33 files changed, 196 insertions, 162 deletions
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 845da3ee56a0..9de93714213a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -55,7 +55,7 @@
 #define AUTO_OFF_TIMEOUT 2000
-int enable_hs;
+bool enable_hs;
 static void hci_rx_work(struct work_struct *work);
 static void hci_cmd_work(struct work_struct *work);
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 673728add60b..82c57069415f 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -59,8 +59,6 @@ struct cfcnfg *get_cfcnfg(struct net *net)
 {
        struct caif_net *caifn;
        caifn = net_generic(net, caif_net_id);
-        if (!caifn)
-                return NULL;
        return caifn->cfg;
 }
 EXPORT_SYMBOL(get_cfcnfg);
@@ -69,8 +67,6 @@ static struct caif_device_entry_list *caif_device_list(struct net *net)
 {
        struct caif_net *caifn;
        caifn = net_generic(net, caif_net_id);
-        if (!caifn)
-                return NULL;
        return &caifn->caifdevs;
 }
@@ -99,8 +95,6 @@ static struct caif_device_entry *caif_device_alloc(struct net_device *dev)
        struct caif_device_entry *caifd;
        caifdevs = caif_device_list(dev_net(dev));
-        if (!caifdevs)
-                return NULL;
        caifd = kzalloc(sizeof(*caifd), GFP_KERNEL);
        if (!caifd)
@@ -120,8 +114,6 @@ static struct caif_device_entry *caif_get(struct net_device *dev)
        struct caif_device_entry_list *caifdevs =
            caif_device_list(dev_net(dev));
        struct caif_device_entry *caifd;
-        if (!caifdevs)
-                return NULL;
        list_for_each_entry_rcu(caifd, &caifdevs->list, list) {
                if (caifd->netdev == dev)
@@ -321,8 +313,6 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
        struct caif_device_entry_list *caifdevs;
        caifdevs = caif_device_list(dev_net(dev));
-        if (!cfg || !caifdevs)
-                return;
        caifd = caif_device_alloc(dev);
        if (!caifd)
                return;
@@ -374,8 +364,6 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
        cfg = get_cfcnfg(dev_net(dev));
        caifdevs = caif_device_list(dev_net(dev));
-        if (!cfg || !caifdevs)
-                return 0;
        caifd = caif_get(dev);
        if (caifd == NULL && dev->type != ARPHRD_CAIF)
@@ -507,9 +495,6 @@ static struct notifier_block caif_device_notifier = {
 static int caif_init_net(struct net *net)
 {
        struct caif_net *caifn = net_generic(net, caif_net_id);
-        if (WARN_ON(!caifn))
-                return -EINVAL;
        INIT_LIST_HEAD(&caifn->caifdevs.list);
        mutex_init(&caifn->caifdevs.lock);
@@ -527,9 +512,6 @@ static void caif_exit_net(struct net *net)
            caif_device_list(net);
        struct cfcnfg *cfg =  get_cfcnfg(net);
-        if (!cfg || !caifdevs)
-                return;
        rtnl_lock();
        mutex_lock(&caifdevs->lock);
@@ -569,7 +551,7 @@ static int __init caif_device_init(void)
 {
        int result;
-        result = register_pernet_device(&caif_net_ops);
+        result = register_pernet_subsys(&caif_net_ops);
        if (result)
                return result;
@@ -582,7 +564,7 @@ static int __init caif_device_init(void)
 static void __exit caif_device_exit(void)
 {
-        unregister_pernet_device(&caif_net_ops);
+        unregister_pernet_subsys(&caif_net_ops);
        unregister_netdevice_notifier(&caif_device_notifier);
        dev_remove_pack(&caif_packet_type);
 }
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index 598aafb4cb51..ba9cfd47778a 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -309,7 +309,6 @@ int caif_connect_client(struct net *net, struct caif_connect_request *conn_req,
        int err;
        struct cfctrl_link_param param;
        struct cfcnfg *cfg = get_cfcnfg(net);
-        caif_assert(cfg != NULL);
        rcu_read_lock();
        err = caif_connect_req_to_link_param(cfg, conn_req, &param);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 921aa2b4b415..369b41894527 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1311,6 +1311,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
        case ETHTOOL_GRXCSUM:
        case ETHTOOL_GTXCSUM:
        case ETHTOOL_GSG:
+        case ETHTOOL_GSSET_INFO:
        case ETHTOOL_GSTRINGS:
        case ETHTOOL_GTSO:
        case ETHTOOL_GPERMADDR:
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 0985b9b14b80..a225089df5b6 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1,4 +1,5 @@
 #include <linux/skbuff.h>
+#include <linux/export.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/if_vlan.h>
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index aefcd7acbffa..0e950fda9a0a 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -30,6 +30,20 @@ EXPORT_SYMBOL(init_net);
 #define INITIAL_NET_GEN_PTRS    13 /* +1 for len +2 for rcu_head */
+static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
+static struct net_generic *net_alloc_generic(void)
+{
+        struct net_generic *ng;
+        size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
+        ng = kzalloc(generic_size, GFP_KERNEL);
+        if (ng)
+                ng->len = max_gen_ptrs;
+        return ng;
+}
 static int net_assign_generic(struct net *net, int id, void *data)
 {
        struct net_generic *ng, *old_ng;
@@ -43,8 +57,7 @@ static int net_assign_generic(struct net *net, int id, void *data)
        if (old_ng->len >= id)
                goto assign;
-        ng = kzalloc(sizeof(struct net_generic) +
+        ng = net_alloc_generic();
-                        id * sizeof(void *), GFP_KERNEL);
        if (ng == NULL)
                return -ENOMEM;
@@ -59,7 +72,6 @@ static int net_assign_generic(struct net *net, int id, void *data)
         * the old copy for kfree after a grace period.
         */
-        ng->len = id;
        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
        rcu_assign_pointer(net->gen, ng);
@@ -161,18 +173,6 @@ out_undo:
        goto out;
 }
-static struct net_generic *net_alloc_generic(void)
-{
-        struct net_generic *ng;
-        size_t generic_size = sizeof(struct net_generic) +
-                INITIAL_NET_GEN_PTRS * sizeof(void *);
-        ng = kzalloc(generic_size, GFP_KERNEL);
-        if (ng)
-                ng->len = INITIAL_NET_GEN_PTRS;
-        return ng;
-}
 #ifdef CONFIG_NET_NS
 static struct kmem_cache *net_cachep;
@@ -483,6 +483,7 @@ again:
                        }
                        return error;
                }
+                max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id);
        }
        error = __register_pernet_operations(list, ops);
        if (error) {
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 65f80c7b1656..4d8ce93cd503 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -767,8 +767,8 @@ done:
        return i;
 }
-static unsigned long num_arg(const char __user * user_buffer,
+static long num_arg(const char __user *user_buffer, unsigned long maxlen,
-                             unsigned long maxlen, unsigned long *num)
+                                unsigned long *num)
 {
        int i;
        *num = 0;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f16444bc6cbb..65aebd450027 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1509,6 +1509,9 @@ errout:
        if (send_addr_notify)
                call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+        min_ifinfo_dump_size = max_t(u16, if_nlmsg_size(dev),
+                                     min_ifinfo_dump_size);
        return err;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 5c5af9988f94..3e81fd2e3c75 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1827,7 +1827,7 @@ suppress_allocation:
        /* Alas. Undo changes. */
        sk->sk_forward_alloc -= amt * SK_MEM_QUANTUM;
-        sk_memory_allocated_sub(sk, amt, parent_status);
+        sk_memory_allocated_sub(sk, amt);
        return 0;
 }
@@ -1840,7 +1840,7 @@ EXPORT_SYMBOL(__sk_mem_schedule);
 void __sk_mem_reclaim(struct sock *sk)
 {
        sk_memory_allocated_sub(sk,
-                                sk->sk_forward_alloc >> SK_MEM_QUANTUM_SHIFT, 0);
+                                sk->sk_forward_alloc >> SK_MEM_QUANTUM_SHIFT);
        sk->sk_forward_alloc &= SK_MEM_QUANTUM - 1;
        if (sk_under_memory_pressure(sk) &&
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 2e4e24476c4c..19d66cefd7d3 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -123,11 +123,14 @@ again:
                                                smallest_size = tb->num_owners;
                                                smallest_rover = rover;
                                                if (atomic_read(&hashinfo->bsockets) > (high - low) + 1) {
-                                                        spin_unlock(&head->lock);
                                                        snum = smallest_rover;
-                                                        goto have_snum;
+                                                        goto tb_found;
                                                }
                                        }
+                                        if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
+                                                snum = rover;
+                                                goto tb_found;
+                                        }
                                        goto next;
                                }
                        break;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 2b53a1f7abf6..6b3ca5ba4450 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -422,6 +422,10 @@ static struct ip_tunnel *ipgre_tunnel_locate(struct net *net,
        if (register_netdevice(dev) < 0)
                goto failed_free;
+        /* Can use a lockless transmit, unless we generate output sequences */
+        if (!(nt->parms.o_flags & GRE_SEQ))
+                dev->features |= NETIF_F_LLTX;
        dev_hold(dev);
        ipgre_tunnel_link(ign, nt);
        return nt;
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 3569d8ecaeac..6afc807ee2ad 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -216,7 +216,6 @@ static const struct snmp_mib snmp4_net_list[] = {
        SNMP_MIB_ITEM("TCPPartialUndo", LINUX_MIB_TCPPARTIALUNDO),
        SNMP_MIB_ITEM("TCPDSACKUndo", LINUX_MIB_TCPDSACKUNDO),
        SNMP_MIB_ITEM("TCPLossUndo", LINUX_MIB_TCPLOSSUNDO),
-        SNMP_MIB_ITEM("TCPLoss", LINUX_MIB_TCPLOSS),
        SNMP_MIB_ITEM("TCPLostRetransmit", LINUX_MIB_TCPLOSTRETRANSMIT),
        SNMP_MIB_ITEM("TCPRenoFailures", LINUX_MIB_TCPRENOFAILURES),
        SNMP_MIB_ITEM("TCPSackFailures", LINUX_MIB_TCPSACKFAILURES),
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 4aa7e9dc0cbb..4cb9cd2f2c39 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -814,6 +814,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
        net->ipv4.sysctl_rt_cache_rebuild_count = 4;
+        tcp_init_mem(net);
        limit = nr_free_buffer_pages() / 8;
        limit = max(limit, 128UL);
        net->ipv4.sysctl_tcp_mem[0] = limit / 4 * 3;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9bcdec3ad772..06373b4a449a 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3216,6 +3216,16 @@ static int __init set_thash_entries(char *str)
 }
 __setup("thash_entries=", set_thash_entries);
+void tcp_init_mem(struct net *net)
+{
+        /* Set per-socket limits to no more than 1/128 the pressure threshold */
+        unsigned long limit = nr_free_buffer_pages() / 8;
+        limit = max(limit, 128UL);
+        net->ipv4.sysctl_tcp_mem[0] = limit / 4 * 3;
+        net->ipv4.sysctl_tcp_mem[1] = limit;
+        net->ipv4.sysctl_tcp_mem[2] = net->ipv4.sysctl_tcp_mem[0] * 2;
+}
 void __init tcp_init(void)
 {
        struct sk_buff *skb = NULL;
@@ -3276,9 +3286,9 @@ void __init tcp_init(void)
        sysctl_tcp_max_orphans = cnt / 2;
        sysctl_max_syn_backlog = max(128, cnt / 256);
-        /* Set per-socket limits to no more than 1/128 the pressure threshold */
+        tcp_init_mem(&init_net);
-        limit = ((unsigned long)init_net.ipv4.sysctl_tcp_mem[1])
+        limit = nr_free_buffer_pages() / 8;
-                << (PAGE_SHIFT - 7);
+        limit = max(limit, 128UL);
        max_share = min(4UL*1024*1024, limit);
        sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
diff --git a/net/ipv4/tcp_bic.c b/net/ipv4/tcp_bic.c
index 6187eb4d1dcf..f45e1c242440 100644
--- a/net/ipv4/tcp_bic.c
+++ b/net/ipv4/tcp_bic.c
@@ -63,7 +63,6 @@ static inline void bictcp_reset(struct bictcp *ca)
 {
        ca->cnt = 0;
        ca->last_max_cwnd = 0;
-        ca->loss_cwnd = 0;
        ca->last_cwnd = 0;
        ca->last_time = 0;
        ca->epoch_start = 0;
@@ -72,7 +71,11 @@ static inline void bictcp_reset(struct bictcp *ca)
 static void bictcp_init(struct sock *sk)
 {
-        bictcp_reset(inet_csk_ca(sk));
+        struct bictcp *ca = inet_csk_ca(sk);
+        bictcp_reset(ca);
+        ca->loss_cwnd = 0;
        if (initial_ssthresh)
                tcp_sk(sk)->snd_ssthresh = initial_ssthresh;
 }
@@ -127,7 +130,7 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
        }
        /* if in slow start or link utilization is very low */
-        if (ca->loss_cwnd == 0) {
+        if (ca->last_max_cwnd == 0) {
                if (ca->cnt > 20) /* increase cwnd 5% per RTT */
                        ca->cnt = 20;
        }
@@ -185,7 +188,7 @@ static u32 bictcp_undo_cwnd(struct sock *sk)
 {
        const struct tcp_sock *tp = tcp_sk(sk);
        const struct bictcp *ca = inet_csk_ca(sk);
-        return max(tp->snd_cwnd, ca->last_max_cwnd);
+        return max(tp->snd_cwnd, ca->loss_cwnd);
 }
 static void bictcp_state(struct sock *sk, u8 new_state)
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index f376b05cca81..a9077f441cb2 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -107,7 +107,6 @@ static inline void bictcp_reset(struct bictcp *ca)
 {
        ca->cnt = 0;
        ca->last_max_cwnd = 0;
-        ca->loss_cwnd = 0;
        ca->last_cwnd = 0;
        ca->last_time = 0;
        ca->bic_origin_point = 0;
@@ -142,7 +141,10 @@ static inline void bictcp_hystart_reset(struct sock *sk)
 static void bictcp_init(struct sock *sk)
 {
-        bictcp_reset(inet_csk_ca(sk));
+        struct bictcp *ca = inet_csk_ca(sk);
+        bictcp_reset(ca);
+        ca->loss_cwnd = 0;
        if (hystart)
                bictcp_hystart_reset(sk);
@@ -275,7 +277,7 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
         * The initial growth of cubic function may be too conservative
         * when the available bandwidth is still unknown.
         */
-        if (ca->loss_cwnd == 0 && ca->cnt > 20)
+        if (ca->last_max_cwnd == 0 && ca->cnt > 20)
                ca->cnt = 20;   /* increase cwnd 5% per RTT */
        /* TCP Friendly */
@@ -342,7 +344,7 @@ static u32 bictcp_undo_cwnd(struct sock *sk)
 {
        struct bictcp *ca = inet_csk_ca(sk);
-        return max(tcp_sk(sk)->snd_cwnd, ca->last_max_cwnd);
+        return max(tcp_sk(sk)->snd_cwnd, ca->loss_cwnd);
 }
 static void bictcp_state(struct sock *sk, u8 new_state)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2877c3e09587..976034f82320 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -105,7 +105,6 @@ int sysctl_tcp_abc __read_mostly;
 #define FLAG_SYN_ACKED          0x10 /* This ACK acknowledged SYN.              */
 #define FLAG_DATA_SACKED        0x20 /* New SACK.                               */
 #define FLAG_ECE                0x40 /* ECE in this ACK                         */
-#define FLAG_DATA_LOST          0x80 /* SACK detected data lossage.             */
 #define FLAG_SLOWPATH           0x100 /* Do not skip RFC checks for window update.*/
 #define FLAG_ONLY_ORIG_SACKED   0x200 /* SACKs only non-rexmit sent before RTO */
 #define FLAG_SND_UNA_ADVANCED   0x400 /* Snd_una was changed (!= FLAG_DATA_ACKED) */
@@ -1040,13 +1039,11 @@ static void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp,
 * These 6 states form finite state machine, controlled by the following events:
 * 1. New ACK (+SACK) arrives. (tcp_sacktag_write_queue())
 * 2. Retransmission. (tcp_retransmit_skb(), tcp_xmit_retransmit_queue())
- * 3. Loss detection event of one of three flavors:
+ * 3. Loss detection event of two flavors:
 *      A. Scoreboard estimator decided the packet is lost.
 *         A'. Reno "three dupacks" marks head of queue lost.
- *         A''. Its FACK modfication, head until snd.fack is lost.
+ *         A''. Its FACK modification, head until snd.fack is lost.
- *      B. SACK arrives sacking data transmitted after never retransmitted
+ *      B. SACK arrives sacking SND.NXT at the moment, when the
- *         hole was sent out.
- *      C. SACK arrives sacking SND.NXT at the moment, when the
 *         segment was retransmitted.
 * 4. D-SACK added new rule: D-SACK changes any tag to S.
 *
@@ -1153,7 +1150,7 @@ static int tcp_is_sackblock_valid(struct tcp_sock *tp, int is_dsack,
 }
 /* Check for lost retransmit. This superb idea is borrowed from "ratehalving".
- * Event "C". Later note: FACK people cheated me again 8), we have to account
+ * Event "B". Later note: FACK people cheated me again 8), we have to account
 * for reordering! Ugly, but should help.
 *
 * Search retransmitted skbs from write_queue that were sent when snd_nxt was
@@ -1844,10 +1841,6 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
                if (found_dup_sack && ((i + 1) == first_sack_index))
                        next_dup = &sp[i + 1];
-                /* Event "B" in the comment above. */
-                if (after(end_seq, tp->high_seq))
-                        state.flag |= FLAG_DATA_LOST;
                /* Skip too early cached blocks */
                while (tcp_sack_cache_ok(tp, cache) &&
                       !before(start_seq, cache->end_seq))
@@ -2515,8 +2508,11 @@ static void tcp_timeout_skbs(struct sock *sk)
        tcp_verify_left_out(tp);
 }
-/* Mark head of queue up as lost. With RFC3517 SACK, the packets is
+/* Detect loss in event "A" above by marking head of queue up as lost.
- * is against sacked "cnt", otherwise it's against facked "cnt"
+ * For FACK or non-SACK(Reno) senders, the first "packets" number of segments
+ * are considered lost. For RFC3517 SACK, a segment is considered lost if it
+ * has at least tp->reordering SACKed seqments above it; "packets" refers to
+ * the maximum SACKed segments to pass before reaching this limit.
 */
 static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 {
@@ -2525,6 +2521,8 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
        int cnt, oldcnt;
        int err;
        unsigned int mss;
+        /* Use SACK to deduce losses of new sequences sent during recovery */
+        const u32 loss_high = tcp_is_sack(tp) ?  tp->snd_nxt : tp->high_seq;
        WARN_ON(packets > tp->packets_out);
        if (tp->lost_skb_hint) {
@@ -2546,7 +2544,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
                tp->lost_skb_hint = skb;
                tp->lost_cnt_hint = cnt;
-                if (after(TCP_SKB_CB(skb)->end_seq, tp->high_seq))
+                if (after(TCP_SKB_CB(skb)->end_seq, loss_high))
                        break;
                oldcnt = cnt;
@@ -3033,19 +3031,10 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
        if (tcp_check_sack_reneging(sk, flag))
                return;
-        /* C. Process data loss notification, provided it is valid. */
+        /* C. Check consistency of the current state. */
-        if (tcp_is_fack(tp) && (flag & FLAG_DATA_LOST) &&
-            before(tp->snd_una, tp->high_seq) &&
-            icsk->icsk_ca_state != TCP_CA_Open &&
-            tp->fackets_out > tp->reordering) {
-                tcp_mark_head_lost(sk, tp->fackets_out - tp->reordering, 0);
-                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPLOSS);
-        }
-        /* D. Check consistency of the current state. */
        tcp_verify_left_out(tp);
-        /* E. Check state exit conditions. State can be terminated
+        /* D. Check state exit conditions. State can be terminated
         *    when high_seq is ACKed. */
        if (icsk->icsk_ca_state == TCP_CA_Open) {
                WARN_ON(tp->retrans_out != 0);
@@ -3077,7 +3066,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
                }
        }
-        /* F. Process state. */
+        /* E. Process state. */
        switch (icsk->icsk_ca_state) {
        case TCP_CA_Recovery:
                if (!(flag & FLAG_SND_UNA_ADVANCED)) {
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 1eb4ad57670e..337ba4cca052 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -631,7 +631,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
        arg.iov[0].iov_len  = sizeof(rep.th);
 #ifdef CONFIG_TCP_MD5SIG
-        key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr) : NULL;
+        key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->saddr) : NULL;
        if (key) {
                rep.opt[0] = htonl((TCPOPT_NOP << 24) |
                                   (TCPOPT_NOP << 16) |
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 8c8de2780c7a..4ff3b6dc74fc 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1141,11 +1141,9 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
        sk_mem_uncharge(sk, len);
        sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
-        /* Any change of skb->len requires recalculation of tso
+        /* Any change of skb->len requires recalculation of tso factor. */
-         * factor and mss.
-         */
        if (tcp_skb_pcount(skb) > 1)
-                tcp_set_skb_tso_segs(sk, skb, tcp_current_mss(sk));
+                tcp_set_skb_tso_segs(sk, skb, tcp_skb_mss(skb));
        return 0;
 }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a225d5ee3c2f..c02280a4d126 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -502,29 +502,31 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
        rcu_read_unlock();
 }
-static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
+static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
 {
        struct net *net;
+        int old;
+        if (!rtnl_trylock())
+                return restart_syscall();
        net = (struct net *)table->extra2;
-        if (p == &net->ipv6.devconf_dflt->forwarding)
+        old = *p;
-                return 0;
+        *p = newf;
-        if (!rtnl_trylock()) {
+        if (p == &net->ipv6.devconf_dflt->forwarding) {
-                /* Restore the original values before restarting */
+                rtnl_unlock();
-                *p = old;
+                return 0;
-                return restart_syscall();
        }
        if (p == &net->ipv6.devconf_all->forwarding) {
-                __s32 newf = net->ipv6.devconf_all->forwarding;
                net->ipv6.devconf_dflt->forwarding = newf;
                addrconf_forward_change(net, newf);
-        } else if ((!*p) ^ (!old))
+        } else if ((!newf) ^ (!old))
                dev_forward_change((struct inet6_dev *)table->extra1);
        rtnl_unlock();
-        if (*p)
+        if (newf)
                rt6_purge_dflt_routers(net);
        return 1;
 }
@@ -4260,9 +4262,17 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
        int *valp = ctl->data;
        int val = *valp;
        loff_t pos = *ppos;
+        ctl_table lctl;
        int ret;
-        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+        /*
+         * ctl->data points to idev->cnf.forwarding, we should
+         * not modify it until we get the rtnl lock.
+         */
+        lctl = *ctl;
+        lctl.data = &val;
+        ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
        if (write)
                ret = addrconf_fixup_forwarding(ctl, valp, val);
@@ -4300,26 +4310,27 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
        rcu_read_unlock();
 }
-static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
+static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
 {
        struct net *net;
+        int old;
+        if (!rtnl_trylock())
+                return restart_syscall();
        net = (struct net *)table->extra2;
+        old = *p;
+        *p = newf;
-        if (p == &net->ipv6.devconf_dflt->disable_ipv6)
+        if (p == &net->ipv6.devconf_dflt->disable_ipv6) {
+                rtnl_unlock();
                return 0;
-        if (!rtnl_trylock()) {
-                /* Restore the original values before restarting */
-                *p = old;
-                return restart_syscall();
        }
        if (p == &net->ipv6.devconf_all->disable_ipv6) {
-                __s32 newf = net->ipv6.devconf_all->disable_ipv6;
                net->ipv6.devconf_dflt->disable_ipv6 = newf;
                addrconf_disable_change(net, newf);
-        } else if ((!*p) ^ (!old))
+        } else if ((!newf) ^ (!old))
                dev_disable_change((struct inet6_dev *)table->extra1);
        rtnl_unlock();
@@ -4333,9 +4344,17 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
        int *valp = ctl->data;
        int val = *valp;
        loff_t pos = *ppos;
+        ctl_table lctl;
        int ret;
-        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+        /*
+         * ctl->data points to idev->cnf.disable_ipv6, we should
+         * not modify it until we get the rtnl lock.
+         */
+        lctl = *ctl;
+        lctl.data = &val;
+        ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
        if (write)
                ret = addrconf_disable_ipv6(ctl, valp, val);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 906c7ca43542..3edd05ae4388 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1083,7 +1083,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 #ifdef CONFIG_TCP_MD5SIG
        if (sk)
-                key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
+                key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr);
 #endif
        if (th->ack)
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index d21e7ebd91ca..55670ec3cd0f 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -393,11 +393,6 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
 {
        int rc;
-        if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
-                goto drop;
-        nf_reset(skb);
        /* Charge it to the socket, dropping if the queue is full. */
        rc = sock_queue_rcv_skb(sk, skb);
        if (rc < 0)
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index a18e6c3d36e3..b9bef2c75026 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -713,6 +713,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
        struct sk_buff *skb = NULL;
        struct sock *sk = sock->sk;
        struct llc_sock *llc = llc_sk(sk);
+        unsigned long cpu_flags;
        size_t copied = 0;
        u32 peek_seq = 0;
        u32 *seq;
@@ -838,7 +839,9 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                        goto copy_uaddr;
                if (!(flags & MSG_PEEK)) {
+                        spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
                        sk_eat_skb(sk, skb, 0);
+                        spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
                        *seq = 0;
                }
@@ -859,7 +862,9 @@ copy_uaddr:
                llc_cmsg_rcv(msg, skb);
        if (!(flags & MSG_PEEK)) {
+                        spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
                        sk_eat_skb(sk, skb, 0);
+                        spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
                        *seq = 0;
        }
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index 38e6101190d9..59edcd95a58d 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -225,9 +225,9 @@ KEY_OPS(key);
                            key, &key_##name##_ops);
 void ieee80211_debugfs_key_add(struct ieee80211_key *key)
-  {
+{
        static int keycount;
-        char buf[50];
+        char buf[100];
        struct sta_info *sta;
        if (!key->local->debugfs.keys)
@@ -244,7 +244,8 @@ void ieee80211_debugfs_key_add(struct ieee80211_key *key)
        sta = key->sta;
        if (sta) {
-                sprintf(buf, "../../stations/%pM", sta->sta.addr);
+                sprintf(buf, "../../netdev:%s/stations/%pM",
+                        sta->sdata->name, sta->sta.addr);
                key->debugfs.stalink =
                        debugfs_create_symlink("station", key->debugfs.dir, buf);
        }
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index b3d76b756cd5..a4643969a13b 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -106,6 +106,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
        sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
+        local->oper_channel = chan;
        channel_type = ifibss->channel_type;
        if (channel_type > NL80211_CHAN_HT20 &&
            !cfg80211_can_beacon_sec_chan(local->hw.wiphy, chan, channel_type))
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index e47768cb8cb3..01a21c2f6ab3 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1314,6 +1314,7 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                        continue;
                }
                /* count everything else */
+                sdata->vif.bss_conf.idle = false;
                count++;
        }
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 73abb7524b2c..54df1b2bafd2 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -119,12 +119,12 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
        int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.mesh_action) +
                      sizeof(mgmt->u.action.u.mesh_action);
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+        skb = dev_alloc_skb(local->tx_headroom +
                            hdr_len +
                            2 + 37); /* max HWMP IE */
        if (!skb)
                return -1;
-        skb_reserve(skb, local->hw.extra_tx_headroom);
+        skb_reserve(skb, local->tx_headroom);
        mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
        memset(mgmt, 0, hdr_len);
        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
@@ -250,12 +250,12 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
        if (time_before(jiffies, ifmsh->next_perr))
                return -EAGAIN;
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+        skb = dev_alloc_skb(local->tx_headroom +
                            hdr_len +
                            2 + 15 /* PERR IE */);
        if (!skb)
                return -1;
-        skb_reserve(skb, local->tx_headroom + local->hw.extra_tx_headroom);
+        skb_reserve(skb, local->tx_headroom);
        mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
        memset(mgmt, 0, hdr_len);
        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 41ef1b476442..a17251730b9e 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -172,7 +172,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
        int hdr_len = offsetof(struct ieee80211_mgmt, u.action.u.self_prot) +
                      sizeof(mgmt->u.action.u.self_prot);
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
+        skb = dev_alloc_skb(local->tx_headroom +
                            hdr_len +
                            2 + /* capability info */
                            2 + /* AID */
@@ -186,7 +186,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                            sdata->u.mesh.ie_len);
        if (!skb)
                return -1;
-        skb_reserve(skb, local->hw.extra_tx_headroom);
+        skb_reserve(skb, local->tx_headroom);
        mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
        memset(mgmt, 0, hdr_len);
        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index ecb4c84c1bb3..295be92f7c77 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2750,7 +2750,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 {
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_work *wk;
        u8 bssid[ETH_ALEN];
        bool assoc_bss = false;
@@ -2763,30 +2762,47 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                assoc_bss = true;
        } else {
                bool not_auth_yet = false;
+                struct ieee80211_work *tmp, *wk = NULL;
                mutex_unlock(&ifmgd->mtx);
                mutex_lock(&local->mtx);
-                list_for_each_entry(wk, &local->work_list, list) {
+                list_for_each_entry(tmp, &local->work_list, list) {
-                        if (wk->sdata != sdata)
+                        if (tmp->sdata != sdata)
                                continue;
-                        if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
+                        if (tmp->type != IEEE80211_WORK_DIRECT_PROBE &&
-                            wk->type != IEEE80211_WORK_AUTH &&
+                            tmp->type != IEEE80211_WORK_AUTH &&
-                            wk->type != IEEE80211_WORK_ASSOC &&
+                            tmp->type != IEEE80211_WORK_ASSOC &&
-                            wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
+                            tmp->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
                                continue;
-                        if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
+                        if (memcmp(req->bss->bssid, tmp->filter_ta, ETH_ALEN))
                                continue;
-                        not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE;
+                        not_auth_yet = tmp->type == IEEE80211_WORK_DIRECT_PROBE;
-                        list_del_rcu(&wk->list);
+                        list_del_rcu(&tmp->list);
-                        free_work(wk);
+                        synchronize_rcu();
+                        wk = tmp;
                        break;
                }
                mutex_unlock(&local->mtx);
+                if (wk && wk->type == IEEE80211_WORK_ASSOC) {
+                        /* clean up dummy sta & TX sync */
+                        sta_info_destroy_addr(wk->sdata, wk->filter_ta);
+                        if (wk->assoc.synced)
+                                drv_finish_tx_sync(local, wk->sdata,
+                                                   wk->filter_ta,
+                                                   IEEE80211_TX_SYNC_ASSOC);
+                } else if (wk && wk->type == IEEE80211_WORK_AUTH) {
+                        if (wk->probe_auth.synced)
+                                drv_finish_tx_sync(local, wk->sdata,
+                                                   wk->filter_ta,
+                                                   IEEE80211_TX_SYNC_AUTH);
+                }
+                kfree(wk);
                /*
                 * If somebody requests authentication and we haven't
                 * sent out an auth frame yet there's no need to send
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index bb6ad81b671d..424ff622ab5f 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -68,7 +68,6 @@ static int rds_release(struct socket *sock)
 {
        struct sock *sk = sock->sk;
        struct rds_sock *rs;
-        unsigned long flags;
        if (!sk)
                goto out;
@@ -94,10 +93,10 @@ static int rds_release(struct socket *sock)
        rds_rdma_drop_keys(rs);
        rds_notify_queue_get(rs, NULL);
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
        list_del_init(&rs->rs_item);
        rds_sock_count--;
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
        rds_trans_put(rs->rs_transport);
@@ -409,7 +408,6 @@ static const struct proto_ops rds_proto_ops = {
 static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
 {
-        unsigned long flags;
        struct rds_sock *rs;
        sock_init_data(sock, sk);
@@ -426,10 +424,10 @@ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
        spin_lock_init(&rs->rs_rdma_lock);
        rs->rs_rdma_keys = RB_ROOT;
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
        list_add_tail(&rs->rs_item, &rds_sock_list);
        rds_sock_count++;
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
        return 0;
 }
@@ -471,12 +469,11 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
 {
        struct rds_sock *rs;
        struct rds_incoming *inc;
-        unsigned long flags;
        unsigned int total = 0;
        len /= sizeof(struct rds_info_message);
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
        list_for_each_entry(rs, &rds_sock_list, rs_item) {
                read_lock(&rs->rs_recv_lock);
@@ -492,7 +489,7 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
                read_unlock(&rs->rs_recv_lock);
        }
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
        lens->nr = total;
        lens->each = sizeof(struct rds_info_message);
@@ -504,11 +501,10 @@ static void rds_sock_info(struct socket *sock, unsigned int len,
 {
        struct rds_info_socket sinfo;
        struct rds_sock *rs;
-        unsigned long flags;
        len /= sizeof(struct rds_info_socket);
-        spin_lock_irqsave(&rds_sock_lock, flags);
+        spin_lock_bh(&rds_sock_lock);
        if (len < rds_sock_count)
                goto out;
@@ -529,7 +525,7 @@ out:
        lens->nr = rds_sock_count;
        lens->each = sizeof(struct rds_info_socket);
-        spin_unlock_irqrestore(&rds_sock_lock, flags);
+        spin_unlock_bh(&rds_sock_lock);
 }
 static void rds_exit(void)
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index e7e1d0b57b3d..2776012132ea 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -419,7 +419,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        cb = netem_skb_cb(skb);
        if (q->gap == 0 ||              /* not doing reordering */
-            q->counter < q->gap ||      /* inside last reordering gap */
+            q->counter < q->gap - 1 ||  /* inside last reordering gap */
            q->reorder < get_crandom(&q->reorder_cor)) {
                psched_time_t now;
                psched_tdiff_t delay;
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index 1426ec3d0a53..75762f346975 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -92,6 +92,7 @@ generic_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
        if (gcred->acred.group_info != NULL)
                get_group_info(gcred->acred.group_info);
        gcred->acred.machine_cred = acred->machine_cred;
+        gcred->acred.principal = acred->principal;
        dprintk("RPC:       allocated %s cred %p for uid %d gid %d\n",
                        gcred->acred.machine_cred ? "machine" : "generic",
@@ -123,6 +124,17 @@ generic_destroy_cred(struct rpc_cred *cred)
        call_rcu(&cred->cr_rcu, generic_free_cred_callback);
 }
+static int
+machine_cred_match(struct auth_cred *acred, struct generic_cred *gcred, int flags)
+{
+        if (!gcred->acred.machine_cred ||
+            gcred->acred.principal != acred->principal ||
+            gcred->acred.uid != acred->uid ||
+            gcred->acred.gid != acred->gid)
+                return 0;
+        return 1;
+}
 /*
 * Match credentials against current process creds.
 */
@@ -132,9 +144,12 @@ generic_match(struct auth_cred *acred, struct rpc_cred *cred, int flags)
        struct generic_cred *gcred = container_of(cred, struct generic_cred, gc_base);
        int i;
+        if (acred->machine_cred)
+                return machine_cred_match(acred, gcred, flags);
        if (gcred->acred.uid != acred->uid ||
            gcred->acred.gid != acred->gid ||
-            gcred->acred.machine_cred != acred->machine_cred)
+            gcred->acred.machine_cred != 0)
                goto out_nomatch;
        /* Optimisation in the case where pointers are identical... */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index aad8fb699989..85d3bb7490aa 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1918,7 +1918,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                struct sk_buff *skb;
                unix_state_lock(sk);
-                skb = skb_dequeue(&sk->sk_receive_queue);
+                skb = skb_peek(&sk->sk_receive_queue);
                if (skb == NULL) {
                        unix_sk(sk)->recursion_level = 0;
                        if (copied >= target)
@@ -1958,11 +1958,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                if (check_creds) {
                        /* Never glue messages from different writers */
                        if ((UNIXCB(skb).pid  != siocb->scm->pid) ||
-                            (UNIXCB(skb).cred != siocb->scm->cred)) {
+                            (UNIXCB(skb).cred != siocb->scm->cred))
-                                skb_queue_head(&sk->sk_receive_queue, skb);
-                                sk->sk_data_ready(sk, skb->len);
                                break;
-                        }
                } else {
                        /* Copy credentials */
                        scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).cred);
@@ -1977,8 +1974,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                chunk = min_t(unsigned int, skb->len, size);
                if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
-                        skb_queue_head(&sk->sk_receive_queue, skb);
-                        sk->sk_data_ready(sk, skb->len);
                        if (copied == 0)
                                copied = -EFAULT;
                        break;
@@ -1993,13 +1988,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                        if (UNIXCB(skb).fp)
                                unix_detach_fds(siocb->scm, skb);
-                        /* put the skb back if we didn't use it up.. */
+                        if (skb->len)
-                        if (skb->len) {
-                                skb_queue_head(&sk->sk_receive_queue, skb);
-                                sk->sk_data_ready(sk, skb->len);
                                break;
-                        }
+                        skb_unlink(skb, &sk->sk_receive_queue);
                        consume_skb(skb);
                        if (siocb->scm->fp)
@@ -2010,9 +2002,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                        if (UNIXCB(skb).fp)
                                siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp);
-                        /* put message back and return */
-                        skb_queue_head(&sk->sk_receive_queue, skb);
-                        sk->sk_data_ready(sk, skb->len);
                        break;
                }
        } while (size);