54 files changed, 484 insertions, 349 deletions
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 9b58d70b0e7d..4f52c3d50ebe 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -148,11 +148,16 @@ static int br_set_tx_csum(struct net_device *dev, u32 data)
 }
 static struct ethtool_ops br_ethtool_ops = {
-        .get_drvinfo = br_getinfo,
+        .get_drvinfo    = br_getinfo,
-        .get_link = ethtool_op_get_link,
+        .get_link       = ethtool_op_get_link,
-        .set_sg = br_set_sg,
+        .get_tx_csum    = ethtool_op_get_tx_csum,
-        .set_tx_csum = br_set_tx_csum,
+        .set_tx_csum    = br_set_tx_csum,
-        .set_tso = br_set_tso,
+        .get_sg         = ethtool_op_get_sg,
+        .set_sg         = br_set_sg,
+        .get_tso        = ethtool_op_get_tso,
+        .set_tso        = br_set_tso,
+        .get_ufo        = ethtool_op_get_ufo,
+        .get_flags      = ethtool_op_get_flags,
 };
 void br_dev_setup(struct net_device *dev)
diff --git a/net/core/datagram.c b/net/core/datagram.c
index dd61dcad6019..52f577a0f544 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -339,6 +339,93 @@ fault:
        return -EFAULT;
 }
+/**
+ *      skb_copy_datagram_from_iovec - Copy a datagram from an iovec.
+ *      @skb: buffer to copy
+ *      @offset: offset in the buffer to start copying to
+ *      @from: io vector to copy to
+ *      @len: amount of data to copy to buffer from iovec
+ *
+ *      Returns 0 or -EFAULT.
+ *      Note: the iovec is modified during the copy.
+ */
+int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
+                                 struct iovec *from, int len)
+{
+        int start = skb_headlen(skb);
+        int i, copy = start - offset;
+        /* Copy header. */
+        if (copy > 0) {
+                if (copy > len)
+                        copy = len;
+                if (memcpy_fromiovec(skb->data + offset, from, copy))
+                        goto fault;
+                if ((len -= copy) == 0)
+                        return 0;
+                offset += copy;
+        }
+        /* Copy paged appendix. Hmm... why does this look so complicated? */
+        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                int end;
+                WARN_ON(start > offset + len);
+                end = start + skb_shinfo(skb)->frags[i].size;
+                if ((copy = end - offset) > 0) {
+                        int err;
+                        u8  *vaddr;
+                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+                        struct page *page = frag->page;
+                        if (copy > len)
+                                copy = len;
+                        vaddr = kmap(page);
+                        err = memcpy_fromiovec(vaddr + frag->page_offset +
+                                               offset - start, from, copy);
+                        kunmap(page);
+                        if (err)
+                                goto fault;
+                        if (!(len -= copy))
+                                return 0;
+                        offset += copy;
+                }
+                start = end;
+        }
+        if (skb_shinfo(skb)->frag_list) {
+                struct sk_buff *list = skb_shinfo(skb)->frag_list;
+                for (; list; list = list->next) {
+                        int end;
+                        WARN_ON(start > offset + len);
+                        end = start + list->len;
+                        if ((copy = end - offset) > 0) {
+                                if (copy > len)
+                                        copy = len;
+                                if (skb_copy_datagram_from_iovec(list,
+                                                                 offset - start,
+                                                                 from, copy))
+                                        goto fault;
+                                if ((len -= copy) == 0)
+                                        return 0;
+                                offset += copy;
+                        }
+                        start = end;
+                }
+        }
+        if (!len)
+                return 0;
+fault:
+        return -EFAULT;
+}
+EXPORT_SYMBOL(skb_copy_datagram_from_iovec);
 static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
                                      u8 __user *to, int len,
                                      __wsum *csump)
diff --git a/net/core/dev.c b/net/core/dev.c
index 600bb23c4c2e..8d133802372b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1339,19 +1339,23 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
 }
-void __netif_schedule(struct Qdisc *q)
+static inline void __netif_reschedule(struct Qdisc *q)
 {
-        if (!test_and_set_bit(__QDISC_STATE_SCHED, &q->state)) {
+        struct softnet_data *sd;
-                struct softnet_data *sd;
+        unsigned long flags;
-                unsigned long flags;
-                local_irq_save(flags);
+        local_irq_save(flags);
-                sd = &__get_cpu_var(softnet_data);
+        sd = &__get_cpu_var(softnet_data);
-                q->next_sched = sd->output_queue;
+        q->next_sched = sd->output_queue;
-                sd->output_queue = q;
+        sd->output_queue = q;
-                raise_softirq_irqoff(NET_TX_SOFTIRQ);
+        raise_softirq_irqoff(NET_TX_SOFTIRQ);
-                local_irq_restore(flags);
+        local_irq_restore(flags);
-        }
+}
+void __netif_schedule(struct Qdisc *q)
+{
+        if (!test_and_set_bit(__QDISC_STATE_SCHED, &q->state))
+                __netif_reschedule(q);
 }
 EXPORT_SYMBOL(__netif_schedule);
@@ -1800,9 +1804,13 @@ gso:
                spin_lock(root_lock);
-                rc = qdisc_enqueue_root(skb, q);
+                if (unlikely(test_bit(__QDISC_STATE_DEACTIVATED, &q->state))) {
-                qdisc_run(q);
+                        kfree_skb(skb);
+                        rc = NET_XMIT_DROP;
+                } else {
+                        rc = qdisc_enqueue_root(skb, q);
+                        qdisc_run(q);
+                }
                spin_unlock(root_lock);
                goto out;
@@ -1974,15 +1982,15 @@ static void net_tx_action(struct softirq_action *h)
                        head = head->next_sched;
-                        smp_mb__before_clear_bit();
-                        clear_bit(__QDISC_STATE_SCHED, &q->state);
                        root_lock = qdisc_lock(q);
                        if (spin_trylock(root_lock)) {
+                                smp_mb__before_clear_bit();
+                                clear_bit(__QDISC_STATE_SCHED,
+                                          &q->state);
                                qdisc_run(q);
                                spin_unlock(root_lock);
                        } else {
-                                __netif_schedule(q);
+                                __netif_reschedule(q);
                        }
                }
        }
@@ -2084,7 +2092,8 @@ static int ing_filter(struct sk_buff *skb)
        q = rxq->qdisc;
        if (q != &noop_qdisc) {
                spin_lock(qdisc_lock(q));
-                result = qdisc_enqueue_root(skb, q);
+                if (likely(!test_bit(__QDISC_STATE_DEACTIVATED, &q->state)))
+                        result = qdisc_enqueue_root(skb, q);
                spin_unlock(qdisc_lock(q));
        }
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 526236453908..a756847e3814 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -1961,6 +1961,8 @@ static int pktgen_setup_dev(struct pktgen_dev *pkt_dev, const char *ifname)
 */
 static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
 {
+        int ntxq;
        if (!pkt_dev->odev) {
                printk(KERN_ERR "pktgen: ERROR: pkt_dev->odev == NULL in "
                       "setup_inject.\n");
@@ -1969,6 +1971,33 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
                return;
        }
+        /* make sure that we don't pick a non-existing transmit queue */
+        ntxq = pkt_dev->odev->real_num_tx_queues;
+        if (ntxq <= num_online_cpus() && (pkt_dev->flags & F_QUEUE_MAP_CPU)) {
+                printk(KERN_WARNING "pktgen: WARNING: QUEUE_MAP_CPU "
+                       "disabled because CPU count (%d) exceeds number ",
+                       num_online_cpus());
+                printk(KERN_WARNING "pktgen: WARNING: of tx queues "
+                       "(%d) on %s \n", ntxq, pkt_dev->odev->name);
+                pkt_dev->flags &= ~F_QUEUE_MAP_CPU;
+        }
+        if (ntxq <= pkt_dev->queue_map_min) {
+                printk(KERN_WARNING "pktgen: WARNING: Requested "
+                       "queue_map_min (%d) exceeds number of tx\n",
+                       pkt_dev->queue_map_min);
+                printk(KERN_WARNING "pktgen: WARNING: queues (%d) on "
+                       "%s, resetting\n", ntxq, pkt_dev->odev->name);
+                pkt_dev->queue_map_min = ntxq - 1;
+        }
+        if (ntxq <= pkt_dev->queue_map_max) {
+                printk(KERN_WARNING "pktgen: WARNING: Requested "
+                       "queue_map_max (%d) exceeds number of tx\n",
+                       pkt_dev->queue_map_max);
+                printk(KERN_WARNING "pktgen: WARNING: queues (%d) on "
+                       "%s, resetting\n", ntxq, pkt_dev->odev->name);
+                pkt_dev->queue_map_max = ntxq - 1;
+        }
        /* Default to the interface's mac if not explicitly set. */
        if (is_zero_ether_addr(pkt_dev->src_mac))
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 84640172d65d..ca1ccdf1ef76 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2256,14 +2256,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
                        segs = nskb;
                tail = nskb;
-                nskb->dev = skb->dev;
+                __copy_skb_header(nskb, skb);
-                skb_copy_queue_mapping(nskb, skb);
-                nskb->priority = skb->priority;
-                nskb->protocol = skb->protocol;
-                nskb->vlan_tci = skb->vlan_tci;
-                nskb->dst = dst_clone(skb->dst);
-                memcpy(nskb->cb, skb->cb, sizeof(skb->cb));
-                nskb->pkt_type = skb->pkt_type;
                nskb->mac_len = skb->mac_len;
                skb_reserve(nskb, headroom);
@@ -2274,6 +2267,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
                skb_copy_from_linear_data(skb, skb_put(nskb, doffset),
                                          doffset);
                if (!sg) {
+                        nskb->ip_summed = CHECKSUM_NONE;
                        nskb->csum = skb_copy_and_csum_bits(skb, offset,
                                                            skb_put(nskb, len),
                                                            len, 0);
@@ -2283,8 +2277,6 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
                frag = skb_shinfo(nskb)->frags;
                k = 0;
-                nskb->ip_summed = CHECKSUM_PARTIAL;
-                nskb->csum = skb->csum;
                skb_copy_from_linear_data_offset(skb, offset,
                                                 skb_put(nskb, hsize), hsize);
diff --git a/net/dccp/input.c b/net/dccp/input.c
index df2f110df94a..803933ab396d 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -411,12 +411,6 @@ static int dccp_rcv_request_sent_state_process(struct sock *sk,
                struct dccp_sock *dp = dccp_sk(sk);
                long tstamp = dccp_timestamp();
-                /* Stop the REQUEST timer */
-                inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
-                WARN_ON(sk->sk_send_head == NULL);
-                __kfree_skb(sk->sk_send_head);
-                sk->sk_send_head = NULL;
                if (!between48(DCCP_SKB_CB(skb)->dccpd_ack_seq,
                               dp->dccps_awl, dp->dccps_awh)) {
                        dccp_pr_debug("invalid ackno: S.AWL=%llu, "
@@ -441,6 +435,12 @@ static int dccp_rcv_request_sent_state_process(struct sock *sk,
                                    DCCP_ACKVEC_STATE_RECEIVED))
                        goto out_invalid_packet; /* FIXME: change error code */
+                /* Stop the REQUEST timer */
+                inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
+                WARN_ON(sk->sk_send_head == NULL);
+                kfree_skb(sk->sk_send_head);
+                sk->sk_send_head = NULL;
                dp->dccps_isr = DCCP_SKB_CB(skb)->dccpd_seq;
                dccp_update_gsr(sk, dp->dccps_isr);
                /*
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index b622d9744856..1ca3b26eed0f 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -474,6 +474,11 @@ static int dccp_setsockopt_change(struct sock *sk, int type,
        if (copy_from_user(&opt, optval, sizeof(opt)))
                return -EFAULT;
+        /*
+         * rfc4340: 6.1. Change Options
+         */
+        if (opt.dccpsf_len < 1)
+                return -EINVAL;
        val = kmalloc(opt.dccpsf_len, GFP_KERNEL);
        if (!val)
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 6203ece53606..f70fac612596 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -289,6 +289,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
        struct rtable *rt;
        struct iphdr *pip;
        struct igmpv3_report *pig;
+        struct net *net = dev_net(dev);
        skb = alloc_skb(size + LL_ALLOCATED_SPACE(dev), GFP_ATOMIC);
        if (skb == NULL)
@@ -299,7 +300,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
                                    .nl_u = { .ip4_u = {
                                    .daddr = IGMPV3_ALL_MCR } },
                                    .proto = IPPROTO_IGMP };
-                if (ip_route_output_key(&init_net, &rt, &fl)) {
+                if (ip_route_output_key(net, &rt, &fl)) {
                        kfree_skb(skb);
                        return NULL;
                }
@@ -629,6 +630,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
        struct igmphdr *ih;
        struct rtable *rt;
        struct net_device *dev = in_dev->dev;
+        struct net *net = dev_net(dev);
        __be32  group = pmc ? pmc->multiaddr : 0;
        __be32  dst;
@@ -643,7 +645,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
                struct flowi fl = { .oif = dev->ifindex,
                                    .nl_u = { .ip4_u = { .daddr = dst } },
                                    .proto = IPPROTO_IGMP };
-                if (ip_route_output_key(&init_net, &rt, &fl))
+                if (ip_route_output_key(net, &rt, &fl))
                        return -1;
        }
        if (rt->rt_src == 0) {
@@ -1196,9 +1198,6 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
        ASSERT_RTNL();
-        if (!net_eq(dev_net(in_dev->dev), &init_net))
-                return;
        for (im=in_dev->mc_list; im; im=im->next) {
                if (im->multiaddr == addr) {
                        im->users++;
@@ -1278,9 +1277,6 @@ void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
        ASSERT_RTNL();
-        if (!net_eq(dev_net(in_dev->dev), &init_net))
-                return;
        for (ip=&in_dev->mc_list; (i=*ip)!=NULL; ip=&i->next) {
                if (i->multiaddr==addr) {
                        if (--i->users == 0) {
@@ -1308,9 +1304,6 @@ void ip_mc_down(struct in_device *in_dev)
        ASSERT_RTNL();
-        if (!net_eq(dev_net(in_dev->dev), &init_net))
-                return;
        for (i=in_dev->mc_list; i; i=i->next)
                igmp_group_dropped(i);
@@ -1331,9 +1324,6 @@ void ip_mc_init_dev(struct in_device *in_dev)
 {
        ASSERT_RTNL();
-        if (!net_eq(dev_net(in_dev->dev), &init_net))
-                return;
        in_dev->mc_tomb = NULL;
 #ifdef CONFIG_IP_MULTICAST
        in_dev->mr_gq_running = 0;
@@ -1357,9 +1347,6 @@ void ip_mc_up(struct in_device *in_dev)
        ASSERT_RTNL();
-        if (!net_eq(dev_net(in_dev->dev), &init_net))
-                return;
        ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
        for (i=in_dev->mc_list; i; i=i->next)
@@ -1376,9 +1363,6 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
        ASSERT_RTNL();
-        if (!net_eq(dev_net(in_dev->dev), &init_net))
-                return;
        /* Deactivate timers */
        ip_mc_down(in_dev);
@@ -1395,7 +1379,7 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
        write_unlock_bh(&in_dev->mc_list_lock);
 }
-static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
+static struct in_device *ip_mc_find_dev(struct net *net, struct ip_mreqn *imr)
 {
        struct flowi fl = { .nl_u = { .ip4_u =
                                      { .daddr = imr->imr_multiaddr.s_addr } } };
@@ -1404,19 +1388,19 @@ static struct in_device * ip_mc_find_dev(struct ip_mreqn *imr)
        struct in_device *idev = NULL;
        if (imr->imr_ifindex) {
-                idev = inetdev_by_index(&init_net, imr->imr_ifindex);
+                idev = inetdev_by_index(net, imr->imr_ifindex);
                if (idev)
                        __in_dev_put(idev);
                return idev;
        }
        if (imr->imr_address.s_addr) {
-                dev = ip_dev_find(&init_net, imr->imr_address.s_addr);
+                dev = ip_dev_find(net, imr->imr_address.s_addr);
                if (!dev)
                        return NULL;
                dev_put(dev);
        }
-        if (!dev && !ip_route_output_key(&init_net, &rt, &fl)) {
+        if (!dev && !ip_route_output_key(net, &rt, &fl)) {
                dev = rt->u.dst.dev;
                ip_rt_put(rt);
        }
@@ -1754,18 +1738,16 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
        struct ip_mc_socklist *iml=NULL, *i;
        struct in_device *in_dev;
        struct inet_sock *inet = inet_sk(sk);
+        struct net *net = sock_net(sk);
        int ifindex;
        int count = 0;
        if (!ipv4_is_multicast(addr))
                return -EINVAL;
-        if (!net_eq(sock_net(sk), &init_net))
-                return -EPROTONOSUPPORT;
        rtnl_lock();
-        in_dev = ip_mc_find_dev(imr);
+        in_dev = ip_mc_find_dev(net, imr);
        if (!in_dev) {
                iml = NULL;
@@ -1827,15 +1809,13 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
        struct inet_sock *inet = inet_sk(sk);
        struct ip_mc_socklist *iml, **imlp;
        struct in_device *in_dev;
+        struct net *net = sock_net(sk);
        __be32 group = imr->imr_multiaddr.s_addr;
        u32 ifindex;
        int ret = -EADDRNOTAVAIL;
-        if (!net_eq(sock_net(sk), &init_net))
-                return -EPROTONOSUPPORT;
        rtnl_lock();
-        in_dev = ip_mc_find_dev(imr);
+        in_dev = ip_mc_find_dev(net, imr);
        ifindex = imr->imr_ifindex;
        for (imlp = &inet->mc_list; (iml = *imlp) != NULL; imlp = &iml->next) {
                if (iml->multi.imr_multiaddr.s_addr != group)
@@ -1873,21 +1853,19 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
        struct in_device *in_dev = NULL;
        struct inet_sock *inet = inet_sk(sk);
        struct ip_sf_socklist *psl;
+        struct net *net = sock_net(sk);
        int leavegroup = 0;
        int i, j, rv;
        if (!ipv4_is_multicast(addr))
                return -EINVAL;
-        if (!net_eq(sock_net(sk), &init_net))
-                return -EPROTONOSUPPORT;
        rtnl_lock();
        imr.imr_multiaddr.s_addr = mreqs->imr_multiaddr;
        imr.imr_address.s_addr = mreqs->imr_interface;
        imr.imr_ifindex = ifindex;
-        in_dev = ip_mc_find_dev(&imr);
+        in_dev = ip_mc_find_dev(net, &imr);
        if (!in_dev) {
                err = -ENODEV;
@@ -2007,6 +1985,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
        struct in_device *in_dev;
        struct inet_sock *inet = inet_sk(sk);
        struct ip_sf_socklist *newpsl, *psl;
+        struct net *net = sock_net(sk);
        int leavegroup = 0;
        if (!ipv4_is_multicast(addr))
@@ -2015,15 +1994,12 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
            msf->imsf_fmode != MCAST_EXCLUDE)
                return -EINVAL;
-        if (!net_eq(sock_net(sk), &init_net))
-                return -EPROTONOSUPPORT;
        rtnl_lock();
        imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
        imr.imr_address.s_addr = msf->imsf_interface;
        imr.imr_ifindex = ifindex;
-        in_dev = ip_mc_find_dev(&imr);
+        in_dev = ip_mc_find_dev(net, &imr);
        if (!in_dev) {
                err = -ENODEV;
@@ -2094,19 +2070,17 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
        struct in_device *in_dev;
        struct inet_sock *inet = inet_sk(sk);
        struct ip_sf_socklist *psl;
+        struct net *net = sock_net(sk);
        if (!ipv4_is_multicast(addr))
                return -EINVAL;
-        if (!net_eq(sock_net(sk), &init_net))
-                return -EPROTONOSUPPORT;
        rtnl_lock();
        imr.imr_multiaddr.s_addr = msf->imsf_multiaddr;
        imr.imr_address.s_addr = msf->imsf_interface;
        imr.imr_ifindex = 0;
-        in_dev = ip_mc_find_dev(&imr);
+        in_dev = ip_mc_find_dev(net, &imr);
        if (!in_dev) {
                err = -ENODEV;
@@ -2163,9 +2137,6 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
        if (!ipv4_is_multicast(addr))
                return -EINVAL;
-        if (!net_eq(sock_net(sk), &init_net))
-                return -EPROTONOSUPPORT;
        rtnl_lock();
        err = -EADDRNOTAVAIL;
@@ -2246,19 +2217,17 @@ void ip_mc_drop_socket(struct sock *sk)
 {
        struct inet_sock *inet = inet_sk(sk);
        struct ip_mc_socklist *iml;
+        struct net *net = sock_net(sk);
        if (inet->mc_list == NULL)
                return;
-        if (!net_eq(sock_net(sk), &init_net))
-                return;
        rtnl_lock();
        while ((iml = inet->mc_list) != NULL) {
                struct in_device *in_dev;
                inet->mc_list = iml->next;
-                in_dev = inetdev_by_index(&init_net, iml->multi.imr_ifindex);
+                in_dev = inetdev_by_index(net, iml->multi.imr_ifindex);
                (void) ip_mc_leave_src(sk, iml, in_dev);
                if (in_dev != NULL) {
                        ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
diff --git a/net/ipv4/ipvs/ip_vs_app.c b/net/ipv4/ipvs/ip_vs_app.c
index 1f1897a1a702..201b8ea3020d 100644
--- a/net/ipv4/ipvs/ip_vs_app.c
+++ b/net/ipv4/ipvs/ip_vs_app.c
@@ -608,7 +608,7 @@ int ip_vs_skb_replace(struct sk_buff *skb, gfp_t pri,
 }
-int ip_vs_app_init(void)
+int __init ip_vs_app_init(void)
 {
        /* we will replace it with proc_net_ipvs_create() soon */
        proc_net_fops_create(&init_net, "ip_vs_app", 0, &ip_vs_app_fops);
diff --git a/net/ipv4/ipvs/ip_vs_conn.c b/net/ipv4/ipvs/ip_vs_conn.c
index f8bdae47a77f..44a6872dc245 100644
--- a/net/ipv4/ipvs/ip_vs_conn.c
+++ b/net/ipv4/ipvs/ip_vs_conn.c
@@ -965,7 +965,7 @@ static void ip_vs_conn_flush(void)
 }
-int ip_vs_conn_init(void)
+int __init ip_vs_conn_init(void)
 {
        int idx;
diff --git a/net/ipv4/ipvs/ip_vs_ctl.c b/net/ipv4/ipvs/ip_vs_ctl.c
index 9a5ace0b4dd6..6379705a8dcb 100644
--- a/net/ipv4/ipvs/ip_vs_ctl.c
+++ b/net/ipv4/ipvs/ip_vs_ctl.c
@@ -683,9 +683,22 @@ static void
 ip_vs_zero_stats(struct ip_vs_stats *stats)
 {
        spin_lock_bh(&stats->lock);
-        memset(stats, 0, (char *)&stats->lock - (char *)stats);
-        spin_unlock_bh(&stats->lock);
+        stats->conns = 0;
+        stats->inpkts = 0;
+        stats->outpkts = 0;
+        stats->inbytes = 0;
+        stats->outbytes = 0;
+        stats->cps = 0;
+        stats->inpps = 0;
+        stats->outpps = 0;
+        stats->inbps = 0;
+        stats->outbps = 0;
        ip_vs_zero_estimator(stats);
+        spin_unlock_bh(&stats->lock);
 }
 /*
@@ -1589,7 +1602,7 @@ static struct ctl_table vs_vars[] = {
        { .ctl_name = 0 }
 };
-struct ctl_path net_vs_ctl_path[] = {
+const struct ctl_path net_vs_ctl_path[] = {
        { .procname = "net", .ctl_name = CTL_NET, },
        { .procname = "ipv4", .ctl_name = NET_IPV4, },
        { .procname = "vs", },
@@ -1784,7 +1797,9 @@ static const struct file_operations ip_vs_info_fops = {
 #endif
-struct ip_vs_stats ip_vs_stats;
+struct ip_vs_stats ip_vs_stats = {
+        .lock = __SPIN_LOCK_UNLOCKED(ip_vs_stats.lock),
+};
 #ifdef CONFIG_PROC_FS
 static int ip_vs_stats_show(struct seq_file *seq, void *v)
@@ -2306,7 +2321,7 @@ static struct nf_sockopt_ops ip_vs_sockopts = {
 };
-int ip_vs_control_init(void)
+int __init ip_vs_control_init(void)
 {
        int ret;
        int idx;
@@ -2333,8 +2348,6 @@ int ip_vs_control_init(void)
                INIT_LIST_HEAD(&ip_vs_rtable[idx]);
        }
-        memset(&ip_vs_stats, 0, sizeof(ip_vs_stats));
-        spin_lock_init(&ip_vs_stats.lock);
        ip_vs_new_estimator(&ip_vs_stats);
        /* Hook the defense timer */
diff --git a/net/ipv4/ipvs/ip_vs_dh.c b/net/ipv4/ipvs/ip_vs_dh.c
index 8afc1503ed20..fa66824d264f 100644
--- a/net/ipv4/ipvs/ip_vs_dh.c
+++ b/net/ipv4/ipvs/ip_vs_dh.c
@@ -233,6 +233,7 @@ static struct ip_vs_scheduler ip_vs_dh_scheduler =
        .name =                 "dh",
        .refcnt =               ATOMIC_INIT(0),
        .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_dh_scheduler.n_list),
        .init_service =         ip_vs_dh_init_svc,
        .done_service =         ip_vs_dh_done_svc,
        .update_service =       ip_vs_dh_update_svc,
@@ -242,7 +243,6 @@ static struct ip_vs_scheduler ip_vs_dh_scheduler =
 static int __init ip_vs_dh_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_dh_scheduler.n_list);
        return register_ip_vs_scheduler(&ip_vs_dh_scheduler);
 }
diff --git a/net/ipv4/ipvs/ip_vs_est.c b/net/ipv4/ipvs/ip_vs_est.c
index bc04eedd6dbb..5a20f93bd7f9 100644
--- a/net/ipv4/ipvs/ip_vs_est.c
+++ b/net/ipv4/ipvs/ip_vs_est.c
@@ -17,6 +17,7 @@
 #include <linux/types.h>
 #include <linux/interrupt.h>
 #include <linux/sysctl.h>
+#include <linux/list.h>
 #include <net/ip_vs.h>
@@ -44,28 +45,11 @@
 */
-struct ip_vs_estimator
+static void estimation_timer(unsigned long arg);
-{
-        struct ip_vs_estimator  *next;
-        struct ip_vs_stats      *stats;
-        u32                     last_conns;
-        u32                     last_inpkts;
-        u32                     last_outpkts;
-        u64                     last_inbytes;
-        u64                     last_outbytes;
-        u32                     cps;
-        u32                     inpps;
-        u32                     outpps;
-        u32                     inbps;
-        u32                     outbps;
-};
-static struct ip_vs_estimator *est_list = NULL;
+static LIST_HEAD(est_list);
-static DEFINE_RWLOCK(est_lock);
+static DEFINE_SPINLOCK(est_lock);
-static struct timer_list est_timer;
+static DEFINE_TIMER(est_timer, estimation_timer, 0, 0);
 static void estimation_timer(unsigned long arg)
 {
@@ -76,9 +60,9 @@ static void estimation_timer(unsigned long arg)
        u64 n_inbytes, n_outbytes;
        u32 rate;
-        read_lock(&est_lock);
+        spin_lock(&est_lock);
-        for (e = est_list; e; e = e->next) {
+        list_for_each_entry(e, &est_list, list) {
-                s = e->stats;
+                s = container_of(e, struct ip_vs_stats, est);
                spin_lock(&s->lock);
                n_conns = s->conns;
@@ -114,19 +98,16 @@ static void estimation_timer(unsigned long arg)
                s->outbps = (e->outbps+0xF)>>5;
                spin_unlock(&s->lock);
        }
-        read_unlock(&est_lock);
+        spin_unlock(&est_lock);
        mod_timer(&est_timer, jiffies + 2*HZ);
 }
-int ip_vs_new_estimator(struct ip_vs_stats *stats)
+void ip_vs_new_estimator(struct ip_vs_stats *stats)
 {
-        struct ip_vs_estimator *est;
+        struct ip_vs_estimator *est = &stats->est;
-        est = kzalloc(sizeof(*est), GFP_KERNEL);
+        INIT_LIST_HEAD(&est->list);
-        if (est == NULL)
-                return -ENOMEM;
-        est->stats = stats;
        est->last_conns = stats->conns;
        est->cps = stats->cps<<10;
@@ -142,59 +123,40 @@ int ip_vs_new_estimator(struct ip_vs_stats *stats)
        est->last_outbytes = stats->outbytes;
        est->outbps = stats->outbps<<5;
-        write_lock_bh(&est_lock);
+        spin_lock_bh(&est_lock);
-        est->next = est_list;
+        if (list_empty(&est_list))
-        if (est->next == NULL) {
+                mod_timer(&est_timer, jiffies + 2 * HZ);
-                setup_timer(&est_timer, estimation_timer, 0);
+        list_add(&est->list, &est_list);
-                est_timer.expires = jiffies + 2*HZ;
+        spin_unlock_bh(&est_lock);
-                add_timer(&est_timer);
-        }
-        est_list = est;
-        write_unlock_bh(&est_lock);
-        return 0;
 }
 void ip_vs_kill_estimator(struct ip_vs_stats *stats)
 {
-        struct ip_vs_estimator *est, **pest;
+        struct ip_vs_estimator *est = &stats->est;
-        int killed = 0;
+        spin_lock_bh(&est_lock);
-        write_lock_bh(&est_lock);
+        list_del(&est->list);
-        pest = &est_list;
+        while (list_empty(&est_list) && try_to_del_timer_sync(&est_timer) < 0) {
-        while ((est=*pest) != NULL) {
+                spin_unlock_bh(&est_lock);
-                if (est->stats != stats) {
+                cpu_relax();
-                        pest = &est->next;
+                spin_lock_bh(&est_lock);
-                        continue;
-                }
-                *pest = est->next;
-                kfree(est);
-                killed++;
        }
-        if (killed && est_list == NULL)
+        spin_unlock_bh(&est_lock);
-                del_timer_sync(&est_timer);
-        write_unlock_bh(&est_lock);
 }
 void ip_vs_zero_estimator(struct ip_vs_stats *stats)
 {
-        struct ip_vs_estimator *e;
+        struct ip_vs_estimator *est = &stats->est;
-        write_lock_bh(&est_lock);
+        /* set counters zero, caller must hold the stats->lock lock */
-        for (e = est_list; e; e = e->next) {
+        est->last_inbytes = 0;
-                if (e->stats != stats)
+        est->last_outbytes = 0;
-                        continue;
+        est->last_conns = 0;
+        est->last_inpkts = 0;
-                /* set counters zero */
+        est->last_outpkts = 0;
-                e->last_conns = 0;
+        est->cps = 0;
-                e->last_inpkts = 0;
+        est->inpps = 0;
-                e->last_outpkts = 0;
+        est->outpps = 0;
-                e->last_inbytes = 0;
+        est->inbps = 0;
-                e->last_outbytes = 0;
+        est->outbps = 0;
-                e->cps = 0;
-                e->inpps = 0;
-                e->outpps = 0;
-                e->inbps = 0;
-                e->outbps = 0;
-        }
-        write_unlock_bh(&est_lock);
 }
diff --git a/net/ipv4/ipvs/ip_vs_lblc.c b/net/ipv4/ipvs/ip_vs_lblc.c
index 0efa3db4b180..7a6a319f544a 100644
--- a/net/ipv4/ipvs/ip_vs_lblc.c
+++ b/net/ipv4/ipvs/ip_vs_lblc.c
@@ -539,6 +539,7 @@ static struct ip_vs_scheduler ip_vs_lblc_scheduler =
        .name =                 "lblc",
        .refcnt =               ATOMIC_INIT(0),
        .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_lblc_scheduler.n_list),
        .init_service =         ip_vs_lblc_init_svc,
        .done_service =         ip_vs_lblc_done_svc,
        .update_service =       ip_vs_lblc_update_svc,
@@ -550,7 +551,6 @@ static int __init ip_vs_lblc_init(void)
 {
        int ret;
-        INIT_LIST_HEAD(&ip_vs_lblc_scheduler.n_list);
        sysctl_header = register_sysctl_paths(net_vs_ctl_path, vs_vars_table);
        ret = register_ip_vs_scheduler(&ip_vs_lblc_scheduler);
        if (ret)
diff --git a/net/ipv4/ipvs/ip_vs_lblcr.c b/net/ipv4/ipvs/ip_vs_lblcr.c
index 8e3bbeb45138..c234e73968a6 100644
--- a/net/ipv4/ipvs/ip_vs_lblcr.c
+++ b/net/ipv4/ipvs/ip_vs_lblcr.c
@@ -728,6 +728,7 @@ static struct ip_vs_scheduler ip_vs_lblcr_scheduler =
        .name =                 "lblcr",
        .refcnt =               ATOMIC_INIT(0),
        .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_lblcr_scheduler.n_list),
        .init_service =         ip_vs_lblcr_init_svc,
        .done_service =         ip_vs_lblcr_done_svc,
        .update_service =       ip_vs_lblcr_update_svc,
@@ -739,7 +740,6 @@ static int __init ip_vs_lblcr_init(void)
 {
        int ret;
-        INIT_LIST_HEAD(&ip_vs_lblcr_scheduler.n_list);
        sysctl_header = register_sysctl_paths(net_vs_ctl_path, vs_vars_table);
        ret = register_ip_vs_scheduler(&ip_vs_lblcr_scheduler);
        if (ret)
diff --git a/net/ipv4/ipvs/ip_vs_lc.c b/net/ipv4/ipvs/ip_vs_lc.c
index ac9f08e065d5..ebcdbf75ac65 100644
--- a/net/ipv4/ipvs/ip_vs_lc.c
+++ b/net/ipv4/ipvs/ip_vs_lc.c
@@ -98,6 +98,7 @@ static struct ip_vs_scheduler ip_vs_lc_scheduler = {
        .name =                 "lc",
        .refcnt =               ATOMIC_INIT(0),
        .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_lc_scheduler.n_list),
        .init_service =         ip_vs_lc_init_svc,
        .done_service =         ip_vs_lc_done_svc,
        .update_service =       ip_vs_lc_update_svc,
@@ -107,7 +108,6 @@ static struct ip_vs_scheduler ip_vs_lc_scheduler = {
 static int __init ip_vs_lc_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_lc_scheduler.n_list);
        return register_ip_vs_scheduler(&ip_vs_lc_scheduler) ;
 }
diff --git a/net/ipv4/ipvs/ip_vs_nq.c b/net/ipv4/ipvs/ip_vs_nq.c
index a46bf258d420..92f3a6770031 100644
--- a/net/ipv4/ipvs/ip_vs_nq.c
+++ b/net/ipv4/ipvs/ip_vs_nq.c
@@ -136,6 +136,7 @@ static struct ip_vs_scheduler ip_vs_nq_scheduler =
        .name =                 "nq",
        .refcnt =               ATOMIC_INIT(0),
        .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_nq_scheduler.n_list),
        .init_service =         ip_vs_nq_init_svc,
        .done_service =         ip_vs_nq_done_svc,
        .update_service =       ip_vs_nq_update_svc,
@@ -145,7 +146,6 @@ static struct ip_vs_scheduler ip_vs_nq_scheduler =
 static int __init ip_vs_nq_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_nq_scheduler.n_list);
        return register_ip_vs_scheduler(&ip_vs_nq_scheduler);
 }
diff --git a/net/ipv4/ipvs/ip_vs_proto.c b/net/ipv4/ipvs/ip_vs_proto.c
index 876714f23d65..6099a88fc200 100644
--- a/net/ipv4/ipvs/ip_vs_proto.c
+++ b/net/ipv4/ipvs/ip_vs_proto.c
@@ -43,7 +43,7 @@ static struct ip_vs_protocol *ip_vs_proto_table[IP_VS_PROTO_TAB_SIZE];
 /*
 *      register an ipvs protocol
 */
-static int __used register_ip_vs_protocol(struct ip_vs_protocol *pp)
+static int __used __init register_ip_vs_protocol(struct ip_vs_protocol *pp)
 {
        unsigned hash = IP_VS_PROTO_HASH(pp->protocol);
@@ -190,7 +190,7 @@ ip_vs_tcpudp_debug_packet(struct ip_vs_protocol *pp,
 }
-int ip_vs_protocol_init(void)
+int __init ip_vs_protocol_init(void)
 {
        char protocols[64];
 #define REGISTER_PROTOCOL(p)                    \
diff --git a/net/ipv4/ipvs/ip_vs_rr.c b/net/ipv4/ipvs/ip_vs_rr.c
index c8db12d39e61..358110d17e59 100644
--- a/net/ipv4/ipvs/ip_vs_rr.c
+++ b/net/ipv4/ipvs/ip_vs_rr.c
@@ -94,6 +94,7 @@ static struct ip_vs_scheduler ip_vs_rr_scheduler = {
        .name =                 "rr",                   /* name */
        .refcnt =               ATOMIC_INIT(0),
        .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_rr_scheduler.n_list),
        .init_service =         ip_vs_rr_init_svc,
        .done_service =         ip_vs_rr_done_svc,
        .update_service =       ip_vs_rr_update_svc,
@@ -102,7 +103,6 @@ static struct ip_vs_scheduler ip_vs_rr_scheduler = {
 static int __init ip_vs_rr_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_rr_scheduler.n_list);
        return register_ip_vs_scheduler(&ip_vs_rr_scheduler);
 }
diff --git a/net/ipv4/ipvs/ip_vs_sched.c b/net/ipv4/ipvs/ip_vs_sched.c
index b64767309855..a46ad9e35016 100644
--- a/net/ipv4/ipvs/ip_vs_sched.c
+++ b/net/ipv4/ipvs/ip_vs_sched.c
@@ -184,7 +184,7 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
        write_lock_bh(&__ip_vs_sched_lock);
-        if (scheduler->n_list.next != &scheduler->n_list) {
+        if (!list_empty(&scheduler->n_list)) {
                write_unlock_bh(&__ip_vs_sched_lock);
                ip_vs_use_count_dec();
                IP_VS_ERR("register_ip_vs_scheduler(): [%s] scheduler "
@@ -229,7 +229,7 @@ int unregister_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
        }
        write_lock_bh(&__ip_vs_sched_lock);
-        if (scheduler->n_list.next == &scheduler->n_list) {
+        if (list_empty(&scheduler->n_list)) {
                write_unlock_bh(&__ip_vs_sched_lock);
                IP_VS_ERR("unregister_ip_vs_scheduler(): [%s] scheduler "
                          "is not in the list. failed\n", scheduler->name);
diff --git a/net/ipv4/ipvs/ip_vs_sed.c b/net/ipv4/ipvs/ip_vs_sed.c
index 2a7d31358181..77663d84cbd1 100644
--- a/net/ipv4/ipvs/ip_vs_sed.c
+++ b/net/ipv4/ipvs/ip_vs_sed.c
@@ -138,6 +138,7 @@ static struct ip_vs_scheduler ip_vs_sed_scheduler =
        .name =                 "sed",
        .refcnt =               ATOMIC_INIT(0),
        .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_sed_scheduler.n_list),
        .init_service =         ip_vs_sed_init_svc,
        .done_service =         ip_vs_sed_done_svc,
        .update_service =       ip_vs_sed_update_svc,
@@ -147,7 +148,6 @@ static struct ip_vs_scheduler ip_vs_sed_scheduler =
 static int __init ip_vs_sed_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_sed_scheduler.n_list);
        return register_ip_vs_scheduler(&ip_vs_sed_scheduler);
 }
diff --git a/net/ipv4/ipvs/ip_vs_sh.c b/net/ipv4/ipvs/ip_vs_sh.c
index b8fdfac65001..7b979e228056 100644
--- a/net/ipv4/ipvs/ip_vs_sh.c
+++ b/net/ipv4/ipvs/ip_vs_sh.c
@@ -230,6 +230,7 @@ static struct ip_vs_scheduler ip_vs_sh_scheduler =
        .name =                 "sh",
        .refcnt =               ATOMIC_INIT(0),
        .module =               THIS_MODULE,
+        .n_list  =              LIST_HEAD_INIT(ip_vs_sh_scheduler.n_list),
        .init_service =         ip_vs_sh_init_svc,
        .done_service =         ip_vs_sh_done_svc,
        .update_service =       ip_vs_sh_update_svc,
@@ -239,7 +240,6 @@ static struct ip_vs_scheduler ip_vs_sh_scheduler =
 static int __init ip_vs_sh_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_sh_scheduler.n_list);
        return register_ip_vs_scheduler(&ip_vs_sh_scheduler);
 }
diff --git a/net/ipv4/ipvs/ip_vs_sync.c b/net/ipv4/ipvs/ip_vs_sync.c
index 45e9bd96c286..a652da2c3200 100644
--- a/net/ipv4/ipvs/ip_vs_sync.c
+++ b/net/ipv4/ipvs/ip_vs_sync.c
@@ -904,9 +904,9 @@ int stop_sync_thread(int state)
                 * progress of stopping the master sync daemon.
                 */
-                spin_lock(&ip_vs_sync_lock);
+                spin_lock_bh(&ip_vs_sync_lock);
                ip_vs_sync_state &= ~IP_VS_STATE_MASTER;
-                spin_unlock(&ip_vs_sync_lock);
+                spin_unlock_bh(&ip_vs_sync_lock);
                kthread_stop(sync_master_thread);
                sync_master_thread = NULL;
        } else if (state == IP_VS_STATE_BACKUP) {
diff --git a/net/ipv4/ipvs/ip_vs_wlc.c b/net/ipv4/ipvs/ip_vs_wlc.c
index 772c3cb4eca1..9b0ef86bb1f7 100644
--- a/net/ipv4/ipvs/ip_vs_wlc.c
+++ b/net/ipv4/ipvs/ip_vs_wlc.c
@@ -126,6 +126,7 @@ static struct ip_vs_scheduler ip_vs_wlc_scheduler =
        .name =                 "wlc",
        .refcnt =               ATOMIC_INIT(0),
        .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_wlc_scheduler.n_list),
        .init_service =         ip_vs_wlc_init_svc,
        .done_service =         ip_vs_wlc_done_svc,
        .update_service =       ip_vs_wlc_update_svc,
@@ -135,7 +136,6 @@ static struct ip_vs_scheduler ip_vs_wlc_scheduler =
 static int __init ip_vs_wlc_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_wlc_scheduler.n_list);
        return register_ip_vs_scheduler(&ip_vs_wlc_scheduler);
 }
diff --git a/net/ipv4/ipvs/ip_vs_wrr.c b/net/ipv4/ipvs/ip_vs_wrr.c
index 1d6932d7dc97..0d86a79b87b5 100644
--- a/net/ipv4/ipvs/ip_vs_wrr.c
+++ b/net/ipv4/ipvs/ip_vs_wrr.c
@@ -212,6 +212,7 @@ static struct ip_vs_scheduler ip_vs_wrr_scheduler = {
        .name =                 "wrr",
        .refcnt =               ATOMIC_INIT(0),
        .module =               THIS_MODULE,
+        .n_list =               LIST_HEAD_INIT(ip_vs_wrr_scheduler.n_list),
        .init_service =         ip_vs_wrr_init_svc,
        .done_service =         ip_vs_wrr_done_svc,
        .update_service =       ip_vs_wrr_update_svc,
@@ -220,7 +221,6 @@ static struct ip_vs_scheduler ip_vs_wrr_scheduler = {
 static int __init ip_vs_wrr_init(void)
 {
-        INIT_LIST_HEAD(&ip_vs_wrr_scheduler.n_list);
        return register_ip_vs_scheduler(&ip_vs_wrr_scheduler) ;
 }
diff --git a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c
index 49587a497229..462a22c97877 100644
--- a/net/ipv4/netfilter/ipt_addrtype.c
+++ b/net/ipv4/netfilter/ipt_addrtype.c
@@ -70,7 +70,7 @@ addrtype_mt_v1(const struct sk_buff *skb, const struct net_device *in,
                       (info->flags & IPT_ADDRTYPE_INVERT_SOURCE);
        if (ret && info->dest)
                ret &= match_type(dev, iph->daddr, info->dest) ^
-                       (info->flags & IPT_ADDRTYPE_INVERT_DEST);
+                       !!(info->flags & IPT_ADDRTYPE_INVERT_DEST);
        return ret;
 }
diff --git a/net/ipv4/netfilter/nf_nat_proto_common.c b/net/ipv4/netfilter/nf_nat_proto_common.c
index 91537f11273f..6c4f11f51446 100644
--- a/net/ipv4/netfilter/nf_nat_proto_common.c
+++ b/net/ipv4/netfilter/nf_nat_proto_common.c
@@ -73,9 +73,13 @@ bool nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
                range_size = ntohs(range->max.all) - min + 1;
        }
-        off = *rover;
        if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
-                off = net_random();
+                off = secure_ipv4_port_ephemeral(tuple->src.u3.ip, tuple->dst.u3.ip,
+                                                 maniptype == IP_NAT_MANIP_SRC
+                                                 ? tuple->dst.u.all
+                                                 : tuple->src.u.all);
+        else
+                off = *rover;
        for (i = 0; i < range_size; i++, off++) {
                *portptr = htons(min + off % range_size);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 16fc6f454a31..cca921ea8550 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2914,6 +2914,68 @@ static int ipv4_sysctl_rtcache_flush_strategy(ctl_table *table,
        return 0;
 }
+static void rt_secret_reschedule(int old)
+{
+        struct net *net;
+        int new = ip_rt_secret_interval;
+        int diff = new - old;
+        if (!diff)
+                return;
+        rtnl_lock();
+        for_each_net(net) {
+                int deleted = del_timer_sync(&net->ipv4.rt_secret_timer);
+                if (!new)
+                        continue;
+                if (deleted) {
+                        long time = net->ipv4.rt_secret_timer.expires - jiffies;
+                        if (time <= 0 || (time += diff) <= 0)
+                                time = 0;
+                        net->ipv4.rt_secret_timer.expires = time;
+                } else
+                        net->ipv4.rt_secret_timer.expires = new;
+                net->ipv4.rt_secret_timer.expires += jiffies;
+                add_timer(&net->ipv4.rt_secret_timer);
+        }
+        rtnl_unlock();
+}
+static int ipv4_sysctl_rt_secret_interval(ctl_table *ctl, int write,
+                                          struct file *filp,
+                                          void __user *buffer, size_t *lenp,
+                                          loff_t *ppos)
+{
+        int old = ip_rt_secret_interval;
+        int ret = proc_dointvec_jiffies(ctl, write, filp, buffer, lenp, ppos);
+        rt_secret_reschedule(old);
+        return ret;
+}
+static int ipv4_sysctl_rt_secret_interval_strategy(ctl_table *table,
+                                                   int __user *name,
+                                                   int nlen,
+                                                   void __user *oldval,
+                                                   size_t __user *oldlenp,
+                                                   void __user *newval,
+                                                   size_t newlen)
+{
+        int old = ip_rt_secret_interval;
+        int ret = sysctl_jiffies(table, name, nlen, oldval, oldlenp, newval,
+                                 newlen);
+        rt_secret_reschedule(old);
+        return ret;
+}
 static ctl_table ipv4_route_table[] = {
        {
                .ctl_name       = NET_IPV4_ROUTE_GC_THRESH,
@@ -3048,8 +3110,8 @@ static ctl_table ipv4_route_table[] = {
                .data           = &ip_rt_secret_interval,
                .maxlen         = sizeof(int),
                .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
+                .proc_handler   = &ipv4_sysctl_rt_secret_interval,
-                .strategy       = &sysctl_jiffies,
+                .strategy       = &ipv4_sysctl_rt_secret_interval_strategy,
        },
        { .ctl_name = 0 }
 };
@@ -3126,10 +3188,12 @@ static __net_init int rt_secret_timer_init(struct net *net)
        net->ipv4.rt_secret_timer.data = (unsigned long)net;
        init_timer_deferrable(&net->ipv4.rt_secret_timer);
-        net->ipv4.rt_secret_timer.expires =
+        if (ip_rt_secret_interval) {
-                jiffies + net_random() % ip_rt_secret_interval +
+                net->ipv4.rt_secret_timer.expires =
-                ip_rt_secret_interval;
+                        jiffies + net_random() % ip_rt_secret_interval +
-        add_timer(&net->ipv4.rt_secret_timer);
+                        ip_rt_secret_interval;
+                add_timer(&net->ipv4.rt_secret_timer);
+        }
        return 0;
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 383d17359d01..8e42fbbd5761 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -989,7 +989,9 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                    up->encap_rcv != NULL) {
                        int ret;
+                        bh_unlock_sock(sk);
                        ret = (*up->encap_rcv)(sk, skb);
+                        bh_lock_sock(sk);
                        if (ret <= 0) {
                                UDP_INC_STATS_BH(sock_net(sk),
                                                 UDP_MIB_INDATAGRAMS,
@@ -1092,7 +1094,7 @@ static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                        if (skb1) {
                                int ret = 0;
-                                bh_lock_sock_nested(sk);
+                                bh_lock_sock(sk);
                                if (!sock_owned_by_user(sk))
                                        ret = udp_queue_rcv_skb(sk, skb1);
                                else
@@ -1194,7 +1196,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
        if (sk != NULL) {
                int ret = 0;
-                bh_lock_sock_nested(sk);
+                bh_lock_sock(sk);
                if (!sock_owned_by_user(sk))
                        ret = udp_queue_rcv_skb(sk, skb);
                else
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a7842c54f58a..e2d3b7580b76 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1106,13 +1106,12 @@ out:
        return ret;
 }
-int ipv6_dev_get_saddr(struct net_device *dst_dev,
+int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
                       const struct in6_addr *daddr, unsigned int prefs,
                       struct in6_addr *saddr)
 {
        struct ipv6_saddr_score scores[2],
                                *score = &scores[0], *hiscore = &scores[1];
-        struct net *net = dev_net(dst_dev);
        struct ipv6_saddr_dst dst;
        struct net_device *dev;
        int dst_type;
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 8d05527524e3..f5de3f9dc692 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -93,7 +93,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                        if (flags & RT6_LOOKUP_F_SRCPREF_COA)
                                srcprefs |= IPV6_PREFER_SRC_COA;
-                        if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
+                        if (ipv6_dev_get_saddr(net,
+                                               ip6_dst_idev(&rt->u.dst)->dev,
                                               &flp->fl6_dst, srcprefs,
                                               &saddr))
                                goto again;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 52dddc25d3e6..29c7c99e69f7 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -378,6 +378,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
        arg.skb = skb;
        arg.cb = cb;
+        arg.net = net;
        w->args = &arg;
        for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index a4402de425d9..0e844c2736a7 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -934,7 +934,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
                goto out_err_release;
        if (ipv6_addr_any(&fl->fl6_src)) {
-                err = ipv6_dev_get_saddr(ip6_dst_idev(*dst)->dev,
+                err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev,
                                         &fl->fl6_dst,
                                         sk ? inet6_sk(sk)->srcprefs : 0,
                                         &fl->fl6_src);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 741cfcd96f88..4e5eac301f91 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -911,7 +911,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                } else {
                        if (np->rxopt.bits.rxinfo) {
                                struct in6_pktinfo src_info;
-                                src_info.ipi6_ifindex = np->mcast_oif;
+                                src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif : sk->sk_bound_dev_if;
                                ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr);
                                put_cmsg(&msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info);
                        }
@@ -921,7 +921,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                        }
                        if (np->rxopt.bits.rxoinfo) {
                                struct in6_pktinfo src_info;
-                                src_info.ipi6_ifindex = np->mcast_oif;
+                                src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif : sk->sk_bound_dev_if;
                                ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr);
                                put_cmsg(&msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info);
                        }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index beb48e3f038a..f1c62ba0f56b 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -549,7 +549,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                        override = 0;
                in6_ifa_put(ifp);
        } else {
-                if (ipv6_dev_get_saddr(dev, daddr,
+                if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
                                       inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
                                       &tmpaddr))
                        return;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 5a3e87e4b18f..9af6115f0f50 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2106,7 +2106,8 @@ static inline size_t rt6_nlmsg_size(void)
               + nla_total_size(sizeof(struct rta_cacheinfo));
 }
-static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
+static int rt6_fill_node(struct net *net,
+                         struct sk_buff *skb, struct rt6_info *rt,
                         struct in6_addr *dst, struct in6_addr *src,
                         int iif, int type, u32 pid, u32 seq,
                         int prefix, int nowait, unsigned int flags)
@@ -2187,8 +2188,9 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
 #endif
                        NLA_PUT_U32(skb, RTA_IIF, iif);
        } else if (dst) {
+                struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst);
                struct in6_addr saddr_buf;
-                if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
+                if (ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
                                       dst, 0, &saddr_buf) == 0)
                        NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
        }
@@ -2233,7 +2235,8 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg)
        } else
                prefix = 0;
-        return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
+        return rt6_fill_node(arg->net,
+                     arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
                     NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq,
                     prefix, 0, NLM_F_MULTI);
 }
@@ -2299,7 +2302,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
        rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl);
        skb->dst = &rt->u.dst;
-        err = rt6_fill_node(skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
+        err = rt6_fill_node(net, skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
                            RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
                            nlh->nlmsg_seq, 0, 0, 0);
        if (err < 0) {
@@ -2326,7 +2329,7 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
        if (skb == NULL)
                goto errout;
-        err = rt6_fill_node(skb, rt, NULL, NULL, 0,
+        err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
                                event, info->pid, seq, 0, 0, 0);
        if (err < 0) {
                /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index d1477b350f76..a6aecf76a71b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -379,7 +379,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                                        uh->source, saddr, dif))) {
                struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
                if (buff) {
-                        bh_lock_sock_nested(sk2);
+                        bh_lock_sock(sk2);
                        if (!sock_owned_by_user(sk2))
                                udpv6_queue_rcv_skb(sk2, buff);
                        else
@@ -387,7 +387,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                        bh_unlock_sock(sk2);
                }
        }
-        bh_lock_sock_nested(sk);
+        bh_lock_sock(sk);
        if (!sock_owned_by_user(sk))
                udpv6_queue_rcv_skb(sk, skb);
        else
@@ -508,7 +508,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
        /* deliver */
-        bh_lock_sock_nested(sk);
+        bh_lock_sock(sk);
        if (!sock_owned_by_user(sk))
                udpv6_queue_rcv_skb(sk, skb);
        else
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8f1e0543b3c4..08e4cbbe3f04 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -52,12 +52,14 @@ static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr,
 static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
 {
        struct dst_entry *dst;
+        struct net_device *dev;
        dst = xfrm6_dst_lookup(0, NULL, daddr);
        if (IS_ERR(dst))
                return -EHOSTUNREACH;
-        ipv6_dev_get_saddr(ip6_dst_idev(dst)->dev,
+        dev = ip6_dst_idev(dst)->dev;
+        ipv6_dev_get_saddr(dev_net(dev), dev,
                           (struct in6_addr *)&daddr->a6, 0,
                           (struct in6_addr *)&saddr->a6);
        dst_release(dst);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index e1d11c9b6729..1e97fb9fb34b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2103,6 +2103,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                        rcu_read_unlock();
                        return;
                }
+                /* update new sta with its last rx activity */
+                sta->last_rx = jiffies;
        }
        /*
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 105a616c5c78..a8752031adcb 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -968,7 +968,7 @@ ctnetlink_change_helper(struct nf_conn *ct, struct nlattr *cda[])
                /* need to zero data of old helper */
                memset(&help->help, 0, sizeof(help->help));
        } else {
-                help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
+                help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
                if (help == NULL)
                        return -ENOMEM;
        }
@@ -1136,16 +1136,33 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
        ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
        ct->status |= IPS_CONFIRMED;
+        rcu_read_lock();
+        helper = __nf_ct_helper_find(rtuple);
+        if (helper) {
+                help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
+                if (help == NULL) {
+                        rcu_read_unlock();
+                        err = -ENOMEM;
+                        goto err;
+                }
+                /* not in hash table yet so not strictly necessary */
+                rcu_assign_pointer(help->helper, helper);
+        }
        if (cda[CTA_STATUS]) {
                err = ctnetlink_change_status(ct, cda);
-                if (err < 0)
+                if (err < 0) {
+                        rcu_read_unlock();
                        goto err;
+                }
        }
        if (cda[CTA_PROTOINFO]) {
                err = ctnetlink_change_protoinfo(ct, cda);
-                if (err < 0)
+                if (err < 0) {
+                        rcu_read_unlock();
                        goto err;
+                }
        }
        nf_ct_acct_ext_add(ct, GFP_KERNEL);
@@ -1155,19 +1172,6 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
                ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
 #endif
-        rcu_read_lock();
-        helper = __nf_ct_helper_find(rtuple);
-        if (helper) {
-                help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
-                if (help == NULL) {
-                        rcu_read_unlock();
-                        err = -ENOMEM;
-                        goto err;
-                }
-                /* not in hash table yet so not strictly necessary */
-                rcu_assign_pointer(help->helper, helper);
-        }
        /* setup master conntrack: this is a confirmed expectation */
        if (master_ct) {
                __set_bit(IPS_EXPECTED_BIT, &ct->status);
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index d2d45655cd1a..35a9994e2339 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -150,6 +150,8 @@ static void update_rfkill_state(struct rfkill *rfkill)
 * calls and handling all the red tape such as issuing notifications
 * if the call is successful.
 *
+ * Suspended devices are not touched at all, and -EAGAIN is returned.
+ *
 * Note that the @force parameter cannot override a (possibly cached)
 * state of RFKILL_STATE_HARD_BLOCKED.  Any device making use of
 * RFKILL_STATE_HARD_BLOCKED implements either get_state() or
@@ -168,6 +170,9 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
        int retval = 0;
        enum rfkill_state oldstate, newstate;
+        if (unlikely(rfkill->dev.power.power_state.event & PM_EVENT_SLEEP))
+                return -EBUSY;
        oldstate = rfkill->state;
        if (rfkill->get_state && !force &&
@@ -214,7 +219,7 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
 *
 * This function toggles the state of all switches of given type,
 * unless a specific switch is claimed by userspace (in which case,
- * that switch is left alone).
+ * that switch is left alone) or suspended.
 */
 void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
 {
@@ -239,8 +244,8 @@ EXPORT_SYMBOL(rfkill_switch_all);
 /**
 * rfkill_epo - emergency power off all transmitters
 *
- * This kicks all rfkill devices to RFKILL_STATE_SOFT_BLOCKED, ignoring
+ * This kicks all non-suspended rfkill devices to RFKILL_STATE_SOFT_BLOCKED,
- * everything in its path but rfkill_mutex and rfkill->mutex.
+ * ignoring everything in its path but rfkill_mutex and rfkill->mutex.
 */
 void rfkill_epo(void)
 {
@@ -458,13 +463,14 @@ static int rfkill_resume(struct device *dev)
        if (dev->power.power_state.event != PM_EVENT_ON) {
                mutex_lock(&rfkill->mutex);
+                dev->power.power_state.event = PM_EVENT_ON;
                /* restore radio state AND notify everybody */
                rfkill_toggle_radio(rfkill, rfkill->state, 1);
                mutex_unlock(&rfkill->mutex);
        }
-        dev->power.power_state = PMSG_ON;
        return 0;
 }
 #else
diff --git a/net/rxrpc/ar-accept.c b/net/rxrpc/ar-accept.c
index bdfb77417794..77228f28fa36 100644
--- a/net/rxrpc/ar-accept.c
+++ b/net/rxrpc/ar-accept.c
@@ -100,7 +100,7 @@ static int rxrpc_accept_incoming_call(struct rxrpc_local *local,
        trans = rxrpc_get_transport(local, peer, GFP_NOIO);
        rxrpc_put_peer(peer);
-        if (!trans) {
+        if (IS_ERR(trans)) {
                _debug("no trans");
                ret = -EBUSY;
                goto error;
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 26c7e1f9a350..9974b3f04f05 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -751,7 +751,7 @@ static int tca_action_flush(struct nlattr *nla, struct nlmsghdr *n, u32 pid)
        struct nlattr *tb[TCA_ACT_MAX+1];
        struct nlattr *kind;
        struct tc_action *a = create_a(0);
-        int err = -EINVAL;
+        int err = -ENOMEM;
        if (a == NULL) {
                printk("tca_action_flush: couldnt create tc_action\n");
@@ -762,7 +762,7 @@ static int tca_action_flush(struct nlattr *nla, struct nlmsghdr *n, u32 pid)
        if (!skb) {
                printk("tca_action_flush: failed skb alloc\n");
                kfree(a);
-                return -ENOBUFS;
+                return err;
        }
        b = skb_tail_pointer(skb);
@@ -790,6 +790,8 @@ static int tca_action_flush(struct nlattr *nla, struct nlmsghdr *n, u32 pid)
        err = a->ops->walk(skb, &dcb, RTM_DELACTION, a);
        if (err < 0)
                goto nla_put_failure;
+        if (err == 0)
+                goto noflush_out;
        nla_nest_end(skb, nest);
@@ -807,6 +809,7 @@ nla_put_failure:
 nlmsg_failure:
        module_put(a->ops->owner);
 err_out:
+noflush_out:
        kfree_skb(skb);
        kfree(a);
        return err;
@@ -824,8 +827,10 @@ tca_action_gd(struct nlattr *nla, struct nlmsghdr *n, u32 pid, int event)
                return ret;
        if (event == RTM_DELACTION && n->nlmsg_flags&NLM_F_ROOT) {
-                if (tb[0] != NULL && tb[1] == NULL)
+                if (tb[1] != NULL)
-                        return tca_action_flush(tb[0], n, pid);
+                        return tca_action_flush(tb[1], n, pid);
+                else
+                        return -EINVAL;
        }
        for (i = 1; i <= TCA_ACT_MAX_PRIO && tb[i]; i++) {
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index d2b6f54a6261..5cafdd4c8018 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -280,7 +280,7 @@ replay:
                if (n->nlmsg_type == RTM_DELTFILTER && t->tcm_handle == 0) {
                        spin_lock_bh(root_lock);
                        *back = tp->next;
-                        spin_lock_bh(root_lock);
+                        spin_unlock_bh(root_lock);
                        tfilter_notify(skb, n, tp, fh, RTM_DELTFILTER);
                        tcf_destroy(tp);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index ba1d121f3127..ef0efeca6352 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -27,6 +27,7 @@
 #include <linux/kmod.h>
 #include <linux/list.h>
 #include <linux/hrtimer.h>
+#include <linux/lockdep.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -183,6 +184,21 @@ EXPORT_SYMBOL(unregister_qdisc);
   (root qdisc, all its children, children of children etc.)
 */
+struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
+{
+        struct Qdisc *q;
+        if (!(root->flags & TCQ_F_BUILTIN) &&
+            root->handle == handle)
+                return root;
+        list_for_each_entry(q, &root->list, list) {
+                if (q->handle == handle)
+                        return q;
+        }
+        return NULL;
+}
 struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
 {
        unsigned int i;
@@ -191,16 +207,11 @@ struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
                struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
                struct Qdisc *q, *txq_root = txq->qdisc_sleeping;
-                if (!(txq_root->flags & TCQ_F_BUILTIN) &&
+                q = qdisc_match_from_root(txq_root, handle);
-                    txq_root->handle == handle)
+                if (q)
-                        return txq_root;
+                        return q;
-                list_for_each_entry(q, &txq_root->list, list) {
-                        if (q->handle == handle)
-                                return q;
-                }
        }
-        return NULL;
+        return qdisc_match_from_root(dev->rx_queue.qdisc_sleeping, handle);
 }
 static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid)
@@ -416,7 +427,7 @@ static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
        wd->qdisc->flags &= ~TCQ_F_THROTTLED;
        smp_wmb();
-        __netif_schedule(wd->qdisc);
+        __netif_schedule(qdisc_root(wd->qdisc));
        return HRTIMER_NORESTART;
 }
@@ -627,11 +638,8 @@ static void notify_and_destroy(struct sk_buff *skb, struct nlmsghdr *n, u32 clid
        if (new || old)
                qdisc_notify(skb, n, clid, old, new);
-        if (old) {
+        if (old)
-                spin_lock_bh(&old->q.lock);
                qdisc_destroy(old);
-                spin_unlock_bh(&old->q.lock);
-        }
 }
 /* Graft qdisc "new" to class "classid" of qdisc "parent" or
@@ -697,6 +705,10 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
        return err;
 }
+/* lockdep annotation is needed for ingress; egress gets it only for name */
+static struct lock_class_key qdisc_tx_lock;
+static struct lock_class_key qdisc_rx_lock;
 /*
   Allocate and initialize new qdisc.
@@ -757,6 +769,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
        if (handle == TC_H_INGRESS) {
                sch->flags |= TCQ_F_INGRESS;
                handle = TC_H_MAKE(TC_H_INGRESS, 0);
+                lockdep_set_class(qdisc_lock(sch), &qdisc_rx_lock);
        } else {
                if (handle == 0) {
                        handle = qdisc_alloc_handle(dev);
@@ -764,6 +777,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
                        if (handle == 0)
                                goto err_out3;
                }
+                lockdep_set_class(qdisc_lock(sch), &qdisc_tx_lock);
        }
        sch->handle = handle;
@@ -908,7 +922,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
                                        return -ENOENT;
                                q = qdisc_leaf(p, clid);
                        } else { /* ingress */
-                                q = dev->rx_queue.qdisc;
+                                q = dev->rx_queue.qdisc_sleeping;
                        }
                } else {
                        struct netdev_queue *dev_queue;
@@ -978,7 +992,7 @@ replay:
                                        return -ENOENT;
                                q = qdisc_leaf(p, clid);
                        } else { /*ingress */
-                                q = dev->rx_queue.qdisc;
+                                q = dev->rx_queue.qdisc_sleeping;
                        }
                } else {
                        struct netdev_queue *dev_queue;
@@ -1074,20 +1088,13 @@ create_n_graft:
        }
 graft:
-        if (1) {
+        err = qdisc_graft(dev, p, skb, n, clid, q, NULL);
-                spinlock_t *root_lock;
+        if (err) {
+                if (q)
-                err = qdisc_graft(dev, p, skb, n, clid, q, NULL);
+                        qdisc_destroy(q);
-                if (err) {
+                return err;
-                        if (q) {
-                                root_lock = qdisc_root_lock(q);
-                                spin_lock_bh(root_lock);
-                                qdisc_destroy(q);
-                                spin_unlock_bh(root_lock);
-                        }
-                        return err;
-                }
        }
        return 0;
 }
@@ -1529,11 +1536,11 @@ static int tc_dump_tclass(struct sk_buff *skb, struct netlink_callback *cb)
        t = 0;
        dev_queue = netdev_get_tx_queue(dev, 0);
-        if (tc_dump_tclass_root(dev_queue->qdisc, skb, tcm, cb, &t, s_t) < 0)
+        if (tc_dump_tclass_root(dev_queue->qdisc_sleeping, skb, tcm, cb, &t, s_t) < 0)
                goto done;
        dev_queue = &dev->rx_queue;
-        if (tc_dump_tclass_root(dev_queue->qdisc, skb, tcm, cb, &t, s_t) < 0)
+        if (tc_dump_tclass_root(dev_queue->qdisc_sleeping, skb, tcm, cb, &t, s_t) < 0)
                goto done;
 done:
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 4e261ce62f48..47ef492c4ff4 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -654,7 +654,7 @@ static enum hrtimer_restart cbq_undelay(struct hrtimer *timer)
        }
        sch->flags &= ~TCQ_F_THROTTLED;
-        __netif_schedule(sch);
+        __netif_schedule(qdisc_root(sch));
        return HRTIMER_NORESTART;
 }
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 7cf83b37459d..c3ed4d44fc14 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -518,14 +518,17 @@ void qdisc_reset(struct Qdisc *qdisc)
 }
 EXPORT_SYMBOL(qdisc_reset);
-/* this is the rcu callback function to clean up a qdisc when there
+void qdisc_destroy(struct Qdisc *qdisc)
- * are no further references to it */
-static void __qdisc_destroy(struct rcu_head *head)
 {
-        struct Qdisc *qdisc = container_of(head, struct Qdisc, q_rcu);
        const struct Qdisc_ops  *ops = qdisc->ops;
+        if (qdisc->flags & TCQ_F_BUILTIN ||
+            !atomic_dec_and_test(&qdisc->refcnt))
+                return;
+        if (qdisc->parent)
+                list_del(&qdisc->list);
 #ifdef CONFIG_NET_SCHED
        qdisc_put_stab(qdisc->stab);
 #endif
@@ -542,20 +545,6 @@ static void __qdisc_destroy(struct rcu_head *head)
        kfree((char *) qdisc - qdisc->padded);
 }
-/* Under qdisc_lock(qdisc) and BH! */
-void qdisc_destroy(struct Qdisc *qdisc)
-{
-        if (qdisc->flags & TCQ_F_BUILTIN ||
-            !atomic_dec_and_test(&qdisc->refcnt))
-                return;
-        if (qdisc->parent)
-                list_del(&qdisc->list);
-        call_rcu(&qdisc->q_rcu, __qdisc_destroy);
-}
 EXPORT_SYMBOL(qdisc_destroy);
 static bool dev_all_qdisc_sleeping_noop(struct net_device *dev)
@@ -597,6 +586,9 @@ static void transition_one_qdisc(struct net_device *dev,
        struct Qdisc *new_qdisc = dev_queue->qdisc_sleeping;
        int *need_watchdog_p = _need_watchdog;
+        if (!(new_qdisc->flags & TCQ_F_BUILTIN))
+                clear_bit(__QDISC_STATE_DEACTIVATED, &new_qdisc->state);
        rcu_assign_pointer(dev_queue->qdisc, new_qdisc);
        if (need_watchdog_p && new_qdisc != &noqueue_qdisc)
                *need_watchdog_p = 1;
@@ -640,6 +632,9 @@ static void dev_deactivate_queue(struct net_device *dev,
        if (qdisc) {
                spin_lock_bh(qdisc_lock(qdisc));
+                if (!(qdisc->flags & TCQ_F_BUILTIN))
+                        set_bit(__QDISC_STATE_DEACTIVATED, &qdisc->state);
                dev_queue->qdisc = qdisc_default;
                qdisc_reset(qdisc);
@@ -647,7 +642,7 @@ static void dev_deactivate_queue(struct net_device *dev,
        }
 }
-static bool some_qdisc_is_running(struct net_device *dev, int lock)
+static bool some_qdisc_is_busy(struct net_device *dev)
 {
        unsigned int i;
@@ -658,16 +653,15 @@ static bool some_qdisc_is_running(struct net_device *dev, int lock)
                int val;
                dev_queue = netdev_get_tx_queue(dev, i);
-                q = dev_queue->qdisc;
+                q = dev_queue->qdisc_sleeping;
                root_lock = qdisc_lock(q);
-                if (lock)
+                spin_lock_bh(root_lock);
-                        spin_lock_bh(root_lock);
-                val = test_bit(__QDISC_STATE_RUNNING, &q->state);
+                val = (test_bit(__QDISC_STATE_RUNNING, &q->state) ||
+                       test_bit(__QDISC_STATE_SCHED, &q->state));
-                if (lock)
+                spin_unlock_bh(root_lock);
-                        spin_unlock_bh(root_lock);
                if (val)
                        return true;
@@ -677,8 +671,6 @@ static bool some_qdisc_is_running(struct net_device *dev, int lock)
 void dev_deactivate(struct net_device *dev)
 {
-        bool running;
        netdev_for_each_tx_queue(dev, dev_deactivate_queue, &noop_qdisc);
        dev_deactivate_queue(dev, &dev->rx_queue, &noop_qdisc);
@@ -688,25 +680,8 @@ void dev_deactivate(struct net_device *dev)
        synchronize_rcu();
        /* Wait for outstanding qdisc_run calls. */
-        do {
+        while (some_qdisc_is_busy(dev))
-                while (some_qdisc_is_running(dev, 0))
+                yield();
-                        yield();
-                /*
-                 * Double-check inside queue lock to ensure that all effects
-                 * of the queue run are visible when we return.
-                 */
-                running = some_qdisc_is_running(dev, 1);
-                /*
-                 * The running flag should never be set at this point because
-                 * we've already set dev->qdisc to noop_qdisc *inside* the same
-                 * pair of spin locks.  That is, if any qdisc_run starts after
-                 * our initial test it should see the noop_qdisc and then
-                 * clear the RUNNING bit before dropping the queue lock.  So
-                 * if it is set here then we've found a bug.
-                 */
-        } while (WARN_ON_ONCE(running));
 }
 static void dev_init_scheduler_queue(struct net_device *dev,
@@ -735,14 +710,10 @@ static void shutdown_scheduler_queue(struct net_device *dev,
        struct Qdisc *qdisc_default = _qdisc_default;
        if (qdisc) {
-                spinlock_t *root_lock = qdisc_lock(qdisc);
                dev_queue->qdisc = qdisc_default;
                dev_queue->qdisc_sleeping = qdisc_default;
-                spin_lock_bh(root_lock);
                qdisc_destroy(qdisc);
-                spin_unlock_bh(root_lock);
        }
 }
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index be35422711a3..0df0df202ed0 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -577,7 +577,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                        sch->qstats.drops++;
                        cl->qstats.drops++;
                }
-                return NET_XMIT_DROP;
+                return ret;
        } else {
                cl->bstats.packets +=
                        skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
@@ -623,7 +623,7 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch)
                        sch->qstats.drops++;
                        cl->qstats.drops++;
                }
-                return NET_XMIT_DROP;
+                return ret;
        } else
                htb_activate(q, cl);
@@ -1279,7 +1279,8 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
        /* delete from hash and active; remainder in destroy_class */
        qdisc_class_hash_remove(&q->clhash, &cl->common);
-        cl->parent->children--;
+        if (cl->parent)
+                cl->parent->children--;
        if (cl->prio_activity)
                htb_deactivate(q, cl);
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index eac197610edf..a6697c686c7f 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -113,11 +113,11 @@ prio_requeue(struct sk_buff *skb, struct Qdisc* sch)
        if ((ret = qdisc->ops->requeue(skb, qdisc)) == NET_XMIT_SUCCESS) {
                sch->q.qlen++;
                sch->qstats.requeues++;
-                return 0;
+                return NET_XMIT_SUCCESS;
        }
        if (net_xmit_drop_count(ret))
                sch->qstats.drops++;
-        return NET_XMIT_DROP;
+        return ret;
 }
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 7d3b7ff3bf07..94c61598b86a 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
        struct tbf_sched_data *q = qdisc_priv(sch);
        int ret;
-        if (qdisc_pkt_len(skb) > q->max_size) {
+        if (qdisc_pkt_len(skb) > q->max_size)
-                sch->qstats.drops++;
+                return qdisc_reshape_fail(skb, sch);
-#ifdef CONFIG_NET_CLS_ACT
-                if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch))
-#endif
-                        kfree_skb(skb);
-                return NET_XMIT_DROP;
-        }
        ret = qdisc_enqueue(skb, q->qdisc);
        if (ret != 0) {
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 483a01d0740a..47f91afa0211 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -319,7 +319,8 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk,
                          __func__, asoc, dst, NIP6(daddr->v6.sin6_addr));
        if (!asoc) {
-                ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL,
+                ipv6_dev_get_saddr(sock_net(sctp_opt2sk(sk)),
+                                   dst ? ip6_dst_idev(dst)->dev : NULL,
                                   &daddr->v6.sin6_addr,
                                   inet6_sk(&sk->inet.sk)->srcprefs,
                                   &saddr->v6.sin6_addr);
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 0326d3060bc7..0747d8a9232f 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -85,7 +85,7 @@ static struct top_srv topsrv = { 0 };
 static u32 htohl(u32 in, int swap)
 {
-        return swap ? (u32)___constant_swab32(in) : in;
+        return swap ? swab32(in) : in;
 }
 /**
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index df5b3886c36b..d98ffb75119a 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -1277,6 +1277,7 @@ static int rtnetlink_fill_iwinfo(struct sk_buff *skb, struct net_device *dev,
        r->ifi_flags = dev_get_flags(dev);
        r->ifi_change = 0;      /* Wireless changes don't affect those flags */
+        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
        /* Add the wireless events in the netlink packet */
        NLA_PUT(skb, IFLA_WIRELESS, event_len, event);
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 3f964db908a7..ac25b4c0e982 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -112,16 +112,13 @@ error_nolock:
 int xfrm_output_resume(struct sk_buff *skb, int err)
 {
        while (likely((err = xfrm_output_one(skb, err)) == 0)) {
-                struct xfrm_state *x;
                nf_reset(skb);
                err = skb->dst->ops->local_out(skb);
                if (unlikely(err != 1))
                        goto out;
-                x = skb->dst->xfrm;
+                if (!skb->dst->xfrm)
-                if (!x)
                        return dst_output(skb);
                err = nf_hook(skb->dst->ops->family,