Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux

to pick up the KVM fix which is required for the NX series.

76 files changed, 856 insertions, 517 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 54728d2eda18..d4bcfd8f95bf 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -172,7 +172,6 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack)
         if (err < 0)
                 goto out_uninit_mvrp;
 
-        vlan->nest_level = dev_get_nest_level(real_dev) + 1;
         err = register_netdevice(dev);
         if (err < 0)
                 goto out_uninit_mvrp;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 93eadf179123..e5bff5cc6f97 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -489,36 +489,6 @@ static void vlan_dev_set_rx_mode(struct net_device *vlan_dev)
         dev_uc_sync(vlan_dev_priv(vlan_dev)->real_dev, vlan_dev);
 }
 
-/*
- * vlan network devices have devices nesting below it, and are a special
- * "super class" of normal network devices; split their locks off into a
- * separate class since they always nest.
- */
-static struct lock_class_key vlan_netdev_xmit_lock_key;
-static struct lock_class_key vlan_netdev_addr_lock_key;
-
-static void vlan_dev_set_lockdep_one(struct net_device *dev,
-                                     struct netdev_queue *txq,
-                                     void *_subclass)
-{
-        lockdep_set_class_and_subclass(&txq->_xmit_lock,
-                                       &vlan_netdev_xmit_lock_key,
-                                       *(int *)_subclass);
-}
-
-static void vlan_dev_set_lockdep_class(struct net_device *dev, int subclass)
-{
-        lockdep_set_class_and_subclass(&dev->addr_list_lock,
-                                       &vlan_netdev_addr_lock_key,
-                                       subclass);
-        netdev_for_each_tx_queue(dev, vlan_dev_set_lockdep_one, &subclass);
-}
-
-static int vlan_dev_get_lock_subclass(struct net_device *dev)
-{
-        return vlan_dev_priv(dev)->nest_level;
-}
-
 static const struct header_ops vlan_header_ops = {
         .create  = vlan_dev_hard_header,
         .parse   = eth_header_parse,
@@ -609,8 +579,6 @@ static int vlan_dev_init(struct net_device *dev)
 
         SET_NETDEV_DEVTYPE(dev, &vlan_type);
 
-        vlan_dev_set_lockdep_class(dev, vlan_dev_get_lock_subclass(dev));
-
         vlan->vlan_pcpu_stats = netdev_alloc_pcpu_stats(struct vlan_pcpu_stats);
         if (!vlan->vlan_pcpu_stats)
                 return -ENOMEM;
@@ -812,7 +780,6 @@ static const struct net_device_ops vlan_netdev_ops = {
         .ndo_netpoll_cleanup    = vlan_dev_netpoll_cleanup,
 #endif
         .ndo_fix_features       = vlan_dev_fix_features,
-        .ndo_get_lock_subclass  = vlan_dev_get_lock_subclass,
         .ndo_get_iflink         = vlan_dev_get_iflink,
 };
 
diff --git a/net/atm/common.c b/net/atm/common.c
index b7528e77997c..0ce530af534d 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -668,7 +668,7 @@ __poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
                 mask |= EPOLLHUP;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         /* writable? */
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index d78938e3e008..5b0b20e6da95 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -22,6 +22,8 @@
 #include <linux/kernel.h>
 #include <linux/kref.h>
 #include <linux/list.h>
+#include <linux/lockdep.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/netlink.h>
 #include <linux/pkt_sched.h>
@@ -193,14 +195,18 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface)
         unsigned char *ogm_buff;
         u32 random_seqno;
 
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+
         /* randomize initial seqno to avoid collision */
         get_random_bytes(&random_seqno, sizeof(random_seqno));
         atomic_set(&hard_iface->bat_iv.ogm_seqno, random_seqno);
 
         hard_iface->bat_iv.ogm_buff_len = BATADV_OGM_HLEN;
         ogm_buff = kmalloc(hard_iface->bat_iv.ogm_buff_len, GFP_ATOMIC);
-        if (!ogm_buff)
+        if (!ogm_buff) {
+                mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
                 return -ENOMEM;
+        }
 
         hard_iface->bat_iv.ogm_buff = ogm_buff;
 
@@ -212,35 +218,59 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface)
         batadv_ogm_packet->reserved = 0;
         batadv_ogm_packet->tq = BATADV_TQ_MAX_VALUE;
 
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
+
         return 0;
 }
 
 static void batadv_iv_ogm_iface_disable(struct batadv_hard_iface *hard_iface)
 {
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+
         kfree(hard_iface->bat_iv.ogm_buff);
         hard_iface->bat_iv.ogm_buff = NULL;
+
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
 }
 
 static void batadv_iv_ogm_iface_update_mac(struct batadv_hard_iface *hard_iface)
 {
         struct batadv_ogm_packet *batadv_ogm_packet;
-        unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff;
+        void *ogm_buff;
 
-        batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+
+        ogm_buff = hard_iface->bat_iv.ogm_buff;
+        if (!ogm_buff)
+                goto unlock;
+
+        batadv_ogm_packet = ogm_buff;
         ether_addr_copy(batadv_ogm_packet->orig,
                         hard_iface->net_dev->dev_addr);
         ether_addr_copy(batadv_ogm_packet->prev_sender,
                         hard_iface->net_dev->dev_addr);
+
+unlock:
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
 }
 
 static void
 batadv_iv_ogm_primary_iface_set(struct batadv_hard_iface *hard_iface)
 {
         struct batadv_ogm_packet *batadv_ogm_packet;
-        unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff;
+        void *ogm_buff;
 
-        batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+
+        ogm_buff = hard_iface->bat_iv.ogm_buff;
+        if (!ogm_buff)
+                goto unlock;
+
+        batadv_ogm_packet = ogm_buff;
         batadv_ogm_packet->ttl = BATADV_TTL;
+
+unlock:
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
 }
 
 /* when do we schedule our own ogm to be sent */
@@ -742,7 +772,11 @@ batadv_iv_ogm_slide_own_bcast_window(struct batadv_hard_iface *hard_iface)
         }
 }
 
-static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
+/**
+ * batadv_iv_ogm_schedule_buff() - schedule submission of hardif ogm buffer
+ * @hard_iface: interface whose ogm buffer should be transmitted
+ */
+static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface)
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         unsigned char **ogm_buff = &hard_iface->bat_iv.ogm_buff;
@@ -753,9 +787,7 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
         u16 tvlv_len = 0;
         unsigned long send_time;
 
-        if (hard_iface->if_status == BATADV_IF_NOT_IN_USE ||
-            hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)
-                return;
+        lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex);
 
         /* the interface gets activated here to avoid race conditions between
          * the moment of activating the interface in
@@ -823,6 +855,17 @@ out:
                 batadv_hardif_put(primary_if);
 }
 
+static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
+{
+        if (hard_iface->if_status == BATADV_IF_NOT_IN_USE ||
+            hard_iface->if_status == BATADV_IF_TO_BE_REMOVED)
+                return;
+
+        mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+        batadv_iv_ogm_schedule_buff(hard_iface);
+        mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
+}
+
 /**
  * batadv_iv_orig_ifinfo_sum() - Get bcast_own sum for originator over iterface
  * @orig_node: originator which reproadcasted the OGMs directly
diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
index dc4f7430cb5a..8033f24f506c 100644
--- a/net/batman-adv/bat_v_ogm.c
+++ b/net/batman-adv/bat_v_ogm.c
@@ -18,6 +18,7 @@
 #include <linux/kref.h>
 #include <linux/list.h>
 #include <linux/lockdep.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/random.h>
 #include <linux/rculist.h>
@@ -256,14 +257,12 @@ static void batadv_v_ogm_queue_on_if(struct sk_buff *skb,
 }
 
 /**
- * batadv_v_ogm_send() - periodic worker broadcasting the own OGM
- * @work: work queue item
+ * batadv_v_ogm_send_softif() - periodic worker broadcasting the own OGM
+ * @bat_priv: the bat priv with all the soft interface information
  */
-static void batadv_v_ogm_send(struct work_struct *work)
+static void batadv_v_ogm_send_softif(struct batadv_priv *bat_priv)
 {
         struct batadv_hard_iface *hard_iface;
-        struct batadv_priv_bat_v *bat_v;
-        struct batadv_priv *bat_priv;
         struct batadv_ogm2_packet *ogm_packet;
         struct sk_buff *skb, *skb_tmp;
         unsigned char *ogm_buff;
@@ -271,8 +270,7 @@ static void batadv_v_ogm_send(struct work_struct *work)
         u16 tvlv_len = 0;
         int ret;
 
-        bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work);
-        bat_priv = container_of(bat_v, struct batadv_priv, bat_v);
+        lockdep_assert_held(&bat_priv->bat_v.ogm_buff_mutex);
 
         if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_DEACTIVATING)
                 goto out;
@@ -364,6 +362,23 @@ out:
 }
 
 /**
+ * batadv_v_ogm_send() - periodic worker broadcasting the own OGM
+ * @work: work queue item
+ */
+static void batadv_v_ogm_send(struct work_struct *work)
+{
+        struct batadv_priv_bat_v *bat_v;
+        struct batadv_priv *bat_priv;
+
+        bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work);
+        bat_priv = container_of(bat_v, struct batadv_priv, bat_v);
+
+        mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
+        batadv_v_ogm_send_softif(bat_priv);
+        mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
+}
+
+/**
  * batadv_v_ogm_aggr_work() - OGM queue periodic task per interface
  * @work: work queue item
  *
@@ -424,11 +439,15 @@ void batadv_v_ogm_primary_iface_set(struct batadv_hard_iface *primary_iface)
         struct batadv_priv *bat_priv = netdev_priv(primary_iface->soft_iface);
         struct batadv_ogm2_packet *ogm_packet;
 
+        mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
         if (!bat_priv->bat_v.ogm_buff)
-                return;
+                goto unlock;
 
         ogm_packet = (struct batadv_ogm2_packet *)bat_priv->bat_v.ogm_buff;
         ether_addr_copy(ogm_packet->orig, primary_iface->net_dev->dev_addr);
+
+unlock:
+        mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
 }
 
 /**
@@ -1050,6 +1069,8 @@ int batadv_v_ogm_init(struct batadv_priv *bat_priv)
         atomic_set(&bat_priv->bat_v.ogm_seqno, random_seqno);
         INIT_DELAYED_WORK(&bat_priv->bat_v.ogm_wq, batadv_v_ogm_send);
 
+        mutex_init(&bat_priv->bat_v.ogm_buff_mutex);
+
         return 0;
 }
 
@@ -1061,7 +1082,11 @@ void batadv_v_ogm_free(struct batadv_priv *bat_priv)
 {
         cancel_delayed_work_sync(&bat_priv->bat_v.ogm_wq);
 
+        mutex_lock(&bat_priv->bat_v.ogm_buff_mutex);
+
         kfree(bat_priv->bat_v.ogm_buff);
         bat_priv->bat_v.ogm_buff = NULL;
         bat_priv->bat_v.ogm_buff_len = 0;
+
+        mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex);
 }
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index c90e47342bb0..afb52282d5bd 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -18,6 +18,7 @@
 #include <linux/kref.h>
 #include <linux/limits.h>
 #include <linux/list.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/printk.h>
 #include <linux/rculist.h>
@@ -929,6 +930,7 @@ batadv_hardif_add_interface(struct net_device *net_dev)
         INIT_LIST_HEAD(&hard_iface->list);
         INIT_HLIST_HEAD(&hard_iface->neigh_list);
 
+        mutex_init(&hard_iface->bat_iv.ogm_buff_mutex);
         spin_lock_init(&hard_iface->neigh_list_lock);
         kref_init(&hard_iface->refcount);
 
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 9cbed6f5a85a..5ee8e9a100f9 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -740,36 +740,6 @@ static int batadv_interface_kill_vid(struct net_device *dev, __be16 proto,
         return 0;
 }
 
-/* batman-adv network devices have devices nesting below it and are a special
- * "super class" of normal network devices; split their locks off into a
- * separate class since they always nest.
- */
-static struct lock_class_key batadv_netdev_xmit_lock_key;
-static struct lock_class_key batadv_netdev_addr_lock_key;
-
-/**
- * batadv_set_lockdep_class_one() - Set lockdep class for a single tx queue
- * @dev: device which owns the tx queue
- * @txq: tx queue to modify
- * @_unused: always NULL
- */
-static void batadv_set_lockdep_class_one(struct net_device *dev,
-                                         struct netdev_queue *txq,
-                                         void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &batadv_netdev_xmit_lock_key);
-}
-
-/**
- * batadv_set_lockdep_class() - Set txq and addr_list lockdep class
- * @dev: network device to modify
- */
-static void batadv_set_lockdep_class(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &batadv_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, batadv_set_lockdep_class_one, NULL);
-}
-
 /**
  * batadv_softif_init_late() - late stage initialization of soft interface
  * @dev: registered network device to modify
@@ -783,8 +753,6 @@ static int batadv_softif_init_late(struct net_device *dev)
         int ret;
         size_t cnt_len = sizeof(u64) * BATADV_CNT_NUM;
 
-        batadv_set_lockdep_class(dev);
-
         bat_priv = netdev_priv(dev);
         bat_priv->soft_iface = dev;
 
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index be7c02aa91e2..4d7f1baee7b7 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -17,6 +17,7 @@
 #include <linux/if.h>
 #include <linux/if_ether.h>
 #include <linux/kref.h>
+#include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/netlink.h>
 #include <linux/sched.h> /* for linux/wait.h */
@@ -81,6 +82,9 @@ struct batadv_hard_iface_bat_iv {
 
         /** @ogm_seqno: OGM sequence number - used to identify each OGM */
         atomic_t ogm_seqno;
+
+        /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */
+        struct mutex ogm_buff_mutex;
 };
 
 /**
@@ -1539,6 +1543,9 @@ struct batadv_priv_bat_v {
         /** @ogm_seqno: OGM sequence number - used to identify each OGM */
         atomic_t ogm_seqno;
 
+        /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */
+        struct mutex ogm_buff_mutex;
+
         /** @ogm_wq: workqueue used to schedule OGM transmissions */
         struct delayed_work ogm_wq;
 };
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index bb55d92691b0..4febc82a7c76 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -571,15 +571,7 @@ static netdev_tx_t bt_xmit(struct sk_buff *skb, struct net_device *netdev)
         return err < 0 ? NET_XMIT_DROP : err;
 }
 
-static int bt_dev_init(struct net_device *dev)
-{
-        netdev_lockdep_set_classes(dev);
-
-        return 0;
-}
-
 static const struct net_device_ops netdev_ops = {
-        .ndo_init               = bt_dev_init,
         .ndo_start_xmit         = bt_xmit,
 };
 
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 94ddf19998c7..5f508c50649d 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -460,7 +460,7 @@ __poll_t bt_sock_poll(struct file *file, struct socket *sock,
         if (sk->sk_state == BT_LISTEN)
                 return bt_accept_poll(sk);
 
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                 mask |= EPOLLERR |
                         (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
 
@@ -470,7 +470,7 @@ __poll_t bt_sock_poll(struct file *file, struct socket *sock,
         if (sk->sk_shutdown == SHUTDOWN_MASK)
                 mask |= EPOLLHUP;
 
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         if (sk->sk_state == BT_CLOSED)
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 681b72862c16..e804a3016902 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -24,8 +24,6 @@
 const struct nf_br_ops __rcu *nf_br_ops __read_mostly;
 EXPORT_SYMBOL_GPL(nf_br_ops);
 
-static struct lock_class_key bridge_netdev_addr_lock_key;
-
 /* net device transmit always called with BH disabled */
 netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
@@ -108,11 +106,6 @@ out:
         return NETDEV_TX_OK;
 }
 
-static void br_set_lockdep_class(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &bridge_netdev_addr_lock_key);
-}
-
 static int br_dev_init(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
@@ -150,7 +143,6 @@ static int br_dev_init(struct net_device *dev)
                 br_mdb_hash_fini(br);
                 br_fdb_hash_fini(br);
         }
-        br_set_lockdep_class(dev);
 
         return err;
 }
diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c
index 506d6141e44e..809673222382 100644
--- a/net/bridge/netfilter/nf_conntrack_bridge.c
+++ b/net/bridge/netfilter/nf_conntrack_bridge.c
@@ -95,7 +95,7 @@ slow_path:
          * This may also be a clone skbuff, we could preserve the geometry for
          * the copies but probably not worth the effort.
          */
-        ip_frag_init(skb, hlen, ll_rs, frag_max_size, &state);
+        ip_frag_init(skb, hlen, ll_rs, frag_max_size, false, &state);
 
         while (state.left > 0) {
                 struct sk_buff *skb2;
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 13ea920600ae..ef14da50a981 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -953,7 +953,7 @@ static __poll_t caif_poll(struct file *file,
                 mask |= EPOLLRDHUP;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue) ||
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
                 (sk->sk_shutdown & RCV_SHUTDOWN))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
diff --git a/net/core/datagram.c b/net/core/datagram.c
index c210fc116103..da3c24ed129c 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -97,7 +97,7 @@ int __skb_wait_for_more_packets(struct sock *sk, int *err, long *timeo_p,
         if (error)
                 goto out_err;
 
-        if (sk->sk_receive_queue.prev != skb)
+        if (READ_ONCE(sk->sk_receive_queue.prev) != skb)
                 goto out;
 
         /* Socket shut down? */
@@ -278,7 +278,7 @@ struct sk_buff *__skb_try_recv_datagram(struct sock *sk, unsigned int flags,
                         break;
 
                 sk_busy_loop(sk, flags & MSG_DONTWAIT);
-        } while (sk->sk_receive_queue.prev != *last);
+        } while (READ_ONCE(sk->sk_receive_queue.prev) != *last);
 
         error = -EAGAIN;
 
@@ -767,7 +767,7 @@ __poll_t datagram_poll(struct file *file, struct socket *sock,
         mask = 0;
 
         /* exceptional events? */
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                 mask |= EPOLLERR |
                         (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
 
@@ -777,7 +777,7 @@ __poll_t datagram_poll(struct file *file, struct socket *sock,
                 mask |= EPOLLHUP;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
diff --git a/net/core/dev.c b/net/core/dev.c
index bf3ed413abaf..99ac84ff398f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -146,6 +146,7 @@
 #include "net-sysfs.h"
 
 #define MAX_GRO_SKBS 8
+#define MAX_NEST_DEV 8
 
 /* This should be increased if a protocol with a bigger head is added. */
 #define GRO_MAX_HEAD (MAX_HEADER + 128)
@@ -276,88 +277,6 @@ static RAW_NOTIFIER_HEAD(netdev_chain);
 DEFINE_PER_CPU_ALIGNED(struct softnet_data, softnet_data);
 EXPORT_PER_CPU_SYMBOL(softnet_data);
 
-#ifdef CONFIG_LOCKDEP
-/*
- * register_netdevice() inits txq->_xmit_lock and sets lockdep class
- * according to dev->type
- */
-static const unsigned short netdev_lock_type[] = {
-         ARPHRD_NETROM, ARPHRD_ETHER, ARPHRD_EETHER, ARPHRD_AX25,
-         ARPHRD_PRONET, ARPHRD_CHAOS, ARPHRD_IEEE802, ARPHRD_ARCNET,
-         ARPHRD_APPLETLK, ARPHRD_DLCI, ARPHRD_ATM, ARPHRD_METRICOM,
-         ARPHRD_IEEE1394, ARPHRD_EUI64, ARPHRD_INFINIBAND, ARPHRD_SLIP,
-         ARPHRD_CSLIP, ARPHRD_SLIP6, ARPHRD_CSLIP6, ARPHRD_RSRVD,
-         ARPHRD_ADAPT, ARPHRD_ROSE, ARPHRD_X25, ARPHRD_HWX25,
-         ARPHRD_PPP, ARPHRD_CISCO, ARPHRD_LAPB, ARPHRD_DDCMP,
-         ARPHRD_RAWHDLC, ARPHRD_TUNNEL, ARPHRD_TUNNEL6, ARPHRD_FRAD,
-         ARPHRD_SKIP, ARPHRD_LOOPBACK, ARPHRD_LOCALTLK, ARPHRD_FDDI,
-         ARPHRD_BIF, ARPHRD_SIT, ARPHRD_IPDDP, ARPHRD_IPGRE,
-         ARPHRD_PIMREG, ARPHRD_HIPPI, ARPHRD_ASH, ARPHRD_ECONET,
-         ARPHRD_IRDA, ARPHRD_FCPP, ARPHRD_FCAL, ARPHRD_FCPL,
-         ARPHRD_FCFABRIC, ARPHRD_IEEE80211, ARPHRD_IEEE80211_PRISM,
-         ARPHRD_IEEE80211_RADIOTAP, ARPHRD_PHONET, ARPHRD_PHONET_PIPE,
-         ARPHRD_IEEE802154, ARPHRD_VOID, ARPHRD_NONE};
-
-static const char *const netdev_lock_name[] = {
-        "_xmit_NETROM", "_xmit_ETHER", "_xmit_EETHER", "_xmit_AX25",
-        "_xmit_PRONET", "_xmit_CHAOS", "_xmit_IEEE802", "_xmit_ARCNET",
-        "_xmit_APPLETLK", "_xmit_DLCI", "_xmit_ATM", "_xmit_METRICOM",
-        "_xmit_IEEE1394", "_xmit_EUI64", "_xmit_INFINIBAND", "_xmit_SLIP",
-        "_xmit_CSLIP", "_xmit_SLIP6", "_xmit_CSLIP6", "_xmit_RSRVD",
-        "_xmit_ADAPT", "_xmit_ROSE", "_xmit_X25", "_xmit_HWX25",
-        "_xmit_PPP", "_xmit_CISCO", "_xmit_LAPB", "_xmit_DDCMP",
-        "_xmit_RAWHDLC", "_xmit_TUNNEL", "_xmit_TUNNEL6", "_xmit_FRAD",
-        "_xmit_SKIP", "_xmit_LOOPBACK", "_xmit_LOCALTLK", "_xmit_FDDI",
-        "_xmit_BIF", "_xmit_SIT", "_xmit_IPDDP", "_xmit_IPGRE",
-        "_xmit_PIMREG", "_xmit_HIPPI", "_xmit_ASH", "_xmit_ECONET",
-        "_xmit_IRDA", "_xmit_FCPP", "_xmit_FCAL", "_xmit_FCPL",
-        "_xmit_FCFABRIC", "_xmit_IEEE80211", "_xmit_IEEE80211_PRISM",
-        "_xmit_IEEE80211_RADIOTAP", "_xmit_PHONET", "_xmit_PHONET_PIPE",
-        "_xmit_IEEE802154", "_xmit_VOID", "_xmit_NONE"};
-
-static struct lock_class_key netdev_xmit_lock_key[ARRAY_SIZE(netdev_lock_type)];
-static struct lock_class_key netdev_addr_lock_key[ARRAY_SIZE(netdev_lock_type)];
-
-static inline unsigned short netdev_lock_pos(unsigned short dev_type)
-{
-        int i;
-
-        for (i = 0; i < ARRAY_SIZE(netdev_lock_type); i++)
-                if (netdev_lock_type[i] == dev_type)
-                        return i;
-        /* the last key is used by default */
-        return ARRAY_SIZE(netdev_lock_type) - 1;
-}
-
-static inline void netdev_set_xmit_lockdep_class(spinlock_t *lock,
-                                                 unsigned short dev_type)
-{
-        int i;
-
-        i = netdev_lock_pos(dev_type);
-        lockdep_set_class_and_name(lock, &netdev_xmit_lock_key[i],
-                                   netdev_lock_name[i]);
-}
-
-static inline void netdev_set_addr_lockdep_class(struct net_device *dev)
-{
-        int i;
-
-        i = netdev_lock_pos(dev->type);
-        lockdep_set_class_and_name(&dev->addr_list_lock,
-                                   &netdev_addr_lock_key[i],
-                                   netdev_lock_name[i]);
-}
-#else
-static inline void netdev_set_xmit_lockdep_class(spinlock_t *lock,
-                                                 unsigned short dev_type)
-{
-}
-static inline void netdev_set_addr_lockdep_class(struct net_device *dev)
-{
-}
-#endif
-
 /*******************************************************************************
  *
  *              Protocol management and registration routines
@@ -6489,6 +6408,9 @@ struct netdev_adjacent {
         /* upper master flag, there can only be one master device per list */
         bool master;
 
+        /* lookup ignore flag */
+        bool ignore;
+
         /* counter for the number of times this device was added to us */
         u16 ref_nr;
 
@@ -6511,7 +6433,7 @@ static struct netdev_adjacent *__netdev_find_adj(struct net_device *adj_dev,
         return NULL;
 }
 
-static int __netdev_has_upper_dev(struct net_device *upper_dev, void *data)
+static int ____netdev_has_upper_dev(struct net_device *upper_dev, void *data)
 {
         struct net_device *dev = data;
 
@@ -6532,7 +6454,7 @@ bool netdev_has_upper_dev(struct net_device *dev,
 {
         ASSERT_RTNL();
 
-        return netdev_walk_all_upper_dev_rcu(dev, __netdev_has_upper_dev,
+        return netdev_walk_all_upper_dev_rcu(dev, ____netdev_has_upper_dev,
                                              upper_dev);
 }
 EXPORT_SYMBOL(netdev_has_upper_dev);
@@ -6550,7 +6472,7 @@ EXPORT_SYMBOL(netdev_has_upper_dev);
 bool netdev_has_upper_dev_all_rcu(struct net_device *dev,
                                   struct net_device *upper_dev)
 {
-        return !!netdev_walk_all_upper_dev_rcu(dev, __netdev_has_upper_dev,
+        return !!netdev_walk_all_upper_dev_rcu(dev, ____netdev_has_upper_dev,
                                                upper_dev);
 }
 EXPORT_SYMBOL(netdev_has_upper_dev_all_rcu);
@@ -6594,6 +6516,22 @@ struct net_device *netdev_master_upper_dev_get(struct net_device *dev)
 }
 EXPORT_SYMBOL(netdev_master_upper_dev_get);
 
+static struct net_device *__netdev_master_upper_dev_get(struct net_device *dev)
+{
+        struct netdev_adjacent *upper;
+
+        ASSERT_RTNL();
+
+        if (list_empty(&dev->adj_list.upper))
+                return NULL;
+
+        upper = list_first_entry(&dev->adj_list.upper,
+                                 struct netdev_adjacent, list);
+        if (likely(upper->master) && !upper->ignore)
+                return upper->dev;
+        return NULL;
+}
+
 /**
  * netdev_has_any_lower_dev - Check if device is linked to some device
  * @dev: device
@@ -6644,6 +6582,23 @@ struct net_device *netdev_upper_get_next_dev_rcu(struct net_device *dev,
 }
 EXPORT_SYMBOL(netdev_upper_get_next_dev_rcu);
 
+static struct net_device *__netdev_next_upper_dev(struct net_device *dev,
+                                                  struct list_head **iter,
+                                                  bool *ignore)
+{
+        struct netdev_adjacent *upper;
+
+        upper = list_entry((*iter)->next, struct netdev_adjacent, list);
+
+        if (&upper->list == &dev->adj_list.upper)
+                return NULL;
+
+        *iter = &upper->list;
+        *ignore = upper->ignore;
+
+        return upper->dev;
+}
+
 static struct net_device *netdev_next_upper_dev_rcu(struct net_device *dev,
                                                     struct list_head **iter)
 {
@@ -6661,34 +6616,111 @@ static struct net_device *netdev_next_upper_dev_rcu(struct net_device *dev,
         return upper->dev;
 }
 
+static int __netdev_walk_all_upper_dev(struct net_device *dev,
+                                       int (*fn)(struct net_device *dev,
+                                                 void *data),
+                                       void *data)
+{
+        struct net_device *udev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
+        bool ignore;
+
+        now = dev;
+        iter = &dev->adj_list.upper;
+
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+
+                next = NULL;
+                while (1) {
+                        udev = __netdev_next_upper_dev(now, &iter, &ignore);
+                        if (!udev)
+                                break;
+                        if (ignore)
+                                continue;
+
+                        next = udev;
+                        niter = &udev->adj_list.upper;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+
+                now = next;
+                iter = niter;
+        }
+
+        return 0;
+}
+
 int netdev_walk_all_upper_dev_rcu(struct net_device *dev,
                                   int (*fn)(struct net_device *dev,
                                             void *data),
                                   void *data)
 {
-        struct net_device *udev;
-        struct list_head *iter;
-        int ret;
+        struct net_device *udev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
 
-        for (iter = &dev->adj_list.upper,
-             udev = netdev_next_upper_dev_rcu(dev, &iter);
-             udev;
-             udev = netdev_next_upper_dev_rcu(dev, &iter)) {
-                /* first is the upper device itself */
-                ret = fn(udev, data);
-                if (ret)
-                        return ret;
+        now = dev;
+        iter = &dev->adj_list.upper;
 
-                /* then look at all of its upper devices */
-                ret = netdev_walk_all_upper_dev_rcu(udev, fn, data);
-                if (ret)
-                        return ret;
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+
+                next = NULL;
+                while (1) {
+                        udev = netdev_next_upper_dev_rcu(now, &iter);
+                        if (!udev)
+                                break;
+
+                        next = udev;
+                        niter = &udev->adj_list.upper;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+
+                now = next;
+                iter = niter;
         }
 
         return 0;
 }
 EXPORT_SYMBOL_GPL(netdev_walk_all_upper_dev_rcu);
 
+static bool __netdev_has_upper_dev(struct net_device *dev,
+                                   struct net_device *upper_dev)
+{
+        ASSERT_RTNL();
+
+        return __netdev_walk_all_upper_dev(dev, ____netdev_has_upper_dev,
+                                           upper_dev);
+}
+
 /**
  * netdev_lower_get_next_private - Get the next ->private from the
  *                                 lower neighbour list
@@ -6785,34 +6817,119 @@ static struct net_device *netdev_next_lower_dev(struct net_device *dev,
         return lower->dev;
 }
 
+static struct net_device *__netdev_next_lower_dev(struct net_device *dev,
+                                                  struct list_head **iter,
+                                                  bool *ignore)
+{
+        struct netdev_adjacent *lower;
+
+        lower = list_entry((*iter)->next, struct netdev_adjacent, list);
+
+        if (&lower->list == &dev->adj_list.lower)
+                return NULL;
+
+        *iter = &lower->list;
+        *ignore = lower->ignore;
+
+        return lower->dev;
+}
+
 int netdev_walk_all_lower_dev(struct net_device *dev,
                               int (*fn)(struct net_device *dev,
                                         void *data),
                               void *data)
 {
-        struct net_device *ldev;
-        struct list_head *iter;
-        int ret;
+        struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
 
-        for (iter = &dev->adj_list.lower,
-             ldev = netdev_next_lower_dev(dev, &iter);
-             ldev;
-             ldev = netdev_next_lower_dev(dev, &iter)) {
-                /* first is the lower device itself */
-                ret = fn(ldev, data);
-                if (ret)
-                        return ret;
+        now = dev;
+        iter = &dev->adj_list.lower;
 
-                /* then look at all of its lower devices */
-                ret = netdev_walk_all_lower_dev(ldev, fn, data);
-                if (ret)
-                        return ret;
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+
+                next = NULL;
+                while (1) {
+                        ldev = netdev_next_lower_dev(now, &iter);
+                        if (!ldev)
+                                break;
+
+                        next = ldev;
+                        niter = &ldev->adj_list.lower;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+
+                now = next;
+                iter = niter;
         }
 
         return 0;
 }
 EXPORT_SYMBOL_GPL(netdev_walk_all_lower_dev);
 
+static int __netdev_walk_all_lower_dev(struct net_device *dev,
+                                       int (*fn)(struct net_device *dev,
+                                                 void *data),
+                                       void *data)
+{
+        struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
+        bool ignore;
+
+        now = dev;
+        iter = &dev->adj_list.lower;
+
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+
+                next = NULL;
+                while (1) {
+                        ldev = __netdev_next_lower_dev(now, &iter, &ignore);
+                        if (!ldev)
+                                break;
+                        if (ignore)
+                                continue;
+
+                        next = ldev;
+                        niter = &ldev->adj_list.lower;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+
+                now = next;
+                iter = niter;
+        }
+
+        return 0;
+}
+
 static struct net_device *netdev_next_lower_dev_rcu(struct net_device *dev,
                                                     struct list_head **iter)
 {
@@ -6827,28 +6944,99 @@ static struct net_device *netdev_next_lower_dev_rcu(struct net_device *dev,
         return lower->dev;
 }
 
-int netdev_walk_all_lower_dev_rcu(struct net_device *dev,
-                                  int (*fn)(struct net_device *dev,
-                                            void *data),
-                                  void *data)
+static u8 __netdev_upper_depth(struct net_device *dev)
+{
+        struct net_device *udev;
+        struct list_head *iter;
+        u8 max_depth = 0;
+        bool ignore;
+
+        for (iter = &dev->adj_list.upper,
+             udev = __netdev_next_upper_dev(dev, &iter, &ignore);
+             udev;
+             udev = __netdev_next_upper_dev(dev, &iter, &ignore)) {
+                if (ignore)
+                        continue;
+                if (max_depth < udev->upper_level)
+                        max_depth = udev->upper_level;
+        }
+
+        return max_depth;
+}
+
+static u8 __netdev_lower_depth(struct net_device *dev)
 {
         struct net_device *ldev;
         struct list_head *iter;
-        int ret;
+        u8 max_depth = 0;
+        bool ignore;
 
         for (iter = &dev->adj_list.lower,
-             ldev = netdev_next_lower_dev_rcu(dev, &iter);
+             ldev = __netdev_next_lower_dev(dev, &iter, &ignore);
              ldev;
-             ldev = netdev_next_lower_dev_rcu(dev, &iter)) {
-                /* first is the lower device itself */
-                ret = fn(ldev, data);
-                if (ret)
-                        return ret;
+             ldev = __netdev_next_lower_dev(dev, &iter, &ignore)) {
+                if (ignore)
+                        continue;
+                if (max_depth < ldev->lower_level)
+                        max_depth = ldev->lower_level;
+        }
 
-                /* then look at all of its lower devices */
-                ret = netdev_walk_all_lower_dev_rcu(ldev, fn, data);
-                if (ret)
-                        return ret;
+        return max_depth;
+}
+
+static int __netdev_update_upper_level(struct net_device *dev, void *data)
+{
+        dev->upper_level = __netdev_upper_depth(dev) + 1;
+        return 0;
+}
+
+static int __netdev_update_lower_level(struct net_device *dev, void *data)
+{
+        dev->lower_level = __netdev_lower_depth(dev) + 1;
+        return 0;
+}
+
+int netdev_walk_all_lower_dev_rcu(struct net_device *dev,
+                                  int (*fn)(struct net_device *dev,
+                                            void *data),
+                                  void *data)
+{
+        struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
+        struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
+        int ret, cur = 0;
+
+        now = dev;
+        iter = &dev->adj_list.lower;
+
+        while (1) {
+                if (now != dev) {
+                        ret = fn(now, data);
+                        if (ret)
+                                return ret;
+                }
+
+                next = NULL;
+                while (1) {
+                        ldev = netdev_next_lower_dev_rcu(now, &iter);
+                        if (!ldev)
+                                break;
+
+                        next = ldev;
+                        niter = &ldev->adj_list.lower;
+                        dev_stack[cur] = now;
+                        iter_stack[cur++] = iter;
+                        break;
+                }
+
+                if (!next) {
+                        if (!cur)
+                                return 0;
+                        next = dev_stack[--cur];
+                        niter = iter_stack[cur];
+                }
+
+                now = next;
+                iter = niter;
         }
 
         return 0;
@@ -6952,6 +7140,7 @@ static int __netdev_adjacent_dev_insert(struct net_device *dev,
         adj->master = master;
         adj->ref_nr = 1;
         adj->private = private;
+        adj->ignore = false;
         dev_hold(adj_dev);
 
         pr_debug("Insert adjacency: dev %s adj_dev %s adj->ref_nr %d; dev_hold on %s\n",
@@ -7102,14 +7291,17 @@ static int __netdev_upper_dev_link(struct net_device *dev,
                 return -EBUSY;
 
         /* To prevent loops, check if dev is not upper device to upper_dev. */
-        if (netdev_has_upper_dev(upper_dev, dev))
+        if (__netdev_has_upper_dev(upper_dev, dev))
                 return -EBUSY;
 
+        if ((dev->lower_level + upper_dev->upper_level) > MAX_NEST_DEV)
+                return -EMLINK;
+
         if (!master) {
-                if (netdev_has_upper_dev(dev, upper_dev))
+                if (__netdev_has_upper_dev(dev, upper_dev))
                         return -EEXIST;
         } else {
-                master_dev = netdev_master_upper_dev_get(dev);
+                master_dev = __netdev_master_upper_dev_get(dev);
                 if (master_dev)
                         return master_dev == upper_dev ? -EEXIST : -EBUSY;
         }
@@ -7131,6 +7323,13 @@ static int __netdev_upper_dev_link(struct net_device *dev,
         if (ret)
                 goto rollback;
 
+        __netdev_update_upper_level(dev, NULL);
+        __netdev_walk_all_lower_dev(dev, __netdev_update_upper_level, NULL);
+
+        __netdev_update_lower_level(upper_dev, NULL);
+        __netdev_walk_all_upper_dev(upper_dev, __netdev_update_lower_level,
+                                    NULL);
+
         return 0;
 
 rollback:
@@ -7213,9 +7412,96 @@ void netdev_upper_dev_unlink(struct net_device *dev,
 
         call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
                                       &changeupper_info.info);
+
+        __netdev_update_upper_level(dev, NULL);
+        __netdev_walk_all_lower_dev(dev, __netdev_update_upper_level, NULL);
+
+        __netdev_update_lower_level(upper_dev, NULL);
+        __netdev_walk_all_upper_dev(upper_dev, __netdev_update_lower_level,
+                                    NULL);
 }
 EXPORT_SYMBOL(netdev_upper_dev_unlink);
 
+static void __netdev_adjacent_dev_set(struct net_device *upper_dev,
+                                      struct net_device *lower_dev,
+                                      bool val)
+{
+        struct netdev_adjacent *adj;
+
+        adj = __netdev_find_adj(lower_dev, &upper_dev->adj_list.lower);
+        if (adj)
+                adj->ignore = val;
+
+        adj = __netdev_find_adj(upper_dev, &lower_dev->adj_list.upper);
+        if (adj)
+                adj->ignore = val;
+}
+
+static void netdev_adjacent_dev_disable(struct net_device *upper_dev,
+                                        struct net_device *lower_dev)
+{
+        __netdev_adjacent_dev_set(upper_dev, lower_dev, true);
+}
+
+static void netdev_adjacent_dev_enable(struct net_device *upper_dev,
+                                       struct net_device *lower_dev)
+{
+        __netdev_adjacent_dev_set(upper_dev, lower_dev, false);
+}
+
+int netdev_adjacent_change_prepare(struct net_device *old_dev,
+                                   struct net_device *new_dev,
+                                   struct net_device *dev,
+                                   struct netlink_ext_ack *extack)
+{
+        int err;
+
+        if (!new_dev)
+                return 0;
+
+        if (old_dev && new_dev != old_dev)
+                netdev_adjacent_dev_disable(dev, old_dev);
+
+        err = netdev_upper_dev_link(new_dev, dev, extack);
+        if (err) {
+                if (old_dev && new_dev != old_dev)
+                        netdev_adjacent_dev_enable(dev, old_dev);
+                return err;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(netdev_adjacent_change_prepare);
+
+void netdev_adjacent_change_commit(struct net_device *old_dev,
+                                   struct net_device *new_dev,
+                                   struct net_device *dev)
+{
+        if (!new_dev || !old_dev)
+                return;
+
+        if (new_dev == old_dev)
+                return;
+
+        netdev_adjacent_dev_enable(dev, old_dev);
+        netdev_upper_dev_unlink(old_dev, dev);
+}
+EXPORT_SYMBOL(netdev_adjacent_change_commit);
+
+void netdev_adjacent_change_abort(struct net_device *old_dev,
+                                  struct net_device *new_dev,
+                                  struct net_device *dev)
+{
+        if (!new_dev)
+                return;
+
+        if (old_dev && new_dev != old_dev)
+                netdev_adjacent_dev_enable(dev, old_dev);
+
+        netdev_upper_dev_unlink(new_dev, dev);
+}
+EXPORT_SYMBOL(netdev_adjacent_change_abort);
+
 /**
  * netdev_bonding_info_change - Dispatch event about slave change
  * @dev: device
@@ -7329,25 +7615,6 @@ void *netdev_lower_dev_get_private(struct net_device *dev,
 EXPORT_SYMBOL(netdev_lower_dev_get_private);
 
 
-int dev_get_nest_level(struct net_device *dev)
-{
-        struct net_device *lower = NULL;
-        struct list_head *iter;
-        int max_nest = -1;
-        int nest;
-
-        ASSERT_RTNL();
-
-        netdev_for_each_lower_dev(dev, lower, iter) {
-                nest = dev_get_nest_level(lower);
-                if (max_nest < nest)
-                        max_nest = nest;
-        }
-
-        return max_nest + 1;
-}
-EXPORT_SYMBOL(dev_get_nest_level);
-
 /**
  * netdev_lower_change - Dispatch event about lower device state change
  * @lower_dev: device
@@ -8154,7 +8421,8 @@ int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
                         return -EINVAL;
                 }
 
-                if (prog->aux->id == prog_id) {
+                /* prog->aux->id may be 0 for orphaned device-bound progs */
+                if (prog->aux->id && prog->aux->id == prog_id) {
                         bpf_prog_put(prog);
                         return 0;
                 }
@@ -8619,7 +8887,7 @@ static void netdev_init_one_queue(struct net_device *dev,
 {
         /* Initialize queue lock */
         spin_lock_init(&queue->_xmit_lock);
-        netdev_set_xmit_lockdep_class(&queue->_xmit_lock, dev->type);
+        lockdep_set_class(&queue->_xmit_lock, &dev->qdisc_xmit_lock_key);
         queue->xmit_lock_owner = -1;
         netdev_queue_numa_node_write(queue, NUMA_NO_NODE);
         queue->dev = dev;
@@ -8666,6 +8934,43 @@ void netif_tx_stop_all_queues(struct net_device *dev)
 }
 EXPORT_SYMBOL(netif_tx_stop_all_queues);
 
+static void netdev_register_lockdep_key(struct net_device *dev)
+{
+        lockdep_register_key(&dev->qdisc_tx_busylock_key);
+        lockdep_register_key(&dev->qdisc_running_key);
+        lockdep_register_key(&dev->qdisc_xmit_lock_key);
+        lockdep_register_key(&dev->addr_list_lock_key);
+}
+
+static void netdev_unregister_lockdep_key(struct net_device *dev)
+{
+        lockdep_unregister_key(&dev->qdisc_tx_busylock_key);
+        lockdep_unregister_key(&dev->qdisc_running_key);
+        lockdep_unregister_key(&dev->qdisc_xmit_lock_key);
+        lockdep_unregister_key(&dev->addr_list_lock_key);
+}
+
+void netdev_update_lockdep_key(struct net_device *dev)
+{
+        struct netdev_queue *queue;
+        int i;
+
+        lockdep_unregister_key(&dev->qdisc_xmit_lock_key);
+        lockdep_unregister_key(&dev->addr_list_lock_key);
+
+        lockdep_register_key(&dev->qdisc_xmit_lock_key);
+        lockdep_register_key(&dev->addr_list_lock_key);
+
+        lockdep_set_class(&dev->addr_list_lock, &dev->addr_list_lock_key);
+        for (i = 0; i < dev->num_tx_queues; i++) {
+                queue = netdev_get_tx_queue(dev, i);
+
+                lockdep_set_class(&queue->_xmit_lock,
+                                  &dev->qdisc_xmit_lock_key);
+        }
+}
+EXPORT_SYMBOL(netdev_update_lockdep_key);
+
 /**
  *      register_netdevice      - register a network device
  *      @dev: device to register
@@ -8700,7 +9005,7 @@ int register_netdevice(struct net_device *dev)
         BUG_ON(!net);
 
         spin_lock_init(&dev->addr_list_lock);
-        netdev_set_addr_lockdep_class(dev);
+        lockdep_set_class(&dev->addr_list_lock, &dev->addr_list_lock_key);
 
         ret = dev_get_valid_name(net, dev, dev->name);
         if (ret < 0)
@@ -9210,8 +9515,12 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
 
         dev_net_set(dev, &init_net);
 
+        netdev_register_lockdep_key(dev);
+
         dev->gso_max_size = GSO_MAX_SIZE;
         dev->gso_max_segs = GSO_MAX_SEGS;
+        dev->upper_level = 1;
+        dev->lower_level = 1;
 
         INIT_LIST_HEAD(&dev->napi_list);
         INIT_LIST_HEAD(&dev->unreg_list);
@@ -9292,6 +9601,8 @@ void free_netdev(struct net_device *dev)
         free_percpu(dev->pcpu_refcnt);
         dev->pcpu_refcnt = NULL;
 
+        netdev_unregister_lockdep_key(dev);
+
         /*  Compatibility with error handling in drivers */
         if (dev->reg_state == NETREG_UNINITIALIZED) {
                 netdev_freemem(dev);
@@ -9460,7 +9771,7 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
         call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
         rcu_barrier();
 
-        new_nsid = peernet2id_alloc(dev_net(dev), net);
+        new_nsid = peernet2id_alloc(dev_net(dev), net, GFP_KERNEL);
         /* If there is an ifindex conflict assign a new one */
         if (__dev_get_by_index(net, dev->ifindex))
                 new_ifindex = dev_new_index(net);
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index 6393ba930097..2f949b5a1eb9 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -637,7 +637,7 @@ int dev_uc_sync(struct net_device *to, struct net_device *from)
         if (to->addr_len != from->addr_len)
                 return -EINVAL;
 
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
         err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len);
         if (!err)
                 __dev_set_rx_mode(to);
@@ -667,7 +667,7 @@ int dev_uc_sync_multiple(struct net_device *to, struct net_device *from)
         if (to->addr_len != from->addr_len)
                 return -EINVAL;
 
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
         err = __hw_addr_sync_multiple(&to->uc, &from->uc, to->addr_len);
         if (!err)
                 __dev_set_rx_mode(to);
@@ -691,7 +691,7 @@ void dev_uc_unsync(struct net_device *to, struct net_device *from)
                 return;
 
         netif_addr_lock_bh(from);
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
         __hw_addr_unsync(&to->uc, &from->uc, to->addr_len);
         __dev_set_rx_mode(to);
         netif_addr_unlock(to);
@@ -858,7 +858,7 @@ int dev_mc_sync(struct net_device *to, struct net_device *from)
         if (to->addr_len != from->addr_len)
                 return -EINVAL;
 
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
         err = __hw_addr_sync(&to->mc, &from->mc, to->addr_len);
         if (!err)
                 __dev_set_rx_mode(to);
@@ -888,7 +888,7 @@ int dev_mc_sync_multiple(struct net_device *to, struct net_device *from)
         if (to->addr_len != from->addr_len)
                 return -EINVAL;
 
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
         err = __hw_addr_sync_multiple(&to->mc, &from->mc, to->addr_len);
         if (!err)
                 __dev_set_rx_mode(to);
@@ -912,7 +912,7 @@ void dev_mc_unsync(struct net_device *to, struct net_device *from)
                 return;
 
         netif_addr_lock_bh(from);
-        netif_addr_lock_nested(to);
+        netif_addr_lock(to);
         __hw_addr_unsync(&to->mc, &from->mc, to->addr_len);
         __dev_set_rx_mode(to);
         netif_addr_unlock(to);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index c763106c73fc..cd9bc67381b2 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1396,11 +1396,13 @@ static int ethtool_reset(struct net_device *dev, char __user *useraddr)
 
 static int ethtool_get_wol(struct net_device *dev, char __user *useraddr)
 {
-        struct ethtool_wolinfo wol = { .cmd = ETHTOOL_GWOL };
+        struct ethtool_wolinfo wol;
 
         if (!dev->ethtool_ops->get_wol)
                 return -EOPNOTSUPP;
 
+        memset(&wol, 0, sizeof(struct ethtool_wolinfo));
+        wol.cmd = ETHTOOL_GWOL;
         dev->ethtool_ops->get_wol(dev, &wol);
 
         if (copy_to_user(useraddr, &wol, sizeof(wol)))
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 7c09d87d3269..68eda10d0680 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1350,30 +1350,21 @@ out_bad:
 }
 EXPORT_SYMBOL(__skb_flow_dissect);
 
-static u32 hashrnd __read_mostly;
+static siphash_key_t hashrnd __read_mostly;
 static __always_inline void __flow_hash_secret_init(void)
 {
         net_get_random_once(&hashrnd, sizeof(hashrnd));
 }
 
-static __always_inline u32 __flow_hash_words(const u32 *words, u32 length,
-                                             u32 keyval)
+static const void *flow_keys_hash_start(const struct flow_keys *flow)
 {
-        return jhash2(words, length, keyval);
-}
-
-static inline const u32 *flow_keys_hash_start(const struct flow_keys *flow)
-{
-        const void *p = flow;
-
-        BUILD_BUG_ON(FLOW_KEYS_HASH_OFFSET % sizeof(u32));
-        return (const u32 *)(p + FLOW_KEYS_HASH_OFFSET);
+        BUILD_BUG_ON(FLOW_KEYS_HASH_OFFSET % SIPHASH_ALIGNMENT);
+        return &flow->FLOW_KEYS_HASH_START_FIELD;
 }
 
 static inline size_t flow_keys_hash_length(const struct flow_keys *flow)
 {
         size_t diff = FLOW_KEYS_HASH_OFFSET + sizeof(flow->addrs);
-        BUILD_BUG_ON((sizeof(*flow) - FLOW_KEYS_HASH_OFFSET) % sizeof(u32));
         BUILD_BUG_ON(offsetof(typeof(*flow), addrs) !=
                      sizeof(*flow) - sizeof(flow->addrs));
 
@@ -1388,7 +1379,7 @@ static inline size_t flow_keys_hash_length(const struct flow_keys *flow)
                 diff -= sizeof(flow->addrs.tipckey);
                 break;
         }
-        return (sizeof(*flow) - diff) / sizeof(u32);
+        return sizeof(*flow) - diff;
 }
 
 __be32 flow_get_u32_src(const struct flow_keys *flow)
@@ -1454,14 +1445,15 @@ static inline void __flow_hash_consistentify(struct flow_keys *keys)
         }
 }
 
-static inline u32 __flow_hash_from_keys(struct flow_keys *keys, u32 keyval)
+static inline u32 __flow_hash_from_keys(struct flow_keys *keys,
+                                        const siphash_key_t *keyval)
 {
         u32 hash;
 
         __flow_hash_consistentify(keys);
 
-        hash = __flow_hash_words(flow_keys_hash_start(keys),
-                                 flow_keys_hash_length(keys), keyval);
+        hash = siphash(flow_keys_hash_start(keys),
+                       flow_keys_hash_length(keys), keyval);
         if (!hash)
                 hash = 1;
 
@@ -1471,12 +1463,13 @@ static inline u32 __flow_hash_from_keys(struct flow_keys *keys, u32 keyval)
 u32 flow_hash_from_keys(struct flow_keys *keys)
 {
         __flow_hash_secret_init();
-        return __flow_hash_from_keys(keys, hashrnd);
+        return __flow_hash_from_keys(keys, &hashrnd);
 }
 EXPORT_SYMBOL(flow_hash_from_keys);
 
 static inline u32 ___skb_get_hash(const struct sk_buff *skb,
-                                  struct flow_keys *keys, u32 keyval)
+                                  struct flow_keys *keys,
+                                  const siphash_key_t *keyval)
 {
         skb_flow_dissect_flow_keys(skb, keys,
                                    FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
@@ -1524,7 +1517,7 @@ u32 __skb_get_hash_symmetric(const struct sk_buff *skb)
                            &keys, NULL, 0, 0, 0,
                            FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
 
-        return __flow_hash_from_keys(&keys, hashrnd);
+        return __flow_hash_from_keys(&keys, &hashrnd);
 }
 EXPORT_SYMBOL_GPL(__skb_get_hash_symmetric);
 
@@ -1544,13 +1537,14 @@ void __skb_get_hash(struct sk_buff *skb)
 
         __flow_hash_secret_init();
 
-        hash = ___skb_get_hash(skb, &keys, hashrnd);
+        hash = ___skb_get_hash(skb, &keys, &hashrnd);
 
         __skb_set_sw_hash(skb, hash, flow_keys_have_l4(&keys));
 }
 EXPORT_SYMBOL(__skb_get_hash);
 
-__u32 skb_get_hash_perturb(const struct sk_buff *skb, u32 perturb)
+__u32 skb_get_hash_perturb(const struct sk_buff *skb,
+                           const siphash_key_t *perturb)
 {
         struct flow_keys keys;
 
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index f93785e5833c..74cfb8b5ab33 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -88,11 +88,16 @@ static int bpf_lwt_input_reroute(struct sk_buff *skb)
         int err = -EINVAL;
 
         if (skb->protocol == htons(ETH_P_IP)) {
+                struct net_device *dev = skb_dst(skb)->dev;
                 struct iphdr *iph = ip_hdr(skb);
 
+                dev_hold(dev);
+                skb_dst_drop(skb);
                 err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
-                                           iph->tos, skb_dst(skb)->dev);
+                                           iph->tos, dev);
+                dev_put(dev);
         } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                skb_dst_drop(skb);
                 err = ipv6_stub->ipv6_route_input(skb);
         } else {
                 err = -EAFNOSUPPORT;
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 6d3e4821b02d..39402840025e 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -246,11 +246,11 @@ static int __peernet2id(struct net *net, struct net *peer)
 }
 
 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
-                              struct nlmsghdr *nlh);
+                              struct nlmsghdr *nlh, gfp_t gfp);
 /* This function returns the id of a peer netns. If no id is assigned, one will
  * be allocated and returned.
  */
-int peernet2id_alloc(struct net *net, struct net *peer)
+int peernet2id_alloc(struct net *net, struct net *peer, gfp_t gfp)
 {
         bool alloc = false, alive = false;
         int id;
@@ -269,7 +269,7 @@ int peernet2id_alloc(struct net *net, struct net *peer)
         id = __peernet2id_alloc(net, peer, &alloc);
         spin_unlock_bh(&net->nsid_lock);
         if (alloc && id >= 0)
-                rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL);
+                rtnl_net_notifyid(net, RTM_NEWNSID, id, 0, NULL, gfp);
         if (alive)
                 put_net(peer);
         return id;
@@ -479,6 +479,7 @@ struct net *copy_net_ns(unsigned long flags,
 
         if (rv < 0) {
 put_userns:
+                key_remove_domain(net->key_domain);
                 put_user_ns(user_ns);
                 net_drop_ns(net);
 dec_ucounts:
@@ -533,7 +534,8 @@ static void unhash_nsid(struct net *net, struct net *last)
                         idr_remove(&tmp->netns_ids, id);
                 spin_unlock_bh(&tmp->nsid_lock);
                 if (id >= 0)
-                        rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL);
+                        rtnl_net_notifyid(tmp, RTM_DELNSID, id, 0, NULL,
+                                          GFP_KERNEL);
                 if (tmp == last)
                         break;
         }
@@ -766,7 +768,7 @@ static int rtnl_net_newid(struct sk_buff *skb, struct nlmsghdr *nlh,
         spin_unlock_bh(&net->nsid_lock);
         if (err >= 0) {
                 rtnl_net_notifyid(net, RTM_NEWNSID, err, NETLINK_CB(skb).portid,
-                                  nlh);
+                                  nlh, GFP_KERNEL);
                 err = 0;
         } else if (err == -ENOSPC && nsid >= 0) {
                 err = -EEXIST;
@@ -1054,7 +1056,7 @@ end:
 }
 
 static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
-                              struct nlmsghdr *nlh)
+                              struct nlmsghdr *nlh, gfp_t gfp)
 {
         struct net_fill_args fillargs = {
                 .portid = portid,
@@ -1065,7 +1067,7 @@ static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
         struct sk_buff *msg;
         int err = -ENOMEM;
 
-        msg = nlmsg_new(rtnl_net_get_size(), GFP_KERNEL);
+        msg = nlmsg_new(rtnl_net_get_size(), gfp);
         if (!msg)
                 goto out;
 
@@ -1073,7 +1075,7 @@ static void rtnl_net_notifyid(struct net *net, int cmd, int id, u32 portid,
         if (err < 0)
                 goto err_out;
 
-        rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, 0);
+        rtnl_notify(msg, net, portid, RTNLGRP_NSID, nlh, gfp);
         return;
 
 err_out:
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 1ee6460f8275..c81cd80114d9 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1523,7 +1523,7 @@ static noinline_for_stack int nla_put_ifalias(struct sk_buff *skb,
 
 static int rtnl_fill_link_netnsid(struct sk_buff *skb,
                                   const struct net_device *dev,
-                                  struct net *src_net)
+                                  struct net *src_net, gfp_t gfp)
 {
         bool put_iflink = false;
 
@@ -1531,7 +1531,7 @@ static int rtnl_fill_link_netnsid(struct sk_buff *skb,
                 struct net *link_net = dev->rtnl_link_ops->get_link_net(dev);
 
                 if (!net_eq(dev_net(dev), link_net)) {
-                        int id = peernet2id_alloc(src_net, link_net);
+                        int id = peernet2id_alloc(src_net, link_net, gfp);
 
                         if (nla_put_s32(skb, IFLA_LINK_NETNSID, id))
                                 return -EMSGSIZE;
@@ -1589,7 +1589,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
                             int type, u32 pid, u32 seq, u32 change,
                             unsigned int flags, u32 ext_filter_mask,
                             u32 event, int *new_nsid, int new_ifindex,
-                            int tgt_netnsid)
+                            int tgt_netnsid, gfp_t gfp)
 {
         struct ifinfomsg *ifm;
         struct nlmsghdr *nlh;
@@ -1681,7 +1681,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
                         goto nla_put_failure;
         }
 
-        if (rtnl_fill_link_netnsid(skb, dev, src_net))
+        if (rtnl_fill_link_netnsid(skb, dev, src_net, gfp))
                 goto nla_put_failure;
 
         if (new_nsid &&
@@ -2001,7 +2001,7 @@ walk_entries:
                                                NETLINK_CB(cb->skb).portid,
                                                nlh->nlmsg_seq, 0, flags,
                                                ext_filter_mask, 0, NULL, 0,
-                                               netnsid);
+                                               netnsid, GFP_KERNEL);
 
                         if (err < 0) {
                                 if (likely(skb->len))
@@ -2355,6 +2355,7 @@ static int do_set_master(struct net_device *dev, int ifindex,
                         err = ops->ndo_del_slave(upper_dev, dev);
                         if (err)
                                 return err;
+                        netdev_update_lockdep_key(dev);
                 } else {
                         return -EOPNOTSUPP;
                 }
@@ -3359,7 +3360,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr *nlh,
         err = rtnl_fill_ifinfo(nskb, dev, net,
                                RTM_NEWLINK, NETLINK_CB(skb).portid,
                                nlh->nlmsg_seq, 0, 0, ext_filter_mask,
-                               0, NULL, 0, netnsid);
+                               0, NULL, 0, netnsid, GFP_KERNEL);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in if_nlmsg_size */
                 WARN_ON(err == -EMSGSIZE);
@@ -3471,7 +3472,7 @@ struct sk_buff *rtmsg_ifinfo_build_skb(int type, struct net_device *dev,
 
         err = rtnl_fill_ifinfo(skb, dev, dev_net(dev),
                                type, 0, 0, change, 0, 0, event,
-                               new_nsid, new_ifindex, -1);
+                               new_nsid, new_ifindex, -1, flags);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in if_nlmsg_size() */
                 WARN_ON(err == -EMSGSIZE);
@@ -3916,7 +3917,7 @@ static int valid_fdb_dump_strict(const struct nlmsghdr *nlh,
         ndm = nlmsg_data(nlh);
         if (ndm->ndm_pad1  || ndm->ndm_pad2  || ndm->ndm_state ||
             ndm->ndm_flags || ndm->ndm_type) {
-                NL_SET_ERR_MSG(extack, "Invalid values in header for fbd dump request");
+                NL_SET_ERR_MSG(extack, "Invalid values in header for fdb dump request");
                 return -EINVAL;
         }
 
diff --git a/net/core/sock.c b/net/core/sock.c
index a515392ba84b..ac78a570e43a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1127,7 +1127,7 @@ set_rcvbuf:
                 break;
                 }
         case SO_INCOMING_CPU:
-                sk->sk_incoming_cpu = val;
+                WRITE_ONCE(sk->sk_incoming_cpu, val);
                 break;
 
         case SO_CNX_ADVICE:
@@ -1476,7 +1476,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 break;
 
         case SO_INCOMING_CPU:
-                v.val = sk->sk_incoming_cpu;
+                v.val = READ_ONCE(sk->sk_incoming_cpu);
                 break;
 
         case SO_MEMINFO:
@@ -3600,7 +3600,7 @@ bool sk_busy_loop_end(void *p, unsigned long start_time)
 {
         struct sock *sk = p;
 
-        return !skb_queue_empty(&sk->sk_receive_queue) ||
+        return !skb_queue_empty_lockless(&sk->sk_receive_queue) ||
                sk_busy_loop_timeout(sk, start_time);
 }
 EXPORT_SYMBOL(sk_busy_loop_end);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index d9b4200ed12d..0d8f782c25cc 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -117,7 +117,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                                                     inet->inet_daddr,
                                                     inet->inet_sport,
                                                     inet->inet_dport);
-        inet->inet_id = dp->dccps_iss ^ jiffies;
+        inet->inet_id = prandom_u32();
 
         err = dccp_connect(sk);
         rt = NULL;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 0ea75286abf4..3349ea81f901 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1205,7 +1205,7 @@ static __poll_t dn_poll(struct file *file, struct socket *sock, poll_table  *wai
         struct dn_scp *scp = DN_SK(sk);
         __poll_t mask = datagram_poll(file, sock, wait);
 
-        if (!skb_queue_empty(&scp->other_receive_queue))
+        if (!skb_queue_empty_lockless(&scp->other_receive_queue))
                 mask |= EPOLLRDBAND;
 
         return mask;
diff --git a/net/dsa/master.c b/net/dsa/master.c
index a8e52c9967f4..3255dfc97f86 100644
--- a/net/dsa/master.c
+++ b/net/dsa/master.c
@@ -310,8 +310,6 @@ static void dsa_master_reset_mtu(struct net_device *dev)
         rtnl_unlock();
 }
 
-static struct lock_class_key dsa_master_addr_list_lock_key;
-
 int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
 {
         int ret;
@@ -325,9 +323,6 @@ int dsa_master_setup(struct net_device *dev, struct dsa_port *cpu_dp)
         wmb();
 
         dev->dsa_ptr = cpu_dp;
-        lockdep_set_class(&dev->addr_list_lock,
-                          &dsa_master_addr_list_lock_key);
-
         ret = dsa_master_ethtool_setup(dev);
         if (ret)
                 return ret;
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 75d58229a4bd..028e65f4b5ba 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1341,15 +1341,6 @@ static int dsa_slave_phy_setup(struct net_device *slave_dev)
         return ret;
 }
 
-static struct lock_class_key dsa_slave_netdev_xmit_lock_key;
-static void dsa_slave_set_lockdep_class_one(struct net_device *dev,
-                                            struct netdev_queue *txq,
-                                            void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock,
-                          &dsa_slave_netdev_xmit_lock_key);
-}
-
 int dsa_slave_suspend(struct net_device *slave_dev)
 {
         struct dsa_port *dp = dsa_slave_to_port(slave_dev);
@@ -1433,9 +1424,6 @@ int dsa_slave_create(struct dsa_port *port)
         slave_dev->max_mtu = ETH_MAX_MTU;
         SET_NETDEV_DEVTYPE(slave_dev, &dsa_type);
 
-        netdev_for_each_tx_queue(slave_dev, dsa_slave_set_lockdep_class_one,
-                                 NULL);
-
         SET_NETDEV_DEV(slave_dev, port->ds->dev);
         slave_dev->dev.of_node = port->dn;
         slave_dev->vlan_features = master->vlan_features;
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index 3297e7fa9945..c0b107cdd715 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -58,13 +58,6 @@ static const struct header_ops lowpan_header_ops = {
         .create = lowpan_header_create,
 };
 
-static int lowpan_dev_init(struct net_device *ldev)
-{
-        netdev_lockdep_set_classes(ldev);
-
-        return 0;
-}
-
 static int lowpan_open(struct net_device *dev)
 {
         if (!open_count)
@@ -96,7 +89,6 @@ static int lowpan_get_iflink(const struct net_device *dev)
 }
 
 static const struct net_device_ops lowpan_netdev_ops = {
-        .ndo_init               = lowpan_dev_init,
         .ndo_start_xmit         = lowpan_xmit,
         .ndo_open               = lowpan_open,
         .ndo_stop               = lowpan_stop,
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 9a0fe0c2fa02..4a8550c49202 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -73,7 +73,7 @@ int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
         reuseport_has_conns(sk, true);
         sk->sk_state = TCP_ESTABLISHED;
         sk_set_txhash(sk);
-        inet->inet_id = jiffies;
+        inet->inet_id = prandom_u32();
 
         sk_dst_set(sk, &rt->dst);
         err = 0;
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index dde77f72e03e..71c78d223dfd 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1148,7 +1148,7 @@ void fib_modify_prefix_metric(struct in_ifaddr *ifa, u32 new_metric)
         if (!(dev->flags & IFF_UP) ||
             ifa->ifa_flags & (IFA_F_SECONDARY | IFA_F_NOPREFIXROUTE) ||
             ipv4_is_zeronet(prefix) ||
-            prefix == ifa->ifa_local || ifa->ifa_prefixlen == 32)
+            (prefix == ifa->ifa_local && ifa->ifa_prefixlen == 32))
                 return;
 
         /* add the new */
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 97824864e40d..83fb00153018 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -240,7 +240,7 @@ static inline int compute_score(struct sock *sk, struct net *net,
                         return -1;
 
                 score = sk->sk_family == PF_INET ? 2 : 1;
-                if (sk->sk_incoming_cpu == raw_smp_processor_id())
+                if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
                         score++;
         }
         return score;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 52690bb3e40f..10636fb6093e 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -509,9 +509,9 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
         key = &tun_info->key;
         if (!(tun_info->key.tun_flags & TUNNEL_ERSPAN_OPT))
                 goto err_free_skb;
-        md = ip_tunnel_info_opts(tun_info);
-        if (!md)
+        if (tun_info->options_len < sizeof(*md))
                 goto err_free_skb;
+        md = ip_tunnel_info_opts(tun_info);
 
         /* ERSPAN has fixed 8 byte GRE header */
         version = md->version;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 814b9b8882a0..3d8baaaf7086 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -645,11 +645,12 @@ void ip_fraglist_prepare(struct sk_buff *skb, struct ip_fraglist_iter *iter)
 EXPORT_SYMBOL(ip_fraglist_prepare);
 
 void ip_frag_init(struct sk_buff *skb, unsigned int hlen,
-                  unsigned int ll_rs, unsigned int mtu,
+                  unsigned int ll_rs, unsigned int mtu, bool DF,
                   struct ip_frag_state *state)
 {
         struct iphdr *iph = ip_hdr(skb);
 
+        state->DF = DF;
         state->hlen = hlen;
         state->ll_rs = ll_rs;
         state->mtu = mtu;
@@ -668,9 +669,6 @@ static void ip_frag_ipcb(struct sk_buff *from, struct sk_buff *to,
         /* Copy the flags to each fragment. */
         IPCB(to)->flags = IPCB(from)->flags;
 
-        if (IPCB(from)->flags & IPSKB_FRAG_PMTU)
-                state->iph->frag_off |= htons(IP_DF);
-
         /* ANK: dirty, but effective trick. Upgrade options only if
          * the segment to be fragmented was THE FIRST (otherwise,
          * options are already fixed) and make it ONCE
@@ -738,6 +736,8 @@ struct sk_buff *ip_frag_next(struct sk_buff *skb, struct ip_frag_state *state)
          */
         iph = ip_hdr(skb2);
         iph->frag_off = htons((state->offset >> 3));
+        if (state->DF)
+                iph->frag_off |= htons(IP_DF);
 
         /*
          *      Added AC : If we are fragmenting a fragment that's not the
@@ -883,7 +883,8 @@ slow_path:
          *      Fragment the datagram.
          */
 
-        ip_frag_init(skb, hlen, ll_rs, mtu, &state);
+        ip_frag_init(skb, hlen, ll_rs, mtu, IPCB(skb)->flags & IPSKB_FRAG_PMTU,
+                     &state);
 
         /*
          *      Keep copying data until we run out.
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 42187a3b82f4..d8876f0e9672 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -584,7 +584,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
         }
         /* This barrier is coupled with smp_wmb() in tcp_reset() */
         smp_rmb();
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                 mask |= EPOLLERR;
 
         return mask;
@@ -1964,7 +1964,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
         if (unlikely(flags & MSG_ERRQUEUE))
                 return inet_recv_error(sk, msg, len, addr_len);
 
-        if (sk_can_busy_loop(sk) && skb_queue_empty(&sk->sk_receive_queue) &&
+        if (sk_can_busy_loop(sk) && skb_queue_empty_lockless(&sk->sk_receive_queue) &&
             (sk->sk_state == TCP_ESTABLISHED))
                 sk_busy_loop(sk, nonblock);
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 6be568334848..67b2dc7a1727 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -303,7 +303,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                                                  inet->inet_daddr);
         }
 
-        inet->inet_id = tp->write_seq ^ jiffies;
+        inet->inet_id = prandom_u32();
 
         if (tcp_fastopen_defer_connect(sk, &err))
                 return err;
@@ -1450,7 +1450,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
         inet_csk(newsk)->icsk_ext_hdr_len = 0;
         if (inet_opt)
                 inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
-        newinet->inet_id = newtp->write_seq ^ jiffies;
+        newinet->inet_id = prandom_u32();
 
         if (!dst) {
                 dst = inet_csk_route_child_sock(sk, newsk, req);
@@ -2681,7 +2681,7 @@ static int __net_init tcp_sk_init(struct net *net)
         net->ipv4.tcp_death_row.sysctl_max_tw_buckets = cnt / 2;
         net->ipv4.tcp_death_row.hashinfo = &tcp_hashinfo;
 
-        net->ipv4.sysctl_max_syn_backlog = max(128, cnt / 256);
+        net->ipv4.sysctl_max_syn_backlog = max(128, cnt / 128);
         net->ipv4.sysctl_tcp_sack = 1;
         net->ipv4.sysctl_tcp_window_scaling = 1;
         net->ipv4.sysctl_tcp_timestamps = 1;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 14bc654b6842..1d58ce829dca 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -388,7 +388,7 @@ static int compute_score(struct sock *sk, struct net *net,
                 return -1;
         score += 4;
 
-        if (sk->sk_incoming_cpu == raw_smp_processor_id())
+        if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
                 score++;
         return score;
 }
@@ -1316,6 +1316,20 @@ static void udp_set_dev_scratch(struct sk_buff *skb)
                 scratch->_tsize_state |= UDP_SKB_IS_STATELESS;
 }
 
+static void udp_skb_csum_unnecessary_set(struct sk_buff *skb)
+{
+        /* We come here after udp_lib_checksum_complete() returned 0.
+         * This means that __skb_checksum_complete() might have
+         * set skb->csum_valid to 1.
+         * On 64bit platforms, we can set csum_unnecessary
+         * to true, but only if the skb is not shared.
+         */
+#if BITS_PER_LONG == 64
+        if (!skb_shared(skb))
+                udp_skb_scratch(skb)->csum_unnecessary = true;
+#endif
+}
+
 static int udp_skb_truesize(struct sk_buff *skb)
 {
         return udp_skb_scratch(skb)->_tsize_state & ~UDP_SKB_IS_STATELESS;
@@ -1550,10 +1564,7 @@ static struct sk_buff *__first_packet_length(struct sock *sk,
                         *total += skb->truesize;
                         kfree_skb(skb);
                 } else {
-                        /* the csum related bits could be changed, refresh
-                         * the scratch area
-                         */
-                        udp_set_dev_scratch(skb);
+                        udp_skb_csum_unnecessary_set(skb);
                         break;
                 }
         }
@@ -1577,7 +1588,7 @@ static int first_packet_length(struct sock *sk)
 
         spin_lock_bh(&rcvq->lock);
         skb = __first_packet_length(sk, rcvq, &total);
-        if (!skb && !skb_queue_empty(sk_queue)) {
+        if (!skb && !skb_queue_empty_lockless(sk_queue)) {
                 spin_lock(&sk_queue->lock);
                 skb_queue_splice_tail_init(sk_queue, rcvq);
                 spin_unlock(&sk_queue->lock);
@@ -1650,7 +1661,7 @@ struct sk_buff *__skb_recv_udp(struct sock *sk, unsigned int flags,
                                 return skb;
                         }
 
-                        if (skb_queue_empty(sk_queue)) {
+                        if (skb_queue_empty_lockless(sk_queue)) {
                                 spin_unlock_bh(&queue->lock);
                                 goto busy_check;
                         }
@@ -1676,7 +1687,7 @@ busy_check:
                                 break;
 
                         sk_busy_loop(sk, flags & MSG_DONTWAIT);
-                } while (!skb_queue_empty(sk_queue));
+                } while (!skb_queue_empty_lockless(sk_queue));
 
                 /* sk_queue is empty, reader_queue may contain peeked packets */
         } while (timeo &&
@@ -2712,7 +2723,7 @@ __poll_t udp_poll(struct file *file, struct socket *sock, poll_table *wait)
         __poll_t mask = datagram_poll(file, sock, wait);
         struct sock *sk = sock->sk;
 
-        if (!skb_queue_empty(&udp_sk(sk)->reader_queue))
+        if (!skb_queue_empty_lockless(&udp_sk(sk)->reader_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         /* Check for false positives due to checksum errors */
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index 783f3c1466da..2fc079284ca4 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -7,6 +7,7 @@
 #include <linux/export.h>
 #include <net/ipv6.h>
 #include <net/ipv6_stubs.h>
+#include <net/addrconf.h>
 #include <net/ip.h>
 
 /* if ipv6 module registers this function is used by xfrm to force all
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index cf60fae9533b..fbe9d4295eac 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -105,7 +105,7 @@ static inline int compute_score(struct sock *sk, struct net *net,
                         return -1;
 
                 score = 1;
-                if (sk->sk_incoming_cpu == raw_smp_processor_id())
+                if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
                         score++;
         }
         return score;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 787d9f2a6e99..923034c52ce4 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -980,9 +980,9 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                 dsfield = key->tos;
                 if (!(tun_info->key.tun_flags & TUNNEL_ERSPAN_OPT))
                         goto tx_err;
-                md = ip_tunnel_info_opts(tun_info);
-                if (!md)
+                if (tun_info->options_len < sizeof(*md))
                         goto tx_err;
+                md = ip_tunnel_info_opts(tun_info);
 
                 tun_id = tunnel_id_to_key32(key->tun_id);
                 if (md->version == 1) {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 6324d3a8cb53..9fec580c968e 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -135,7 +135,7 @@ static int compute_score(struct sock *sk, struct net *net,
                 return -1;
         score++;
 
-        if (sk->sk_incoming_cpu == raw_smp_processor_id())
+        if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
                 score++;
 
         return score;
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index fd5ac2788e45..d3b520b9b2c9 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -56,7 +56,6 @@ static int l2tp_eth_dev_init(struct net_device *dev)
 {
         eth_hw_addr_random(dev);
         eth_broadcast_addr(dev->broadcast);
-        netdev_lockdep_set_classes(dev);
 
         return 0;
 }
diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c
index 4515056ef1c2..f9b16f2b2219 100644
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -193,21 +193,29 @@ struct ip_vs_app *register_ip_vs_app(struct netns_ipvs *ipvs, struct ip_vs_app *
 
         mutex_lock(&__ip_vs_app_mutex);
 
+        /* increase the module use count */
+        if (!ip_vs_use_count_inc()) {
+                err = -ENOENT;
+                goto out_unlock;
+        }
+
         list_for_each_entry(a, &ipvs->app_list, a_list) {
                 if (!strcmp(app->name, a->name)) {
                         err = -EEXIST;
+                        /* decrease the module use count */
+                        ip_vs_use_count_dec();
                         goto out_unlock;
                 }
         }
         a = kmemdup(app, sizeof(*app), GFP_KERNEL);
         if (!a) {
                 err = -ENOMEM;
+                /* decrease the module use count */
+                ip_vs_use_count_dec();
                 goto out_unlock;
         }
         INIT_LIST_HEAD(&a->incs_list);
         list_add(&a->a_list, &ipvs->app_list);
-        /* increase the module use count */
-        ip_vs_use_count_inc();
 
 out_unlock:
         mutex_unlock(&__ip_vs_app_mutex);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 8b48e7ce1c2c..3cccc88ef817 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -93,7 +93,6 @@ static bool __ip_vs_addr_is_local_v6(struct net *net,
 static void update_defense_level(struct netns_ipvs *ipvs)
 {
         struct sysinfo i;
-        static int old_secure_tcp = 0;
         int availmem;
         int nomem;
         int to_change = -1;
@@ -174,35 +173,35 @@ static void update_defense_level(struct netns_ipvs *ipvs)
         spin_lock(&ipvs->securetcp_lock);
         switch (ipvs->sysctl_secure_tcp) {
         case 0:
-                if (old_secure_tcp >= 2)
+                if (ipvs->old_secure_tcp >= 2)
                         to_change = 0;
                 break;
         case 1:
                 if (nomem) {
-                        if (old_secure_tcp < 2)
+                        if (ipvs->old_secure_tcp < 2)
                                 to_change = 1;
                         ipvs->sysctl_secure_tcp = 2;
                 } else {
-                        if (old_secure_tcp >= 2)
+                        if (ipvs->old_secure_tcp >= 2)
                                 to_change = 0;
                 }
                 break;
         case 2:
                 if (nomem) {
-                        if (old_secure_tcp < 2)
+                        if (ipvs->old_secure_tcp < 2)
                                 to_change = 1;
                 } else {
-                        if (old_secure_tcp >= 2)
+                        if (ipvs->old_secure_tcp >= 2)
                                 to_change = 0;
                         ipvs->sysctl_secure_tcp = 1;
                 }
                 break;
         case 3:
-                if (old_secure_tcp < 2)
+                if (ipvs->old_secure_tcp < 2)
                         to_change = 1;
                 break;
         }
-        old_secure_tcp = ipvs->sysctl_secure_tcp;
+        ipvs->old_secure_tcp = ipvs->sysctl_secure_tcp;
         if (to_change >= 0)
                 ip_vs_protocol_timeout_change(ipvs,
                                               ipvs->sysctl_secure_tcp > 1);
@@ -1275,7 +1274,8 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
         struct ip_vs_service *svc = NULL;
 
         /* increase the module use count */
-        ip_vs_use_count_inc();
+        if (!ip_vs_use_count_inc())
+                return -ENOPROTOOPT;
 
         /* Lookup the scheduler by 'u->sched_name' */
         if (strcmp(u->sched_name, "none")) {
@@ -2435,9 +2435,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
         if (copy_from_user(arg, user, len) != 0)
                 return -EFAULT;
 
-        /* increase the module use count */
-        ip_vs_use_count_inc();
-
         /* Handle daemons since they have another lock */
         if (cmd == IP_VS_SO_SET_STARTDAEMON ||
             cmd == IP_VS_SO_SET_STOPDAEMON) {
@@ -2450,13 +2447,13 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                         ret = -EINVAL;
                         if (strscpy(cfg.mcast_ifn, dm->mcast_ifn,
                                     sizeof(cfg.mcast_ifn)) <= 0)
-                                goto out_dec;
+                                return ret;
                         cfg.syncid = dm->syncid;
                         ret = start_sync_thread(ipvs, &cfg, dm->state);
                 } else {
                         ret = stop_sync_thread(ipvs, dm->state);
                 }
-                goto out_dec;
+                return ret;
         }
 
         mutex_lock(&__ip_vs_mutex);
@@ -2551,10 +2548,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 
   out_unlock:
         mutex_unlock(&__ip_vs_mutex);
-  out_dec:
-        /* decrease the module use count */
-        ip_vs_use_count_dec();
-
         return ret;
 }
 
diff --git a/net/netfilter/ipvs/ip_vs_pe.c b/net/netfilter/ipvs/ip_vs_pe.c
index 8e104dff7abc..166c669f0763 100644
--- a/net/netfilter/ipvs/ip_vs_pe.c
+++ b/net/netfilter/ipvs/ip_vs_pe.c
@@ -68,7 +68,8 @@ int register_ip_vs_pe(struct ip_vs_pe *pe)
         struct ip_vs_pe *tmp;
 
         /* increase the module use count */
-        ip_vs_use_count_inc();
+        if (!ip_vs_use_count_inc())
+                return -ENOENT;
 
         mutex_lock(&ip_vs_pe_mutex);
         /* Make sure that the pe with this name doesn't exist
diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
index 2f9d5cd5daee..d4903723be7e 100644
--- a/net/netfilter/ipvs/ip_vs_sched.c
+++ b/net/netfilter/ipvs/ip_vs_sched.c
@@ -179,7 +179,8 @@ int register_ip_vs_scheduler(struct ip_vs_scheduler *scheduler)
         }
 
         /* increase the module use count */
-        ip_vs_use_count_inc();
+        if (!ip_vs_use_count_inc())
+                return -ENOENT;
 
         mutex_lock(&ip_vs_sched_mutex);
 
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index a4a78c4b06de..8dc892a9dc91 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1762,6 +1762,10 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
         IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %zd bytes\n",
                   sizeof(struct ip_vs_sync_conn_v0));
 
+        /* increase the module use count */
+        if (!ip_vs_use_count_inc())
+                return -ENOPROTOOPT;
+
         /* Do not hold one mutex and then to block on another */
         for (;;) {
                 rtnl_lock();
@@ -1892,9 +1896,6 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c,
         mutex_unlock(&ipvs->sync_mutex);
         rtnl_unlock();
 
-        /* increase the module use count */
-        ip_vs_use_count_inc();
-
         return 0;
 
 out:
@@ -1924,11 +1925,17 @@ out:
                 }
                 kfree(ti);
         }
+
+        /* decrease the module use count */
+        ip_vs_use_count_dec();
         return result;
 
 out_early:
         mutex_unlock(&ipvs->sync_mutex);
         rtnl_unlock();
+
+        /* decrease the module use count */
+        ip_vs_use_count_dec();
         return result;
 }
 
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 132f5228b431..128245efe84a 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -202,6 +202,8 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
 {
         int err;
 
+        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
+
         err = rhashtable_insert_fast(&flow_table->rhashtable,
                                      &flow->tuplehash[0].node,
                                      nf_flow_offload_rhash_params);
@@ -218,7 +220,6 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
                 return err;
         }
 
-        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
         return 0;
 }
 EXPORT_SYMBOL_GPL(flow_offload_add);
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index e546f759b7a7..ad783f4840ef 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -347,7 +347,7 @@ int nft_flow_rule_offload_commit(struct net *net)
 
                         policy = nft_trans_chain_policy(trans);
                         err = nft_flow_offload_chain(trans->ctx.chain, &policy,
-                                                     FLOW_BLOCK_BIND);
+                                                     FLOW_BLOCK_UNBIND);
                         break;
                 case NFT_MSG_NEWRULE:
                         if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c
index 22a80eb60222..5cb2d8908d2a 100644
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -161,13 +161,21 @@ static int nft_payload_offload_ll(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct ethhdr, h_source):
+                if (priv->len != ETH_ALEN)
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_ETH_ADDRS, eth_addrs,
                                   src, ETH_ALEN, reg);
                 break;
         case offsetof(struct ethhdr, h_dest):
+                if (priv->len != ETH_ALEN)
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_ETH_ADDRS, eth_addrs,
                                   dst, ETH_ALEN, reg);
                 break;
+        default:
+                return -EOPNOTSUPP;
         }
 
         return 0;
@@ -181,14 +189,23 @@ static int nft_payload_offload_ip(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct iphdr, saddr):
+                if (priv->len != sizeof(struct in_addr))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4, src,
                                   sizeof(struct in_addr), reg);
                 break;
         case offsetof(struct iphdr, daddr):
+                if (priv->len != sizeof(struct in_addr))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4, dst,
                                   sizeof(struct in_addr), reg);
                 break;
         case offsetof(struct iphdr, protocol):
+                if (priv->len != sizeof(__u8))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
                                   sizeof(__u8), reg);
                 nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_TRANSPORT);
@@ -208,14 +225,23 @@ static int nft_payload_offload_ip6(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct ipv6hdr, saddr):
+                if (priv->len != sizeof(struct in6_addr))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6, src,
                                   sizeof(struct in6_addr), reg);
                 break;
         case offsetof(struct ipv6hdr, daddr):
+                if (priv->len != sizeof(struct in6_addr))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6, dst,
                                   sizeof(struct in6_addr), reg);
                 break;
         case offsetof(struct ipv6hdr, nexthdr):
+                if (priv->len != sizeof(__u8))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_BASIC, basic, ip_proto,
                                   sizeof(__u8), reg);
                 nft_offload_set_dependency(ctx, NFT_OFFLOAD_DEP_TRANSPORT);
@@ -255,10 +281,16 @@ static int nft_payload_offload_tcp(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct tcphdr, source):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, src,
                                   sizeof(__be16), reg);
                 break;
         case offsetof(struct tcphdr, dest):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, dst,
                                   sizeof(__be16), reg);
                 break;
@@ -277,10 +309,16 @@ static int nft_payload_offload_udp(struct nft_offload_ctx *ctx,
 
         switch (priv->offset) {
         case offsetof(struct udphdr, source):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, src,
                                   sizeof(__be16), reg);
                 break;
         case offsetof(struct udphdr, dest):
+                if (priv->len != sizeof(__be16))
+                        return -EOPNOTSUPP;
+
                 NFT_OFFLOAD_MATCH(FLOW_DISSECTOR_KEY_PORTS, tp, dst,
                                   sizeof(__be16), reg);
                 break;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index c4f54ad2b98a..58d5373c513c 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -64,28 +64,6 @@ static DEFINE_SPINLOCK(nr_list_lock);
 static const struct proto_ops nr_proto_ops;
 
 /*
- * NETROM network devices are virtual network devices encapsulating NETROM
- * frames into AX.25 which will be sent through an AX.25 device, so form a
- * special "super class" of normal net devices; split their locks off into a
- * separate class since they always nest.
- */
-static struct lock_class_key nr_netdev_xmit_lock_key;
-static struct lock_class_key nr_netdev_addr_lock_key;
-
-static void nr_set_lockdep_one(struct net_device *dev,
-                               struct netdev_queue *txq,
-                               void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &nr_netdev_xmit_lock_key);
-}
-
-static void nr_set_lockdep_key(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &nr_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, nr_set_lockdep_one, NULL);
-}
-
-/*
  *      Socket removal during an interrupt is now safe.
  */
 static void nr_remove_socket(struct sock *sk)
@@ -1414,7 +1392,6 @@ static int __init nr_proto_init(void)
                         free_netdev(dev);
                         goto fail;
                 }
-                nr_set_lockdep_key(dev);
                 dev_nr[i] = dev;
         }
 
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index ccdd790e163a..28604414dec1 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -554,11 +554,11 @@ static __poll_t llcp_sock_poll(struct file *file, struct socket *sock,
         if (sk->sk_state == LLCP_LISTEN)
                 return llcp_accept_poll(sk);
 
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                 mask |= EPOLLERR |
                         (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
 
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         if (sk->sk_state == LLCP_CLOSED)
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index f30e406fbec5..d8c364d637b1 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1881,7 +1881,7 @@ static struct genl_family dp_datapath_genl_family __ro_after_init = {
 /* Called with ovs_mutex or RCU read lock. */
 static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
                                    struct net *net, u32 portid, u32 seq,
-                                   u32 flags, u8 cmd)
+                                   u32 flags, u8 cmd, gfp_t gfp)
 {
         struct ovs_header *ovs_header;
         struct ovs_vport_stats vport_stats;
@@ -1902,7 +1902,7 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb,
                 goto nla_put_failure;
 
         if (!net_eq(net, dev_net(vport->dev))) {
-                int id = peernet2id_alloc(net, dev_net(vport->dev));
+                int id = peernet2id_alloc(net, dev_net(vport->dev), gfp);
 
                 if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id))
                         goto nla_put_failure;
@@ -1943,11 +1943,12 @@ struct sk_buff *ovs_vport_cmd_build_info(struct vport *vport, struct net *net,
         struct sk_buff *skb;
         int retval;
 
-        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!skb)
                 return ERR_PTR(-ENOMEM);
 
-        retval = ovs_vport_cmd_fill_info(vport, skb, net, portid, seq, 0, cmd);
+        retval = ovs_vport_cmd_fill_info(vport, skb, net, portid, seq, 0, cmd,
+                                         GFP_KERNEL);
         BUG_ON(retval < 0);
 
         return skb;
@@ -2089,7 +2090,7 @@ restart:
 
         err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
                                       info->snd_portid, info->snd_seq, 0,
-                                      OVS_VPORT_CMD_NEW);
+                                      OVS_VPORT_CMD_NEW, GFP_KERNEL);
 
         new_headroom = netdev_get_fwd_headroom(vport->dev);
 
@@ -2150,7 +2151,7 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
 
         err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
                                       info->snd_portid, info->snd_seq, 0,
-                                      OVS_VPORT_CMD_SET);
+                                      OVS_VPORT_CMD_SET, GFP_KERNEL);
         BUG_ON(err < 0);
 
         ovs_unlock();
@@ -2190,7 +2191,7 @@ static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)
 
         err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
                                       info->snd_portid, info->snd_seq, 0,
-                                      OVS_VPORT_CMD_DEL);
+                                      OVS_VPORT_CMD_DEL, GFP_KERNEL);
         BUG_ON(err < 0);
 
         /* the vport deletion may trigger dp headroom update */
@@ -2237,7 +2238,7 @@ static int ovs_vport_cmd_get(struct sk_buff *skb, struct genl_info *info)
                 goto exit_unlock_free;
         err = ovs_vport_cmd_fill_info(vport, reply, genl_info_net(info),
                                       info->snd_portid, info->snd_seq, 0,
-                                      OVS_VPORT_CMD_GET);
+                                      OVS_VPORT_CMD_GET, GFP_ATOMIC);
         BUG_ON(err < 0);
         rcu_read_unlock();
 
@@ -2273,7 +2274,8 @@ static int ovs_vport_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
                                                     NETLINK_CB(cb->skb).portid,
                                                     cb->nlh->nlmsg_seq,
                                                     NLM_F_MULTI,
-                                                    OVS_VPORT_CMD_GET) < 0)
+                                                    OVS_VPORT_CMD_GET,
+                                                    GFP_ATOMIC) < 0)
                                 goto out;
 
                         j++;
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 21c90d3a7ebf..58a7b8312c28 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -137,7 +137,7 @@ static void do_setup(struct net_device *netdev)
         netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_OPENVSWITCH |
                               IFF_NO_QUEUE;
         netdev->needs_free_netdev = true;
-        netdev->priv_destructor = internal_dev_destructor;
+        netdev->priv_destructor = NULL;
         netdev->ethtool_ops = &internal_dev_ethtool_ops;
         netdev->rtnl_link_ops = &internal_dev_link_ops;
 
@@ -159,7 +159,6 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
         struct internal_dev *internal_dev;
         struct net_device *dev;
         int err;
-        bool free_vport = true;
 
         vport = ovs_vport_alloc(0, &ovs_internal_vport_ops, parms);
         if (IS_ERR(vport)) {
@@ -190,10 +189,9 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
 
         rtnl_lock();
         err = register_netdevice(vport->dev);
-        if (err) {
-                free_vport = false;
+        if (err)
                 goto error_unlock;
-        }
+        vport->dev->priv_destructor = internal_dev_destructor;
 
         dev_set_promiscuity(vport->dev, 1);
         rtnl_unlock();
@@ -207,8 +205,7 @@ error_unlock:
 error_free_netdev:
         free_netdev(dev);
 error_free_vport:
-        if (free_vport)
-                ovs_vport_free(vport);
+        ovs_vport_free(vport);
 error:
         return ERR_PTR(err);
 }
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 96ea9f254ae9..76d499f6af9a 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -338,9 +338,9 @@ static __poll_t pn_socket_poll(struct file *file, struct socket *sock,
 
         if (sk->sk_state == TCP_CLOSE)
                 return EPOLLERR;
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
-        if (!skb_queue_empty(&pn->ctrlreq_queue))
+        if (!skb_queue_empty_lockless(&pn->ctrlreq_queue))
                 mask |= EPOLLPRI;
         if (!mask && sk->sk_state == TCP_CLOSE_WAIT)
                 return EPOLLHUP;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index f0e9ccf472a9..6a0df7c8a939 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -65,28 +65,6 @@ static const struct proto_ops rose_proto_ops;
 ax25_address rose_callsign;
 
 /*
- * ROSE network devices are virtual network devices encapsulating ROSE
- * frames into AX.25 which will be sent through an AX.25 device, so form a
- * special "super class" of normal net devices; split their locks off into a
- * separate class since they always nest.
- */
-static struct lock_class_key rose_netdev_xmit_lock_key;
-static struct lock_class_key rose_netdev_addr_lock_key;
-
-static void rose_set_lockdep_one(struct net_device *dev,
-                                 struct netdev_queue *txq,
-                                 void *_unused)
-{
-        lockdep_set_class(&txq->_xmit_lock, &rose_netdev_xmit_lock_key);
-}
-
-static void rose_set_lockdep_key(struct net_device *dev)
-{
-        lockdep_set_class(&dev->addr_list_lock, &rose_netdev_addr_lock_key);
-        netdev_for_each_tx_queue(dev, rose_set_lockdep_one, NULL);
-}
-
-/*
  *      Convert a ROSE address into text.
  */
 char *rose2asc(char *buf, const rose_address *addr)
@@ -1533,7 +1511,6 @@ static int __init rose_proto_init(void)
                         free_netdev(dev);
                         goto fail;
                 }
-                rose_set_lockdep_key(dev);
                 dev_rose[i] = dev;
         }
 
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index ecc17dabec8f..7c7d10f2e0c1 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -601,6 +601,7 @@ struct rxrpc_call {
         int                     debug_id;       /* debug ID for printks */
         unsigned short          rx_pkt_offset;  /* Current recvmsg packet offset */
         unsigned short          rx_pkt_len;     /* Current recvmsg packet len */
+        bool                    rx_pkt_last;    /* Current recvmsg packet is last */
 
         /* Rx/Tx circular buffer, depending on phase.
          *
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index a4090797c9b2..8578c39ec839 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -267,11 +267,13 @@ static int rxrpc_verify_packet(struct rxrpc_call *call, struct sk_buff *skb,
  */
 static int rxrpc_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
                              u8 *_annotation,
-                             unsigned int *_offset, unsigned int *_len)
+                             unsigned int *_offset, unsigned int *_len,
+                             bool *_last)
 {
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
         unsigned int offset = sizeof(struct rxrpc_wire_header);
         unsigned int len;
+        bool last = false;
         int ret;
         u8 annotation = *_annotation;
         u8 subpacket = annotation & RXRPC_RX_ANNO_SUBPACKET;
@@ -281,6 +283,8 @@ static int rxrpc_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
         len = skb->len - offset;
         if (subpacket < sp->nr_subpackets - 1)
                 len = RXRPC_JUMBO_DATALEN;
+        else if (sp->rx_flags & RXRPC_SKB_INCL_LAST)
+                last = true;
 
         if (!(annotation & RXRPC_RX_ANNO_VERIFIED)) {
                 ret = rxrpc_verify_packet(call, skb, annotation, offset, len);
@@ -291,6 +295,7 @@ static int rxrpc_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
 
         *_offset = offset;
         *_len = len;
+        *_last = last;
         call->security->locate_data(call, skb, _offset, _len);
         return 0;
 }
@@ -309,7 +314,7 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
         rxrpc_serial_t serial;
         rxrpc_seq_t hard_ack, top, seq;
         size_t remain;
-        bool last;
+        bool rx_pkt_last;
         unsigned int rx_pkt_offset, rx_pkt_len;
         int ix, copy, ret = -EAGAIN, ret2;
 
@@ -319,6 +324,7 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
 
         rx_pkt_offset = call->rx_pkt_offset;
         rx_pkt_len = call->rx_pkt_len;
+        rx_pkt_last = call->rx_pkt_last;
 
         if (call->state >= RXRPC_CALL_SERVER_ACK_REQUEST) {
                 seq = call->rx_hard_ack;
@@ -329,6 +335,7 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
         /* Barriers against rxrpc_input_data(). */
         hard_ack = call->rx_hard_ack;
         seq = hard_ack + 1;
+
         while (top = smp_load_acquire(&call->rx_top),
                before_eq(seq, top)
                ) {
@@ -356,7 +363,8 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
                 if (rx_pkt_offset == 0) {
                         ret2 = rxrpc_locate_data(call, skb,
                                                  &call->rxtx_annotations[ix],
-                                                 &rx_pkt_offset, &rx_pkt_len);
+                                                 &rx_pkt_offset, &rx_pkt_len,
+                                                 &rx_pkt_last);
                         trace_rxrpc_recvmsg(call, rxrpc_recvmsg_next, seq,
                                             rx_pkt_offset, rx_pkt_len, ret2);
                         if (ret2 < 0) {
@@ -396,13 +404,12 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
                 }
 
                 /* The whole packet has been transferred. */
-                last = sp->hdr.flags & RXRPC_LAST_PACKET;
                 if (!(flags & MSG_PEEK))
                         rxrpc_rotate_rx_window(call);
                 rx_pkt_offset = 0;
                 rx_pkt_len = 0;
 
-                if (last) {
+                if (rx_pkt_last) {
                         ASSERTCMP(seq, ==, READ_ONCE(call->rx_top));
                         ret = 1;
                         goto out;
@@ -415,6 +422,7 @@ out:
         if (!(flags & MSG_PEEK)) {
                 call->rx_pkt_offset = rx_pkt_offset;
                 call->rx_pkt_len = rx_pkt_len;
+                call->rx_pkt_last = rx_pkt_last;
         }
 done:
         trace_rxrpc_recvmsg(call, rxrpc_recvmsg_data_return, seq,
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index bf10bdaf5012..8229ed4a67be 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -162,16 +162,20 @@ static int cls_bpf_offload_cmd(struct tcf_proto *tp, struct cls_bpf_prog *prog,
         cls_bpf.name = obj->bpf_name;
         cls_bpf.exts_integrated = obj->exts_integrated;
 
-        if (oldprog)
+        if (oldprog && prog)
                 err = tc_setup_cb_replace(block, tp, TC_SETUP_CLSBPF, &cls_bpf,
                                           skip_sw, &oldprog->gen_flags,
                                           &oldprog->in_hw_count,
                                           &prog->gen_flags, &prog->in_hw_count,
                                           true);
-        else
+        else if (prog)
                 err = tc_setup_cb_add(block, tp, TC_SETUP_CLSBPF, &cls_bpf,
                                       skip_sw, &prog->gen_flags,
                                       &prog->in_hw_count, true);
+        else
+                err = tc_setup_cb_destroy(block, tp, TC_SETUP_CLSBPF, &cls_bpf,
+                                          skip_sw, &oldprog->gen_flags,
+                                          &oldprog->in_hw_count, true);
 
         if (prog && err) {
                 cls_bpf_offload_cmd(tp, oldprog, prog, extack);
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 17bd8f539bc7..8769b4b8807d 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -799,9 +799,6 @@ struct Qdisc_ops pfifo_fast_ops __read_mostly = {
 };
 EXPORT_SYMBOL(pfifo_fast_ops);
 
-static struct lock_class_key qdisc_tx_busylock;
-static struct lock_class_key qdisc_running_key;
-
 struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
                           const struct Qdisc_ops *ops,
                           struct netlink_ext_ack *extack)
@@ -854,17 +851,9 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
         }
 
         spin_lock_init(&sch->busylock);
-        lockdep_set_class(&sch->busylock,
-                          dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
-
         /* seqlock has the same scope of busylock, for NOLOCK qdisc */
         spin_lock_init(&sch->seqlock);
-        lockdep_set_class(&sch->busylock,
-                          dev->qdisc_tx_busylock ?: &qdisc_tx_busylock);
-
         seqcount_init(&sch->running);
-        lockdep_set_class(&sch->running,
-                          dev->qdisc_running_key ?: &qdisc_running_key);
 
         sch->ops = ops;
         sch->flags = ops->static_flags;
@@ -875,6 +864,12 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue,
         dev_hold(dev);
         refcount_set(&sch->refcnt, 1);
 
+        if (sch != &noop_qdisc) {
+                lockdep_set_class(&sch->busylock, &dev->qdisc_tx_busylock_key);
+                lockdep_set_class(&sch->seqlock, &dev->qdisc_tx_busylock_key);
+                lockdep_set_class(&sch->running, &dev->qdisc_running_key);
+        }
+
         return sch;
 errout1:
         kfree(p);
@@ -1043,6 +1038,8 @@ static void attach_one_default_qdisc(struct net_device *dev,
 
         if (dev->priv_flags & IFF_NO_QUEUE)
                 ops = &noqueue_qdisc_ops;
+        else if(dev->type == ARPHRD_CAN)
+                ops = &pfifo_fast_ops;
 
         qdisc = qdisc_create_dflt(dev_queue, ops, TC_H_ROOT, NULL);
         if (!qdisc) {
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
index 23cd1c873a2c..be35f03b657b 100644
--- a/net/sched/sch_hhf.c
+++ b/net/sched/sch_hhf.c
@@ -5,11 +5,11 @@
  * Copyright (C) 2013 Nandita Dukkipati <nanditad@google.com>
  */
 
-#include <linux/jhash.h>
 #include <linux/jiffies.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/vmalloc.h>
+#include <linux/siphash.h>
 #include <net/pkt_sched.h>
 #include <net/sock.h>
 
@@ -126,7 +126,7 @@ struct wdrr_bucket {
 
 struct hhf_sched_data {
         struct wdrr_bucket buckets[WDRR_BUCKET_CNT];
-        u32                perturbation;   /* hash perturbation */
+        siphash_key_t      perturbation;   /* hash perturbation */
         u32                quantum;        /* psched_mtu(qdisc_dev(sch)); */
         u32                drop_overlimit; /* number of times max qdisc packet
                                             * limit was hit
@@ -264,7 +264,7 @@ static enum wdrr_bucket_idx hhf_classify(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         /* Get hashed flow-id of the skb. */
-        hash = skb_get_hash_perturb(skb, q->perturbation);
+        hash = skb_get_hash_perturb(skb, &q->perturbation);
 
         /* Check if this packet belongs to an already established HH flow. */
         flow_pos = hash & HHF_BIT_MASK;
@@ -582,7 +582,7 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt,
 
         sch->limit = 1000;
         q->quantum = psched_mtu(qdisc_dev(sch));
-        q->perturbation = prandom_u32();
+        get_random_bytes(&q->perturbation, sizeof(q->perturbation));
         INIT_LIST_HEAD(&q->new_buckets);
         INIT_LIST_HEAD(&q->old_buckets);
 
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index d448fe3068e5..4074c50ac3d7 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -18,7 +18,7 @@
 #include <linux/errno.h>
 #include <linux/skbuff.h>
 #include <linux/random.h>
-#include <linux/jhash.h>
+#include <linux/siphash.h>
 #include <net/ip.h>
 #include <net/pkt_sched.h>
 #include <net/pkt_cls.h>
@@ -45,7 +45,7 @@ struct sfb_bucket {
  * (Section 4.4 of SFB reference : moving hash functions)
  */
 struct sfb_bins {
-        u32               perturbation; /* jhash perturbation */
+        siphash_key_t     perturbation; /* siphash key */
         struct sfb_bucket bins[SFB_LEVELS][SFB_NUMBUCKETS];
 };
 
@@ -217,7 +217,8 @@ static u32 sfb_compute_qlen(u32 *prob_r, u32 *avgpm_r, const struct sfb_sched_da
 
 static void sfb_init_perturbation(u32 slot, struct sfb_sched_data *q)
 {
-        q->bins[slot].perturbation = prandom_u32();
+        get_random_bytes(&q->bins[slot].perturbation,
+                         sizeof(q->bins[slot].perturbation));
 }
 
 static void sfb_swap_slot(struct sfb_sched_data *q)
@@ -314,9 +315,9 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                 /* If using external classifiers, get result and record it. */
                 if (!sfb_classify(skb, fl, &ret, &salt))
                         goto other_drop;
-                sfbhash = jhash_1word(salt, q->bins[slot].perturbation);
+                sfbhash = siphash_1u32(salt, &q->bins[slot].perturbation);
         } else {
-                sfbhash = skb_get_hash_perturb(skb, q->bins[slot].perturbation);
+                sfbhash = skb_get_hash_perturb(skb, &q->bins[slot].perturbation);
         }
 
 
@@ -352,7 +353,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                 /* Inelastic flow */
                 if (q->double_buffering) {
                         sfbhash = skb_get_hash_perturb(skb,
-                            q->bins[slot].perturbation);
+                            &q->bins[slot].perturbation);
                         if (!sfbhash)
                                 sfbhash = 1;
                         sfb_skb_cb(skb)->hashes[slot] = sfbhash;
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 68404a9d2ce4..c787d4d46017 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -14,7 +14,7 @@
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/skbuff.h>
-#include <linux/jhash.h>
+#include <linux/siphash.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <net/netlink.h>
@@ -117,7 +117,7 @@ struct sfq_sched_data {
         u8              headdrop;
         u8              maxdepth;       /* limit of packets per flow */
 
-        u32             perturbation;
+        siphash_key_t   perturbation;
         u8              cur_depth;      /* depth of longest slot */
         u8              flags;
         unsigned short  scaled_quantum; /* SFQ_ALLOT_SIZE(quantum) */
@@ -157,7 +157,7 @@ static inline struct sfq_head *sfq_dep_head(struct sfq_sched_data *q, sfq_index
 static unsigned int sfq_hash(const struct sfq_sched_data *q,
                              const struct sk_buff *skb)
 {
-        return skb_get_hash_perturb(skb, q->perturbation) & (q->divisor - 1);
+        return skb_get_hash_perturb(skb, &q->perturbation) & (q->divisor - 1);
 }
 
 static unsigned int sfq_classify(struct sk_buff *skb, struct Qdisc *sch,
@@ -607,9 +607,11 @@ static void sfq_perturbation(struct timer_list *t)
         struct sfq_sched_data *q = from_timer(q, t, perturb_timer);
         struct Qdisc *sch = q->sch;
         spinlock_t *root_lock = qdisc_lock(qdisc_root_sleeping(sch));
+        siphash_key_t nkey;
 
+        get_random_bytes(&nkey, sizeof(nkey));
         spin_lock(root_lock);
-        q->perturbation = prandom_u32();
+        q->perturbation = nkey;
         if (!q->filter_list && q->tail)
                 sfq_rehash(sch);
         spin_unlock(root_lock);
@@ -688,7 +690,7 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
         del_timer(&q->perturb_timer);
         if (q->perturb_period) {
                 mod_timer(&q->perturb_timer, jiffies + q->perturb_period);
-                q->perturbation = prandom_u32();
+                get_random_bytes(&q->perturbation, sizeof(q->perturbation));
         }
         sch_tree_unlock(sch);
         kfree(p);
@@ -745,7 +747,7 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt,
         q->quantum = psched_mtu(qdisc_dev(sch));
         q->scaled_quantum = SFQ_ALLOT_SIZE(q->quantum);
         q->perturb_period = 0;
-        q->perturbation = prandom_u32();
+        get_random_bytes(&q->perturbation, sizeof(q->perturbation));
 
         if (opt) {
                 int err = sfq_change(sch, opt);
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 6719a65169d4..2121187229cd 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -1152,7 +1152,7 @@ EXPORT_SYMBOL_GPL(taprio_offload_free);
  * offload state (PENDING, ACTIVE, INACTIVE) so it can be visible in dump().
  * This is left as TODO.
  */
-void taprio_offload_config_changed(struct taprio_sched *q)
+static void taprio_offload_config_changed(struct taprio_sched *q)
 {
         struct sched_gate_list *oper, *admin;
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 5ca0ec0e823c..ffd3262b7a41 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -8476,7 +8476,7 @@ __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
         mask = 0;
 
         /* Is there any exceptional events?  */
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                 mask |= EPOLLERR |
                         (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
         if (sk->sk_shutdown & RCV_SHUTDOWN)
@@ -8485,7 +8485,7 @@ __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
                 mask |= EPOLLHUP;
 
         /* Is it readable?  Reconsider this code with TCP-style support.  */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         /* The association is either gone or not ready.  */
@@ -8871,7 +8871,7 @@ struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags,
                 if (sk_can_busy_loop(sk)) {
                         sk_busy_loop(sk, noblock);
 
-                        if (!skb_queue_empty(&sk->sk_receive_queue))
+                        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                                 continue;
                 }
 
@@ -9306,7 +9306,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
         newinet->inet_rcv_saddr = inet->inet_rcv_saddr;
         newinet->inet_dport = htons(asoc->peer.port);
         newinet->pmtudisc = inet->pmtudisc;
-        newinet->inet_id = asoc->next_tsn ^ jiffies;
+        newinet->inet_id = prandom_u32();
 
         newinet->uc_ttl = inet->uc_ttl;
         newinet->mc_loop = 1;
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 5b932583e407..47946f489fd4 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -123,6 +123,12 @@ struct proto smc_proto6 = {
 };
 EXPORT_SYMBOL_GPL(smc_proto6);
 
+static void smc_restore_fallback_changes(struct smc_sock *smc)
+{
+        smc->clcsock->file->private_data = smc->sk.sk_socket;
+        smc->clcsock->file = NULL;
+}
+
 static int __smc_release(struct smc_sock *smc)
 {
         struct sock *sk = &smc->sk;
@@ -141,6 +147,7 @@ static int __smc_release(struct smc_sock *smc)
                 }
                 sk->sk_state = SMC_CLOSED;
                 sk->sk_state_change(sk);
+                smc_restore_fallback_changes(smc);
         }
 
         sk->sk_prot->unhash(sk);
@@ -700,8 +707,6 @@ static int __smc_connect(struct smc_sock *smc)
         int smc_type;
         int rc = 0;
 
-        sock_hold(&smc->sk); /* sock put in passive closing */
-
         if (smc->use_fallback)
                 return smc_connect_fallback(smc, smc->fallback_rsn);
 
@@ -846,6 +851,8 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr,
         rc = kernel_connect(smc->clcsock, addr, alen, flags);
         if (rc && rc != -EINPROGRESS)
                 goto out;
+
+        sock_hold(&smc->sk); /* sock put in passive closing */
         if (flags & O_NONBLOCK) {
                 if (schedule_work(&smc->connect_work))
                         smc->connect_nonblock = 1;
@@ -1291,8 +1298,8 @@ static void smc_listen_work(struct work_struct *work)
         /* check if RDMA is available */
         if (!ism_supported) { /* SMC_TYPE_R or SMC_TYPE_B */
                 /* prepare RDMA check */
-                memset(&ini, 0, sizeof(ini));
                 ini.is_smcd = false;
+                ini.ism_dev = NULL;
                 ini.ib_lcl = &pclc->lcl;
                 rc = smc_find_rdma_device(new_smc, &ini);
                 if (rc) {
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 88556f0251ab..2ba97ff325a5 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -561,7 +561,7 @@ int smc_vlan_by_tcpsk(struct socket *clcsock, struct smc_init_info *ini)
         }
 
         rtnl_lock();
-        nest_lvl = dev_get_nest_level(ndev);
+        nest_lvl = ndev->lower_level;
         for (i = 0; i < nest_lvl; i++) {
                 struct list_head *lower = &ndev->adj_list.lower;
 
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
index bab2da8cf17a..2920b006f65c 100644
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
@@ -718,7 +718,7 @@ static struct net_device *pnet_find_base_ndev(struct net_device *ndev)
         int i, nest_lvl;
 
         rtnl_lock();
-        nest_lvl = dev_get_nest_level(ndev);
+        nest_lvl = ndev->lower_level;
         for (i = 0; i < nest_lvl; i++) {
                 struct list_head *lower = &ndev->adj_list.lower;
 
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 339e8c077c2d..195b40c5dae4 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -220,7 +220,7 @@ void xprt_destroy_bc(struct rpc_xprt *xprt, unsigned int max_reqs)
                 goto out;
 
         spin_lock_bh(&xprt->bc_pa_lock);
-        xprt->bc_alloc_max -= max_reqs;
+        xprt->bc_alloc_max -= min(max_reqs, xprt->bc_alloc_max);
         list_for_each_entry_safe(req, tmp, &xprt->bc_pa_list, rq_bc_pa_list) {
                 dprintk("RPC:        req=%p\n", req);
                 list_del(&req->rq_bc_pa_list);
@@ -307,8 +307,8 @@ void xprt_free_bc_rqst(struct rpc_rqst *req)
                  */
                 dprintk("RPC:       Last session removed req=%p\n", req);
                 xprt_free_allocation(req);
-                return;
         }
+        xprt_put(xprt);
 }
 
 /*
@@ -339,7 +339,7 @@ found:
                 spin_unlock(&xprt->bc_pa_lock);
                 if (new) {
                         if (req != new)
-                                xprt_free_bc_rqst(new);
+                                xprt_free_allocation(new);
                         break;
                 } else if (req)
                         break;
@@ -368,6 +368,7 @@ void xprt_complete_bc_request(struct rpc_rqst *req, uint32_t copied)
         set_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state);
 
         dprintk("RPC:       add callback request to list\n");
+        xprt_get(xprt);
         spin_lock(&bc_serv->sv_cb_lock);
         list_add(&req->rq_bc_list, &bc_serv->sv_cb_list);
         wake_up(&bc_serv->sv_cb_waitq);
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 8a45b3ccc313..41df4c507193 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1943,6 +1943,11 @@ static void xprt_destroy_cb(struct work_struct *work)
         rpc_destroy_wait_queue(&xprt->backlog);
         kfree(xprt->servername);
         /*
+         * Destroy any existing back channel
+         */
+        xprt_destroy_backchannel(xprt, UINT_MAX);
+
+        /*
          * Tear down transport state and free the rpc_xprt
          */
         xprt->ops->destroy(xprt);
diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index 50e075fcdd8f..b458bf53ca69 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -163,6 +163,7 @@ void xprt_rdma_bc_free_rqst(struct rpc_rqst *rqst)
         spin_lock(&xprt->bc_pa_lock);
         list_add_tail(&rqst->rq_bc_pa_list, &xprt->bc_pa_list);
         spin_unlock(&xprt->bc_pa_lock);
+        xprt_put(xprt);
 }
 
 static struct rpc_rqst *rpcrdma_bc_rqst_get(struct rpcrdma_xprt *r_xprt)
@@ -259,6 +260,7 @@ void rpcrdma_bc_receive_call(struct rpcrdma_xprt *r_xprt,
 
         /* Queue rqst for ULP's callback service */
         bc_serv = xprt->bc_serv;
+        xprt_get(xprt);
         spin_lock(&bc_serv->sv_cb_lock);
         list_add(&rqst->rq_bc_list, &bc_serv->sv_cb_list);
         spin_unlock(&bc_serv->sv_cb_lock);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index f8bbc4aab213..4b92b196cfa6 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -740,7 +740,7 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
                 /* fall through */
         case TIPC_LISTEN:
         case TIPC_CONNECTING:
-                if (!skb_queue_empty(&sk->sk_receive_queue))
+                if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                         revents |= EPOLLIN | EPOLLRDNORM;
                 break;
         case TIPC_OPEN:
@@ -748,7 +748,7 @@ static __poll_t tipc_poll(struct file *file, struct socket *sock,
                         revents |= EPOLLOUT;
                 if (!tipc_sk_type_connectionless(sk))
                         break;
-                if (skb_queue_empty(&sk->sk_receive_queue))
+                if (skb_queue_empty_lockless(&sk->sk_receive_queue))
                         break;
                 revents |= EPOLLIN | EPOLLRDNORM;
                 break;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 67e87db5877f..0d8da809bea2 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2599,7 +2599,7 @@ static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wa
                 mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
@@ -2628,7 +2628,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
         mask = 0;
 
         /* exceptional events? */
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
+        if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
                 mask |= EPOLLERR |
                         (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
 
@@ -2638,7 +2638,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
                 mask |= EPOLLHUP;
 
         /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
                 mask |= EPOLLIN | EPOLLRDNORM;
 
         /* Connection-based need to check for termination and startup */
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 2ab43b2bba31..582a3e4dfce2 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -870,7 +870,7 @@ static __poll_t vsock_poll(struct file *file, struct socket *sock,
                  * the queue and write as long as the socket isn't shutdown for
                  * sending.
                  */
-                if (!skb_queue_empty(&sk->sk_receive_queue) ||
+                if (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
                     (sk->sk_shutdown & RCV_SHUTDOWN)) {
                         mask |= EPOLLIN | EPOLLRDNORM;
                 }
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index e851cafd8e2f..fcac5c6366e1 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -204,6 +204,11 @@ bool cfg80211_chandef_valid(const struct cfg80211_chan_def *chandef)
                 return false;
         }
 
+        /* channel 14 is only for IEEE 802.11b */
+        if (chandef->center_freq1 == 2484 &&
+            chandef->width != NL80211_CHAN_WIDTH_20_NOHT)
+                return false;
+
         if (cfg80211_chandef_is_edmg(chandef) &&
             !cfg80211_edmg_chandef_valid(chandef))
                 return false;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4453dd375de9..7b72286922f7 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -393,7 +393,7 @@ const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
                                    .len = IEEE80211_MAX_MESH_ID_LEN },
-        [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
+        [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 
         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 419eb12c1e93..5b4ed5bbc542 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1559,7 +1559,8 @@ bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef,
         }
 
         if (freq == 2484) {
-                if (chandef->width > NL80211_CHAN_WIDTH_40)
+                /* channel 14 is only for IEEE 802.11b */
+                if (chandef->width != NL80211_CHAN_WIDTH_20_NOHT)
                         return false;
 
                 *op_class = 82; /* channel 14 */
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 16d5f353163a..3049af269fbf 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -27,6 +27,9 @@ void xdp_add_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 {
         unsigned long flags;
 
+        if (!xs->tx)
+                return;
+
         spin_lock_irqsave(&umem->xsk_list_lock, flags);
         list_add_rcu(&xs->list, &umem->xsk_list);
         spin_unlock_irqrestore(&umem->xsk_list_lock, flags);
@@ -36,6 +39,9 @@ void xdp_del_sk_umem(struct xdp_umem *umem, struct xdp_sock *xs)
 {
         unsigned long flags;
 
+        if (!xs->tx)
+                return;
+
         spin_lock_irqsave(&umem->xsk_list_lock, flags);
         list_del_rcu(&xs->list);
         spin_unlock_irqrestore(&umem->xsk_list_lock, flags);