct sock* sk, int len,
+static int sctp_getsockopt_connectx3(struct sock *sk, int len,
                                     char __user *optval,
                                     int __user *optlen)
 {
@@ -1569,7 +1568,7 @@ static int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
        struct net *net = sock_net(sk);
        struct sctp_sock *sp;
        struct sctp_endpoint *ep;
-        struct sctp_association *new_asoc=NULL, *asoc=NULL;
+        struct sctp_association *new_asoc = NULL, *asoc = NULL;
        struct sctp_transport *transport, *chunk_tp;
        struct sctp_chunk *chunk;
        union sctp_addr to;
@@ -2196,6 +2195,7 @@ static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
                                     unsigned int optlen)
 {
        struct sctp_sock *sp = sctp_sk(sk);
+        struct net *net = sock_net(sk);
        /* Applicable to UDP-style socket only */
        if (sctp_style(sk, TCP))
@@ -2205,6 +2205,9 @@ static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
        if (copy_from_user(&sp->autoclose, optval, optlen))
                return -EFAULT;
+        if (sp->autoclose > net->sctp.max_autoclose)
+                sp->autoclose = net->sctp.max_autoclose;
        return 0;
 }
@@ -2459,7 +2462,7 @@ static int sctp_setsockopt_peer_addr_params(struct sock *sk,
        int hb_change, pmtud_change, sackdelay_change;
        if (optlen != sizeof(struct sctp_paddrparams))
-                return - EINVAL;
+                return -EINVAL;
        if (copy_from_user(&params, optval, optlen))
                return -EFAULT;
@@ -2480,7 +2483,7 @@ static int sctp_setsockopt_peer_addr_params(struct sock *sk,
        /* If an address other than INADDR_ANY is specified, and
         * no transport is found, then the request is invalid.
         */
-        if (!sctp_is_any(sk, ( union sctp_addr *)&params.spp_address)) {
+        if (!sctp_is_any(sk, (union sctp_addr *)&params.spp_address)) {
                trans = sctp_addr_id2transport(sk, &params.spp_address,
                                               params.spp_assoc_id);
                if (!trans)
@@ -2575,8 +2578,9 @@ static int sctp_setsockopt_delayed_ack(struct sock *sk,
                if (params.sack_delay == 0 && params.sack_freq == 0)
                        return 0;
        } else if (optlen == sizeof(struct sctp_assoc_value)) {
-                pr_warn("Use of struct sctp_assoc_value in delayed_ack socket option deprecated\n");
+                pr_warn_ratelimited(DEPRECATED
-                pr_warn("Use struct sctp_sack_info instead\n");
+                                    "Use of struct sctp_assoc_value in delayed_ack socket option.\n"
+                                    "Use struct sctp_sack_info instead\n");
                if (copy_from_user(&params, optval, optlen))
                        return -EFAULT;
@@ -2585,7 +2589,7 @@ static int sctp_setsockopt_delayed_ack(struct sock *sk,
                else
                        params.sack_freq = 0;
        } else
-                return - EINVAL;
+                return -EINVAL;
        /* Validate value parameter. */
        if (params.sack_delay > 500)
@@ -2811,6 +2815,8 @@ static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigne
 {
        struct sctp_rtoinfo rtoinfo;
        struct sctp_association *asoc;
+        unsigned long rto_min, rto_max;
+        struct sctp_sock *sp = sctp_sk(sk);
        if (optlen != sizeof (struct sctp_rtoinfo))
                return -EINVAL;
@@ -2824,26 +2830,36 @@ static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigne
        if (!asoc && rtoinfo.srto_assoc_id && sctp_style(sk, UDP))
                return -EINVAL;
+        rto_max = rtoinfo.srto_max;
+        rto_min = rtoinfo.srto_min;
+        if (rto_max)
+                rto_max = asoc ? msecs_to_jiffies(rto_max) : rto_max;
+        else
+                rto_max = asoc ? asoc->rto_max : sp->rtoinfo.srto_max;
+        if (rto_min)
+                rto_min = asoc ? msecs_to_jiffies(rto_min) : rto_min;
+        else
+                rto_min = asoc ? asoc->rto_min : sp->rtoinfo.srto_min;
+        if (rto_min > rto_max)
+                return -EINVAL;
        if (asoc) {
                if (rtoinfo.srto_initial != 0)
                        asoc->rto_initial =
                                msecs_to_jiffies(rtoinfo.srto_initial);
-                if (rtoinfo.srto_max != 0)
+                asoc->rto_max = rto_max;
-                        asoc->rto_max = msecs_to_jiffies(rtoinfo.srto_max);
+                asoc->rto_min = rto_min;
-                if (rtoinfo.srto_min != 0)
-                        asoc->rto_min = msecs_to_jiffies(rtoinfo.srto_min);
        } else {
                /* If there is no association or the association-id = 0
                 * set the values to the endpoint.
                 */
-                struct sctp_sock *sp = sctp_sk(sk);
                if (rtoinfo.srto_initial != 0)
                        sp->rtoinfo.srto_initial = rtoinfo.srto_initial;
-                if (rtoinfo.srto_max != 0)
+                sp->rtoinfo.srto_max = rto_max;
-                        sp->rtoinfo.srto_max = rtoinfo.srto_max;
+                sp->rtoinfo.srto_min = rto_min;
-                if (rtoinfo.srto_min != 0)
-                        sp->rtoinfo.srto_min = rtoinfo.srto_min;
        }
        return 0;
@@ -2979,8 +2995,9 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned
        int val;
        if (optlen == sizeof(int)) {
-                pr_warn("Use of int in maxseg socket option deprecated\n");
+                pr_warn_ratelimited(DEPRECATED
-                pr_warn("Use struct sctp_assoc_value instead\n");
+                                    "Use of int in maxseg socket option.\n"
+                                    "Use struct sctp_assoc_value instead\n");
                if (copy_from_user(&val, optval, optlen))
                        return -EFAULT;
                params.assoc_id = 0;
@@ -3237,8 +3254,9 @@ static int sctp_setsockopt_maxburst(struct sock *sk,
        int assoc_id = 0;
        if (optlen == sizeof(int)) {
-                pr_warn("Use of int in max_burst socket option deprecated\n");
+                pr_warn_ratelimited(DEPRECATED
-                pr_warn("Use struct sctp_assoc_value instead\n");
+                                    "Use of int in max_burst socket option deprecated.\n"
+                                    "Use struct sctp_assoc_value instead\n");
                if (copy_from_user(&val, optval, optlen))
                        return -EFAULT;
        } else if (optlen == sizeof(struct sctp_assoc_value)) {
@@ -3317,7 +3335,7 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
        if (optlen < sizeof(struct sctp_hmacalgo))
                return -EINVAL;
-        hmacs= memdup_user(optval, optlen);
+        hmacs = memdup_user(optval, optlen);
        if (IS_ERR(hmacs))
                return PTR_ERR(hmacs);
@@ -3355,7 +3373,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
        if (optlen <= sizeof(struct sctp_authkey))
                return -EINVAL;
-        authkey= memdup_user(optval, optlen);
+        authkey = memdup_user(optval, optlen);
        if (IS_ERR(authkey))
                return PTR_ERR(authkey);
@@ -3909,7 +3927,7 @@ static int sctp_init_sock(struct sock *sk)
         */
        sp->hbinterval  = net->sctp.hb_interval;
        sp->pathmaxrxt  = net->sctp.max_retrans_path;
-        sp->pathmtu     = 0; // allow default discovery
+        sp->pathmtu     = 0; /* allow default discovery */
        sp->sackdelay   = net->sctp.sack_timeout;
        sp->sackfreq    = 2;
        sp->param_flags = SPP_HB_ENABLE |
@@ -4452,7 +4470,7 @@ static int sctp_getsockopt_peer_addr_params(struct sock *sk, int len,
        /* If an address other than INADDR_ANY is specified, and
         * no transport is found, then the request is invalid.
         */
-        if (!sctp_is_any(sk, ( union sctp_addr *)&params.spp_address)) {
+        if (!sctp_is_any(sk, (union sctp_addr *)&params.spp_address)) {
                trans = sctp_addr_id2transport(sk, &params.spp_address,
                                               params.spp_assoc_id);
                if (!trans) {
@@ -4558,12 +4576,13 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
                if (copy_from_user(&params, optval, len))
                        return -EFAULT;
        } else if (len == sizeof(struct sctp_assoc_value)) {
-                pr_warn("Use of struct sctp_assoc_value in delayed_ack socket option deprecated\n");
+                pr_warn_ratelimited(DEPRECATED
-                pr_warn("Use struct sctp_sack_info instead\n");
+                                    "Use of struct sctp_assoc_value in delayed_ack socket option.\n"
+                                    "Use struct sctp_sack_info instead\n");
                if (copy_from_user(&params, optval, len))
                        return -EFAULT;
        } else
-                return - EINVAL;
+                return -EINVAL;
        /* Get association, if sack_assoc_id != 0 and the socket is a one
         * to many style socket, and an association was not found, then
@@ -4653,8 +4672,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
        if (!asoc)
                return -EINVAL;
-        to = optval + offsetof(struct sctp_getaddrs,addrs);
+        to = optval + offsetof(struct sctp_getaddrs, addrs);
-        space_left = len - offsetof(struct sctp_getaddrs,addrs);
+        space_left = len - offsetof(struct sctp_getaddrs, addrs);
        list_for_each_entry(from, &asoc->peer.transport_addr_list,
                                transports) {
@@ -4714,7 +4733,7 @@ static int sctp_copy_laddrs(struct sock *sk, __u16 port, void *to,
                memcpy(to, &temp, addrlen);
                to += addrlen;
-                cnt ++;
+                cnt++;
                space_left -= addrlen;
                *bytes_copied += addrlen;
        }
@@ -4763,8 +4782,8 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
                bp = &asoc->base.bind_addr;
        }
-        to = optval + offsetof(struct sctp_getaddrs,addrs);
+        to = optval + offsetof(struct sctp_getaddrs, addrs);
-        space_left = len - offsetof(struct sctp_getaddrs,addrs);
+        space_left = len - offsetof(struct sctp_getaddrs, addrs);
        addrs = kmalloc(space_left, GFP_KERNEL);
        if (!addrs)
@@ -4803,7 +4822,7 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
                memcpy(buf, &temp, addrlen);
                buf += addrlen;
                bytes_copied += addrlen;
-                cnt ++;
+                cnt++;
                space_left -= addrlen;
        }
@@ -5075,7 +5094,7 @@ static int sctp_getsockopt_associnfo(struct sock *sk, int len,
                assocparams.sasoc_cookie_life = ktime_to_ms(asoc->cookie_life);
                list_for_each(pos, &asoc->peer.transport_addr_list) {
-                        cnt ++;
+                        cnt++;
                }
                assocparams.sasoc_number_peer_destinations = cnt;
@@ -5203,8 +5222,9 @@ static int sctp_getsockopt_maxseg(struct sock *sk, int len,
        struct sctp_association *asoc;
        if (len == sizeof(int)) {
-                pr_warn("Use of int in maxseg socket option deprecated\n");
+                pr_warn_ratelimited(DEPRECATED
-                pr_warn("Use struct sctp_assoc_value instead\n");
+                                    "Use of int in maxseg socket option.\n"
+                                    "Use struct sctp_assoc_value instead\n");
                params.assoc_id = 0;
        } else if (len >= sizeof(struct sctp_assoc_value)) {
                len = sizeof(struct sctp_assoc_value);
@@ -5295,8 +5315,9 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
        struct sctp_association *asoc;
        if (len == sizeof(int)) {
-                pr_warn("Use of int in max_burst socket option deprecated\n");
+                pr_warn_ratelimited(DEPRECATED
-                pr_warn("Use struct sctp_assoc_value instead\n");
+                                    "Use of int in max_burst socket option.\n"
+                                    "Use struct sctp_assoc_value instead\n");
                params.assoc_id = 0;
        } else if (len >= sizeof(struct sctp_assoc_value)) {
                len = sizeof(struct sctp_assoc_value);
@@ -5428,7 +5449,8 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
                return -EFAULT;
 num:
        len = sizeof(struct sctp_authchunks) + num_chunks;
-        if (put_user(len, optlen)) return -EFAULT;
+        if (put_user(len, optlen))
+                return -EFAULT;
        if (put_user(num_chunks, &p->gauth_number_of_chunks))
                return -EFAULT;
        return 0;
@@ -5460,7 +5482,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
                return -EINVAL;
        if (asoc)
-                ch = (struct sctp_chunks_param*)asoc->c.auth_chunks;
+                ch = (struct sctp_chunks_param *)asoc->c.auth_chunks;
        else
                ch = sctp_sk(sk)->ep->auth_chunk_list;
@@ -6402,7 +6424,7 @@ static int sctp_msghdr_parse(const struct msghdr *msg, sctp_cmsgs_t *cmsgs)
 * Note: This function is the same function as in core/datagram.c
 * with a few modifications to make lksctp work.
 */
-static int sctp_wait_for_packet(struct sock * sk, int *err, long *timeo_p)
+static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p)
 {
        int error;
        DEFINE_WAIT(wait);
diff --git a/net/sctp/ssnmap.c b/net/sctp/ssnmap.c
index 6007124aefa0..b9c8521c1a98 100644
--- a/net/sctp/ssnmap.c
+++ b/net/sctp/ssnmap.c
@@ -18,9 +18,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 6b36561a1b3b..7135e617ab0f 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -19,9 +19,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -56,11 +55,16 @@ extern long sysctl_sctp_mem[3];
 extern int sysctl_sctp_rmem[3];
 extern int sysctl_sctp_wmem[3];
-static int proc_sctp_do_hmac_alg(struct ctl_table *ctl,
+static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
-                                int write,
+                                void __user *buffer, size_t *lenp,
+                                loff_t *ppos);
+static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
+                                void __user *buffer, size_t *lenp,
+                                loff_t *ppos);
+static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
                                void __user *buffer, size_t *lenp,
                                loff_t *ppos);
 static struct ctl_table sctp_table[] = {
        {
                .procname       = "sctp_mem",
@@ -102,17 +106,17 @@ static struct ctl_table sctp_net_table[] = {
                .data           = &init_net.sctp.rto_min,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
+                .proc_handler   = proc_sctp_do_rto_min,
                .extra1         = &one,
-                .extra2         = &timer_max
+                .extra2         = &init_net.sctp.rto_max
        },
        {
                .procname       = "rto_max",
                .data           = &init_net.sctp.rto_max,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
+                .proc_handler   = proc_sctp_do_rto_max,
-                .extra1         = &one,
+                .extra1         = &init_net.sctp.rto_min,
                .extra2         = &timer_max
        },
        {
@@ -294,8 +298,7 @@ static struct ctl_table sctp_net_table[] = {
        { /* sentinel */ }
 };
-static int proc_sctp_do_hmac_alg(struct ctl_table *ctl,
+static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
-                                int write,
                                void __user *buffer, size_t *lenp,
                                loff_t *ppos)
 {
@@ -342,6 +345,60 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl,
        return ret;
 }
+static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
+                                void __user *buffer, size_t *lenp,
+                                loff_t *ppos)
+{
+        struct net *net = current->nsproxy->net_ns;
+        int new_value;
+        struct ctl_table tbl;
+        unsigned int min = *(unsigned int *) ctl->extra1;
+        unsigned int max = *(unsigned int *) ctl->extra2;
+        int ret;
+        memset(&tbl, 0, sizeof(struct ctl_table));
+        tbl.maxlen = sizeof(unsigned int);
+        if (write)
+                tbl.data = &new_value;
+        else
+                tbl.data = &net->sctp.rto_min;
+        ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
+        if (write) {
+                if (ret || new_value > max || new_value < min)
+                        return -EINVAL;
+                net->sctp.rto_min = new_value;
+        }
+        return ret;
+}
+static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
+                                void __user *buffer, size_t *lenp,
+                                loff_t *ppos)
+{
+        struct net *net = current->nsproxy->net_ns;
+        int new_value;
+        struct ctl_table tbl;
+        unsigned int min = *(unsigned int *) ctl->extra1;
+        unsigned int max = *(unsigned int *) ctl->extra2;
+        int ret;
+        memset(&tbl, 0, sizeof(struct ctl_table));
+        tbl.maxlen = sizeof(unsigned int);
+        if (write)
+                tbl.data = &new_value;
+        else
+                tbl.data = &net->sctp.rto_max;
+        ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
+        if (write) {
+                if (ret || new_value > max || new_value < min)
+                        return -EINVAL;
+                net->sctp.rto_max = new_value;
+        }
+        return ret;
+}
 int sctp_sysctl_net_register(struct net *net)
 {
        struct ctl_table *table;
@@ -367,7 +424,7 @@ void sctp_sysctl_net_unregister(struct net *net)
        kfree(table);
 }
-static struct ctl_table_header * sctp_sysctl_header;
+static struct ctl_table_header *sctp_sysctl_header;
 /* Sysctl registration.  */
 void sctp_sysctl_register(void)
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index e332efb124cc..d0810dc5f079 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -24,9 +24,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -573,7 +572,7 @@ void sctp_transport_burst_limited(struct sctp_transport *t)
        u32 old_cwnd = t->cwnd;
        u32 max_burst_bytes;
-        if (t->burst_limited)
+        if (t->burst_limited || asoc->max_burst == 0)
                return;
        max_burst_bytes = t->flight_size + (asoc->max_burst * asoc->pathmtu);
diff --git a/net/sctp/tsnmap.c b/net/sctp/tsnmap.c
index fbda20028285..7635f9f2311d 100644
--- a/net/sctp/tsnmap.c
+++ b/net/sctp/tsnmap.c
@@ -21,9 +21,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 81089ed65456..85c64658bd0b 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -22,9 +22,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index 1c1484ed605d..5dc94117e9d4 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -21,9 +21,8 @@
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with GNU CC; see the file COPYING.  If not, write to
+ * along with GNU CC; see the file COPYING.  If not, see
- * the Free Software Foundation, 59 Temple Place - Suite 330,
+ * <http://www.gnu.org/licenses/>.
- * Boston, MA 02111-1307, USA.
 *
 * Please send any bug reports or fixes you make to the
 * email address(es):
@@ -44,9 +43,9 @@
 #include <net/sctp/sm.h>
 /* Forward declarations for internal helpers.  */
-static struct sctp_ulpevent * sctp_ulpq_reasm(struct sctp_ulpq *ulpq,
+static struct sctp_ulpevent *sctp_ulpq_reasm(struct sctp_ulpq *ulpq,
                                              struct sctp_ulpevent *);
-static struct sctp_ulpevent * sctp_ulpq_order(struct sctp_ulpq *,
+static struct sctp_ulpevent *sctp_ulpq_order(struct sctp_ulpq *,
                                              struct sctp_ulpevent *);
 static void sctp_ulpq_reasm_drain(struct sctp_ulpq *ulpq);
@@ -108,7 +107,7 @@ int sctp_ulpq_tail_data(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
        event = sctp_ulpq_reasm(ulpq, event);
        /* Do ordering if needed.  */
-        if ((event) && (event->msg_flags & MSG_EOR)){
+        if ((event) && (event->msg_flags & MSG_EOR)) {
                /* Create a temporary list to collect chunks on.  */
                skb_queue_head_init(&temp);
                __skb_queue_tail(&temp, sctp_event2skb(event));
@@ -337,7 +336,8 @@ static struct sctp_ulpevent *sctp_make_reassembled_event(struct net *net,
                pos = f_frag->next;
        /* Get the last skb in the f_frag's frag_list if present. */
-        for (last = list; list; last = list, list = list->next);
+        for (last = list; list; last = list, list = list->next)
+                ;
        /* Add the list of remaining fragments to the first fragments
         * frag_list.
@@ -727,7 +727,7 @@ static void sctp_ulpq_reasm_drain(struct sctp_ulpq *ulpq)
        while ((event = sctp_ulpq_retrieve_reassembled(ulpq)) != NULL) {
                /* Do ordering if needed.  */
-                if ((event) && (event->msg_flags & MSG_EOR)){
+                if ((event) && (event->msg_flags & MSG_EOR)) {
                        skb_queue_head_init(&temp);
                        __skb_queue_tail(&temp, sctp_event2skb(event));
diff --git a/net/socket.c b/net/socket.c
index 0b18693f2be6..879933aaed4c 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1445,48 +1445,61 @@ SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
                err = fd1;
                goto out_release_both;
        }
        fd2 = get_unused_fd_flags(flags);
        if (unlikely(fd2 < 0)) {
                err = fd2;
-                put_unused_fd(fd1);
+                goto out_put_unused_1;
-                goto out_release_both;
        }
        newfile1 = sock_alloc_file(sock1, flags, NULL);
        if (unlikely(IS_ERR(newfile1))) {
                err = PTR_ERR(newfile1);
-                put_unused_fd(fd1);
+                goto out_put_unused_both;
-                put_unused_fd(fd2);
-                goto out_release_both;
        }
        newfile2 = sock_alloc_file(sock2, flags, NULL);
        if (IS_ERR(newfile2)) {
                err = PTR_ERR(newfile2);
-                fput(newfile1);
+                goto out_fput_1;
-                put_unused_fd(fd1);
-                put_unused_fd(fd2);
-                sock_release(sock2);
-                goto out;
        }
+        err = put_user(fd1, &usockvec[0]);
+        if (err)
+                goto out_fput_both;
+        err = put_user(fd2, &usockvec[1]);
+        if (err)
+                goto out_fput_both;
        audit_fd_pair(fd1, fd2);
        fd_install(fd1, newfile1);
        fd_install(fd2, newfile2);
        /* fd1 and fd2 may be already another descriptors.
         * Not kernel problem.
         */
-        err = put_user(fd1, &usockvec[0]);
+        return 0;
-        if (!err)
-                err = put_user(fd2, &usockvec[1]);
-        if (!err)
-                return 0;
-        sys_close(fd2);
+out_fput_both:
-        sys_close(fd1);
+        fput(newfile2);
-        return err;
+        fput(newfile1);
+        put_unused_fd(fd2);
+        put_unused_fd(fd1);
+        goto out;
+out_fput_1:
+        fput(newfile1);
+        put_unused_fd(fd2);
+        put_unused_fd(fd1);
+        sock_release(sock2);
+        goto out;
+out_put_unused_both:
+        put_unused_fd(fd2);
+out_put_unused_1:
+        put_unused_fd(fd1);
 out_release_both:
        sock_release(sock2);
 out_release_1:
@@ -1973,7 +1986,7 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
        if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
                return -EFAULT;
        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
-                return -EINVAL;
+                kmsg->msg_namelen = sizeof(struct sockaddr_storage);
        return 0;
 }
@@ -2968,11 +2981,8 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
                         struct compat_ifreq __user *ifr32)
 {
        struct ifreq kifr;
-        struct ifreq __user *uifr;
        mm_segment_t old_fs;
        int err;
-        u32 data;
-        void __user *datap;
        switch (cmd) {
        case SIOCBONDENSLAVE:
@@ -2989,26 +2999,13 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
                set_fs(old_fs);
                return err;
-        case SIOCBONDSLAVEINFOQUERY:
-        case SIOCBONDINFOQUERY:
-                uifr = compat_alloc_user_space(sizeof(*uifr));
-                if (copy_in_user(&uifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
-                        return -EFAULT;
-                if (get_user(data, &ifr32->ifr_ifru.ifru_data))
-                        return -EFAULT;
-                datap = compat_ptr(data);
-                if (put_user(datap, &uifr->ifr_ifru.ifru_data))
-                        return -EFAULT;
-                return dev_ioctl(net, cmd, uifr);
        default:
                return -ENOIOCTLCMD;
        }
 }
-static int siocdevprivate_ioctl(struct net *net, unsigned int cmd,
+/* Handle ioctls that use ifreq::ifr_data and just need struct ifreq converted */
+static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd,
                                 struct compat_ifreq __user *u_ifreq32)
 {
        struct ifreq __user *u_ifreq64;
@@ -3019,19 +3016,16 @@ static int siocdevprivate_ioctl(struct net *net, unsigned int cmd,
        if (copy_from_user(&tmp_buf[0], &(u_ifreq32->ifr_ifrn.ifrn_name[0]),
                           IFNAMSIZ))
                return -EFAULT;
-        if (__get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
+        if (get_user(data32, &u_ifreq32->ifr_ifru.ifru_data))
                return -EFAULT;
        data64 = compat_ptr(data32);
        u_ifreq64 = compat_alloc_user_space(sizeof(*u_ifreq64));
-        /* Don't check these user accesses, just let that get trapped
-         * in the ioctl handler instead.
-         */
        if (copy_to_user(&u_ifreq64->ifr_ifrn.ifrn_name[0], &tmp_buf[0],
                         IFNAMSIZ))
                return -EFAULT;
-        if (__put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
+        if (put_user(data64, &u_ifreq64->ifr_ifru.ifru_data))
                return -EFAULT;
        return dev_ioctl(net, cmd, u_ifreq64);
@@ -3111,27 +3105,6 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
        return err;
 }
-static int compat_siocshwtstamp(struct net *net, struct compat_ifreq __user *uifr32)
-{
-        void __user *uptr;
-        compat_uptr_t uptr32;
-        struct ifreq __user *uifr;
-        uifr = compat_alloc_user_space(sizeof(*uifr));
-        if (copy_in_user(uifr, uifr32, sizeof(struct compat_ifreq)))
-                return -EFAULT;
-        if (get_user(uptr32, &uifr32->ifr_data))
-                return -EFAULT;
-        uptr = compat_ptr(uptr32);
-        if (put_user(uptr, &uifr->ifr_data))
-                return -EFAULT;
-        return dev_ioctl(net, SIOCSHWTSTAMP, uifr);
-}
 struct rtentry32 {
        u32             rt_pad1;
        struct sockaddr rt_dst;         /* target address               */
@@ -3243,7 +3216,7 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
        struct net *net = sock_net(sk);
        if (cmd >= SIOCDEVPRIVATE && cmd <= (SIOCDEVPRIVATE + 15))
-                return siocdevprivate_ioctl(net, cmd, argp);
+                return compat_ifr_data_ioctl(net, cmd, argp);
        switch (cmd) {
        case SIOCSIFBR:
@@ -3263,8 +3236,6 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
        case SIOCBONDENSLAVE:
        case SIOCBONDRELEASE:
        case SIOCBONDSETHWADDR:
-        case SIOCBONDSLAVEINFOQUERY:
-        case SIOCBONDINFOQUERY:
        case SIOCBONDCHANGEACTIVE:
                return bond_ioctl(net, cmd, argp);
        case SIOCADDRT:
@@ -3274,8 +3245,11 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
                return do_siocgstamp(net, sock, cmd, argp);
        case SIOCGSTAMPNS:
                return do_siocgstampns(net, sock, cmd, argp);
+        case SIOCBONDSLAVEINFOQUERY:
+        case SIOCBONDINFOQUERY:
        case SIOCSHWTSTAMP:
-                return compat_siocshwtstamp(net, argp);
+        case SIOCGHWTSTAMP:
+                return compat_ifr_data_ioctl(net, cmd, argp);
        case FIOSETOWN:
        case SIOCSPGRP:
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 97912b40c254..42fdfc634e56 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1517,7 +1517,7 @@ out:
 static int
 gss_refresh_null(struct rpc_task *task)
 {
-        return -EACCES;
+        return 0;
 }
 static __be32 *
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index d0d14a04dce1..bf04b30a788a 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -471,15 +471,6 @@ struct rpc_filelist {
        umode_t mode;
 };
-static int rpc_delete_dentry(const struct dentry *dentry)
-{
-        return 1;
-}
-static const struct dentry_operations rpc_dentry_operations = {
-        .d_delete = rpc_delete_dentry,
-};
 static struct inode *
 rpc_get_inode(struct super_block *sb, umode_t mode)
 {
@@ -1266,7 +1257,7 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
        sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
        sb->s_magic = RPCAUTH_GSSMAGIC;
        sb->s_op = &s_ops;
-        sb->s_d_op = &rpc_dentry_operations;
+        sb->s_d_op = &simple_dentry_operations;
        sb->s_time_gran = 1;
        inode = rpc_get_inode(sb, S_IFDIR | S_IRUGO | S_IXUGO);
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 0d4402587fdf..4c2a80b3c01e 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -621,12 +621,6 @@ static int tipc_bcbearer_send(struct sk_buff *buf, struct tipc_bearer *unused1,
                if (!p)
                        break; /* No more bearers to try */
-                if (tipc_bearer_blocked(p)) {
-                        if (!s || tipc_bearer_blocked(s))
-                                continue; /* Can't use either bearer */
-                        b = s;
-                }
                tipc_nmap_diff(&bcbearer->remains, &b->nodes,
                               &bcbearer->remains_new);
                if (bcbearer->remains_new.count == bcbearer->remains.count)
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 3f9707a16d06..3bb5f266b0eb 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -1,8 +1,8 @@
 /*
 * net/tipc/bearer.c: TIPC bearer code
 *
- * Copyright (c) 1996-2006, Ericsson AB
+ * Copyright (c) 1996-2006, 2013, Ericsson AB
- * Copyright (c) 2004-2006, 2010-2011, Wind River Systems
+ * Copyright (c) 2004-2006, 2010-2013, Wind River Systems
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -41,8 +41,13 @@
 #define MAX_ADDR_STR 60
-static struct tipc_media *media_list[MAX_MEDIA];
+static struct tipc_media * const media_info_array[] = {
-static u32 media_count;
+        &eth_media_info,
+#ifdef CONFIG_TIPC_MEDIA_IB
+        &ib_media_info,
+#endif
+        NULL
+};
 struct tipc_bearer tipc_bearers[MAX_BEARERS];
@@ -55,11 +60,11 @@ struct tipc_media *tipc_media_find(const char *name)
 {
        u32 i;
-        for (i = 0; i < media_count; i++) {
+        for (i = 0; media_info_array[i] != NULL; i++) {
-                if (!strcmp(media_list[i]->name, name))
+                if (!strcmp(media_info_array[i]->name, name))
-                        return media_list[i];
+                        break;
        }
-        return NULL;
+        return media_info_array[i];
 }
 /**
@@ -69,44 +74,11 @@ static struct tipc_media *media_find_id(u8 type)
 {
        u32 i;
-        for (i = 0; i < media_count; i++) {
+        for (i = 0; media_info_array[i] != NULL; i++) {
-                if (media_list[i]->type_id == type)
+                if (media_info_array[i]->type_id == type)
-                        return media_list[i];
+                        break;
        }
-        return NULL;
+        return media_info_array[i];
-}
-/**
- * tipc_register_media - register a media type
- *
- * Bearers for this media type must be activated separately at a later stage.
- */
-int tipc_register_media(struct tipc_media *m_ptr)
-{
-        int res = -EINVAL;
-        write_lock_bh(&tipc_net_lock);
-        if ((strlen(m_ptr->name) + 1) > TIPC_MAX_MEDIA_NAME)
-                goto exit;
-        if (m_ptr->priority > TIPC_MAX_LINK_PRI)
-                goto exit;
-        if ((m_ptr->tolerance < TIPC_MIN_LINK_TOL) ||
-            (m_ptr->tolerance > TIPC_MAX_LINK_TOL))
-                goto exit;
-        if (media_count >= MAX_MEDIA)
-                goto exit;
-        if (tipc_media_find(m_ptr->name) || media_find_id(m_ptr->type_id))
-                goto exit;
-        media_list[media_count] = m_ptr;
-        media_count++;
-        res = 0;
-exit:
-        write_unlock_bh(&tipc_net_lock);
-        if (res)
-                pr_warn("Media <%s> registration error\n", m_ptr->name);
-        return res;
 }
 /**
@@ -144,13 +116,11 @@ struct sk_buff *tipc_media_get_names(void)
        if (!buf)
                return NULL;
-        read_lock_bh(&tipc_net_lock);
+        for (i = 0; media_info_array[i] != NULL; i++) {
-        for (i = 0; i < media_count; i++) {
                tipc_cfg_append_tlv(buf, TIPC_TLV_MEDIA_NAME,
-                                    media_list[i]->name,
+                                    media_info_array[i]->name,
-                                    strlen(media_list[i]->name) + 1);
+                                    strlen(media_info_array[i]->name) + 1);
        }
-        read_unlock_bh(&tipc_net_lock);
        return buf;
 }
@@ -239,7 +209,7 @@ struct tipc_bearer *tipc_bearer_find_interface(const char *if_name)
 struct sk_buff *tipc_bearer_get_names(void)
 {
        struct sk_buff *buf;
-        struct tipc_bearer *b_ptr;
+        struct tipc_bearer *b;
        int i, j;
        buf = tipc_cfg_reply_alloc(MAX_BEARERS * TLV_SPACE(TIPC_MAX_BEARER_NAME));
@@ -247,13 +217,13 @@ struct sk_buff *tipc_bearer_get_names(void)
                return NULL;
        read_lock_bh(&tipc_net_lock);
-        for (i = 0; i < media_count; i++) {
+        for (i = 0; media_info_array[i] != NULL; i++) {
                for (j = 0; j < MAX_BEARERS; j++) {
-                        b_ptr = &tipc_bearers[j];
+                        b = &tipc_bearers[j];
-                        if (b_ptr->active && (b_ptr->media == media_list[i])) {
+                        if (b->active && (b->media == media_info_array[i])) {
                                tipc_cfg_append_tlv(buf, TIPC_TLV_BEARER_NAME,
-                                                    b_ptr->name,
+                                                    b->name,
-                                                    strlen(b_ptr->name) + 1);
+                                                    strlen(b->name) + 1);
                        }
                }
        }
@@ -275,31 +245,6 @@ void tipc_bearer_remove_dest(struct tipc_bearer *b_ptr, u32 dest)
        tipc_disc_remove_dest(b_ptr->link_req);
 }
-/*
- * Interrupt enabling new requests after bearer blocking:
- * See bearer_send().
- */
-void tipc_continue(struct tipc_bearer *b)
-{
-        spin_lock_bh(&b->lock);
-        b->blocked = 0;
-        spin_unlock_bh(&b->lock);
-}
-/*
- * tipc_bearer_blocked - determines if bearer is currently blocked
- */
-int tipc_bearer_blocked(struct tipc_bearer *b)
-{
-        int res;
-        spin_lock_bh(&b->lock);
-        res = b->blocked;
-        spin_unlock_bh(&b->lock);
-        return res;
-}
 /**
 * tipc_enable_bearer - enable bearer with the given name
 */
@@ -387,6 +332,7 @@ restart:
        b_ptr = &tipc_bearers[bearer_id];
        strcpy(b_ptr->name, name);
+        b_ptr->media = m_ptr;
        res = m_ptr->enable_media(b_ptr);
        if (res) {
                pr_warn("Bearer <%s> rejected, enable failure (%d)\n",
@@ -395,7 +341,6 @@ restart:
        }
        b_ptr->identity = bearer_id;
-        b_ptr->media = m_ptr;
        b_ptr->tolerance = m_ptr->tolerance;
        b_ptr->window = m_ptr->window;
        b_ptr->net_plane = bearer_id + 'A';
@@ -420,17 +365,16 @@ exit:
 }
 /**
- * tipc_block_bearer - Block the bearer, and reset all its links
+ * tipc_reset_bearer - Reset all links established over this bearer
 */
-int tipc_block_bearer(struct tipc_bearer *b_ptr)
+static int tipc_reset_bearer(struct tipc_bearer *b_ptr)
 {
        struct tipc_link *l_ptr;
        struct tipc_link *temp_l_ptr;
        read_lock_bh(&tipc_net_lock);
-        pr_info("Blocking bearer <%s>\n", b_ptr->name);
+        pr_info("Resetting bearer <%s>\n", b_ptr->name);
        spin_lock_bh(&b_ptr->lock);
-        b_ptr->blocked = 1;
        list_for_each_entry_safe(l_ptr, temp_l_ptr, &b_ptr->links, link_list) {
                struct tipc_node *n_ptr = l_ptr->owner;
@@ -456,7 +400,6 @@ static void bearer_disable(struct tipc_bearer *b_ptr)
        pr_info("Disabling bearer <%s>\n", b_ptr->name);
        spin_lock_bh(&b_ptr->lock);
-        b_ptr->blocked = 1;
        b_ptr->media->disable_media(b_ptr);
        list_for_each_entry_safe(l_ptr, temp_l_ptr, &b_ptr->links, link_list) {
                tipc_link_delete(l_ptr);
@@ -490,6 +433,211 @@ int tipc_disable_bearer(const char *name)
 }
+/* tipc_l2_media_addr_set - initialize Ethernet media address structure
+ *
+ * Media-dependent "value" field stores MAC address in first 6 bytes
+ * and zeroes out the remaining bytes.
+ */
+void tipc_l2_media_addr_set(const struct tipc_bearer *b,
+                            struct tipc_media_addr *a, char *mac)
+{
+        int len = b->media->hwaddr_len;
+        if (unlikely(sizeof(a->value) < len)) {
+                WARN_ONCE(1, "Media length invalid\n");
+                return;
+        }
+        memcpy(a->value, mac, len);
+        memset(a->value + len, 0, sizeof(a->value) - len);
+        a->media_id = b->media->type_id;
+        a->broadcast = !memcmp(mac, b->bcast_addr.value, len);
+}
+int tipc_enable_l2_media(struct tipc_bearer *b)
+{
+        struct net_device *dev;
+        char *driver_name = strchr((const char *)b->name, ':') + 1;
+        /* Find device with specified name */
+        dev = dev_get_by_name(&init_net, driver_name);
+        if (!dev)
+                return -ENODEV;
+        /* Associate TIPC bearer with Ethernet bearer */
+        b->media_ptr = dev;
+        memset(b->bcast_addr.value, 0, sizeof(b->bcast_addr.value));
+        memcpy(b->bcast_addr.value, dev->broadcast, b->media->hwaddr_len);
+        b->bcast_addr.media_id = b->media->type_id;
+        b->bcast_addr.broadcast = 1;
+        b->mtu = dev->mtu;
+        tipc_l2_media_addr_set(b, &b->addr, (char *)dev->dev_addr);
+        rcu_assign_pointer(dev->tipc_ptr, b);
+        return 0;
+}
+/* tipc_disable_l2_media - detach TIPC bearer from an Ethernet interface
+ *
+ * Mark Ethernet bearer as inactive so that incoming buffers are thrown away,
+ * then get worker thread to complete bearer cleanup.  (Can't do cleanup
+ * here because cleanup code needs to sleep and caller holds spinlocks.)
+ */
+void tipc_disable_l2_media(struct tipc_bearer *b)
+{
+        struct net_device *dev = (struct net_device *)b->media_ptr;
+        RCU_INIT_POINTER(dev->tipc_ptr, NULL);
+        dev_put(dev);
+}
+/**
+ * tipc_l2_send_msg - send a TIPC packet out over an Ethernet interface
+ * @buf: the packet to be sent
+ * @b_ptr: the bearer throught which the packet is to be sent
+ * @dest: peer destination address
+ */
+int tipc_l2_send_msg(struct sk_buff *buf, struct tipc_bearer *b,
+                     struct tipc_media_addr *dest)
+{
+        struct sk_buff *clone;
+        int delta;
+        struct net_device *dev = (struct net_device *)b->media_ptr;
+        clone = skb_clone(buf, GFP_ATOMIC);
+        if (!clone)
+                return 0;
+        delta = dev->hard_header_len - skb_headroom(buf);
+        if ((delta > 0) &&
+            pskb_expand_head(clone, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) {
+                kfree_skb(clone);
+                return 0;
+        }
+        skb_reset_network_header(clone);
+        clone->dev = dev;
+        clone->protocol = htons(ETH_P_TIPC);
+        dev_hard_header(clone, dev, ETH_P_TIPC, dest->value,
+                        dev->dev_addr, clone->len);
+        dev_queue_xmit(clone);
+        return 0;
+}
+/* tipc_bearer_send- sends buffer to destination over bearer
+ *
+ * IMPORTANT:
+ * The media send routine must not alter the buffer being passed in
+ * as it may be needed for later retransmission!
+ */
+void tipc_bearer_send(struct tipc_bearer *b, struct sk_buff *buf,
+                      struct tipc_media_addr *dest)
+{
+        b->media->send_msg(buf, b, dest);
+}
+/**
+ * tipc_l2_rcv_msg - handle incoming TIPC message from an interface
+ * @buf: the received packet
+ * @dev: the net device that the packet was received on
+ * @pt: the packet_type structure which was used to register this handler
+ * @orig_dev: the original receive net device in case the device is a bond
+ *
+ * Accept only packets explicitly sent to this node, or broadcast packets;
+ * ignores packets sent using interface multicast, and traffic sent to other
+ * nodes (which can happen if interface is running in promiscuous mode).
+ */
+static int tipc_l2_rcv_msg(struct sk_buff *buf, struct net_device *dev,
+                           struct packet_type *pt, struct net_device *orig_dev)
+{
+        struct tipc_bearer *b_ptr;
+        if (!net_eq(dev_net(dev), &init_net)) {
+                kfree_skb(buf);
+                return NET_RX_DROP;
+        }
+        rcu_read_lock();
+        b_ptr = rcu_dereference(dev->tipc_ptr);
+        if (likely(b_ptr)) {
+                if (likely(buf->pkt_type <= PACKET_BROADCAST)) {
+                        buf->next = NULL;
+                        tipc_recv_msg(buf, b_ptr);
+                        rcu_read_unlock();
+                        return NET_RX_SUCCESS;
+                }
+        }
+        rcu_read_unlock();
+        kfree_skb(buf);
+        return NET_RX_DROP;
+}
+/**
+ * tipc_l2_device_event - handle device events from network device
+ * @nb: the context of the notification
+ * @evt: the type of event
+ * @ptr: the net device that the event was on
+ *
+ * This function is called by the Ethernet driver in case of link
+ * change event.
+ */
+static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
+                                void *ptr)
+{
+        struct tipc_bearer *b_ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        if (!net_eq(dev_net(dev), &init_net))
+                return NOTIFY_DONE;
+        rcu_read_lock();
+        b_ptr = rcu_dereference(dev->tipc_ptr);
+        if (!b_ptr) {
+                rcu_read_unlock();
+                return NOTIFY_DONE;
+        }
+        b_ptr->mtu = dev->mtu;
+        switch (evt) {
+        case NETDEV_CHANGE:
+                if (netif_carrier_ok(dev))
+                        break;
+        case NETDEV_DOWN:
+        case NETDEV_CHANGEMTU:
+        case NETDEV_CHANGEADDR:
+                tipc_reset_bearer(b_ptr);
+                break;
+        case NETDEV_UNREGISTER:
+        case NETDEV_CHANGENAME:
+                tipc_disable_bearer(b_ptr->name);
+                break;
+        }
+        rcu_read_unlock();
+        return NOTIFY_OK;
+}
+static struct packet_type tipc_packet_type __read_mostly = {
+        .type = __constant_htons(ETH_P_TIPC),
+        .func = tipc_l2_rcv_msg,
+};
+static struct notifier_block notifier = {
+        .notifier_call  = tipc_l2_device_event,
+        .priority       = 0,
+};
+int tipc_bearer_setup(void)
+{
+        dev_add_pack(&tipc_packet_type);
+        return register_netdevice_notifier(&notifier);
+}
+void tipc_bearer_cleanup(void)
+{
+        unregister_netdevice_notifier(&notifier);
+        dev_remove_pack(&tipc_packet_type);
+}
 void tipc_bearer_stop(void)
 {
@@ -499,5 +647,4 @@ void tipc_bearer_stop(void)
                if (tipc_bearers[i].active)
                        bearer_disable(&tipc_bearers[i]);
        }
-        media_count = 0;
 }
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index e5e04be6fffa..fa95c34ca926 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -1,7 +1,7 @@
 /*
 * net/tipc/bearer.h: Include file for TIPC bearer code
 *
- * Copyright (c) 1996-2006, Ericsson AB
+ * Copyright (c) 1996-2006, 2013, Ericsson AB
 * Copyright (c) 2005, 2010-2011, Wind River Systems
 * All rights reserved.
 *
@@ -73,18 +73,18 @@ struct tipc_media_addr {
 struct tipc_bearer;
 /**
- * struct tipc_media - TIPC media information available to internal users
+ * struct tipc_media - Media specific info exposed to generic bearer layer
 * @send_msg: routine which handles buffer transmission
 * @enable_media: routine which enables a media
 * @disable_media: routine which disables a media
 * @addr2str: routine which converts media address to string
 * @addr2msg: routine which converts media address to protocol message area
 * @msg2addr: routine which converts media address from protocol message area
- * @bcast_addr: media address used in broadcasting
 * @priority: default link (and bearer) priority
 * @tolerance: default time (in ms) before declaring link failure
 * @window: default window (in packets) before declaring link congestion
 * @type_id: TIPC media identifier
+ * @hwaddr_len: TIPC media address len
 * @name: media name
 */
 struct tipc_media {
@@ -101,18 +101,20 @@ struct tipc_media {
        u32 tolerance;
        u32 window;
        u32 type_id;
+        u32 hwaddr_len;
        char name[TIPC_MAX_MEDIA_NAME];
 };
 /**
- * struct tipc_bearer - TIPC bearer structure
+ * struct tipc_bearer - Generic TIPC bearer structure
+ * @dev: ptr to associated network device
 * @usr_handle: pointer to additional media-specific information about bearer
 * @mtu: max packet size bearer can support
- * @blocked: non-zero if bearer is blocked
 * @lock: spinlock for controlling access to bearer
 * @addr: media-specific address associated with bearer
 * @name: bearer name (format = media:interface)
 * @media: ptr to media structure associated with bearer
+ * @bcast_addr: media address used in broadcasting
 * @priority: default link priority for bearer
 * @window: default window size for bearer
 * @tolerance: default link tolerance for bearer
@@ -128,9 +130,8 @@ struct tipc_media {
 * care of initializing all other fields.
 */
 struct tipc_bearer {
-        void *usr_handle;                       /* initalized by media */
+        void *media_ptr;                        /* initalized by media */
        u32 mtu;                                /* initalized by media */
-        int blocked;                            /* initalized by media */
        struct tipc_media_addr addr;            /* initalized by media */
        char name[TIPC_MAX_BEARER_NAME];
        spinlock_t lock;
@@ -159,34 +160,31 @@ extern struct tipc_bearer tipc_bearers[];
 /*
 * TIPC routines available to supported media types
 */
-int tipc_register_media(struct tipc_media *m_ptr);
 void tipc_recv_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr);
-int  tipc_block_bearer(struct tipc_bearer *b_ptr);
-void tipc_continue(struct tipc_bearer *tb_ptr);
 int tipc_enable_bearer(const char *bearer_name, u32 disc_domain, u32 priority);
 int tipc_disable_bearer(const char *name);
 /*
 * Routines made available to TIPC by supported media types
 */
-int  tipc_eth_media_start(void);
+extern struct tipc_media eth_media_info;
-void tipc_eth_media_stop(void);
 #ifdef CONFIG_TIPC_MEDIA_IB
-int  tipc_ib_media_start(void);
+extern struct tipc_media ib_media_info;
-void tipc_ib_media_stop(void);
-#else
-static inline int tipc_ib_media_start(void) { return 0; }
-static inline void tipc_ib_media_stop(void) { return; }
 #endif
 int tipc_media_set_priority(const char *name, u32 new_value);
 int tipc_media_set_window(const char *name, u32 new_value);
 void tipc_media_addr_printf(char *buf, int len, struct tipc_media_addr *a);
 struct sk_buff *tipc_media_get_names(void);
+void tipc_l2_media_addr_set(const struct tipc_bearer *b,
+                            struct tipc_media_addr *a, char *mac);
+int tipc_enable_l2_media(struct tipc_bearer *b);
+void tipc_disable_l2_media(struct tipc_bearer *b);
+int tipc_l2_send_msg(struct sk_buff *buf, struct tipc_bearer *b,
+                     struct tipc_media_addr *dest);
 struct sk_buff *tipc_bearer_get_names(void);
 void tipc_bearer_add_dest(struct tipc_bearer *b_ptr, u32 dest);
@@ -194,20 +192,10 @@ void tipc_bearer_remove_dest(struct tipc_bearer *b_ptr, u32 dest);
 struct tipc_bearer *tipc_bearer_find(const char *name);
 struct tipc_bearer *tipc_bearer_find_interface(const char *if_name);
 struct tipc_media *tipc_media_find(const char *name);
-int tipc_bearer_blocked(struct tipc_bearer *b_ptr);
+int tipc_bearer_setup(void);
+void tipc_bearer_cleanup(void);
 void tipc_bearer_stop(void);
+void tipc_bearer_send(struct tipc_bearer *b, struct sk_buff *buf,
-/**
+                      struct tipc_media_addr *dest);
- * tipc_bearer_send- sends buffer to destination over bearer
- *
- * IMPORTANT:
- * The media send routine must not alter the buffer being passed in
- * as it may be needed for later retransmission!
- */
-static inline void tipc_bearer_send(struct tipc_bearer *b, struct sk_buff *buf,
-                                   struct tipc_media_addr *dest)
-{
-        b->media->send_msg(buf, b, dest);
-}
 #endif  /* _TIPC_BEARER_H */
diff --git a/net/tipc/core.c b/net/tipc/core.c
index fd4eeeaa972a..f9e88d8b04ca 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -82,8 +82,7 @@ struct sk_buff *tipc_buf_acquire(u32 size)
 static void tipc_core_stop_net(void)
 {
        tipc_net_stop();
-        tipc_eth_media_stop();
+        tipc_bearer_cleanup();
-        tipc_ib_media_stop();
 }
 /**
@@ -94,10 +93,7 @@ int tipc_core_start_net(unsigned long addr)
        int res;
        tipc_net_start(addr);
-        res = tipc_eth_media_start();
+        res = tipc_bearer_setup();
-        if (res < 0)
-                goto err;
-        res = tipc_ib_media_start();
        if (res < 0)
                goto err;
        return res;
@@ -113,7 +109,6 @@ err:
 static void tipc_core_stop(void)
 {
        tipc_netlink_stop();
-        tipc_handler_stop();
        tipc_cfg_stop();
        tipc_subscr_stop();
        tipc_nametbl_stop();
@@ -146,9 +141,10 @@ static int tipc_core_start(void)
                res = tipc_subscr_start();
        if (!res)
                res = tipc_cfg_init();
-        if (res)
+        if (res) {
+                tipc_handler_stop();
                tipc_core_stop();
+        }
        return res;
 }
@@ -178,6 +174,7 @@ static int __init tipc_init(void)
 static void __exit tipc_exit(void)
 {
+        tipc_handler_stop();
        tipc_core_stop_net();
        tipc_core_stop();
        pr_info("Deactivated\n");
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 94895d4e86ab..1ff477b0450d 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -47,7 +47,7 @@
 #include <linux/mm.h>
 #include <linux/timer.h>
 #include <linux/string.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <linux/interrupt.h>
 #include <linux/atomic.h>
 #include <asm/hardirq.h>
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index ecc758c6eacf..bc849f1efa16 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -239,7 +239,7 @@ void tipc_disc_recv_msg(struct sk_buff *buf, struct tipc_bearer *b_ptr)
        /* Accept discovery message & send response, if necessary */
        link_fully_up = link_working_working(link);
-        if ((type == DSC_REQ_MSG) && !link_fully_up && !b_ptr->blocked) {
+        if ((type == DSC_REQ_MSG) && !link_fully_up) {
                rbuf = tipc_disc_init_msg(DSC_RESP_MSG, orig, b_ptr);
                if (rbuf) {
                        tipc_bearer_send(b_ptr, rbuf, &media_addr);
@@ -288,16 +288,6 @@ void tipc_disc_remove_dest(struct tipc_link_req *req)
 }
 /**
- * disc_send_msg - send link setup request message
- * @req: ptr to link request structure
- */
-static void disc_send_msg(struct tipc_link_req *req)
-{
-        if (!req->bearer->blocked)
-                tipc_bearer_send(req->bearer, req->buf, &req->dest);
-}
-/**
 * disc_timeout - send a periodic link setup request
 * @req: ptr to link request structure
 *
@@ -322,7 +312,8 @@ static void disc_timeout(struct tipc_link_req *req)
         * hold at fast polling rate if don't have any associated nodes,
         * otherwise hold at slow polling rate
         */
-        disc_send_msg(req);
+        tipc_bearer_send(req->bearer, req->buf, &req->dest);
        req->timer_intv *= 2;
        if (req->num_nodes)
@@ -368,7 +359,7 @@ int tipc_disc_create(struct tipc_bearer *b_ptr, struct tipc_media_addr *dest,
        k_init_timer(&req->timer, (Handler)disc_timeout, (unsigned long)req);
        k_start_timer(&req->timer, req->timer_intv);
        b_ptr->link_req = req;
-        disc_send_msg(req);
+        tipc_bearer_send(req->bearer, req->buf, &req->dest);
        return 0;
 }
diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
index f80d59f5a161..67cf3f935dba 100644
--- a/net/tipc/eth_media.c
+++ b/net/tipc/eth_media.c
@@ -1,7 +1,7 @@
 /*
 * net/tipc/eth_media.c: Ethernet bearer support for TIPC
 *
- * Copyright (c) 2001-2007, Ericsson AB
+ * Copyright (c) 2001-2007, 2013, Ericsson AB
 * Copyright (c) 2005-2008, 2011-2013, Wind River Systems
 * All rights reserved.
 *
@@ -37,259 +37,11 @@
 #include "core.h"
 #include "bearer.h"
-#define MAX_ETH_MEDIA           MAX_BEARERS
 #define ETH_ADDR_OFFSET 4       /* message header offset of MAC address */
-/**
+/* convert Ethernet address to string */
- * struct eth_media - Ethernet bearer data structure
+static int tipc_eth_addr2str(struct tipc_media_addr *a, char *str_buf,
- * @bearer: ptr to associated "generic" bearer structure
+                             int str_size)
- * @dev: ptr to associated Ethernet network device
- * @tipc_packet_type: used in binding TIPC to Ethernet driver
- * @setup: work item used when enabling bearer
- * @cleanup: work item used when disabling bearer
- */
-struct eth_media {
-        struct tipc_bearer *bearer;
-        struct net_device *dev;
-        struct packet_type tipc_packet_type;
-        struct work_struct setup;
-        struct work_struct cleanup;
-};
-static struct tipc_media eth_media_info;
-static struct eth_media eth_media_array[MAX_ETH_MEDIA];
-static int eth_started;
-static int recv_notification(struct notifier_block *nb, unsigned long evt,
-                             void *dv);
-/*
- * Network device notifier info
- */
-static struct notifier_block notifier = {
-        .notifier_call  = recv_notification,
-        .priority       = 0
-};
-/**
- * eth_media_addr_set - initialize Ethernet media address structure
- *
- * Media-dependent "value" field stores MAC address in first 6 bytes
- * and zeroes out the remaining bytes.
- */
-static void eth_media_addr_set(const struct tipc_bearer *tb_ptr,
-                               struct tipc_media_addr *a, char *mac)
-{
-        memcpy(a->value, mac, ETH_ALEN);
-        memset(a->value + ETH_ALEN, 0, sizeof(a->value) - ETH_ALEN);
-        a->media_id = TIPC_MEDIA_TYPE_ETH;
-        a->broadcast = !memcmp(mac, tb_ptr->bcast_addr.value, ETH_ALEN);
-}
-/**
- * send_msg - send a TIPC message out over an Ethernet interface
- */
-static int send_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr,
-                    struct tipc_media_addr *dest)
-{
-        struct sk_buff *clone;
-        struct net_device *dev;
-        int delta;
-        clone = skb_clone(buf, GFP_ATOMIC);
-        if (!clone)
-                return 0;
-        dev = ((struct eth_media *)(tb_ptr->usr_handle))->dev;
-        delta = dev->hard_header_len - skb_headroom(buf);
-        if ((delta > 0) &&
-            pskb_expand_head(clone, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) {
-                kfree_skb(clone);
-                return 0;
-        }
-        skb_reset_network_header(clone);
-        clone->dev = dev;
-        clone->protocol = htons(ETH_P_TIPC);
-        dev_hard_header(clone, dev, ETH_P_TIPC, dest->value,
-                        dev->dev_addr, clone->len);
-        dev_queue_xmit(clone);
-        return 0;
-}
-/**
- * recv_msg - handle incoming TIPC message from an Ethernet interface
- *
- * Accept only packets explicitly sent to this node, or broadcast packets;
- * ignores packets sent using Ethernet multicast, and traffic sent to other
- * nodes (which can happen if interface is running in promiscuous mode).
- */
-static int recv_msg(struct sk_buff *buf, struct net_device *dev,
-                    struct packet_type *pt, struct net_device *orig_dev)
-{
-        struct eth_media *eb_ptr = (struct eth_media *)pt->af_packet_priv;
-        if (!net_eq(dev_net(dev), &init_net)) {
-                kfree_skb(buf);
-                return NET_RX_DROP;
-        }
-        if (likely(eb_ptr->bearer)) {
-                if (likely(buf->pkt_type <= PACKET_BROADCAST)) {
-                        buf->next = NULL;
-                        tipc_recv_msg(buf, eb_ptr->bearer);
-                        return NET_RX_SUCCESS;
-                }
-        }
-        kfree_skb(buf);
-        return NET_RX_DROP;
-}
-/**
- * setup_media - setup association between Ethernet bearer and interface
- */
-static void setup_media(struct work_struct *work)
-{
-        struct eth_media *eb_ptr =
-                container_of(work, struct eth_media, setup);
-        dev_add_pack(&eb_ptr->tipc_packet_type);
-}
-/**
- * enable_media - attach TIPC bearer to an Ethernet interface
- */
-static int enable_media(struct tipc_bearer *tb_ptr)
-{
-        struct net_device *dev;
-        struct eth_media *eb_ptr = &eth_media_array[0];
-        struct eth_media *stop = &eth_media_array[MAX_ETH_MEDIA];
-        char *driver_name = strchr((const char *)tb_ptr->name, ':') + 1;
-        int pending_dev = 0;
-        /* Find unused Ethernet bearer structure */
-        while (eb_ptr->dev) {
-                if (!eb_ptr->bearer)
-                        pending_dev++;
-                if (++eb_ptr == stop)
-                        return pending_dev ? -EAGAIN : -EDQUOT;
-        }
-        /* Find device with specified name */
-        dev = dev_get_by_name(&init_net, driver_name);
-        if (!dev)
-                return -ENODEV;
-        /* Create Ethernet bearer for device */
-        eb_ptr->dev = dev;
-        eb_ptr->tipc_packet_type.type = htons(ETH_P_TIPC);
-        eb_ptr->tipc_packet_type.dev = dev;
-        eb_ptr->tipc_packet_type.func = recv_msg;
-        eb_ptr->tipc_packet_type.af_packet_priv = eb_ptr;
-        INIT_LIST_HEAD(&(eb_ptr->tipc_packet_type.list));
-        INIT_WORK(&eb_ptr->setup, setup_media);
-        schedule_work(&eb_ptr->setup);
-        /* Associate TIPC bearer with Ethernet bearer */
-        eb_ptr->bearer = tb_ptr;
-        tb_ptr->usr_handle = (void *)eb_ptr;
-        memset(tb_ptr->bcast_addr.value, 0, sizeof(tb_ptr->bcast_addr.value));
-        memcpy(tb_ptr->bcast_addr.value, dev->broadcast, ETH_ALEN);
-        tb_ptr->bcast_addr.media_id = TIPC_MEDIA_TYPE_ETH;
-        tb_ptr->bcast_addr.broadcast = 1;
-        tb_ptr->mtu = dev->mtu;
-        tb_ptr->blocked = 0;
-        eth_media_addr_set(tb_ptr, &tb_ptr->addr, (char *)dev->dev_addr);
-        return 0;
-}
-/**
- * cleanup_media - break association between Ethernet bearer and interface
- *
- * This routine must be invoked from a work queue because it can sleep.
- */
-static void cleanup_media(struct work_struct *work)
-{
-        struct eth_media *eb_ptr =
-                container_of(work, struct eth_media, cleanup);
-        dev_remove_pack(&eb_ptr->tipc_packet_type);
-        dev_put(eb_ptr->dev);
-        eb_ptr->dev = NULL;
-}
-/**
- * disable_media - detach TIPC bearer from an Ethernet interface
- *
- * Mark Ethernet bearer as inactive so that incoming buffers are thrown away,
- * then get worker thread to complete bearer cleanup.  (Can't do cleanup
- * here because cleanup code needs to sleep and caller holds spinlocks.)
- */
-static void disable_media(struct tipc_bearer *tb_ptr)
-{
-        struct eth_media *eb_ptr = (struct eth_media *)tb_ptr->usr_handle;
-        eb_ptr->bearer = NULL;
-        INIT_WORK(&eb_ptr->cleanup, cleanup_media);
-        schedule_work(&eb_ptr->cleanup);
-}
-/**
- * recv_notification - handle device updates from OS
- *
- * Change the state of the Ethernet bearer (if any) associated with the
- * specified device.
- */
-static int recv_notification(struct notifier_block *nb, unsigned long evt,
-                             void *ptr)
-{
-        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
-        struct eth_media *eb_ptr = &eth_media_array[0];
-        struct eth_media *stop = &eth_media_array[MAX_ETH_MEDIA];
-        if (!net_eq(dev_net(dev), &init_net))
-                return NOTIFY_DONE;
-        while ((eb_ptr->dev != dev)) {
-                if (++eb_ptr == stop)
-                        return NOTIFY_DONE;     /* couldn't find device */
-        }
-        if (!eb_ptr->bearer)
-                return NOTIFY_DONE;             /* bearer had been disabled */
-        eb_ptr->bearer->mtu = dev->mtu;
-        switch (evt) {
-        case NETDEV_CHANGE:
-                if (netif_carrier_ok(dev))
-                        tipc_continue(eb_ptr->bearer);
-                else
-                        tipc_block_bearer(eb_ptr->bearer);
-                break;
-        case NETDEV_UP:
-                tipc_continue(eb_ptr->bearer);
-                break;
-        case NETDEV_DOWN:
-                tipc_block_bearer(eb_ptr->bearer);
-                break;
-        case NETDEV_CHANGEMTU:
-        case NETDEV_CHANGEADDR:
-                tipc_block_bearer(eb_ptr->bearer);
-                tipc_continue(eb_ptr->bearer);
-                break;
-        case NETDEV_UNREGISTER:
-        case NETDEV_CHANGENAME:
-                tipc_disable_bearer(eb_ptr->bearer->name);
-                break;
-        }
-        return NOTIFY_OK;
-}
-/**
- * eth_addr2str - convert Ethernet address to string
- */
-static int eth_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size)
 {
        if (str_size < 18)      /* 18 = strlen("aa:bb:cc:dd:ee:ff\0") */
                return 1;
@@ -298,10 +50,8 @@ static int eth_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size)
        return 0;
 }
-/**
+/* convert Ethernet address format to message header format */
- * eth_str2addr - convert Ethernet address format to message header format
+static int tipc_eth_addr2msg(struct tipc_media_addr *a, char *msg_area)
- */
-static int eth_addr2msg(struct tipc_media_addr *a, char *msg_area)
 {
        memset(msg_area, 0, TIPC_MEDIA_ADDR_SIZE);
        msg_area[TIPC_MEDIA_TYPE_OFFSET] = TIPC_MEDIA_TYPE_ETH;
@@ -309,68 +59,30 @@ static int eth_addr2msg(struct tipc_media_addr *a, char *msg_area)
        return 0;
 }
-/**
+/* convert message header address format to Ethernet format */
- * eth_str2addr - convert message header address format to Ethernet format
+static int tipc_eth_msg2addr(const struct tipc_bearer *tb_ptr,
- */
+                             struct tipc_media_addr *a, char *msg_area)
-static int eth_msg2addr(const struct tipc_bearer *tb_ptr,
-                        struct tipc_media_addr *a, char *msg_area)
 {
        if (msg_area[TIPC_MEDIA_TYPE_OFFSET] != TIPC_MEDIA_TYPE_ETH)
                return 1;
-        eth_media_addr_set(tb_ptr, a, msg_area + ETH_ADDR_OFFSET);
+        tipc_l2_media_addr_set(tb_ptr, a, msg_area + ETH_ADDR_OFFSET);
        return 0;
 }
-/*
+/* Ethernet media registration info */
- * Ethernet media registration info
+struct tipc_media eth_media_info = {
- */
+        .send_msg       = tipc_l2_send_msg,
-static struct tipc_media eth_media_info = {
+        .enable_media   = tipc_enable_l2_media,
-        .send_msg       = send_msg,
+        .disable_media  = tipc_disable_l2_media,
-        .enable_media   = enable_media,
+        .addr2str       = tipc_eth_addr2str,
-        .disable_media  = disable_media,
+        .addr2msg       = tipc_eth_addr2msg,
-        .addr2str       = eth_addr2str,
+        .msg2addr       = tipc_eth_msg2addr,
-        .addr2msg       = eth_addr2msg,
-        .msg2addr       = eth_msg2addr,
        .priority       = TIPC_DEF_LINK_PRI,
        .tolerance      = TIPC_DEF_LINK_TOL,
        .window         = TIPC_DEF_LINK_WIN,
        .type_id        = TIPC_MEDIA_TYPE_ETH,
+        .hwaddr_len     = ETH_ALEN,
        .name           = "eth"
 };
-/**
- * tipc_eth_media_start - activate Ethernet bearer support
- *
- * Register Ethernet media type with TIPC bearer code.  Also register
- * with OS for notifications about device state changes.
- */
-int tipc_eth_media_start(void)
-{
-        int res;
-        if (eth_started)
-                return -EINVAL;
-        res = tipc_register_media(&eth_media_info);
-        if (res)
-                return res;
-        res = register_netdevice_notifier(&notifier);
-        if (!res)
-                eth_started = 1;
-        return res;
-}
-/**
- * tipc_eth_media_stop - deactivate Ethernet bearer support
- */
-void tipc_eth_media_stop(void)
-{
-        if (!eth_started)
-                return;
-        flush_scheduled_work();
-        unregister_netdevice_notifier(&notifier);
-        eth_started = 0;
-}
diff --git a/net/tipc/handler.c b/net/tipc/handler.c
index b36f0fcd9bdf..e4bc8a296744 100644
--- a/net/tipc/handler.c
+++ b/net/tipc/handler.c
@@ -56,12 +56,13 @@ unsigned int tipc_k_signal(Handler routine, unsigned long argument)
 {
        struct queue_item *item;
+        spin_lock_bh(&qitem_lock);
        if (!handler_enabled) {
                pr_err("Signal request ignored by handler\n");
+                spin_unlock_bh(&qitem_lock);
                return -ENOPROTOOPT;
        }
-        spin_lock_bh(&qitem_lock);
        item = kmem_cache_alloc(tipc_queue_item_cache, GFP_ATOMIC);
        if (!item) {
                pr_err("Signal queue out of memory\n");
@@ -112,10 +113,14 @@ void tipc_handler_stop(void)
        struct list_head *l, *n;
        struct queue_item *item;
-        if (!handler_enabled)
+        spin_lock_bh(&qitem_lock);
+        if (!handler_enabled) {
+                spin_unlock_bh(&qitem_lock);
                return;
+        }
        handler_enabled = 0;
+        spin_unlock_bh(&qitem_lock);
        tasklet_kill(&tipc_tasklet);
        spin_lock_bh(&qitem_lock);
diff --git a/net/tipc/ib_media.c b/net/tipc/ib_media.c
index c13989297464..844a77e25828 100644
--- a/net/tipc/ib_media.c
+++ b/net/tipc/ib_media.c
@@ -42,252 +42,9 @@
 #include "core.h"
 #include "bearer.h"
-#define MAX_IB_MEDIA            MAX_BEARERS
+/* convert InfiniBand address to string */
+static int tipc_ib_addr2str(struct tipc_media_addr *a, char *str_buf,
-/**
+                            int str_size)
- * struct ib_media - Infiniband media data structure
- * @bearer: ptr to associated "generic" bearer structure
- * @dev: ptr to associated Infiniband network device
- * @tipc_packet_type: used in binding TIPC to Infiniband driver
- * @cleanup: work item used when disabling bearer
- */
-struct ib_media {
-        struct tipc_bearer *bearer;
-        struct net_device *dev;
-        struct packet_type tipc_packet_type;
-        struct work_struct setup;
-        struct work_struct cleanup;
-};
-static struct tipc_media ib_media_info;
-static struct ib_media ib_media_array[MAX_IB_MEDIA];
-static int ib_started;
-/**
- * ib_media_addr_set - initialize Infiniband media address structure
- *
- * Media-dependent "value" field stores MAC address in first 6 bytes
- * and zeroes out the remaining bytes.
- */
-static void ib_media_addr_set(const struct tipc_bearer *tb_ptr,
-                              struct tipc_media_addr *a, char *mac)
-{
-        BUILD_BUG_ON(sizeof(a->value) < INFINIBAND_ALEN);
-        memcpy(a->value, mac, INFINIBAND_ALEN);
-        a->media_id = TIPC_MEDIA_TYPE_IB;
-        a->broadcast = !memcmp(mac, tb_ptr->bcast_addr.value, INFINIBAND_ALEN);
-}
-/**
- * send_msg - send a TIPC message out over an InfiniBand interface
- */
-static int send_msg(struct sk_buff *buf, struct tipc_bearer *tb_ptr,
-                    struct tipc_media_addr *dest)
-{
-        struct sk_buff *clone;
-        struct net_device *dev;
-        int delta;
-        clone = skb_clone(buf, GFP_ATOMIC);
-        if (!clone)
-                return 0;
-        dev = ((struct ib_media *)(tb_ptr->usr_handle))->dev;
-        delta = dev->hard_header_len - skb_headroom(buf);
-        if ((delta > 0) &&
-            pskb_expand_head(clone, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) {
-                kfree_skb(clone);
-                return 0;
-        }
-        skb_reset_network_header(clone);
-        clone->dev = dev;
-        clone->protocol = htons(ETH_P_TIPC);
-        dev_hard_header(clone, dev, ETH_P_TIPC, dest->value,
-                        dev->dev_addr, clone->len);
-        dev_queue_xmit(clone);
-        return 0;
-}
-/**
- * recv_msg - handle incoming TIPC message from an InfiniBand interface
- *
- * Accept only packets explicitly sent to this node, or broadcast packets;
- * ignores packets sent using InfiniBand multicast, and traffic sent to other
- * nodes (which can happen if interface is running in promiscuous mode).
- */
-static int recv_msg(struct sk_buff *buf, struct net_device *dev,
-                    struct packet_type *pt, struct net_device *orig_dev)
-{
-        struct ib_media *ib_ptr = (struct ib_media *)pt->af_packet_priv;
-        if (!net_eq(dev_net(dev), &init_net)) {
-                kfree_skb(buf);
-                return NET_RX_DROP;
-        }
-        if (likely(ib_ptr->bearer)) {
-                if (likely(buf->pkt_type <= PACKET_BROADCAST)) {
-                        buf->next = NULL;
-                        tipc_recv_msg(buf, ib_ptr->bearer);
-                        return NET_RX_SUCCESS;
-                }
-        }
-        kfree_skb(buf);
-        return NET_RX_DROP;
-}
-/**
- * setup_bearer - setup association between InfiniBand bearer and interface
- */
-static void setup_media(struct work_struct *work)
-{
-        struct ib_media *ib_ptr =
-                container_of(work, struct ib_media, setup);
-        dev_add_pack(&ib_ptr->tipc_packet_type);
-}
-/**
- * enable_media - attach TIPC bearer to an InfiniBand interface
- */
-static int enable_media(struct tipc_bearer *tb_ptr)
-{
-        struct net_device *dev;
-        struct ib_media *ib_ptr = &ib_media_array[0];
-        struct ib_media *stop = &ib_media_array[MAX_IB_MEDIA];
-        char *driver_name = strchr((const char *)tb_ptr->name, ':') + 1;
-        int pending_dev = 0;
-        /* Find unused InfiniBand bearer structure */
-        while (ib_ptr->dev) {
-                if (!ib_ptr->bearer)
-                        pending_dev++;
-                if (++ib_ptr == stop)
-                        return pending_dev ? -EAGAIN : -EDQUOT;
-        }
-        /* Find device with specified name */
-        dev = dev_get_by_name(&init_net, driver_name);
-        if (!dev)
-                return -ENODEV;
-        /* Create InfiniBand bearer for device */
-        ib_ptr->dev = dev;
-        ib_ptr->tipc_packet_type.type = htons(ETH_P_TIPC);
-        ib_ptr->tipc_packet_type.dev = dev;
-        ib_ptr->tipc_packet_type.func = recv_msg;
-        ib_ptr->tipc_packet_type.af_packet_priv = ib_ptr;
-        INIT_LIST_HEAD(&(ib_ptr->tipc_packet_type.list));
-        INIT_WORK(&ib_ptr->setup, setup_media);
-        schedule_work(&ib_ptr->setup);
-        /* Associate TIPC bearer with InfiniBand bearer */
-        ib_ptr->bearer = tb_ptr;
-        tb_ptr->usr_handle = (void *)ib_ptr;
-        memset(tb_ptr->bcast_addr.value, 0, sizeof(tb_ptr->bcast_addr.value));
-        memcpy(tb_ptr->bcast_addr.value, dev->broadcast, INFINIBAND_ALEN);
-        tb_ptr->bcast_addr.media_id = TIPC_MEDIA_TYPE_IB;
-        tb_ptr->bcast_addr.broadcast = 1;
-        tb_ptr->mtu = dev->mtu;
-        tb_ptr->blocked = 0;
-        ib_media_addr_set(tb_ptr, &tb_ptr->addr, (char *)dev->dev_addr);
-        return 0;
-}
-/**
- * cleanup_bearer - break association between InfiniBand bearer and interface
- *
- * This routine must be invoked from a work queue because it can sleep.
- */
-static void cleanup_bearer(struct work_struct *work)
-{
-        struct ib_media *ib_ptr =
-                container_of(work, struct ib_media, cleanup);
-        dev_remove_pack(&ib_ptr->tipc_packet_type);
-        dev_put(ib_ptr->dev);
-        ib_ptr->dev = NULL;
-}
-/**
- * disable_media - detach TIPC bearer from an InfiniBand interface
- *
- * Mark InfiniBand bearer as inactive so that incoming buffers are thrown away,
- * then get worker thread to complete bearer cleanup.  (Can't do cleanup
- * here because cleanup code needs to sleep and caller holds spinlocks.)
- */
-static void disable_media(struct tipc_bearer *tb_ptr)
-{
-        struct ib_media *ib_ptr = (struct ib_media *)tb_ptr->usr_handle;
-        ib_ptr->bearer = NULL;
-        INIT_WORK(&ib_ptr->cleanup, cleanup_bearer);
-        schedule_work(&ib_ptr->cleanup);
-}
-/**
- * recv_notification - handle device updates from OS
- *
- * Change the state of the InfiniBand bearer (if any) associated with the
- * specified device.
- */
-static int recv_notification(struct notifier_block *nb, unsigned long evt,
-                             void *ptr)
-{
-        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
-        struct ib_media *ib_ptr = &ib_media_array[0];
-        struct ib_media *stop = &ib_media_array[MAX_IB_MEDIA];
-        if (!net_eq(dev_net(dev), &init_net))
-                return NOTIFY_DONE;
-        while ((ib_ptr->dev != dev)) {
-                if (++ib_ptr == stop)
-                        return NOTIFY_DONE;     /* couldn't find device */
-        }
-        if (!ib_ptr->bearer)
-                return NOTIFY_DONE;             /* bearer had been disabled */
-        ib_ptr->bearer->mtu = dev->mtu;
-        switch (evt) {
-        case NETDEV_CHANGE:
-                if (netif_carrier_ok(dev))
-                        tipc_continue(ib_ptr->bearer);
-                else
-                        tipc_block_bearer(ib_ptr->bearer);
-                break;
-        case NETDEV_UP:
-                tipc_continue(ib_ptr->bearer);
-                break;
-        case NETDEV_DOWN:
-                tipc_block_bearer(ib_ptr->bearer);
-                break;
-        case NETDEV_CHANGEMTU:
-        case NETDEV_CHANGEADDR:
-                tipc_block_bearer(ib_ptr->bearer);
-                tipc_continue(ib_ptr->bearer);
-                break;
-        case NETDEV_UNREGISTER:
-        case NETDEV_CHANGENAME:
-                tipc_disable_bearer(ib_ptr->bearer->name);
-                break;
-        }
-        return NOTIFY_OK;
-}
-static struct notifier_block notifier = {
-        .notifier_call  = recv_notification,
-        .priority       = 0,
-};
-/**
- * ib_addr2str - convert InfiniBand address to string
- */
-static int ib_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size)
 {
        if (str_size < 60)      /* 60 = 19 * strlen("xx:") + strlen("xx\0") */
                return 1;
@@ -297,10 +54,8 @@ static int ib_addr2str(struct tipc_media_addr *a, char *str_buf, int str_size)
        return 0;
 }
-/**
+/* convert InfiniBand address format to message header format */
- * ib_addr2msg - convert InfiniBand address format to message header format
+static int tipc_ib_addr2msg(struct tipc_media_addr *a, char *msg_area)
- */
-static int ib_addr2msg(struct tipc_media_addr *a, char *msg_area)
 {
        memset(msg_area, 0, TIPC_MEDIA_ADDR_SIZE);
        msg_area[TIPC_MEDIA_TYPE_OFFSET] = TIPC_MEDIA_TYPE_IB;
@@ -308,65 +63,27 @@ static int ib_addr2msg(struct tipc_media_addr *a, char *msg_area)
        return 0;
 }
-/**
+/* convert message header address format to InfiniBand format */
- * ib_msg2addr - convert message header address format to InfiniBand format
+static int tipc_ib_msg2addr(const struct tipc_bearer *tb_ptr,
- */
+                            struct tipc_media_addr *a, char *msg_area)
-static int ib_msg2addr(const struct tipc_bearer *tb_ptr,
-                       struct tipc_media_addr *a, char *msg_area)
 {
-        ib_media_addr_set(tb_ptr, a, msg_area);
+        tipc_l2_media_addr_set(tb_ptr, a, msg_area);
        return 0;
 }
-/*
+/* InfiniBand media registration info */
- * InfiniBand media registration info
+struct tipc_media ib_media_info = {
- */
+        .send_msg       = tipc_l2_send_msg,
-static struct tipc_media ib_media_info = {
+        .enable_media   = tipc_enable_l2_media,
-        .send_msg       = send_msg,
+        .disable_media  = tipc_disable_l2_media,
-        .enable_media   = enable_media,
+        .addr2str       = tipc_ib_addr2str,
-        .disable_media  = disable_media,
+        .addr2msg       = tipc_ib_addr2msg,
-        .addr2str       = ib_addr2str,
+        .msg2addr       = tipc_ib_msg2addr,
-        .addr2msg       = ib_addr2msg,
-        .msg2addr       = ib_msg2addr,
        .priority       = TIPC_DEF_LINK_PRI,
        .tolerance      = TIPC_DEF_LINK_TOL,
        .window         = TIPC_DEF_LINK_WIN,
        .type_id        = TIPC_MEDIA_TYPE_IB,
+        .hwaddr_len     = INFINIBAND_ALEN,
        .name           = "ib"
 };
-/**
- * tipc_ib_media_start - activate InfiniBand bearer support
- *
- * Register InfiniBand media type with TIPC bearer code.  Also register
- * with OS for notifications about device state changes.
- */
-int tipc_ib_media_start(void)
-{
-        int res;
-        if (ib_started)
-                return -EINVAL;
-        res = tipc_register_media(&ib_media_info);
-        if (res)
-                return res;
-        res = register_netdevice_notifier(&notifier);
-        if (!res)
-                ib_started = 1;
-        return res;
-}
-/**
- * tipc_ib_media_stop - deactivate InfiniBand bearer support
- */
-void tipc_ib_media_stop(void)
-{
-        if (!ib_started)
-                return;
-        flush_scheduled_work();
-        unregister_netdevice_notifier(&notifier);
-        ib_started = 0;
-}
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 69cd9bf3f561..3d73144a1ccc 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -386,14 +386,7 @@ exit:
 */
 static void link_release_outqueue(struct tipc_link *l_ptr)
 {
-        struct sk_buff *buf = l_ptr->first_out;
+        kfree_skb_list(l_ptr->first_out);
-        struct sk_buff *next;
-        while (buf) {
-                next = buf->next;
-                kfree_skb(buf);
-                buf = next;
-        }
        l_ptr->first_out = NULL;
        l_ptr->out_queue_size = 0;
 }
@@ -415,32 +408,15 @@ void tipc_link_reset_fragments(struct tipc_link *l_ptr)
 */
 void tipc_link_stop(struct tipc_link *l_ptr)
 {
-        struct sk_buff *buf;
+        kfree_skb_list(l_ptr->oldest_deferred_in);
-        struct sk_buff *next;
+        kfree_skb_list(l_ptr->first_out);
-        buf = l_ptr->oldest_deferred_in;
-        while (buf) {
-                next = buf->next;
-                kfree_skb(buf);
-                buf = next;
-        }
-        buf = l_ptr->first_out;
-        while (buf) {
-                next = buf->next;
-                kfree_skb(buf);
-                buf = next;
-        }
        tipc_link_reset_fragments(l_ptr);
        kfree_skb(l_ptr->proto_msg_queue);
        l_ptr->proto_msg_queue = NULL;
 }
 void tipc_link_reset(struct tipc_link *l_ptr)
 {
-        struct sk_buff *buf;
        u32 prev_state = l_ptr->state;
        u32 checkpoint = l_ptr->next_in_no;
        int was_active_link = tipc_link_is_active(l_ptr);
@@ -471,12 +447,7 @@ void tipc_link_reset(struct tipc_link *l_ptr)
        link_release_outqueue(l_ptr);
        kfree_skb(l_ptr->proto_msg_queue);
        l_ptr->proto_msg_queue = NULL;
-        buf = l_ptr->oldest_deferred_in;
+        kfree_skb_list(l_ptr->oldest_deferred_in);
-        while (buf) {
-                struct sk_buff *next = buf->next;
-                kfree_skb(buf);
-                buf = next;
-        }
        if (!list_empty(&l_ptr->waiting_ports))
                tipc_link_wakeup_ports(l_ptr, 1);
@@ -517,10 +488,11 @@ static void link_state_event(struct tipc_link *l_ptr, unsigned int event)
        if (!l_ptr->started && (event != STARTING_EVT))
                return;         /* Not yet. */
-        if (link_blocked(l_ptr)) {
+        /* Check whether changeover is going on */
+        if (l_ptr->exp_msg_count) {
                if (event == TIMEOUT_EVT)
                        link_set_timer(l_ptr, cont_intv);
-                return;   /* Changeover going on */
+                return;
        }
        switch (l_ptr->state) {
@@ -790,8 +762,7 @@ int tipc_link_send_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
                return link_send_long_buf(l_ptr, buf);
        /* Packet can be queued or sent. */
-        if (likely(!tipc_bearer_blocked(l_ptr->b_ptr) &&
+        if (likely(!link_congested(l_ptr))) {
-                   !link_congested(l_ptr))) {
                link_add_to_outqueue(l_ptr, buf, msg);
                tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
@@ -957,14 +928,13 @@ static int link_send_buf_fast(struct tipc_link *l_ptr, struct sk_buff *buf,
        if (likely(!link_congested(l_ptr))) {
                if (likely(msg_size(msg) <= l_ptr->max_pkt)) {
-                        if (likely(!tipc_bearer_blocked(l_ptr->b_ptr))) {
+                        link_add_to_outqueue(l_ptr, buf, msg);
-                                link_add_to_outqueue(l_ptr, buf, msg);
+                        tipc_bearer_send(l_ptr->b_ptr, buf,
-                                tipc_bearer_send(l_ptr->b_ptr, buf,
+                                         &l_ptr->media_addr);
-                                                 &l_ptr->media_addr);
+                        l_ptr->unacked_window = 0;
-                                l_ptr->unacked_window = 0;
+                        return res;
-                                return res;
+                }
-                        }
+                else
-                } else
                        *used_max_pkt = l_ptr->max_pkt;
        }
        return tipc_link_send_buf(l_ptr, buf);  /* All other cases */
@@ -1013,8 +983,7 @@ exit:
                        }
                        /* Exit if link (or bearer) is congested */
-                        if (link_congested(l_ptr) ||
+                        if (link_congested(l_ptr)) {
-                            tipc_bearer_blocked(l_ptr->b_ptr)) {
                                res = link_schedule_port(l_ptr,
                                                         sender->ref, res);
                                goto exit;
@@ -1127,10 +1096,7 @@ again:
                if (copy_from_user(buf->data + fragm_crs, sect_crs, sz)) {
                        res = -EFAULT;
 error:
-                        for (; buf_chain; buf_chain = buf) {
+                        kfree_skb_list(buf_chain);
-                                buf = buf_chain->next;
-                                kfree_skb(buf_chain);
-                        }
                        return res;
                }
                sect_crs += sz;
@@ -1180,18 +1146,12 @@ error:
                if (l_ptr->max_pkt < max_pkt) {
                        sender->max_pkt = l_ptr->max_pkt;
                        tipc_node_unlock(node);
-                        for (; buf_chain; buf_chain = buf) {
+                        kfree_skb_list(buf_chain);
-                                buf = buf_chain->next;
-                                kfree_skb(buf_chain);
-                        }
                        goto again;
                }
        } else {
 reject:
-                for (; buf_chain; buf_chain = buf) {
+                kfree_skb_list(buf_chain);
-                        buf = buf_chain->next;
-                        kfree_skb(buf_chain);
-                }
                return tipc_port_reject_sections(sender, hdr, msg_sect,
                                                 len, TIPC_ERR_NO_NODE);
        }
@@ -1281,9 +1241,6 @@ void tipc_link_push_queue(struct tipc_link *l_ptr)
 {
        u32 res;
-        if (tipc_bearer_blocked(l_ptr->b_ptr))
-                return;
        do {
                res = tipc_link_push_packet(l_ptr);
        } while (!res);
@@ -1370,26 +1327,15 @@ void tipc_link_retransmit(struct tipc_link *l_ptr, struct sk_buff *buf,
        msg = buf_msg(buf);
-        if (tipc_bearer_blocked(l_ptr->b_ptr)) {
+        /* Detect repeated retransmit failures */
-                if (l_ptr->retransm_queue_size == 0) {
+        if (l_ptr->last_retransmitted == msg_seqno(msg)) {
-                        l_ptr->retransm_queue_head = msg_seqno(msg);
+                if (++l_ptr->stale_count > 100) {
-                        l_ptr->retransm_queue_size = retransmits;
+                        link_retransmit_failure(l_ptr, buf);
-                } else {
+                        return;
-                        pr_err("Unexpected retransmit on link %s (qsize=%d)\n",
-                               l_ptr->name, l_ptr->retransm_queue_size);
                }
-                return;
        } else {
-                /* Detect repeated retransmit failures on unblocked bearer */
+                l_ptr->last_retransmitted = msg_seqno(msg);
-                if (l_ptr->last_retransmitted == msg_seqno(msg)) {
+                l_ptr->stale_count = 1;
-                        if (++l_ptr->stale_count > 100) {
-                                link_retransmit_failure(l_ptr, buf);
-                                return;
-                        }
-                } else {
-                        l_ptr->last_retransmitted = msg_seqno(msg);
-                        l_ptr->stale_count = 1;
-                }
        }
        while (retransmits && (buf != l_ptr->next_out) && buf) {
@@ -1786,7 +1732,8 @@ void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
                l_ptr->proto_msg_queue = NULL;
        }
-        if (link_blocked(l_ptr))
+        /* Don't send protocol message during link changeover */
+        if (l_ptr->exp_msg_count)
                return;
        /* Abort non-RESET send if communication with node is prohibited */
@@ -1861,12 +1808,6 @@ void tipc_link_send_proto_msg(struct tipc_link *l_ptr, u32 msg_typ,
        skb_copy_to_linear_data(buf, msg, sizeof(l_ptr->proto_msg));
        buf->priority = TC_PRIO_CONTROL;
-        /* Defer message if bearer is already blocked */
-        if (tipc_bearer_blocked(l_ptr->b_ptr)) {
-                l_ptr->proto_msg_queue = buf;
-                return;
-        }
        tipc_bearer_send(l_ptr->b_ptr, buf, &l_ptr->media_addr);
        l_ptr->unacked_window = 0;
        kfree_skb(buf);
@@ -1885,7 +1826,8 @@ static void link_recv_proto_msg(struct tipc_link *l_ptr, struct sk_buff *buf)
        u32 msg_tol;
        struct tipc_msg *msg = buf_msg(buf);
-        if (link_blocked(l_ptr))
+        /* Discard protocol message during link changeover */
+        if (l_ptr->exp_msg_count)
                goto exit;
        /* record unnumbered packet arrival (force mismatch on next timeout) */
@@ -2306,11 +2248,7 @@ static int link_send_long_buf(struct tipc_link *l_ptr, struct sk_buff *buf)
                fragm = tipc_buf_acquire(fragm_sz + INT_H_SIZE);
                if (fragm == NULL) {
                        kfree_skb(buf);
-                        while (buf_chain) {
+                        kfree_skb_list(buf_chain);
-                                buf = buf_chain;
-                                buf_chain = buf_chain->next;
-                                kfree_skb(buf);
-                        }
                        return -ENOMEM;
                }
                msg_set_size(&fragm_hdr, fragm_sz + INT_H_SIZE);
diff --git a/net/tipc/link.h b/net/tipc/link.h
index 8a6c1026644d..424b1dfe436b 100644
--- a/net/tipc/link.h
+++ b/net/tipc/link.h
@@ -112,7 +112,6 @@ struct tipc_stats {
 * @continuity_interval: link continuity testing interval [in ms]
 * @abort_limit: # of unacknowledged continuity probes needed to reset link
 * @state: current state of link FSM
- * @blocked: indicates if link has been administratively blocked
 * @fsm_msg_cnt: # of protocol messages link FSM has sent in current state
 * @proto_msg: template for control messages generated by link
 * @pmsg: convenience pointer to "proto_msg" field
@@ -162,7 +161,6 @@ struct tipc_link {
        u32 continuity_interval;
        u32 abort_limit;
        int state;
-        int blocked;
        u32 fsm_msg_cnt;
        struct {
                unchar hdr[INT_H_SIZE];
@@ -312,11 +310,6 @@ static inline int link_reset_reset(struct tipc_link *l_ptr)
        return l_ptr->state == RESET_RESET;
 }
-static inline int link_blocked(struct tipc_link *l_ptr)
-{
-        return l_ptr->exp_msg_count || l_ptr->blocked;
-}
 static inline int link_congested(struct tipc_link *l_ptr)
 {
        return l_ptr->out_queue_size >= l_ptr->queue_limit[0];
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 09dcd54b04e1..92a1533af4e0 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -148,8 +148,7 @@ static struct publication *publ_create(u32 type, u32 lower, u32 upper,
 */
 static struct sub_seq *tipc_subseq_alloc(u32 cnt)
 {
-        struct sub_seq *sseq = kcalloc(cnt, sizeof(struct sub_seq), GFP_ATOMIC);
+        return kcalloc(cnt, sizeof(struct sub_seq), GFP_ATOMIC);
-        return sseq;
 }
 /**
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 25100c0a6fe8..bf1ac89b4806 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -291,11 +291,7 @@ static void node_lost_contact(struct tipc_node *n_ptr)
        /* Flush broadcast link info associated with lost node */
        if (n_ptr->bclink.recv_permitted) {
-                while (n_ptr->bclink.deferred_head) {
+                kfree_skb_list(n_ptr->bclink.deferred_head);
-                        struct sk_buff *buf = n_ptr->bclink.deferred_head;
-                        n_ptr->bclink.deferred_head = buf->next;
-                        kfree_skb(buf);
-                }
                n_ptr->bclink.deferred_size = 0;
                if (n_ptr->bclink.reasm_head) {
diff --git a/net/tipc/port.c b/net/tipc/port.c
index c081a7632302..5fd4c8cec08e 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -832,17 +832,14 @@ exit:
 */
 int __tipc_disconnect(struct tipc_port *tp_ptr)
 {
-        int res;
        if (tp_ptr->connected) {
                tp_ptr->connected = 0;
                /* let timer expire on it's own to avoid deadlock! */
                tipc_nodesub_unsubscribe(&tp_ptr->subscription);
-                res = 0;
+                return 0;
-        } else {
-                res = -ENOTCONN;
        }
-        return res;
+        return -ENOTCONN;
 }
 /*
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 3b61851bb927..83f466e57fea 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -239,7 +239,6 @@ static int tipc_sk_create(struct net *net, struct socket *sock, int protocol,
 int tipc_sock_create_local(int type, struct socket **res)
 {
        int rc;
-        struct sock *sk;
        rc = sock_create_lite(AF_TIPC, type, 0, res);
        if (rc < 0) {
@@ -248,8 +247,6 @@ int tipc_sock_create_local(int type, struct socket **res)
        }
        tipc_sk_create(&init_net, *res, 0, 1);
-        sk = (*res)->sk;
        return 0;
 }
@@ -754,16 +751,14 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
        /* Handle special cases where there is no connection */
        if (unlikely(sock->state != SS_CONNECTED)) {
-                if (sock->state == SS_UNCONNECTED) {
+                res = -ENOTCONN;
+                if (sock->state == SS_UNCONNECTED)
                        res = send_packet(NULL, sock, m, total_len);
-                        goto exit;
+                else if (sock->state == SS_DISCONNECTING)
-                } else if (sock->state == SS_DISCONNECTING) {
                        res = -EPIPE;
-                        goto exit;
-                } else {
+                goto exit;
-                        res = -ENOTCONN;
-                        goto exit;
-                }
        }
        if (unlikely(m->msg_name)) {
@@ -1311,14 +1306,12 @@ static u32 filter_connect(struct tipc_sock *tsock, struct sk_buff **buf)
 static unsigned int rcvbuf_limit(struct sock *sk, struct sk_buff *buf)
 {
        struct tipc_msg *msg = buf_msg(buf);
-        unsigned int limit;
        if (msg_connected(msg))
-                limit = sysctl_tipc_rmem[2];
+                return sysctl_tipc_rmem[2];
-        else
-                limit = sk->sk_rcvbuf >> TIPC_CRITICAL_IMPORTANCE <<
+        return sk->sk_rcvbuf >> TIPC_CRITICAL_IMPORTANCE <<
-                        msg_importance(msg);
+                msg_importance(msg);
-        return limit;
 }
 /**
@@ -1514,14 +1507,12 @@ static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
                                sock->state != SS_CONNECTING,
                                timeout ? (long)msecs_to_jiffies(timeout)
                                        : MAX_SCHEDULE_TIMEOUT);
-                lock_sock(sk);
                if (res <= 0) {
                        if (res == 0)
                                res = -ETIMEDOUT;
-                        else
+                        return res;
-                                ; /* leave "res" unchanged */
-                        goto exit;
                }
+                lock_sock(sk);
        }
        if (unlikely(sock->state == SS_DISCONNECTING))
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 01625ccc3ae6..800ca61758ff 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -80,6 +80,8 @@
 *                with BSD names.
 */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
@@ -366,7 +368,7 @@ static void unix_sock_destructor(struct sock *sk)
        WARN_ON(!sk_unhashed(sk));
        WARN_ON(sk->sk_socket);
        if (!sock_flag(sk, SOCK_DEAD)) {
-                printk(KERN_INFO "Attempt to release alive unix socket: %p\n", sk);
+                pr_info("Attempt to release alive unix socket: %p\n", sk);
                return;
        }
@@ -378,7 +380,7 @@ static void unix_sock_destructor(struct sock *sk)
        sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
        local_bh_enable();
 #ifdef UNIX_REFCNT_DEBUG
-        printk(KERN_DEBUG "UNIX %p is destroyed, %ld are still alive.\n", sk,
+        pr_debug("UNIX %p is destroyed, %ld are still alive.\n", sk,
                atomic_long_read(&unix_nr_socks));
 #endif
 }
@@ -530,13 +532,17 @@ static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
 static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
                                  struct msghdr *, size_t, int);
-static void unix_set_peek_off(struct sock *sk, int val)
+static int unix_set_peek_off(struct sock *sk, int val)
 {
        struct unix_sock *u = unix_sk(sk);
-        mutex_lock(&u->readlock);
+        if (mutex_lock_interruptible(&u->readlock))
+                return -EINTR;
        sk->sk_peek_off = val;
        mutex_unlock(&u->readlock);
+        return 0;
 }
@@ -714,7 +720,9 @@ static int unix_autobind(struct socket *sock)
        int err;
        unsigned int retries = 0;
-        mutex_lock(&u->readlock);
+        err = mutex_lock_interruptible(&u->readlock);
+        if (err)
+                return err;
        err = 0;
        if (u->addr)
@@ -873,7 +881,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                goto out;
        addr_len = err;
-        mutex_lock(&u->readlock);
+        err = mutex_lock_interruptible(&u->readlock);
+        if (err)
+                goto out;
        err = -EINVAL;
        if (u->addr)
@@ -2433,8 +2443,7 @@ static int __init af_unix_init(void)
        rc = proto_register(&unix_proto, 1);
        if (rc != 0) {
-                printk(KERN_CRIT "%s: Cannot create unix_sock SLAB cache!\n",
+                pr_crit("%s: Cannot create unix_sock SLAB cache!\n", __func__);
-                       __func__);
                goto out;
        }
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 7622789d3750..c8a8297cd4b8 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -35,6 +35,8 @@
 *                                      response
 */
+#define pr_fmt(fmt) "X25: " fmt
 #include <linux/module.h>
 #include <linux/capability.h>
 #include <linux/errno.h>
@@ -1809,7 +1811,7 @@ static int __init x25_init(void)
        if (rc != 0)
                goto out_sock;
-        printk(KERN_INFO "X.25 for Linux Version 0.2\n");
+        pr_info("Linux Version 0.2\n");
        x25_register_sysctl();
        rc = x25_proc_init();
diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
index a8a236338e61..39231237e1c3 100644
--- a/net/x25/x25_dev.c
+++ b/net/x25/x25_dev.c
@@ -17,6 +17,8 @@
 *      2000-09-04      Henner Eisen    Prevent freeing a dangling skb.
 */
+#define pr_fmt(fmt) "X25: " fmt
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
@@ -89,7 +91,7 @@ static int x25_receive_data(struct sk_buff *skb, struct x25_neigh *nb)
 */
        if (frametype != X25_CLEAR_CONFIRMATION)
-                printk(KERN_DEBUG "x25_receive_data(): unknown frame type %2x\n",frametype);
+                pr_debug("x25_receive_data(): unknown frame type %2x\n",frametype);
        return 0;
 }
@@ -114,7 +116,7 @@ int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev,
         */
        nb = x25_get_neigh(dev);
        if (!nb) {
-                printk(KERN_DEBUG "X.25: unknown neighbour - %s\n", dev->name);
+                pr_debug("unknown neighbour - %s\n", dev->name);
                goto drop;
        }
@@ -154,7 +156,7 @@ void x25_establish_link(struct x25_neigh *nb)
        switch (nb->dev->type) {
        case ARPHRD_X25:
                if ((skb = alloc_skb(1, GFP_ATOMIC)) == NULL) {
-                        printk(KERN_ERR "x25_dev: out of memory\n");
+                        pr_err("x25_dev: out of memory\n");
                        return;
                }
                ptr  = skb_put(skb, 1);
@@ -189,7 +191,7 @@ void x25_terminate_link(struct x25_neigh *nb)
        skb = alloc_skb(1, GFP_ATOMIC);
        if (!skb) {
-                printk(KERN_ERR "x25_dev: out of memory\n");
+                pr_err("x25_dev: out of memory\n");
                return;
        }
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index b8253250d723..7ecd04c21360 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -21,6 +21,8 @@
 *                                      on response.
 */
+#define pr_fmt(fmt) "X25: " fmt
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/skbuff.h>
@@ -109,7 +111,7 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                        case X25_MARKER:
                                break;
                        default:
-                                printk(KERN_DEBUG "X.25: unknown facility "
+                                pr_debug("unknown facility "
                                       "%02X, value %02X\n",
                                       p[0], p[1]);
                                break;
@@ -132,7 +134,7 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                                *vc_fac_mask |= X25_MASK_WINDOW_SIZE;
                                break;
                        default:
-                                printk(KERN_DEBUG "X.25: unknown facility "
+                                pr_debug("unknown facility "
                                       "%02X, values %02X, %02X\n",
                                       p[0], p[1], p[2]);
                                break;
@@ -143,7 +145,7 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                case X25_FAC_CLASS_C:
                        if (len < 4)
                                return -1;
-                        printk(KERN_DEBUG "X.25: unknown facility %02X, "
+                        pr_debug("unknown facility %02X, "
                               "values %02X, %02X, %02X\n",
                               p[0], p[1], p[2], p[3]);
                        p   += 4;
@@ -172,7 +174,7 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                                *vc_fac_mask |= X25_MASK_CALLED_AE;
                                break;
                        default:
-                                printk(KERN_DEBUG "X.25: unknown facility %02X,"
+                                pr_debug("unknown facility %02X,"
                                        "length %d\n", p[0], p[1]);
                                break;
                        }
@@ -341,12 +343,12 @@ void x25_limit_facilities(struct x25_facilities *facilities,
        if (!nb->extended) {
                if (facilities->winsize_in  > 7) {
-                        printk(KERN_DEBUG "X.25: incoming winsize limited to 7\n");
+                        pr_debug("incoming winsize limited to 7\n");
                        facilities->winsize_in = 7;
                }
                if (facilities->winsize_out > 7) {
                        facilities->winsize_out = 7;
-                        printk( KERN_DEBUG "X.25: outgoing winsize limited to 7\n");
+                        pr_debug("outgoing winsize limited to 7\n");
                }
        }
 }
diff --git a/net/x25/x25_forward.c b/net/x25/x25_forward.c
index c541b622ae16..cf561f1613e1 100644
--- a/net/x25/x25_forward.c
+++ b/net/x25/x25_forward.c
@@ -8,6 +8,9 @@
 *      History
 *      03-01-2007      Added forwarding for x.25       Andrew Hendry
 */
+#define pr_fmt(fmt) "X25: " fmt
 #include <linux/if_arp.h>
 #include <linux/init.h>
 #include <linux/slab.h>
@@ -51,7 +54,7 @@ int x25_forward_call(struct x25_address *dest_addr, struct x25_neigh *from,
        list_for_each(entry, &x25_forward_list) {
                x25_frwd = list_entry(entry, struct x25_forward, node);
                if (x25_frwd->lci == lci) {
-                        printk(KERN_WARNING "X.25: call request for lci which is already registered!, transmitting but not registering new pair\n");
+                        pr_warn("call request for lci which is already registered!, transmitting but not registering new pair\n");
                        same_lci = 1;
                }
        }
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index a49cd4ec551a..d1b0dc79bb6f 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -23,6 +23,8 @@
 *                                        i-frames.
 */
+#define pr_fmt(fmt) "X25: " fmt
 #include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
@@ -317,7 +319,7 @@ static int x25_state3_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                        break;
                default:
-                        printk(KERN_WARNING "x25: unknown %02X in state 3\n", frametype);
+                        pr_warn("unknown %02X in state 3\n", frametype);
                        break;
        }
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index 4acacf3c6617..fd5ffb25873f 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -21,6 +21,8 @@
 *      2000-09-04      Henner Eisen      dev_hold() / dev_put() for x25_neigh.
 */
+#define pr_fmt(fmt) "X25: " fmt
 #include <linux/kernel.h>
 #include <linux/jiffies.h>
 #include <linux/timer.h>
@@ -93,13 +95,13 @@ void x25_link_control(struct sk_buff *skb, struct x25_neigh *nb,
                if (!pskb_may_pull(skb, X25_STD_MIN_LEN + 4))
                        break;
-                printk(KERN_WARNING "x25: diagnostic #%d - %02X %02X %02X\n",
+                pr_warn("diagnostic #%d - %02X %02X %02X\n",
                       skb->data[3], skb->data[4],
                       skb->data[5], skb->data[6]);
                break;
        default:
-                printk(KERN_WARNING "x25: received unknown %02X with LCI 000\n",
+                pr_warn("received unknown %02X with LCI 000\n",
                       frametype);
                break;
        }
diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
index 5170d52bfd96..6b5af65f491f 100644
--- a/net/x25/x25_subr.c
+++ b/net/x25/x25_subr.c
@@ -23,6 +23,8 @@
 *                                              restriction on response.
 */
+#define pr_fmt(fmt) "X25: " fmt
 #include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -148,7 +150,7 @@ void x25_write_internal(struct sock *sk, int frametype)
        case X25_RESET_CONFIRMATION:
                break;
        default:
-                printk(KERN_ERR "X.25: invalid frame type %02X\n", frametype);
+                pr_err("invalid frame type %02X\n", frametype);
                return;
        }
@@ -338,7 +340,7 @@ int x25_decode(struct sock *sk, struct sk_buff *skb, int *ns, int *nr, int *q,
                }
        }
-        printk(KERN_DEBUG "X.25: invalid PLP frame %02X %02X %02X\n",
+        pr_debug("invalid PLP frame %02X %02X %02X\n",
               frame[0], frame[1], frame[2]);
        return X25_ILLEGAL;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 9a91f7431c41..a7487f34e813 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -39,12 +39,7 @@
 #define XFRM_QUEUE_TMO_MAX ((unsigned)(60*HZ))
 #define XFRM_MAX_QUEUE_LEN      100
-DEFINE_MUTEX(xfrm_cfg_mutex);
-EXPORT_SYMBOL(xfrm_cfg_mutex);
-static DEFINE_SPINLOCK(xfrm_policy_sk_bundle_lock);
 static struct dst_entry *xfrm_policy_sk_bundles;
-static DEFINE_RWLOCK(xfrm_policy_lock);
 static DEFINE_SPINLOCK(xfrm_policy_afinfo_lock);
 static struct xfrm_policy_afinfo __rcu *xfrm_policy_afinfo[NPROTO]
@@ -438,7 +433,7 @@ static void xfrm_bydst_resize(struct net *net, int dir)
        if (!ndst)
                return;
-        write_lock_bh(&xfrm_policy_lock);
+        write_lock_bh(&net->xfrm.xfrm_policy_lock);
        for (i = hmask; i >= 0; i--)
                xfrm_dst_hash_transfer(odst + i, ndst, nhashmask);
@@ -446,7 +441,7 @@ static void xfrm_bydst_resize(struct net *net, int dir)
        net->xfrm.policy_bydst[dir].table = ndst;
        net->xfrm.policy_bydst[dir].hmask = nhashmask;
-        write_unlock_bh(&xfrm_policy_lock);
+        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
        xfrm_hash_free(odst, (hmask + 1) * sizeof(struct hlist_head));
 }
@@ -463,7 +458,7 @@ static void xfrm_byidx_resize(struct net *net, int total)
        if (!nidx)
                return;
-        write_lock_bh(&xfrm_policy_lock);
+        write_lock_bh(&net->xfrm.xfrm_policy_lock);
        for (i = hmask; i >= 0; i--)
                xfrm_idx_hash_transfer(oidx + i, nidx, nhashmask);
@@ -471,7 +466,7 @@ static void xfrm_byidx_resize(struct net *net, int total)
        net->xfrm.policy_byidx = nidx;
        net->xfrm.policy_idx_hmask = nhashmask;
-        write_unlock_bh(&xfrm_policy_lock);
+        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
        xfrm_hash_free(oidx, (hmask + 1) * sizeof(struct hlist_head));
 }
@@ -504,7 +499,7 @@ static inline int xfrm_byidx_should_resize(struct net *net, int total)
 void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si)
 {
-        read_lock_bh(&xfrm_policy_lock);
+        read_lock_bh(&net->xfrm.xfrm_policy_lock);
        si->incnt = net->xfrm.policy_count[XFRM_POLICY_IN];
        si->outcnt = net->xfrm.policy_count[XFRM_POLICY_OUT];
        si->fwdcnt = net->xfrm.policy_count[XFRM_POLICY_FWD];
@@ -513,7 +508,7 @@ void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si)
        si->fwdscnt = net->xfrm.policy_count[XFRM_POLICY_FWD+XFRM_POLICY_MAX];
        si->spdhcnt = net->xfrm.policy_idx_hmask;
        si->spdhmcnt = xfrm_policy_hashmax;
-        read_unlock_bh(&xfrm_policy_lock);
+        read_unlock_bh(&net->xfrm.xfrm_policy_lock);
 }
 EXPORT_SYMBOL(xfrm_spd_getinfo);
@@ -538,7 +533,7 @@ static void xfrm_hash_resize(struct work_struct *work)
 /* Generate new index... KAME seems to generate them ordered by cost
 * of an absolute inpredictability of ordering of rules. This will not pass. */
-static u32 xfrm_gen_index(struct net *net, int dir)
+static u32 xfrm_gen_index(struct net *net, int dir, u32 index)
 {
        static u32 idx_generator;
@@ -548,8 +543,14 @@ static u32 xfrm_gen_index(struct net *net, int dir)
                u32 idx;
                int found;
-                idx = (idx_generator | dir);
+                if (!index) {
-                idx_generator += 8;
+                        idx = (idx_generator | dir);
+                        idx_generator += 8;
+                } else {
+                        idx = index;
+                        index = 0;
+                }
                if (idx == 0)
                        idx = 8;
                list = net->xfrm.policy_byidx + idx_hash(net, idx);
@@ -630,7 +631,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
        struct hlist_head *chain;
        struct hlist_node *newpos;
-        write_lock_bh(&xfrm_policy_lock);
+        write_lock_bh(&net->xfrm.xfrm_policy_lock);
        chain = policy_hash_bysel(net, &policy->selector, policy->family, dir);
        delpol = NULL;
        newpos = NULL;
@@ -641,7 +642,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
                    xfrm_sec_ctx_match(pol->security, policy->security) &&
                    !WARN_ON(delpol)) {
                        if (excl) {
-                                write_unlock_bh(&xfrm_policy_lock);
+                                write_unlock_bh(&net->xfrm.xfrm_policy_lock);
                                return -EEXIST;
                        }
                        delpol = pol;
@@ -672,14 +673,14 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
                xfrm_policy_requeue(delpol, policy);
                __xfrm_policy_unlink(delpol, dir);
        }
-        policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
+        policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir, policy->index);
        hlist_add_head(&policy->byidx, net->xfrm.policy_byidx+idx_hash(net, policy->index));
        policy->curlft.add_time = get_seconds();
        policy->curlft.use_time = 0;
        if (!mod_timer(&policy->timer, jiffies + HZ))
                xfrm_pol_hold(policy);
        list_add(&policy->walk.all, &net->xfrm.policy_all);
-        write_unlock_bh(&xfrm_policy_lock);
+        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
        if (delpol)
                xfrm_policy_kill(delpol);
@@ -699,7 +700,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type,
        struct hlist_head *chain;
        *err = 0;
-        write_lock_bh(&xfrm_policy_lock);
+        write_lock_bh(&net->xfrm.xfrm_policy_lock);
        chain = policy_hash_bysel(net, sel, sel->family, dir);
        ret = NULL;
        hlist_for_each_entry(pol, chain, bydst) {
@@ -712,7 +713,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type,
                                *err = security_xfrm_policy_delete(
                                                                pol->security);
                                if (*err) {
-                                        write_unlock_bh(&xfrm_policy_lock);
+                                        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
                                        return pol;
                                }
                                __xfrm_policy_unlink(pol, dir);
@@ -721,7 +722,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u8 type,
                        break;
                }
        }
-        write_unlock_bh(&xfrm_policy_lock);
+        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
        if (ret && delete)
                xfrm_policy_kill(ret);
@@ -740,7 +741,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
                return NULL;
        *err = 0;
-        write_lock_bh(&xfrm_policy_lock);
+        write_lock_bh(&net->xfrm.xfrm_policy_lock);
        chain = net->xfrm.policy_byidx + idx_hash(net, id);
        ret = NULL;
        hlist_for_each_entry(pol, chain, byidx) {
@@ -751,7 +752,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
                                *err = security_xfrm_policy_delete(
                                                                pol->security);
                                if (*err) {
-                                        write_unlock_bh(&xfrm_policy_lock);
+                                        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
                                        return pol;
                                }
                                __xfrm_policy_unlink(pol, dir);
@@ -760,7 +761,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8 type,
                        break;
                }
        }
-        write_unlock_bh(&xfrm_policy_lock);
+        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
        if (ret && delete)
                xfrm_policy_kill(ret);
@@ -823,7 +824,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
 {
        int dir, err = 0, cnt = 0;
-        write_lock_bh(&xfrm_policy_lock);
+        write_lock_bh(&net->xfrm.xfrm_policy_lock);
        err = xfrm_policy_flush_secctx_check(net, type, audit_info);
        if (err)
@@ -839,7 +840,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
                        if (pol->type != type)
                                continue;
                        __xfrm_policy_unlink(pol, dir);
-                        write_unlock_bh(&xfrm_policy_lock);
+                        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
                        cnt++;
                        xfrm_audit_policy_delete(pol, 1, audit_info->loginuid,
@@ -848,7 +849,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
                        xfrm_policy_kill(pol);
-                        write_lock_bh(&xfrm_policy_lock);
+                        write_lock_bh(&net->xfrm.xfrm_policy_lock);
                        goto again1;
                }
@@ -860,7 +861,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
                                if (pol->type != type)
                                        continue;
                                __xfrm_policy_unlink(pol, dir);
-                                write_unlock_bh(&xfrm_policy_lock);
+                                write_unlock_bh(&net->xfrm.xfrm_policy_lock);
                                cnt++;
                                xfrm_audit_policy_delete(pol, 1,
@@ -869,7 +870,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
                                                         audit_info->secid);
                                xfrm_policy_kill(pol);
-                                write_lock_bh(&xfrm_policy_lock);
+                                write_lock_bh(&net->xfrm.xfrm_policy_lock);
                                goto again2;
                        }
                }
@@ -878,7 +879,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
        if (!cnt)
                err = -ESRCH;
 out:
-        write_unlock_bh(&xfrm_policy_lock);
+        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
        return err;
 }
 EXPORT_SYMBOL(xfrm_policy_flush);
@@ -898,7 +899,7 @@ int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
        if (list_empty(&walk->walk.all) && walk->seq != 0)
                return 0;
-        write_lock_bh(&xfrm_policy_lock);
+        write_lock_bh(&net->xfrm.xfrm_policy_lock);
        if (list_empty(&walk->walk.all))
                x = list_first_entry(&net->xfrm.policy_all, struct xfrm_policy_walk_entry, all);
        else
@@ -924,7 +925,7 @@ int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk,
        }
        list_del_init(&walk->walk.all);
 out:
-        write_unlock_bh(&xfrm_policy_lock);
+        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
        return error;
 }
 EXPORT_SYMBOL(xfrm_policy_walk);
@@ -938,14 +939,14 @@ void xfrm_policy_walk_init(struct xfrm_policy_walk *walk, u8 type)
 }
 EXPORT_SYMBOL(xfrm_policy_walk_init);
-void xfrm_policy_walk_done(struct xfrm_policy_walk *walk)
+void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net)
 {
        if (list_empty(&walk->walk.all))
                return;
-        write_lock_bh(&xfrm_policy_lock);
+        write_lock_bh(&net->xfrm.xfrm_policy_lock); /*FIXME where is net? */
        list_del(&walk->walk.all);
-        write_unlock_bh(&xfrm_policy_lock);
+        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
 }
 EXPORT_SYMBOL(xfrm_policy_walk_done);
@@ -990,7 +991,7 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,
        if (unlikely(!daddr || !saddr))
                return NULL;
-        read_lock_bh(&xfrm_policy_lock);
+        read_lock_bh(&net->xfrm.xfrm_policy_lock);
        chain = policy_hash_direct(net, daddr, saddr, family, dir);
        ret = NULL;
        hlist_for_each_entry(pol, chain, bydst) {
@@ -1026,7 +1027,7 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(struct net *net, u8 type,
        if (ret)
                xfrm_pol_hold(ret);
 fail:
-        read_unlock_bh(&xfrm_policy_lock);
+        read_unlock_bh(&net->xfrm.xfrm_policy_lock);
        return ret;
 }
@@ -1103,8 +1104,9 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir,
                                                 const struct flowi *fl)
 {
        struct xfrm_policy *pol;
+        struct net *net = sock_net(sk);
-        read_lock_bh(&xfrm_policy_lock);
+        read_lock_bh(&net->xfrm.xfrm_policy_lock);
        if ((pol = sk->sk_policy[dir]) != NULL) {
                bool match = xfrm_selector_match(&pol->selector, fl,
                                                 sk->sk_family);
@@ -1128,7 +1130,7 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir,
                        pol = NULL;
        }
 out:
-        read_unlock_bh(&xfrm_policy_lock);
+        read_unlock_bh(&net->xfrm.xfrm_policy_lock);
        return pol;
 }
@@ -1166,9 +1168,11 @@ static struct xfrm_policy *__xfrm_policy_unlink(struct xfrm_policy *pol,
 int xfrm_policy_delete(struct xfrm_policy *pol, int dir)
 {
-        write_lock_bh(&xfrm_policy_lock);
+        struct net *net = xp_net(pol);
+        write_lock_bh(&net->xfrm.xfrm_policy_lock);
        pol = __xfrm_policy_unlink(pol, dir);
-        write_unlock_bh(&xfrm_policy_lock);
+        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
        if (pol) {
                xfrm_policy_kill(pol);
                return 0;
@@ -1187,12 +1191,12 @@ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
                return -EINVAL;
 #endif
-        write_lock_bh(&xfrm_policy_lock);
+        write_lock_bh(&net->xfrm.xfrm_policy_lock);
        old_pol = sk->sk_policy[dir];
        sk->sk_policy[dir] = pol;
        if (pol) {
                pol->curlft.add_time = get_seconds();
-                pol->index = xfrm_gen_index(net, XFRM_POLICY_MAX+dir);
+                pol->index = xfrm_gen_index(net, XFRM_POLICY_MAX+dir, 0);
                __xfrm_policy_link(pol, XFRM_POLICY_MAX+dir);
        }
        if (old_pol) {
@@ -1204,7 +1208,7 @@ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
                 */
                __xfrm_policy_unlink(old_pol, XFRM_POLICY_MAX+dir);
        }
-        write_unlock_bh(&xfrm_policy_lock);
+        write_unlock_bh(&net->xfrm.xfrm_policy_lock);
        if (old_pol) {
                xfrm_policy_kill(old_pol);
@@ -1215,6 +1219,7 @@ int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol)
 static struct xfrm_policy *clone_policy(const struct xfrm_policy *old, int dir)
 {
        struct xfrm_policy *newp = xfrm_policy_alloc(xp_net(old), GFP_ATOMIC);
+        struct net *net = xp_net(old);
        if (newp) {
                newp->selector = old->selector;
@@ -1233,9 +1238,9 @@ static struct xfrm_policy *clone_policy(const struct xfrm_policy *old, int dir)
                newp->type = old->type;
                memcpy(newp->xfrm_vec, old->xfrm_vec,
                       newp->xfrm_nr*sizeof(struct xfrm_tmpl));
-                write_lock_bh(&xfrm_policy_lock);
+                write_lock_bh(&net->xfrm.xfrm_policy_lock);
                __xfrm_policy_link(newp, XFRM_POLICY_MAX+dir);
-                write_unlock_bh(&xfrm_policy_lock);
+                write_unlock_bh(&net->xfrm.xfrm_policy_lock);
                xfrm_pol_put(newp);
        }
        return newp;
@@ -1896,8 +1901,7 @@ static struct xfrm_dst *xfrm_create_dummy_bundle(struct net *net,
        if (IS_ERR(xdst))
                return xdst;
-        if (net->xfrm.sysctl_larval_drop || num_xfrms <= 0 ||
+        if (net->xfrm.sysctl_larval_drop || num_xfrms <= 0)
-            (fl->flowi_flags & FLOWI_FLAG_CAN_SLEEP))
                return xdst;
        dst1 = &xdst->u.dst;
@@ -2072,7 +2076,6 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
        u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
        int i, err, num_pols, num_xfrms = 0, drop_pols = 0;
-restart:
        dst = NULL;
        xdst = NULL;
        route = NULL;
@@ -2106,10 +2109,10 @@ restart:
                        dst_hold(&xdst->u.dst);
-                        spin_lock_bh(&xfrm_policy_sk_bundle_lock);
+                        spin_lock_bh(&net->xfrm.xfrm_policy_sk_bundle_lock);
                        xdst->u.dst.next = xfrm_policy_sk_bundles;
                        xfrm_policy_sk_bundles = &xdst->u.dst;
-                        spin_unlock_bh(&xfrm_policy_sk_bundle_lock);
+                        spin_unlock_bh(&net->xfrm.xfrm_policy_sk_bundle_lock);
                        route = xdst->route;
                }
@@ -2152,23 +2155,8 @@ restart:
                        return make_blackhole(net, family, dst_orig);
                }
-                if (fl->flowi_flags & FLOWI_FLAG_CAN_SLEEP) {
-                        DECLARE_WAITQUEUE(wait, current);
-                        add_wait_queue(&net->xfrm.km_waitq, &wait);
-                        set_current_state(TASK_INTERRUPTIBLE);
-                        schedule();
-                        set_current_state(TASK_RUNNING);
-                        remove_wait_queue(&net->xfrm.km_waitq, &wait);
-                        if (!signal_pending(current)) {
+                err = -EAGAIN;
-                                dst_release(dst);
-                                goto restart;
-                        }
-                        err = -ERESTART;
-                } else
-                        err = -EAGAIN;
                XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTNOSTATES);
                goto error;
@@ -2434,7 +2422,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
                }
                xfrm_nr = ti;
                if (npols > 1) {
-                        xfrm_tmpl_sort(stp, tpp, xfrm_nr, family);
+                        xfrm_tmpl_sort(stp, tpp, xfrm_nr, family, net);
                        tpp = stp;
                }
@@ -2563,10 +2551,10 @@ static void __xfrm_garbage_collect(struct net *net)
 {
        struct dst_entry *head, *next;
-        spin_lock_bh(&xfrm_policy_sk_bundle_lock);
+        spin_lock_bh(&net->xfrm.xfrm_policy_sk_bundle_lock);
        head = xfrm_policy_sk_bundles;
        xfrm_policy_sk_bundles = NULL;
-        spin_unlock_bh(&xfrm_policy_sk_bundle_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_policy_sk_bundle_lock);
        while (head) {
                next = head->next;
@@ -2950,6 +2938,13 @@ static int __net_init xfrm_net_init(struct net *net)
        rv = xfrm_sysctl_init(net);
        if (rv < 0)
                goto out_sysctl;
+        /* Initialize the per-net locks here */
+        spin_lock_init(&net->xfrm.xfrm_state_lock);
+        rwlock_init(&net->xfrm.xfrm_policy_lock);
+        spin_lock_init(&net->xfrm.xfrm_policy_sk_bundle_lock);
+        mutex_init(&net->xfrm.xfrm_cfg_mutex);
        return 0;
 out_sysctl:
@@ -3070,14 +3065,14 @@ static bool xfrm_migrate_selector_match(const struct xfrm_selector *sel_cmp,
 }
 static struct xfrm_policy * xfrm_migrate_policy_find(const struct xfrm_selector *sel,
-                                                     u8 dir, u8 type)
+                                                     u8 dir, u8 type, struct net *net)
 {
        struct xfrm_policy *pol, *ret = NULL;
        struct hlist_head *chain;
        u32 priority = ~0U;
-        read_lock_bh(&xfrm_policy_lock);
+        read_lock_bh(&net->xfrm.xfrm_policy_lock); /*FIXME*/
-        chain = policy_hash_direct(&init_net, &sel->daddr, &sel->saddr, sel->family, dir);
+        chain = policy_hash_direct(net, &sel->daddr, &sel->saddr, sel->family, dir);
        hlist_for_each_entry(pol, chain, bydst) {
                if (xfrm_migrate_selector_match(sel, &pol->selector) &&
                    pol->type == type) {
@@ -3086,7 +3081,7 @@ static struct xfrm_policy * xfrm_migrate_policy_find(const struct xfrm_selector
                        break;
                }
        }
-        chain = &init_net.xfrm.policy_inexact[dir];
+        chain = &net->xfrm.policy_inexact[dir];
        hlist_for_each_entry(pol, chain, bydst) {
                if (xfrm_migrate_selector_match(sel, &pol->selector) &&
                    pol->type == type &&
@@ -3099,7 +3094,7 @@ static struct xfrm_policy * xfrm_migrate_policy_find(const struct xfrm_selector
        if (ret)
                xfrm_pol_hold(ret);
-        read_unlock_bh(&xfrm_policy_lock);
+        read_unlock_bh(&net->xfrm.xfrm_policy_lock);
        return ret;
 }
@@ -3210,7 +3205,7 @@ static int xfrm_migrate_check(const struct xfrm_migrate *m, int num_migrate)
 int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
                 struct xfrm_migrate *m, int num_migrate,
-                 struct xfrm_kmaddress *k)
+                 struct xfrm_kmaddress *k, struct net *net)
 {
        int i, err, nx_cur = 0, nx_new = 0;
        struct xfrm_policy *pol = NULL;
@@ -3223,14 +3218,14 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
                goto out;
        /* Stage 1 - find policy */
-        if ((pol = xfrm_migrate_policy_find(sel, dir, type)) == NULL) {
+        if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) {
                err = -ENOENT;
                goto out;
        }
        /* Stage 2 - find and update state(s) */
        for (i = 0, mp = m; i < num_migrate; i++, mp++) {
-                if ((x = xfrm_migrate_state_find(mp))) {
+                if ((x = xfrm_migrate_state_find(mp, net))) {
                        x_cur[nx_cur] = x;
                        nx_cur++;
                        if ((xc = xfrm_state_migrate(x, mp))) {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 68c2f357a183..a62c25ea3631 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -35,8 +35,6 @@
      destination/tunnel endpoint. (output)
 */
-static DEFINE_SPINLOCK(xfrm_state_lock);
 static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024;
 static inline unsigned int xfrm_dst_hash(struct net *net,
@@ -127,7 +125,7 @@ static void xfrm_hash_resize(struct work_struct *work)
                goto out_unlock;
        }
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        nhashmask = (nsize / sizeof(struct hlist_head)) - 1U;
        for (i = net->xfrm.state_hmask; i >= 0; i--)
@@ -144,7 +142,7 @@ static void xfrm_hash_resize(struct work_struct *work)
        net->xfrm.state_byspi = nspi;
        net->xfrm.state_hmask = nhashmask;
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
        osize = (ohashmask + 1) * sizeof(struct hlist_head);
        xfrm_hash_free(odst, osize);
@@ -374,8 +372,6 @@ static void xfrm_state_gc_task(struct work_struct *work)
        hlist_for_each_entry_safe(x, tmp, &gc_list, gclist)
                xfrm_state_gc_destroy(x);
-        wake_up(&net->xfrm.km_waitq);
 }
 static inline unsigned long make_jiffies(long secs)
@@ -390,7 +386,6 @@ static enum hrtimer_restart xfrm_timer_handler(struct hrtimer * me)
 {
        struct tasklet_hrtimer *thr = container_of(me, struct tasklet_hrtimer, timer);
        struct xfrm_state *x = container_of(thr, struct xfrm_state, mtimer);
-        struct net *net = xs_net(x);
        unsigned long now = get_seconds();
        long next = LONG_MAX;
        int warn = 0;
@@ -460,12 +455,8 @@ resched:
        goto out;
 expired:
-        if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0) {
+        if (x->km.state == XFRM_STATE_ACQ && x->id.spi == 0)
                x->km.state = XFRM_STATE_EXPIRED;
-                wake_up(&net->xfrm.km_waitq);
-                next = 2;
-                goto resched;
-        }
        err = __xfrm_state_delete(x);
        if (!err)
@@ -535,14 +526,14 @@ int __xfrm_state_delete(struct xfrm_state *x)
        if (x->km.state != XFRM_STATE_DEAD) {
                x->km.state = XFRM_STATE_DEAD;
-                spin_lock(&xfrm_state_lock);
+                spin_lock(&net->xfrm.xfrm_state_lock);
                list_del(&x->km.all);
                hlist_del(&x->bydst);
                hlist_del(&x->bysrc);
                if (x->id.spi)
                        hlist_del(&x->byspi);
                net->xfrm.state_num--;
-                spin_unlock(&xfrm_state_lock);
+                spin_unlock(&net->xfrm.xfrm_state_lock);
                /* All xfrm_state objects are created by xfrm_state_alloc.
                 * The xfrm_state_alloc call gives a reference, and that
@@ -603,7 +594,7 @@ int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info)
 {
        int i, err = 0, cnt = 0;
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        err = xfrm_state_flush_secctx_check(net, proto, audit_info);
        if (err)
                goto out;
@@ -616,7 +607,7 @@ restart:
                        if (!xfrm_state_kern(x) &&
                            xfrm_id_proto_match(x->id.proto, proto)) {
                                xfrm_state_hold(x);
-                                spin_unlock_bh(&xfrm_state_lock);
+                                spin_unlock_bh(&net->xfrm.xfrm_state_lock);
                                err = xfrm_state_delete(x);
                                xfrm_audit_state_delete(x, err ? 0 : 1,
@@ -627,7 +618,7 @@ restart:
                                if (!err)
                                        cnt++;
-                                spin_lock_bh(&xfrm_state_lock);
+                                spin_lock_bh(&net->xfrm.xfrm_state_lock);
                                goto restart;
                        }
                }
@@ -636,19 +627,18 @@ restart:
                err = 0;
 out:
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
-        wake_up(&net->xfrm.km_waitq);
        return err;
 }
 EXPORT_SYMBOL(xfrm_state_flush);
 void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
 {
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        si->sadcnt = net->xfrm.state_num;
        si->sadhcnt = net->xfrm.state_hmask;
        si->sadhmcnt = xfrm_state_hashmax;
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
 }
 EXPORT_SYMBOL(xfrm_sad_getinfo);
@@ -801,7 +791,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
        to_put = NULL;
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
        hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
                if (x->props.family == encap_family &&
@@ -886,7 +876,7 @@ out:
                xfrm_state_hold(x);
        else
                *err = acquire_in_progress ? -EAGAIN : error;
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
        if (to_put)
                xfrm_state_put(to_put);
        return x;
@@ -900,7 +890,7 @@ xfrm_stateonly_find(struct net *net, u32 mark,
        unsigned int h;
        struct xfrm_state *rx = NULL, *x = NULL;
-        spin_lock(&xfrm_state_lock);
+        spin_lock(&net->xfrm.xfrm_state_lock);
        h = xfrm_dst_hash(net, daddr, saddr, reqid, family);
        hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
                if (x->props.family == family &&
@@ -918,7 +908,7 @@ xfrm_stateonly_find(struct net *net, u32 mark,
        if (rx)
                xfrm_state_hold(rx);
-        spin_unlock(&xfrm_state_lock);
+        spin_unlock(&net->xfrm.xfrm_state_lock);
        return rx;
@@ -950,14 +940,12 @@ static void __xfrm_state_insert(struct xfrm_state *x)
        if (x->replay_maxage)
                mod_timer(&x->rtimer, jiffies + x->replay_maxage);
-        wake_up(&net->xfrm.km_waitq);
        net->xfrm.state_num++;
        xfrm_hash_grow_check(net, x->bydst.next != NULL);
 }
-/* xfrm_state_lock is held */
+/* net->xfrm.xfrm_state_lock is held */
 static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
 {
        struct net *net = xs_net(xnew);
@@ -980,14 +968,16 @@ static void __xfrm_state_bump_genids(struct xfrm_state *xnew)
 void xfrm_state_insert(struct xfrm_state *x)
 {
-        spin_lock_bh(&xfrm_state_lock);
+        struct net *net = xs_net(x);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        __xfrm_state_bump_genids(x);
        __xfrm_state_insert(x);
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
 }
 EXPORT_SYMBOL(xfrm_state_insert);
-/* xfrm_state_lock is held */
+/* net->xfrm.xfrm_state_lock is held */
 static struct xfrm_state *__find_acq_core(struct net *net,
                                          const struct xfrm_mark *m,
                                          unsigned short family, u8 mode,
@@ -1079,7 +1069,7 @@ int xfrm_state_add(struct xfrm_state *x)
        to_put = NULL;
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        x1 = __xfrm_state_locate(x, use_spi, family);
        if (x1) {
@@ -1108,7 +1098,7 @@ int xfrm_state_add(struct xfrm_state *x)
        err = 0;
 out:
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
        if (x1) {
                xfrm_state_delete(x1);
@@ -1203,16 +1193,16 @@ out:
        return NULL;
 }
-/* xfrm_state_lock is held */
+/* net->xfrm.xfrm_state_lock is held */
-struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
+struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net)
 {
        unsigned int h;
        struct xfrm_state *x;
        if (m->reqid) {
-                h = xfrm_dst_hash(&init_net, &m->old_daddr, &m->old_saddr,
+                h = xfrm_dst_hash(net, &m->old_daddr, &m->old_saddr,
                                  m->reqid, m->old_family);
-                hlist_for_each_entry(x, init_net.xfrm.state_bydst+h, bydst) {
+                hlist_for_each_entry(x, net->xfrm.state_bydst+h, bydst) {
                        if (x->props.mode != m->mode ||
                            x->id.proto != m->proto)
                                continue;
@@ -1227,9 +1217,9 @@ struct xfrm_state * xfrm_migrate_state_find(struct xfrm_migrate *m)
                        return x;
                }
        } else {
-                h = xfrm_src_hash(&init_net, &m->old_daddr, &m->old_saddr,
+                h = xfrm_src_hash(net, &m->old_daddr, &m->old_saddr,
                                  m->old_family);
-                hlist_for_each_entry(x, init_net.xfrm.state_bysrc+h, bysrc) {
+                hlist_for_each_entry(x, net->xfrm.state_bysrc+h, bysrc) {
                        if (x->props.mode != m->mode ||
                            x->id.proto != m->proto)
                                continue;
@@ -1283,10 +1273,11 @@ int xfrm_state_update(struct xfrm_state *x)
        struct xfrm_state *x1, *to_put;
        int err;
        int use_spi = xfrm_id_proto_match(x->id.proto, IPSEC_PROTO_ANY);
+        struct net *net = xs_net(x);
        to_put = NULL;
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        x1 = __xfrm_state_locate(x, use_spi, x->props.family);
        err = -ESRCH;
@@ -1306,7 +1297,7 @@ int xfrm_state_update(struct xfrm_state *x)
        err = 0;
 out:
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
        if (to_put)
                xfrm_state_put(to_put);
@@ -1377,9 +1368,9 @@ xfrm_state_lookup(struct net *net, u32 mark, const xfrm_address_t *daddr, __be32
 {
        struct xfrm_state *x;
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        x = __xfrm_state_lookup(net, mark, daddr, spi, proto, family);
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
        return x;
 }
 EXPORT_SYMBOL(xfrm_state_lookup);
@@ -1391,9 +1382,9 @@ xfrm_state_lookup_byaddr(struct net *net, u32 mark,
 {
        struct xfrm_state *x;
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        x = __xfrm_state_lookup_byaddr(net, mark, daddr, saddr, proto, family);
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
        return x;
 }
 EXPORT_SYMBOL(xfrm_state_lookup_byaddr);
@@ -1405,9 +1396,9 @@ xfrm_find_acq(struct net *net, const struct xfrm_mark *mark, u8 mode, u32 reqid,
 {
        struct xfrm_state *x;
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        x = __find_acq_core(net, mark, family, mode, reqid, proto, daddr, saddr, create);
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
        return x;
 }
@@ -1416,17 +1407,17 @@ EXPORT_SYMBOL(xfrm_find_acq);
 #ifdef CONFIG_XFRM_SUB_POLICY
 int
 xfrm_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n,
-               unsigned short family)
+               unsigned short family, struct net *net)
 {
        int err = 0;
        struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
        if (!afinfo)
                return -EAFNOSUPPORT;
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock); /*FIXME*/
        if (afinfo->tmpl_sort)
                err = afinfo->tmpl_sort(dst, src, n);
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
        xfrm_state_put_afinfo(afinfo);
        return err;
 }
@@ -1438,13 +1429,15 @@ xfrm_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n,
 {
        int err = 0;
        struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
+        struct net *net = xs_net(*dst);
        if (!afinfo)
                return -EAFNOSUPPORT;
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        if (afinfo->state_sort)
                err = afinfo->state_sort(dst, src, n);
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
        xfrm_state_put_afinfo(afinfo);
        return err;
 }
@@ -1476,9 +1469,9 @@ struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq)
 {
        struct xfrm_state *x;
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        x = __xfrm_find_acq_byseq(net, mark, seq);
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
        return x;
 }
 EXPORT_SYMBOL(xfrm_find_acq_byseq);
@@ -1496,6 +1489,30 @@ u32 xfrm_get_acqseq(void)
 }
 EXPORT_SYMBOL(xfrm_get_acqseq);
+int verify_spi_info(u8 proto, u32 min, u32 max)
+{
+        switch (proto) {
+        case IPPROTO_AH:
+        case IPPROTO_ESP:
+                break;
+        case IPPROTO_COMP:
+                /* IPCOMP spi is 16-bits. */
+                if (max >= 0x10000)
+                        return -EINVAL;
+                break;
+        default:
+                return -EINVAL;
+        }
+        if (min > max)
+                return -EINVAL;
+        return 0;
+}
+EXPORT_SYMBOL(verify_spi_info);
 int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
 {
        struct net *net = xs_net(x);
@@ -1536,10 +1553,10 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high)
                }
        }
        if (x->id.spi) {
-                spin_lock_bh(&xfrm_state_lock);
+                spin_lock_bh(&net->xfrm.xfrm_state_lock);
                h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
                hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
-                spin_unlock_bh(&xfrm_state_lock);
+                spin_unlock_bh(&net->xfrm.xfrm_state_lock);
                err = 0;
        }
@@ -1562,7 +1579,7 @@ int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
        if (walk->seq != 0 && list_empty(&walk->all))
                return 0;
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        if (list_empty(&walk->all))
                x = list_first_entry(&net->xfrm.state_all, struct xfrm_state_walk, all);
        else
@@ -1586,7 +1603,7 @@ int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
        }
        list_del_init(&walk->all);
 out:
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
        return err;
 }
 EXPORT_SYMBOL(xfrm_state_walk);
@@ -1600,14 +1617,14 @@ void xfrm_state_walk_init(struct xfrm_state_walk *walk, u8 proto)
 }
 EXPORT_SYMBOL(xfrm_state_walk_init);
-void xfrm_state_walk_done(struct xfrm_state_walk *walk)
+void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net)
 {
        if (list_empty(&walk->all))
                return;
-        spin_lock_bh(&xfrm_state_lock);
+        spin_lock_bh(&net->xfrm.xfrm_state_lock);
        list_del(&walk->all);
-        spin_unlock_bh(&xfrm_state_lock);
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
 }
 EXPORT_SYMBOL(xfrm_state_walk_done);
@@ -1655,16 +1672,12 @@ EXPORT_SYMBOL(km_state_notify);
 void km_state_expired(struct xfrm_state *x, int hard, u32 portid)
 {
-        struct net *net = xs_net(x);
        struct km_event c;
        c.data.hard = hard;
        c.portid = portid;
        c.event = XFRM_MSG_EXPIRE;
        km_state_notify(x, &c);
-        if (hard)
-                wake_up(&net->xfrm.km_waitq);
 }
 EXPORT_SYMBOL(km_state_expired);
@@ -1707,16 +1720,12 @@ EXPORT_SYMBOL(km_new_mapping);
 void km_policy_expired(struct xfrm_policy *pol, int dir, int hard, u32 portid)
 {
-        struct net *net = xp_net(pol);
        struct km_event c;
        c.data.hard = hard;
        c.portid = portid;
        c.event = XFRM_MSG_POLEXPIRE;
        km_policy_notify(pol, dir, &c);
-        if (hard)
-                wake_up(&net->xfrm.km_waitq);
 }
 EXPORT_SYMBOL(km_policy_expired);
@@ -2025,7 +2034,7 @@ int __net_init xfrm_state_init(struct net *net)
        INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize);
        INIT_HLIST_HEAD(&net->xfrm.state_gc_list);
        INIT_WORK(&net->xfrm.state_gc_work, xfrm_state_gc_task);
-        init_waitqueue_head(&net->xfrm.km_waitq);
+        spin_lock_init(&net->xfrm.xfrm_state_lock);
        return 0;
 out_byspi:
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index f964d4c00ffb..97681a390402 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -181,7 +181,9 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
                    attrs[XFRMA_ALG_AEAD]       ||
                    attrs[XFRMA_ALG_CRYPT]      ||
                    attrs[XFRMA_ALG_COMP]       ||
-                    attrs[XFRMA_TFCPAD])
+                    attrs[XFRMA_TFCPAD]         ||
+                    (ntohl(p->id.spi) >= 0x10000))
                        goto out;
                break;
@@ -877,7 +879,10 @@ static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
 static int xfrm_dump_sa_done(struct netlink_callback *cb)
 {
        struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
-        xfrm_state_walk_done(walk);
+        struct sock *sk = cb->skb->sk;
+        struct net *net = sock_net(sk);
+        xfrm_state_walk_done(walk, net);
        return 0;
 }
@@ -1074,29 +1079,6 @@ out_noput:
        return err;
 }
-static int verify_userspi_info(struct xfrm_userspi_info *p)
-{
-        switch (p->info.id.proto) {
-        case IPPROTO_AH:
-        case IPPROTO_ESP:
-                break;
-        case IPPROTO_COMP:
-                /* IPCOMP spi is 16-bits. */
-                if (p->max >= 0x10000)
-                        return -EINVAL;
-                break;
-        default:
-                return -EINVAL;
-        }
-        if (p->min > p->max)
-                return -EINVAL;
-        return 0;
-}
 static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
                struct nlattr **attrs)
 {
@@ -1111,7 +1093,7 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh,
        struct xfrm_mark m;
        p = nlmsg_data(nlh);
-        err = verify_userspi_info(p);
+        err = verify_spi_info(p->info.id.proto, p->min, p->max);
        if (err)
                goto out_noput;
@@ -1189,6 +1171,8 @@ static int verify_policy_type(u8 type)
 static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
 {
+        int ret;
        switch (p->share) {
        case XFRM_SHARE_ANY:
        case XFRM_SHARE_SESSION:
@@ -1224,7 +1208,13 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
                return -EINVAL;
        }
-        return verify_policy_dir(p->dir);
+        ret = verify_policy_dir(p->dir);
+        if (ret)
+                return ret;
+        if (p->index && ((p->index & XFRM_POLICY_MAX) != p->dir))
+                return -EINVAL;
+        return 0;
 }
 static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs)
@@ -1547,8 +1537,9 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
 static int xfrm_dump_policy_done(struct netlink_callback *cb)
 {
        struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
+        struct net *net = sock_net(cb->skb->sk);
-        xfrm_policy_walk_done(walk);
+        xfrm_policy_walk_done(walk, net);
        return 0;
 }
@@ -2129,6 +2120,7 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
        u8 type;
        int err;
        int n = 0;
+        struct net *net = sock_net(skb->sk);
        if (attrs[XFRMA_MIGRATE] == NULL)
                return -EINVAL;
@@ -2146,7 +2138,7 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh,
        if (!n)
                return 0;
-        xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp);
+        xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net);
        return 0;
 }
@@ -2394,9 +2386,11 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 static void xfrm_netlink_rcv(struct sk_buff *skb)
 {
-        mutex_lock(&xfrm_cfg_mutex);
+        struct net *net = sock_net(skb->sk);
+        mutex_lock(&net->xfrm.xfrm_cfg_mutex);
        netlink_rcv_skb(skb, &xfrm_user_rcv_msg);
-        mutex_unlock(&xfrm_cfg_mutex);
+        mutex_unlock(&net->xfrm.xfrm_cfg_mutex);
 }
 static inline size_t xfrm_expire_msgsize(void)