Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
authorDavid S. Miller <davem@davemloft.net>
Fri, 31 Aug 2012 19:14:10 +0000 (15:14 -0400)
committerDavid S. Miller <davem@davemloft.net>
Fri, 31 Aug 2012 19:14:18 +0000 (15:14 -0400)
Merge the 'net' tree to get the recent set of netfilter bug fixes in
order to assist with some merge hassles Pablo is going to have to deal
with for upcoming changes.

Signed-off-by: David S. Miller <davem@davemloft.net>
20 files changed:
1  2 
drivers/net/ethernet/emulex/benet/be_cmds.c
drivers/net/ethernet/emulex/benet/be_main.c
drivers/net/ethernet/freescale/gianfar.c
drivers/net/ethernet/sfc/ethtool.c
drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
drivers/net/wireless/iwlwifi/dvm/debugfs.c
drivers/net/wireless/iwlwifi/pcie/internal.h
drivers/net/wireless/iwlwifi/pcie/rx.c
drivers/net/wireless/iwlwifi/pcie/trans.c
drivers/net/xen-netfront.c
fs/namei.c
net/core/netpoll.c
net/ipv4/ipmr.c
net/ipv4/route.c
net/ipv4/tcp_input.c
net/mac80211/tx.c
net/netfilter/ipvs/ip_vs_ctl.c
net/netfilter/nfnetlink_log.c
net/netlink/af_netlink.c
net/packet/af_packet.c

@@@ -120,7 -120,7 +120,7 @@@ static int be_mcc_compl_process(struct 
  
                if (compl_status == MCC_STATUS_UNAUTHORIZED_REQUEST) {
                        dev_warn(&adapter->pdev->dev,
 -                               "opcode %d-%d is not permitted\n",
 +                               "VF is not privileged to issue opcode %d-%d\n",
                                 opcode, subsystem);
                } else {
                        extd_status = (compl->status >> CQE_STATUS_EXTD_SHIFT) &
@@@ -259,7 -259,7 +259,7 @@@ int be_process_mcc(struct be_adapter *a
        int num = 0, status = 0;
        struct be_mcc_obj *mcc_obj = &adapter->mcc_obj;
  
-       spin_lock_bh(&adapter->mcc_cq_lock);
+       spin_lock(&adapter->mcc_cq_lock);
        while ((compl = be_mcc_compl_get(adapter))) {
                if (compl->flags & CQE_FLAGS_ASYNC_MASK) {
                        /* Interpret flags as an async trailer */
        if (num)
                be_cq_notify(adapter, mcc_obj->cq.id, mcc_obj->rearm_cq, num);
  
-       spin_unlock_bh(&adapter->mcc_cq_lock);
+       spin_unlock(&adapter->mcc_cq_lock);
        return status;
  }
  
@@@ -295,7 -295,9 +295,9 @@@ static int be_mcc_wait_compl(struct be_
                if (be_error(adapter))
                        return -EIO;
  
+               local_bh_disable();
                status = be_process_mcc(adapter);
+               local_bh_enable();
  
                if (atomic_read(&mcc_obj->q.used) == 0)
                        break;
@@@ -2176,7 -2176,8 +2176,7 @@@ static uint be_num_rss_want(struct be_a
  {
        u32 num = 0;
        if ((adapter->function_caps & BE_FUNCTION_CAPS_RSS) &&
 -           !sriov_want(adapter) && be_physfn(adapter) &&
 -           !be_is_mc(adapter)) {
 +           !sriov_want(adapter) && be_physfn(adapter)) {
                num = (adapter->be3_native) ? BE3_MAX_RSS_QS : BE2_MAX_RSS_QS;
                num = min_t(u32, num, (u32)netif_get_num_default_rss_queues());
        }
@@@ -2645,8 -2646,8 +2645,8 @@@ static int be_vf_setup(struct be_adapte
        }
  
        for_all_vfs(adapter, vf_cfg, vf) {
 -              status = be_cmd_link_status_query(adapter, NULL, &lnk_speed,
 -                                                NULL, vf + 1);
 +              lnk_speed = 1000;
 +              status = be_cmd_set_qos(adapter, lnk_speed, vf + 1);
                if (status)
                        goto err;
                vf_cfg->tx_rate = lnk_speed * 10;
@@@ -2723,8 -2724,6 +2723,8 @@@ static int be_get_config(struct be_adap
        if (pos) {
                pci_read_config_word(adapter->pdev, pos + PCI_SRIOV_TOTAL_VF,
                                     &dev_num_vfs);
 +              if (!lancer_chip(adapter))
 +                      dev_num_vfs = min_t(u16, dev_num_vfs, MAX_VFS);
                adapter->dev_num_vfs = dev_num_vfs;
        }
        return 0;
@@@ -3438,7 -3437,6 +3438,7 @@@ static void be_ctrl_cleanup(struct be_a
        if (mem->va)
                dma_free_coherent(&adapter->pdev->dev, mem->size, mem->va,
                                  mem->dma);
 +      kfree(adapter->pmac_id);
  }
  
  static int be_ctrl_init(struct be_adapter *adapter)
        }
        memset(rx_filter->va, 0, rx_filter->size);
  
 +      /* primary mac needs 1 pmac entry */
 +      adapter->pmac_id = kcalloc(adapter->max_pmac_cnt + 1,
 +                                 sizeof(*adapter->pmac_id), GFP_KERNEL);
 +      if (!adapter->pmac_id)
 +              return -ENOMEM;
 +
        mutex_init(&adapter->mbox_lock);
        spin_lock_init(&adapter->mcc_lock);
        spin_lock_init(&adapter->mcc_cq_lock);
@@@ -3617,6 -3609,12 +3617,6 @@@ static int be_get_initial_config(struc
        else
                adapter->max_pmac_cnt = BE_VF_UC_PMAC_COUNT;
  
 -      /* primary mac needs 1 pmac entry */
 -      adapter->pmac_id = kcalloc(adapter->max_pmac_cnt + 1,
 -                                sizeof(u32), GFP_KERNEL);
 -      if (!adapter->pmac_id)
 -              return -ENOMEM;
 -
        status = be_cmd_get_cntl_attributes(adapter);
        if (status)
                return status;
@@@ -3765,7 -3763,9 +3765,9 @@@ static void be_worker(struct work_struc
        /* when interrupts are not yet enabled, just reap any pending
        * mcc completions */
        if (!netif_running(adapter->netdev)) {
+               local_bh_disable();
                be_process_mcc(adapter);
+               local_bh_enable();
                goto reschedule;
        }
  
  #include <linux/of_net.h>
  
  #include "gianfar.h"
 -#include "fsl_pq_mdio.h"
  
  #define TX_TIMEOUT      (1*HZ)
  
@@@ -1040,7 -1041,7 +1040,7 @@@ static int gfar_probe(struct platform_d
  
        if (priv->device_flags & FSL_GIANFAR_DEV_HAS_VLAN) {
                dev->hw_features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
-               dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
+               dev->features |= NETIF_F_HW_VLAN_RX;
        }
  
        if (priv->device_flags & FSL_GIANFAR_DEV_HAS_EXTENDED_HASH) {
@@@ -529,7 -529,9 +529,7 @@@ static void efx_ethtool_self_test(struc
        if (!efx_tests)
                goto fail;
  
 -
 -      ASSERT_RTNL();
 -      if (efx->state != STATE_RUNNING) {
 +      if (efx->state != STATE_READY) {
                rc = -EIO;
                goto fail1;
        }
@@@ -861,8 -863,8 +861,8 @@@ static int efx_ethtool_get_class_rule(s
                                       &ip_entry->ip4dst, &ip_entry->pdst);
        if (rc != 0) {
                rc = efx_filter_get_ipv4_full(
-                       &spec, &proto, &ip_entry->ip4src, &ip_entry->psrc,
-                       &ip_entry->ip4dst, &ip_entry->pdst);
+                       &spec, &proto, &ip_entry->ip4dst, &ip_entry->pdst,
+                       &ip_entry->ip4src, &ip_entry->psrc);
                EFX_WARN_ON_PARANOID(rc);
                ip_mask->ip4src = ~0;
                ip_mask->psrc = ~0;
@@@ -86,9 -86,7 +86,9 @@@ MODULE_AUTHOR("Broadcom Corporation")
  MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN driver.");
  MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN cards");
  MODULE_LICENSE("Dual BSD/GPL");
 -
 +/* This needs to be adjusted when brcms_firmwares changes */
 +MODULE_FIRMWARE("brcm/bcm43xx-0.fw");
 +MODULE_FIRMWARE("brcm/bcm43xx_hdr-0.fw");
  
  /* recognized BCMA Core IDs */
  static struct bcma_device_id brcms_coreid_table[] = {
@@@ -267,9 -265,7 +267,9 @@@ static void brcms_set_basic_rate(struc
        }
  }
  
 -static void brcms_ops_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 +static void brcms_ops_tx(struct ieee80211_hw *hw,
 +                       struct ieee80211_tx_control *control,
 +                       struct sk_buff *skb)
  {
        struct brcms_info *wl = hw->priv;
        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
                goto done;
        }
        brcms_c_sendpkt_mac80211(wl->wlc, skb, hw);
 -      tx_info->rate_driver_data[0] = tx_info->control.sta;
 +      tx_info->rate_driver_data[0] = control->sta;
   done:
        spin_unlock_bh(&wl->lock);
  }
@@@ -1237,6 -1233,9 +1237,9 @@@ uint brcms_reset(struct brcms_info *wl
        /* dpc will not be rescheduled */
        wl->resched = false;
  
+       /* inform publicly that interface is down */
+       wl->pub->up = false;
        return 0;
  }
  
@@@ -124,6 -124,9 +124,9 @@@ static ssize_t iwl_dbgfs_sram_read(stru
        const struct fw_img *img;
        size_t bufsz;
  
+       if (!iwl_is_ready_rf(priv))
+               return -EAGAIN;
        /* default is to dump the entire data segment */
        if (!priv->dbgfs_sram_offset && !priv->dbgfs_sram_len) {
                priv->dbgfs_sram_offset = 0x800000;
@@@ -2349,19 -2352,24 +2352,19 @@@ DEBUGFS_READ_WRITE_FILE_OPS(calib_disab
   * Create the debugfs files and directories
   *
   */
 -int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
 +int iwl_dbgfs_register(struct iwl_priv *priv, struct dentry *dbgfs_dir)
  {
 -      struct dentry *phyd = priv->hw->wiphy->debugfsdir;
 -      struct dentry *dir_drv, *dir_data, *dir_rf, *dir_debug;
 +      struct dentry *dir_data, *dir_rf, *dir_debug;
  
 -      dir_drv = debugfs_create_dir(name, phyd);
 -      if (!dir_drv)
 -              return -ENOMEM;
 -
 -      priv->debugfs_dir = dir_drv;
 +      priv->debugfs_dir = dbgfs_dir;
  
 -      dir_data = debugfs_create_dir("data", dir_drv);
 +      dir_data = debugfs_create_dir("data", dbgfs_dir);
        if (!dir_data)
                goto err;
 -      dir_rf = debugfs_create_dir("rf", dir_drv);
 +      dir_rf = debugfs_create_dir("rf", dbgfs_dir);
        if (!dir_rf)
                goto err;
 -      dir_debug = debugfs_create_dir("debug", dir_drv);
 +      dir_debug = debugfs_create_dir("debug", dbgfs_dir);
        if (!dir_debug)
                goto err;
  
        /* Calibrations disabled/enabled status*/
        DEBUGFS_ADD_FILE(calib_disabled, dir_rf, S_IWUSR | S_IRUSR);
  
 -      if (iwl_trans_dbgfs_register(priv->trans, dir_debug))
 -              goto err;
 +      /*
 +       * Create a symlink with mac80211. This is not very robust, as it does
 +       * not remove the symlink created. The implicit assumption is that
 +       * when the opmode exits, mac80211 will also exit, and will remove
 +       * this symlink as part of its cleanup.
 +       */
 +      if (priv->mac80211_registered) {
 +              char buf[100];
 +              struct dentry *mac80211_dir, *dev_dir, *root_dir;
 +
 +              dev_dir = dbgfs_dir->d_parent;
 +              root_dir = dev_dir->d_parent;
 +              mac80211_dir = priv->hw->wiphy->debugfsdir;
 +
 +              snprintf(buf, 100, "../../%s/%s", root_dir->d_name.name,
 +                       dev_dir->d_name.name);
 +
 +              if (!debugfs_create_symlink("iwlwifi", mac80211_dir, buf))
 +                      goto err;
 +      }
 +
        return 0;
  
  err:
 -      IWL_ERR(priv, "Can't create the debugfs directory\n");
 -      iwl_dbgfs_unregister(priv);
 +      IWL_ERR(priv, "failed to create the dvm debugfs entries\n");
        return -ENOMEM;
  }
 -
 -/**
 - * Remove the debugfs files and directories
 - *
 - */
 -void iwl_dbgfs_unregister(struct iwl_priv *priv)
 -{
 -      if (!priv->debugfs_dir)
 -              return;
 -
 -      debugfs_remove_recursive(priv->debugfs_dir);
 -      priv->debugfs_dir = NULL;
 -}
@@@ -184,7 -184,6 +184,7 @@@ struct iwl_queue 
  
  struct iwl_pcie_tx_queue_entry {
        struct iwl_device_cmd *cmd;
 +      struct iwl_device_cmd *copy_cmd;
        struct sk_buff *skb;
        struct iwl_cmd_meta meta;
  };
@@@ -351,7 -350,7 +351,7 @@@ int iwl_queue_space(const struct iwl_qu
  /*****************************************************
  * Error handling
  ******************************************************/
- int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display);
+ int iwl_dump_fh(struct iwl_trans *trans, char **buf);
  void iwl_dump_csr(struct iwl_trans *trans);
  
  /*****************************************************
@@@ -421,23 -421,13 +421,23 @@@ static void iwl_rx_handle_rxbuf(struct 
                index = SEQ_TO_INDEX(sequence);
                cmd_index = get_cmd_index(&txq->q, index);
  
 -              if (reclaim)
 -                      cmd = txq->entries[cmd_index].cmd;
 -              else
 +              if (reclaim) {
 +                      struct iwl_pcie_tx_queue_entry *ent;
 +                      ent = &txq->entries[cmd_index];
 +                      cmd = ent->copy_cmd;
 +                      WARN_ON_ONCE(!cmd && ent->meta.flags & CMD_WANT_HCMD);
 +              } else {
                        cmd = NULL;
 +              }
  
                err = iwl_op_mode_rx(trans->op_mode, &rxcb, cmd);
  
 +              if (reclaim) {
 +                      /* The original command isn't needed any more */
 +                      kfree(txq->entries[cmd_index].copy_cmd);
 +                      txq->entries[cmd_index].copy_cmd = NULL;
 +              }
 +
                /*
                 * After here, we should always check rxcb._page_stolen,
                 * if it is true then one of the handlers took the page.
@@@ -565,7 -555,7 +565,7 @@@ static void iwl_irq_handle_error(struc
        }
  
        iwl_dump_csr(trans);
-       iwl_dump_fh(trans, NULL, false);
+       iwl_dump_fh(trans, NULL);
  
        iwl_op_mode_nic_error(trans->op_mode);
  }
@@@ -492,11 -492,10 +492,11 @@@ static void iwl_tx_queue_free(struct iw
        iwl_tx_queue_unmap(trans, txq_id);
  
        /* De-alloc array of command/tx buffers */
 -
        if (txq_id == trans_pcie->cmd_queue)
 -              for (i = 0; i < txq->q.n_window; i++)
 +              for (i = 0; i < txq->q.n_window; i++) {
                        kfree(txq->entries[i].cmd);
 +                      kfree(txq->entries[i].copy_cmd);
 +              }
  
        /* De-alloc circular buffer of TFDs */
        if (txq->q.n_bd) {
@@@ -897,7 -896,6 +897,7 @@@ static int iwl_set_hw_ready(struct iwl_
  static int iwl_prepare_card_hw(struct iwl_trans *trans)
  {
        int ret;
 +      int t = 0;
  
        IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
  
        iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
                    CSR_HW_IF_CONFIG_REG_PREPARE);
  
 -      ret = iwl_poll_bit(trans, CSR_HW_IF_CONFIG_REG,
 -                         ~CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE,
 -                         CSR_HW_IF_CONFIG_REG_BIT_NIC_PREPARE_DONE, 150000);
 +      do {
 +              ret = iwl_set_hw_ready(trans);
 +              if (ret >= 0)
 +                      return 0;
  
 -      if (ret < 0)
 -              return ret;
 +              usleep_range(200, 1000);
 +              t += 200;
 +      } while (t < 150000);
  
 -      /* HW should be ready by now, check again. */
 -      ret = iwl_set_hw_ready(trans);
 -      if (ret >= 0)
 -              return 0;
        return ret;
  }
  
@@@ -1649,13 -1649,9 +1649,9 @@@ static const char *get_fh_string(int cm
  #undef IWL_CMD
  }
  
- int iwl_dump_fh(struct iwl_trans *trans, char **buf, bool display)
+ int iwl_dump_fh(struct iwl_trans *trans, char **buf)
  {
        int i;
- #ifdef CONFIG_IWLWIFI_DEBUG
-       int pos = 0;
-       size_t bufsz = 0;
- #endif
        static const u32 fh_tbl[] = {
                FH_RSCSR_CHNL0_STTS_WPTR_REG,
                FH_RSCSR_CHNL0_RBDCB_BASE_REG,
                FH_TSSR_TX_STATUS_REG,
                FH_TSSR_TX_ERROR_REG
        };
- #ifdef CONFIG_IWLWIFI_DEBUG
-       if (display) {
-               bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+       if (buf) {
+               int pos = 0;
+               size_t bufsz = ARRAY_SIZE(fh_tbl) * 48 + 40;
                *buf = kmalloc(bufsz, GFP_KERNEL);
                if (!*buf)
                        return -ENOMEM;
                pos += scnprintf(*buf + pos, bufsz - pos,
                                "FH register values:\n");
-               for (i = 0; i < ARRAY_SIZE(fh_tbl); i++) {
+               for (i = 0; i < ARRAY_SIZE(fh_tbl); i++)
                        pos += scnprintf(*buf + pos, bufsz - pos,
                                "  %34s: 0X%08x\n",
                                get_fh_string(fh_tbl[i]),
                                iwl_read_direct32(trans, fh_tbl[i]));
-               }
                return pos;
        }
  #endif
        IWL_ERR(trans, "FH register values:\n");
-       for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++) {
+       for (i = 0; i <  ARRAY_SIZE(fh_tbl); i++)
                IWL_ERR(trans, "  %34s: 0X%08x\n",
                        get_fh_string(fh_tbl[i]),
                        iwl_read_direct32(trans, fh_tbl[i]));
-       }
        return 0;
  }
  
@@@ -1769,7 -1771,7 +1771,7 @@@ void iwl_dump_csr(struct iwl_trans *tra
  #define DEBUGFS_ADD_FILE(name, parent, mode) do {                     \
        if (!debugfs_create_file(#name, mode, parent, trans,            \
                                 &iwl_dbgfs_##name##_ops))              \
 -              return -ENOMEM;                                         \
 +              goto err;                                               \
  } while (0)
  
  /* file operation */
@@@ -1982,11 -1984,11 +1984,11 @@@ static ssize_t iwl_dbgfs_fh_reg_read(st
                                     size_t count, loff_t *ppos)
  {
        struct iwl_trans *trans = file->private_data;
-       char *buf;
+       char *buf = NULL;
        int pos = 0;
        ssize_t ret = -EFAULT;
  
-       ret = pos = iwl_dump_fh(trans, &buf, true);
+       ret = pos = iwl_dump_fh(trans, &buf);
        if (buf) {
                ret = simple_read_from_buffer(user_buf,
                                              count, ppos, buf, pos);
@@@ -2033,10 -2035,6 +2035,10 @@@ static int iwl_trans_pcie_dbgfs_registe
        DEBUGFS_ADD_FILE(fh_reg, dir, S_IRUSR);
        DEBUGFS_ADD_FILE(fw_restart, dir, S_IWUSR);
        return 0;
 +
 +err:
 +      IWL_ERR(trans, "failed to create the trans debugfs entry\n");
 +      return -ENOMEM;
  }
  #else
  static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
@@@ -57,8 -57,7 +57,7 @@@
  static const struct ethtool_ops xennet_ethtool_ops;
  
  struct netfront_cb {
-       struct page *page;
-       unsigned offset;
+       int pull_to;
  };
  
  #define NETFRONT_SKB_CB(skb)  ((struct netfront_cb *)((skb)->cb))
@@@ -867,15 -866,9 +866,9 @@@ static int handle_incoming_queue(struc
        struct sk_buff *skb;
  
        while ((skb = __skb_dequeue(rxq)) != NULL) {
-               struct page *page = NETFRONT_SKB_CB(skb)->page;
-               void *vaddr = page_address(page);
-               unsigned offset = NETFRONT_SKB_CB(skb)->offset;
-               memcpy(skb->data, vaddr + offset,
-                      skb_headlen(skb));
+               int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
  
-               if (page != skb_frag_page(&skb_shinfo(skb)->frags[0]))
-                       __free_page(page);
+               __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
  
                /* Ethernet work: Delayed to here as it peeks the header. */
                skb->protocol = eth_type_trans(skb, dev);
@@@ -913,7 -906,6 +906,6 @@@ static int xennet_poll(struct napi_stru
        struct sk_buff_head errq;
        struct sk_buff_head tmpq;
        unsigned long flags;
-       unsigned int len;
        int err;
  
        spin_lock(&np->rx_lock);
@@@ -955,24 -947,13 +947,13 @@@ err
                        }
                }
  
-               NETFRONT_SKB_CB(skb)->page =
-                       skb_frag_page(&skb_shinfo(skb)->frags[0]);
-               NETFRONT_SKB_CB(skb)->offset = rx->offset;
-               len = rx->status;
-               if (len > RX_COPY_THRESHOLD)
-                       len = RX_COPY_THRESHOLD;
-               skb_put(skb, len);
+               NETFRONT_SKB_CB(skb)->pull_to = rx->status;
+               if (NETFRONT_SKB_CB(skb)->pull_to > RX_COPY_THRESHOLD)
+                       NETFRONT_SKB_CB(skb)->pull_to = RX_COPY_THRESHOLD;
  
-               if (rx->status > len) {
-                       skb_shinfo(skb)->frags[0].page_offset =
-                               rx->offset + len;
-                       skb_frag_size_set(&skb_shinfo(skb)->frags[0], rx->status - len);
-                       skb->data_len = rx->status - len;
-               } else {
-                       __skb_fill_page_desc(skb, 0, NULL, 0, 0);
-                       skb_shinfo(skb)->nr_frags = 0;
-               }
+               skb_shinfo(skb)->frags[0].page_offset = rx->offset;
+               skb_frag_size_set(&skb_shinfo(skb)->frags[0], rx->status);
+               skb->data_len = rx->status;
  
                i = xennet_fill_frags(np, skb, &tmpq);
  
                 * receive throughout using the standard receive
                 * buffer size was cut by 25%(!!!).
                 */
-               skb->truesize += skb->data_len - (RX_COPY_THRESHOLD - len);
+               skb->truesize += skb->data_len - RX_COPY_THRESHOLD;
                skb->len += skb->data_len;
  
                if (rx->flags & XEN_NETRXF_csum_blank)
@@@ -1731,7 -1712,7 +1712,7 @@@ static void netback_changed(struct xenb
                break;
  
        case XenbusStateConnected:
 -              netif_notify_peers(netdev);
 +              netdev_notify_peers(netdev);
                break;
  
        case XenbusStateClosing:
diff --combined fs/namei.c
@@@ -352,6 -352,7 +352,7 @@@ int __inode_permission(struct inode *in
  /**
   * sb_permission - Check superblock-level permissions
   * @sb: Superblock of inode to check permission on
+  * @inode: Inode to check permission on
   * @mask: Right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
   *
   * Separate out file-system wide checks from inode-specific permission checks.
@@@ -656,6 -657,7 +657,7 @@@ int sysctl_protected_hardlinks __read_m
  /**
   * may_follow_link - Check symlink following for unsafe situations
   * @link: The path of the symlink
+  * @nd: nameidata pathwalk data
   *
   * In the case of the sysctl_protected_symlinks sysctl being enabled,
   * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
@@@ -678,7 -680,7 +680,7 @@@ static inline int may_follow_link(struc
  
        /* Allowed if owner and follower match. */
        inode = link->dentry->d_inode;
 -      if (current_cred()->fsuid == inode->i_uid)
 +      if (uid_eq(current_cred()->fsuid, inode->i_uid))
                return 0;
  
        /* Allowed if parent directory not sticky and world-writable. */
                return 0;
  
        /* Allowed if parent directory and link owner match. */
 -      if (parent->i_uid == inode->i_uid)
 +      if (uid_eq(parent->i_uid, inode->i_uid))
                return 0;
  
        path_put_conditional(link, nd);
@@@ -757,7 -759,7 +759,7 @@@ static int may_linkat(struct path *link
        /* Source inode owner (or CAP_FOWNER) can hardlink all they like,
         * otherwise, it must be a safe source.
         */
 -      if (cred->fsuid == inode->i_uid || safe_hardlink_source(inode) ||
 +      if (uid_eq(cred->fsuid, inode->i_uid) || safe_hardlink_source(inode) ||
            capable(CAP_FOWNER))
                return 0;
  
diff --combined net/core/netpoll.c
@@@ -168,24 -168,16 +168,16 @@@ static void poll_napi(struct net_devic
        struct napi_struct *napi;
        int budget = 16;
  
-       WARN_ON_ONCE(!irqs_disabled());
        list_for_each_entry(napi, &dev->napi_list, dev_list) {
-               local_irq_enable();
                if (napi->poll_owner != smp_processor_id() &&
                    spin_trylock(&napi->poll_lock)) {
-                       rcu_read_lock_bh();
                        budget = poll_one_napi(rcu_dereference_bh(dev->npinfo),
                                               napi, budget);
-                       rcu_read_unlock_bh();
                        spin_unlock(&napi->poll_lock);
  
-                       if (!budget) {
-                               local_irq_disable();
+                       if (!budget)
                                break;
-                       }
                }
-               local_irq_disable();
        }
  }
  
@@@ -388,7 -380,6 +380,7 @@@ void netpoll_send_udp(struct netpoll *n
        struct udphdr *udph;
        struct iphdr *iph;
        struct ethhdr *eth;
 +      static atomic_t ip_ident;
  
        udp_len = len + sizeof(*udph);
        ip_len = udp_len + sizeof(*iph);
        put_unaligned(0x45, (unsigned char *)iph);
        iph->tos      = 0;
        put_unaligned(htons(ip_len), &(iph->tot_len));
 -      iph->id       = 0;
 +      iph->id       = htons(atomic_inc_return(&ip_ident));
        iph->frag_off = 0;
        iph->ttl      = 64;
        iph->protocol = IPPROTO_UDP;
diff --combined net/ipv4/ipmr.c
@@@ -124,6 -124,8 +124,8 @@@ static DEFINE_SPINLOCK(mfc_unres_lock)
  static struct kmem_cache *mrt_cachep __read_mostly;
  
  static struct mr_table *ipmr_new_table(struct net *net, u32 id);
+ static void ipmr_free_table(struct mr_table *mrt);
  static int ip_mr_forward(struct net *net, struct mr_table *mrt,
                         struct sk_buff *skb, struct mfc_cache *cache,
                         int local);
@@@ -131,6 -133,7 +133,7 @@@ static int ipmr_cache_report(struct mr_
                             struct sk_buff *pkt, vifi_t vifi, int assert);
  static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
                              struct mfc_cache *c, struct rtmsg *rtm);
+ static void mroute_clean_tables(struct mr_table *mrt);
  static void ipmr_expire_process(unsigned long arg);
  
  #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
@@@ -271,7 -274,7 +274,7 @@@ static void __net_exit ipmr_rules_exit(
  
        list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
                list_del(&mrt->list);
-               kfree(mrt);
+               ipmr_free_table(mrt);
        }
        fib_rules_unregister(net->ipv4.mr_rules_ops);
  }
@@@ -299,7 -302,7 +302,7 @@@ static int __net_init ipmr_rules_init(s
  
  static void __net_exit ipmr_rules_exit(struct net *net)
  {
-       kfree(net->ipv4.mrt);
+       ipmr_free_table(net->ipv4.mrt);
  }
  #endif
  
@@@ -336,6 -339,13 +339,13 @@@ static struct mr_table *ipmr_new_table(
        return mrt;
  }
  
+ static void ipmr_free_table(struct mr_table *mrt)
+ {
+       del_timer_sync(&mrt->ipmr_expire_timer);
+       mroute_clean_tables(mrt);
+       kfree(mrt);
+ }
  /* Service routines creating virtual interfaces: DVMRP tunnels and PIMREG */
  
  static void ipmr_del_tunnel(struct net_device *dev, struct vifctl *v)
@@@ -1798,7 -1808,7 +1808,7 @@@ static struct mr_table *ipmr_rt_fib_loo
                .flowi4_oif = (rt_is_output_route(rt) ?
                               skb->dev->ifindex : 0),
                .flowi4_iif = (rt_is_output_route(rt) ?
 -                             net->loopback_dev->ifindex :
 +                             LOOPBACK_IFINDEX :
                               skb->dev->ifindex),
                .flowi4_mark = skb->mark,
        };
diff --combined net/ipv4/route.c
@@@ -934,12 -934,14 +934,14 @@@ static u32 __ip_rt_update_pmtu(struct r
        if (mtu < ip_rt_min_pmtu)
                mtu = ip_rt_min_pmtu;
  
+       rcu_read_lock();
        if (fib_lookup(dev_net(rt->dst.dev), fl4, &res) == 0) {
                struct fib_nh *nh = &FIB_RES_NH(res);
  
                update_or_create_fnhe(nh, fl4->daddr, 0, mtu,
                                      jiffies + ip_rt_mtu_expires);
        }
+       rcu_read_unlock();
        return mtu;
  }
  
@@@ -956,7 -958,7 +958,7 @@@ static void ip_rt_update_pmtu(struct ds
                dst->obsolete = DST_OBSOLETE_KILL;
        } else {
                rt->rt_pmtu = mtu;
-               dst_set_expires(&rt->dst, ip_rt_mtu_expires);
+               rt->dst.expires = max(1UL, jiffies + ip_rt_mtu_expires);
        }
  }
  
@@@ -1263,7 -1265,7 +1265,7 @@@ static void ipv4_dst_destroy(struct dst
  {
        struct rtable *rt = (struct rtable *) dst;
  
-       if (dst->flags & DST_NOCACHE) {
+       if (!list_empty(&rt->rt_uncached)) {
                spin_lock_bh(&rt_uncached_lock);
                list_del(&rt->rt_uncached);
                spin_unlock_bh(&rt_uncached_lock);
@@@ -1587,14 -1589,11 +1589,14 @@@ static int ip_route_input_slow(struct s
        if (ipv4_is_zeronet(daddr))
                goto martian_destination;
  
 -      if (likely(!IN_DEV_ROUTE_LOCALNET(in_dev))) {
 -              if (ipv4_is_loopback(daddr))
 +      /* Following code try to avoid calling IN_DEV_NET_ROUTE_LOCALNET(),
 +       * and call it once if daddr or/and saddr are loopback addresses
 +       */
 +      if (ipv4_is_loopback(daddr)) {
 +              if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
                        goto martian_destination;
 -
 -              if (ipv4_is_loopback(saddr))
 +      } else if (ipv4_is_loopback(saddr)) {
 +              if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
                        goto martian_source;
        }
  
  
        if (res.type == RTN_LOCAL) {
                err = fib_validate_source(skb, saddr, daddr, tos,
 -                                        net->loopback_dev->ifindex,
 +                                        LOOPBACK_IFINDEX,
                                          dev, in_dev, &itag);
                if (err < 0)
                        goto martian_source_keep_err;
@@@ -1895,7 -1894,7 +1897,7 @@@ struct rtable *__ip_route_output_key(st
  
        orig_oif = fl4->flowi4_oif;
  
 -      fl4->flowi4_iif = net->loopback_dev->ifindex;
 +      fl4->flowi4_iif = LOOPBACK_IFINDEX;
        fl4->flowi4_tos = tos & IPTOS_RT_MASK;
        fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
                         RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
                if (!fl4->daddr)
                        fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
                dev_out = net->loopback_dev;
 -              fl4->flowi4_oif = net->loopback_dev->ifindex;
 +              fl4->flowi4_oif = LOOPBACK_IFINDEX;
                res.type = RTN_LOCAL;
                flags |= RTCF_LOCAL;
                goto make_route;
diff --combined net/ipv4/tcp_input.c
@@@ -237,11 -237,7 +237,11 @@@ static inline void TCP_ECN_check_ce(str
                        tcp_enter_quickack_mode((struct sock *)tp);
                break;
        case INET_ECN_CE:
 -              tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
 +              if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
 +                      /* Better not delay acks, sender can have a very low cwnd */
 +                      tcp_enter_quickack_mode((struct sock *)tp);
 +                      tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
 +              }
                /* fallinto */
        default:
                tp->ecn_flags |= TCP_ECN_SEEN;
@@@ -2930,13 -2926,14 +2930,14 @@@ static void tcp_enter_recovery(struct s
   * tcp_xmit_retransmit_queue().
   */
  static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
-                                 int newly_acked_sacked, bool is_dupack,
+                                 int prior_sacked, bool is_dupack,
                                  int flag)
  {
        struct inet_connection_sock *icsk = inet_csk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
        int do_lost = is_dupack || ((flag & FLAG_DATA_SACKED) &&
                                    (tcp_fackets_out(tp) > tp->reordering));
+       int newly_acked_sacked = 0;
        int fast_rexmit = 0;
  
        if (WARN_ON(!tp->packets_out && tp->sacked_out))
                                tcp_add_reno_sack(sk);
                } else
                        do_lost = tcp_try_undo_partial(sk, pkts_acked);
+               newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;
                break;
        case TCP_CA_Loss:
                if (flag & FLAG_DATA_ACKED)
                        if (is_dupack)
                                tcp_add_reno_sack(sk);
                }
+               newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;
  
                if (icsk->icsk_ca_state <= TCP_CA_Disorder)
                        tcp_try_undo_dsack(sk);
@@@ -3594,7 -3593,6 +3597,6 @@@ static int tcp_ack(struct sock *sk, con
        int prior_packets;
        int prior_sacked = tp->sacked_out;
        int pkts_acked = 0;
-       int newly_acked_sacked = 0;
        bool frto_cwnd = false;
  
        /* If the ack is older than previous acks
        flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una);
  
        pkts_acked = prior_packets - tp->packets_out;
-       newly_acked_sacked = (prior_packets - prior_sacked) -
-                            (tp->packets_out - tp->sacked_out);
  
        if (tp->frto_counter)
                frto_cwnd = tcp_process_frto(sk, flag);
                    tcp_may_raise_cwnd(sk, flag))
                        tcp_cong_avoid(sk, ack, prior_in_flight);
                is_dupack = !(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP));
-               tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
+               tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
                                      is_dupack, flag);
        } else {
                if ((flag & FLAG_DATA_ACKED) && !frto_cwnd)
  no_queue:
        /* If data was DSACKed, see if we can undo a cwnd reduction. */
        if (flag & FLAG_DSACKING_ACK)
-               tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
+               tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
                                      is_dupack, flag);
        /* If this ack opens up a zero window, clear backoff.  It was
         * being used to time the probes, and is probably far higher than
@@@ -3722,8 -3718,7 +3722,7 @@@ old_ack
         */
        if (TCP_SKB_CB(skb)->sacked) {
                flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una);
-               newly_acked_sacked = tp->sacked_out - prior_sacked;
-               tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
+               tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
                                      is_dupack, flag);
        }
  
@@@ -5746,7 -5741,7 +5745,7 @@@ static int tcp_rcv_synsent_state_proces
  
                TCP_ECN_rcv_synack(tp, th);
  
 -              tp->snd_wl1 = TCP_SKB_CB(skb)->seq;
 +              tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
                tcp_ack(sk, skb, FLAG_SLOWPATH);
  
                /* Ok.. it's good. Set up sequence numbers and
                 * never scaled.
                 */
                tp->snd_wnd = ntohs(th->window);
 -              tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
  
                if (!tp->rx_opt.wscale_ok) {
                        tp->rx_opt.snd_wscale = tp->rx_opt.rcv_wscale = 0;
diff --combined net/mac80211/tx.c
@@@ -55,7 -55,7 +55,7 @@@ static __le16 ieee80211_duration(struc
        if (WARN_ON_ONCE(info->control.rates[0].idx < 0))
                return 0;
  
 -      sband = local->hw.wiphy->bands[tx->channel->band];
 +      sband = local->hw.wiphy->bands[info->band];
        txrate = &sband->bitrates[info->control.rates[0].idx];
  
        erp = txrate->flags & IEEE80211_RATE_ERP_G;
@@@ -615,7 -615,7 +615,7 @@@ ieee80211_tx_h_rate_ctrl(struct ieee802
  
        memset(&txrc, 0, sizeof(txrc));
  
 -      sband = tx->local->hw.wiphy->bands[tx->channel->band];
 +      sband = tx->local->hw.wiphy->bands[info->band];
  
        len = min_t(u32, tx->skb->len + FCS_LEN,
                         tx->local->hw.wiphy->frag_threshold);
        txrc.bss_conf = &tx->sdata->vif.bss_conf;
        txrc.skb = tx->skb;
        txrc.reported_rate.idx = -1;
 -      txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[tx->channel->band];
 +      txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
        if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
                txrc.max_rate_idx = -1;
        else
                txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
        memcpy(txrc.rate_idx_mcs_mask,
 -             tx->sdata->rc_rateidx_mcs_mask[tx->channel->band],
 +             tx->sdata->rc_rateidx_mcs_mask[info->band],
               sizeof(txrc.rate_idx_mcs_mask));
        txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
                    tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
                 "scanning and associated. Target station: "
                 "%pM on %d GHz band\n",
                 tx->sdata->name, hdr->addr1,
 -               tx->channel->band ? 5 : 2))
 +               info->band ? 5 : 2))
                return TX_DROP;
  
        /*
@@@ -1131,6 -1131,7 +1131,6 @@@ ieee80211_tx_prepare(struct ieee80211_s
        tx->skb = skb;
        tx->local = local;
        tx->sdata = sdata;
 -      tx->channel = local->hw.conf.channel;
        __skb_queue_head_init(&tx->skbs);
  
        /*
@@@ -1203,7 -1204,6 +1203,7 @@@ static bool ieee80211_tx_frags(struct i
                               struct sk_buff_head *skbs,
                               bool txpending)
  {
 +      struct ieee80211_tx_control control;
        struct sk_buff *skb, *tmp;
        unsigned long flags;
  
                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
  
                info->control.vif = vif;
 -              info->control.sta = sta;
 +              control.sta = sta;
  
                __skb_unlink(skb, skbs);
 -              drv_tx(local, skb);
 +              drv_tx(local, &control, skb);
        }
  
        return true;
@@@ -1399,7 -1399,8 +1399,7 @@@ static bool ieee80211_tx(struct ieee802
                goto out;
        }
  
 -      tx.channel = local->hw.conf.channel;
 -      info->band = tx.channel->band;
 +      info->band = local->hw.conf.channel->band;
  
        /* set up hw_queue value early */
        if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
@@@ -1719,7 -1720,7 +1719,7 @@@ netdev_tx_t ieee80211_subif_start_xmit(
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        struct ieee80211_local *local = sdata->local;
        struct ieee80211_tx_info *info;
 -      int ret = NETDEV_TX_BUSY, head_need;
 +      int head_need;
        u16 ethertype, hdrlen,  meshhdrlen = 0;
        __le16 fc;
        struct ieee80211_hdr hdr;
        u32 info_flags = 0;
        u16 info_id = 0;
  
 -      if (unlikely(skb->len < ETH_HLEN)) {
 -              ret = NETDEV_TX_OK;
 +      if (unlikely(skb->len < ETH_HLEN))
                goto fail;
 -      }
  
        /* convert Ethernet header to proper 802.11 header (based on
         * operation mode) */
                if (!sdata->u.mesh.mshcfg.dot11MeshTTL) {
                        /* Do not send frames with mesh_ttl == 0 */
                        sdata->u.mesh.mshstats.dropped_frames_ttl++;
 -                      ret = NETDEV_TX_OK;
                        goto fail;
                }
                rcu_read_lock();
                        meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
                                        sdata, NULL, NULL);
                } else {
-                       int is_mesh_mcast = 1;
-                       const u8 *mesh_da;
+                       /* DS -> MBSS (802.11-2012 13.11.3.3).
+                        * For unicast with unknown forwarding information,
+                        * destination might be in the MBSS or if that fails
+                        * forwarded to another mesh gate. In either case
+                        * resolution will be handled in ieee80211_xmit(), so
+                        * leave the original DA. This also works for mcast */
+                       const u8 *mesh_da = skb->data;
+                       if (mppath)
+                               mesh_da = mppath->mpp;
+                       else if (mpath)
+                               mesh_da = mpath->dst;
+                       rcu_read_unlock();
  
-                       if (is_multicast_ether_addr(skb->data))
-                               /* DA TA mSA AE:SA */
-                               mesh_da = skb->data;
-                       else {
-                               static const u8 bcast[ETH_ALEN] =
-                                       { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-                               if (mppath) {
-                                       /* RA TA mDA mSA AE:DA SA */
-                                       mesh_da = mppath->mpp;
-                                       is_mesh_mcast = 0;
-                               } else if (mpath) {
-                                       mesh_da = mpath->dst;
-                                       is_mesh_mcast = 0;
-                               } else {
-                                       /* DA TA mSA AE:SA */
-                                       mesh_da = bcast;
-                               }
-                       }
                        hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
                                        mesh_da, sdata->vif.addr);
-                       rcu_read_unlock();
-                       if (is_mesh_mcast)
+                       if (is_multicast_ether_addr(mesh_da))
+                               /* DA TA mSA AE:SA */
                                meshhdrlen =
                                        ieee80211_new_mesh_header(&mesh_hdr,
                                                        sdata,
                                                        skb->data + ETH_ALEN,
                                                        NULL);
                        else
+                               /* RA TA mDA mSA AE:DA SA */
                                meshhdrlen =
                                        ieee80211_new_mesh_header(&mesh_hdr,
                                                        sdata,
  
                if (tdls_direct) {
                        /* link during setup - throw out frames to peer */
 -                      if (!tdls_auth) {
 -                              ret = NETDEV_TX_OK;
 +                      if (!tdls_auth)
                                goto fail;
 -                      }
  
                        /* DA SA BSSID */
                        memcpy(hdr.addr1, skb->data, ETH_ALEN);
                hdrlen = 24;
                break;
        default:
 -              ret = NETDEV_TX_OK;
                goto fail;
        }
  
  
                I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
  
 -              ret = NETDEV_TX_OK;
                goto fail;
        }
  
                skb = skb_clone(skb, GFP_ATOMIC);
                kfree_skb(tmp_skb);
  
 -              if (!skb) {
 -                      ret = NETDEV_TX_OK;
 +              if (!skb)
                        goto fail;
 -              }
        }
  
        hdr.frame_control = fc;
        return NETDEV_TX_OK;
  
   fail:
 -      if (ret == NETDEV_TX_OK)
 -              dev_kfree_skb(skb);
 -
 -      return ret;
 +      dev_kfree_skb(skb);
 +      return NETDEV_TX_OK;
  }
  
  
@@@ -2289,9 -2295,12 +2283,9 @@@ struct sk_buff *ieee80211_beacon_get_ti
        struct ieee80211_sub_if_data *sdata = NULL;
        struct ieee80211_if_ap *ap = NULL;
        struct beacon_data *beacon;
 -      struct ieee80211_supported_band *sband;
 -      enum ieee80211_band band = local->hw.conf.channel->band;
 +      enum ieee80211_band band = local->oper_channel->band;
        struct ieee80211_tx_rate_control txrc;
  
 -      sband = local->hw.wiphy->bands[band];
 -
        rcu_read_lock();
  
        sdata = vif_to_sdata(vif);
                memset(mgmt, 0, hdr_len);
                mgmt->frame_control =
                    cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
 -              memset(mgmt->da, 0xff, ETH_ALEN);
 +              eth_broadcast_addr(mgmt->da);
                memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
                mgmt->u.beacon.beacon_int =
                *pos++ = WLAN_EID_SSID;
                *pos++ = 0x0;
  
 -              if (ieee80211_add_srates_ie(sdata, skb, true) ||
 +              if (ieee80211_add_srates_ie(sdata, skb, true, band) ||
                    mesh_add_ds_params_ie(skb, sdata) ||
 -                  ieee80211_add_ext_srates_ie(sdata, skb, true) ||
 +                  ieee80211_add_ext_srates_ie(sdata, skb, true, band) ||
                    mesh_add_rsn_ie(skb, sdata) ||
                    mesh_add_ht_cap_ie(skb, sdata) ||
                    mesh_add_ht_oper_ie(skb, sdata) ||
  
        memset(&txrc, 0, sizeof(txrc));
        txrc.hw = hw;
 -      txrc.sband = sband;
 +      txrc.sband = local->hw.wiphy->bands[band];
        txrc.bss_conf = &sdata->vif.bss_conf;
        txrc.skb = skb;
        txrc.reported_rate.idx = -1;
        txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
 -      if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
 +      if (txrc.rate_idx_mask == (1 << txrc.sband->n_bitrates) - 1)
                txrc.max_rate_idx = -1;
        else
                txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
@@@ -2467,8 -2476,7 +2461,8 @@@ struct sk_buff *ieee80211_proberesp_get
                                        struct ieee80211_vif *vif)
  {
        struct ieee80211_if_ap *ap = NULL;
 -      struct sk_buff *presp = NULL, *skb = NULL;
 +      struct sk_buff *skb = NULL;
 +      struct probe_resp *presp = NULL;
        struct ieee80211_hdr *hdr;
        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
  
        if (!presp)
                goto out;
  
 -      skb = skb_copy(presp, GFP_ATOMIC);
 +      skb = dev_alloc_skb(presp->len);
        if (!skb)
                goto out;
  
 +      memcpy(skb_put(skb, presp->len), presp->data, presp->len);
 +
        hdr = (struct ieee80211_hdr *) skb->data;
        memset(hdr->addr1, 0, sizeof(hdr->addr1));
  
@@@ -2598,9 -2604,9 +2592,9 @@@ struct sk_buff *ieee80211_probereq_get(
        memset(hdr, 0, sizeof(*hdr));
        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                         IEEE80211_STYPE_PROBE_REQ);
 -      memset(hdr->addr1, 0xff, ETH_ALEN);
 +      eth_broadcast_addr(hdr->addr1);
        memcpy(hdr->addr2, vif->addr, ETH_ALEN);
 -      memset(hdr->addr3, 0xff, ETH_ALEN);
 +      eth_broadcast_addr(hdr->addr3);
  
        pos = skb_put(skb, ie_ssid_len);
        *pos++ = WLAN_EID_SSID;
@@@ -2697,7 -2703,8 +2691,7 @@@ ieee80211_get_buffered_bc(struct ieee80
        info = IEEE80211_SKB_CB(skb);
  
        tx.flags |= IEEE80211_TX_PS_BUFFERED;
 -      tx.channel = local->hw.conf.channel;
 -      info->band = tx.channel->band;
 +      info->band = local->oper_channel->band;
  
        if (invoke_tx_handlers(&tx))
                skb = NULL;
@@@ -1171,8 -1171,10 +1171,10 @@@ ip_vs_add_service(struct net *net, stru
                goto out_err;
        }
        svc->stats.cpustats = alloc_percpu(struct ip_vs_cpu_stats);
-       if (!svc->stats.cpustats)
+       if (!svc->stats.cpustats) {
+               ret = -ENOMEM;
                goto out_err;
+       }
  
        /* I'm the first user of the service */
        atomic_set(&svc->usecnt, 0);
@@@ -1801,12 -1803,6 +1803,12 @@@ static struct ctl_table vs_vars[] = 
                .mode           = 0644,
                .proc_handler   = proc_dointvec,
        },
 +      {
 +              .procname       = "pmtu_disc",
 +              .maxlen         = sizeof(int),
 +              .mode           = 0644,
 +              .proc_handler   = proc_dointvec,
 +      },
  #ifdef CONFIG_IP_VS_DEBUG
        {
                .procname       = "debug_level",
@@@ -3682,7 -3678,7 +3684,7 @@@ static void ip_vs_genl_unregister(void
   * per netns intit/exit func.
   */
  #ifdef CONFIG_SYSCTL
 -int __net_init ip_vs_control_net_init_sysctl(struct net *net)
 +static int __net_init ip_vs_control_net_init_sysctl(struct net *net)
  {
        int idx;
        struct netns_ipvs *ipvs = net_ipvs(net);
        ipvs->sysctl_sync_retries = clamp_t(int, DEFAULT_SYNC_RETRIES, 0, 3);
        tbl[idx++].data = &ipvs->sysctl_sync_retries;
        tbl[idx++].data = &ipvs->sysctl_nat_icmp_send;
 +      ipvs->sysctl_pmtu_disc = 1;
 +      tbl[idx++].data = &ipvs->sysctl_pmtu_disc;
  
  
        ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
        return 0;
  }
  
 -void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
 +static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
  {
        struct netns_ipvs *ipvs = net_ipvs(net);
  
  
  #else
  
 -int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
 -void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) { }
 +static int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
 +static void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) { }
  
  #endif
  
@@@ -55,7 -55,6 +55,7 @@@ struct nfulnl_instance 
        unsigned int qlen;              /* number of nlmsgs in skb */
        struct sk_buff *skb;            /* pre-allocatd skb */
        struct timer_list timer;
 +      struct user_namespace *peer_user_ns;    /* User namespace of the peer process */
        int peer_pid;                   /* PID of the peer process */
  
        /* configurable parameters */
@@@ -133,7 -132,7 +133,7 @@@ instance_put(struct nfulnl_instance *in
  static void nfulnl_timer(unsigned long data);
  
  static struct nfulnl_instance *
 -instance_create(u_int16_t group_num, int pid)
 +instance_create(u_int16_t group_num, int pid, struct user_namespace *user_ns)
  {
        struct nfulnl_instance *inst;
        int err;
  
        setup_timer(&inst->timer, nfulnl_timer, (unsigned long)inst);
  
 +      inst->peer_user_ns = user_ns;
        inst->peer_pid = pid;
        inst->group_num = group_num;
  
@@@ -482,7 -480,7 +482,7 @@@ __build_packet_message(struct nfulnl_in
        }
  
        if (indev && skb_mac_header_was_set(skb)) {
-               if (nla_put_be32(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
+               if (nla_put_be16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
                    nla_put_be16(inst->skb, NFULA_HWLEN,
                                 htons(skb->dev->hard_header_len)) ||
                    nla_put(inst->skb, NFULA_HWHEADER, skb->dev->hard_header_len,
                read_lock_bh(&skb->sk->sk_callback_lock);
                if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
                        struct file *file = skb->sk->sk_socket->file;
 -                      __be32 uid = htonl(file->f_cred->fsuid);
 -                      __be32 gid = htonl(file->f_cred->fsgid);
 +                      __be32 uid = htonl(from_kuid_munged(inst->peer_user_ns,
 +                                                          file->f_cred->fsuid));
 +                      __be32 gid = htonl(from_kgid_munged(inst->peer_user_ns,
 +                                                          file->f_cred->fsgid));
 +                      /* need to unlock here since NLA_PUT may goto */
                        read_unlock_bh(&skb->sk->sk_callback_lock);
                        if (nla_put_be32(inst->skb, NFULA_UID, uid) ||
                            nla_put_be32(inst->skb, NFULA_GID, gid))
@@@ -788,8 -783,7 +788,8 @@@ nfulnl_recv_config(struct sock *ctnl, s
                        }
  
                        inst = instance_create(group_num,
 -                                             NETLINK_CB(skb).pid);
 +                                             NETLINK_CB(skb).pid,
 +                                             sk_user_ns(NETLINK_CB(skb).ssk));
                        if (IS_ERR(inst)) {
                                ret = PTR_ERR(inst);
                                goto out;
@@@ -1002,8 -996,10 +1002,10 @@@ static int __init nfnetlink_log_init(vo
  
  #ifdef CONFIG_PROC_FS
        if (!proc_create("nfnetlink_log", 0440,
-                        proc_net_netfilter, &nful_file_ops))
+                        proc_net_netfilter, &nful_file_ops)) {
+               status = -ENOMEM;
                goto cleanup_logger;
+       }
  #endif
        return status;
  
diff --combined net/netlink/af_netlink.c
@@@ -912,8 -912,7 +912,8 @@@ static void netlink_rcv_wake(struct soc
                wake_up_interruptible(&nlk->wait);
  }
  
 -static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb)
 +static int netlink_unicast_kernel(struct sock *sk, struct sk_buff *skb,
 +                                struct sock *ssk)
  {
        int ret;
        struct netlink_sock *nlk = nlk_sk(sk);
        if (nlk->netlink_rcv != NULL) {
                ret = skb->len;
                skb_set_owner_r(skb, sk);
 +              NETLINK_CB(skb).ssk = ssk;
                nlk->netlink_rcv(skb);
                consume_skb(skb);
        } else {
@@@ -949,7 -947,7 +949,7 @@@ retry
                return PTR_ERR(sk);
        }
        if (netlink_is_kernel(sk))
 -              return netlink_unicast_kernel(sk, skb);
 +              return netlink_unicast_kernel(sk, skb, ssk);
  
        if (sk_filter(sk, skb)) {
                err = skb->len;
@@@ -1375,7 -1373,8 +1375,8 @@@ static int netlink_sendmsg(struct kioc
                dst_pid = addr->nl_pid;
                dst_group = ffs(addr->nl_groups);
                err =  -EPERM;
-               if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND))
+               if ((dst_group || dst_pid) &&
+                   !netlink_capable(sock, NL_NONROOT_SEND))
                        goto out;
        } else {
                dst_pid = nlk->dst_pid;
@@@ -2149,6 -2148,7 +2150,7 @@@ static void __init netlink_add_usersock
        rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
        nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
        nl_table[NETLINK_USERSOCK].registered = 1;
+       nl_table[NETLINK_USERSOCK].nl_nonroot = NL_NONROOT_SEND;
  
        netlink_table_ungrab();
  }
diff --combined net/packet/af_packet.c
@@@ -93,8 -93,6 +93,8 @@@
  #include <net/inet_common.h>
  #endif
  
 +#include "internal.h"
 +
  /*
     Assumptions:
     - if device has no dev->hard_header routine, it adds and removes ll header
@@@ -148,6 -146,14 +148,6 @@@ dev->hard_header == NULL (ll header is 
  
  /* Private packet socket structures. */
  
 -struct packet_mclist {
 -      struct packet_mclist    *next;
 -      int                     ifindex;
 -      int                     count;
 -      unsigned short          type;
 -      unsigned short          alen;
 -      unsigned char           addr[MAX_ADDR_LEN];
 -};
  /* identical to struct packet_mreq except it has
   * a longer address field.
   */
@@@ -169,7 -175,63 +169,7 @@@ static int packet_set_ring(struct sock 
  #define BLK_PLUS_PRIV(sz_of_priv) \
        (BLK_HDR_LEN + ALIGN((sz_of_priv), V3_ALIGNMENT))
  
 -/* kbdq - kernel block descriptor queue */
 -struct tpacket_kbdq_core {
 -      struct pgv      *pkbdq;
 -      unsigned int    feature_req_word;
 -      unsigned int    hdrlen;
 -      unsigned char   reset_pending_on_curr_blk;
 -      unsigned char   delete_blk_timer;
 -      unsigned short  kactive_blk_num;
 -      unsigned short  blk_sizeof_priv;
 -
 -      /* last_kactive_blk_num:
 -       * trick to see if user-space has caught up
 -       * in order to avoid refreshing timer when every single pkt arrives.
 -       */
 -      unsigned short  last_kactive_blk_num;
 -
 -      char            *pkblk_start;
 -      char            *pkblk_end;
 -      int             kblk_size;
 -      unsigned int    knum_blocks;
 -      uint64_t        knxt_seq_num;
 -      char            *prev;
 -      char            *nxt_offset;
 -      struct sk_buff  *skb;
 -
 -      atomic_t        blk_fill_in_prog;
 -
 -      /* Default is set to 8ms */
 -#define DEFAULT_PRB_RETIRE_TOV        (8)
 -
 -      unsigned short  retire_blk_tov;
 -      unsigned short  version;
 -      unsigned long   tov_in_jiffies;
 -
 -      /* timer to retire an outstanding block */
 -      struct timer_list retire_blk_timer;
 -};
 -
  #define PGV_FROM_VMALLOC 1
 -struct pgv {
 -      char *buffer;
 -};
 -
 -struct packet_ring_buffer {
 -      struct pgv              *pg_vec;
 -      unsigned int            head;
 -      unsigned int            frames_per_block;
 -      unsigned int            frame_size;
 -      unsigned int            frame_max;
 -
 -      unsigned int            pg_vec_order;
 -      unsigned int            pg_vec_pages;
 -      unsigned int            pg_vec_len;
 -
 -      struct tpacket_kbdq_core        prb_bdqc;
 -      atomic_t                pending;
 -};
  
  #define BLOCK_STATUS(x)       ((x)->hdr.bh1.block_status)
  #define BLOCK_NUM_PKTS(x)     ((x)->hdr.bh1.num_pkts)
@@@ -207,6 -269,52 +207,6 @@@ static void prb_fill_vlan_info(struct t
                struct tpacket3_hdr *);
  static void packet_flush_mclist(struct sock *sk);
  
 -struct packet_fanout;
 -struct packet_sock {
 -      /* struct sock has to be the first member of packet_sock */
 -      struct sock             sk;
 -      struct packet_fanout    *fanout;
 -      struct tpacket_stats    stats;
 -      union  tpacket_stats_u  stats_u;
 -      struct packet_ring_buffer       rx_ring;
 -      struct packet_ring_buffer       tx_ring;
 -      int                     copy_thresh;
 -      spinlock_t              bind_lock;
 -      struct mutex            pg_vec_lock;
 -      unsigned int            running:1,      /* prot_hook is attached*/
 -                              auxdata:1,
 -                              origdev:1,
 -                              has_vnet_hdr:1;
 -      int                     ifindex;        /* bound device         */
 -      __be16                  num;
 -      struct packet_mclist    *mclist;
 -      atomic_t                mapped;
 -      enum tpacket_versions   tp_version;
 -      unsigned int            tp_hdrlen;
 -      unsigned int            tp_reserve;
 -      unsigned int            tp_loss:1;
 -      unsigned int            tp_tstamp;
 -      struct packet_type      prot_hook ____cacheline_aligned_in_smp;
 -};
 -
 -#define PACKET_FANOUT_MAX     256
 -
 -struct packet_fanout {
 -#ifdef CONFIG_NET_NS
 -      struct net              *net;
 -#endif
 -      unsigned int            num_members;
 -      u16                     id;
 -      u8                      type;
 -      u8                      defrag;
 -      atomic_t                rr_cur;
 -      struct list_head        list;
 -      struct sock             *arr[PACKET_FANOUT_MAX];
 -      spinlock_t              lock;
 -      atomic_t                sk_ref;
 -      struct packet_type      prot_hook ____cacheline_aligned_in_smp;
 -};
 -
  struct packet_skb_cb {
        unsigned int origlen;
        union {
        (((x)->kactive_blk_num < ((x)->knum_blocks-1)) ? \
        ((x)->kactive_blk_num+1) : 0)
  
 -static struct packet_sock *pkt_sk(struct sock *sk)
 -{
 -      return (struct packet_sock *)sk;
 -}
 -
  static void __fanout_unlink(struct sock *sk, struct packet_sock *po);
  static void __fanout_link(struct sock *sk, struct packet_sock *po);
  
@@@ -855,8 -968,7 +855,8 @@@ static void prb_fill_vlan_info(struct t
                ppd->hv1.tp_vlan_tci = vlan_tx_tag_get(pkc->skb);
                ppd->tp_status = TP_STATUS_VLAN_VALID;
        } else {
 -              ppd->hv1.tp_vlan_tci = ppd->tp_status = 0;
 +              ppd->hv1.tp_vlan_tci = 0;
 +              ppd->tp_status = TP_STATUS_AVAILABLE;
        }
  }
  
@@@ -1131,8 -1243,7 +1131,8 @@@ static int packet_rcv_fanout(struct sk_
        return po->prot_hook.func(skb, dev, &po->prot_hook, orig_dev);
  }
  
 -static DEFINE_MUTEX(fanout_mutex);
 +DEFINE_MUTEX(fanout_mutex);
 +EXPORT_SYMBOL_GPL(fanout_mutex);
  static LIST_HEAD(fanout_list);
  
  static void __fanout_link(struct sock *sk, struct packet_sock *po)
@@@ -1162,7 -1273,7 +1162,7 @@@ static void __fanout_unlink(struct soc
        spin_unlock(&f->lock);
  }
  
- bool match_fanout_group(struct packet_type *ptype, struct sock * sk)
static bool match_fanout_group(struct packet_type *ptype, struct sock * sk)
  {
        if (ptype->af_packet_priv == (void*)((struct packet_sock *)sk)->fanout)
                return true;
@@@ -1253,9 -1364,9 +1253,9 @@@ static void fanout_release(struct sock 
        if (!f)
                return;
  
 +      mutex_lock(&fanout_mutex);
        po->fanout = NULL;
  
 -      mutex_lock(&fanout_mutex);
        if (atomic_dec_and_test(&f->sk_ref)) {
                list_del(&f->list);
                dev_remove_pack(&f->prot_hook);
@@@ -1952,7 -2063,7 +1952,7 @@@ static int tpacket_snd(struct packet_so
        int tp_len, size_max;
        unsigned char *addr;
        int len_sum = 0;
 -      int status = 0;
 +      int status = TP_STATUS_AVAILABLE;
        int hlen, tlen;
  
        mutex_lock(&po->pg_vec_lock);
@@@ -2317,13 -2428,10 +2317,13 @@@ static int packet_release(struct socke
        net = sock_net(sk);
        po = pkt_sk(sk);
  
 -      spin_lock_bh(&net->packet.sklist_lock);
 +      mutex_lock(&net->packet.sklist_lock);
        sk_del_node_init_rcu(sk);
 +      mutex_unlock(&net->packet.sklist_lock);
 +
 +      preempt_disable();
        sock_prot_inuse_add(net, sk->sk_prot, -1);
 -      spin_unlock_bh(&net->packet.sklist_lock);
 +      preempt_enable();
  
        spin_lock(&po->bind_lock);
        unregister_prot_hook(sk, false);
@@@ -2522,13 -2630,10 +2522,13 @@@ static int packet_create(struct net *ne
                register_prot_hook(sk);
        }
  
 -      spin_lock_bh(&net->packet.sklist_lock);
 +      mutex_lock(&net->packet.sklist_lock);
        sk_add_node_rcu(sk, &net->packet.sklist);
 +      mutex_unlock(&net->packet.sklist_lock);
 +
 +      preempt_disable();
        sock_prot_inuse_add(net, &packet_proto, 1);
 -      spin_unlock_bh(&net->packet.sklist_lock);
 +      preempt_enable();
  
        return 0;
  out:
@@@ -3749,7 -3854,7 +3749,7 @@@ static int packet_seq_show(struct seq_f
                           po->ifindex,
                           po->running,
                           atomic_read(&s->sk_rmem_alloc),
 -                         sock_i_uid(s),
 +                         from_kuid_munged(seq_user_ns(seq), sock_i_uid(s)),
                           sock_i_ino(s));
        }
  
@@@ -3781,7 -3886,7 +3781,7 @@@ static const struct file_operations pac
  
  static int __net_init packet_net_init(struct net *net)
  {
 -      spin_lock_init(&net->packet.sklist_lock);
 +      mutex_init(&net->packet.sklist_lock);
        INIT_HLIST_HEAD(&net->packet.sklist);
  
        if (!proc_net_fops_create(net, "packet", 0, &packet_seq_fops))