75 files changed, 705 insertions, 231 deletions

diff --git a/Documentation/devicetree/bindings/net/stm32-dwmac.txt b/Documentation/devicetree/bindings/net/stm32-dwmac.txt
index 1341012722aa..a90eef11dc46 100644
--- a/Documentation/devicetree/bindings/net/stm32-dwmac.txt
+++ b/Documentation/devicetree/bindings/net/stm32-dwmac.txt
@@ -14,8 +14,7 @@ Required properties:
 - clock-names: Should be "stmmaceth" for the host clock.
                Should be "mac-clk-tx" for the MAC TX clock.
                Should be "mac-clk-rx" for the MAC RX clock.
-               For MPU family need to add also "ethstp" for power mode clock and,
-                                               "syscfg-clk" for SYSCFG clock.
+               For MPU family need to add also "ethstp" for power mode clock
 - interrupt-names: Should contain a list of interrupt names corresponding to
            the interrupts in the interrupts property, if available.
                    Should be "macirq" for the main MAC IRQ
@@ -24,9 +23,9 @@ Required properties:
                encompases the glue register, and the offset of the control register.
 
 Optional properties:
-- clock-names:     For MPU family "mac-clk-ck" for PHY without quartz
-- st,int-phyclk (boolean) :  valid only where PHY do not have quartz and need to be clock
-                   by RCC
+- clock-names:     For MPU family "eth-ck" for PHY without quartz
+- st,eth-clk-sel (boolean) : set this property in RGMII PHY when you want to select RCC clock instead of ETH_CLK125.
+- st,eth-ref-clk-sel (boolean) :  set this property in RMII mode when you have PHY without crystal 50MHz and want to select RCC clock instead of ETH_REF_CLK.
 
 Example:
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 17b59b66474b..e2ec45968a16 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1059,6 +1059,8 @@ L:	netdev@vger.kernel.org
 S:      Odd fixes
 F:      drivers/net/appletalk/
 F:      net/appletalk/
+F:      include/linux/atalk.h
+F:      include/uapi/linux/atalk.h
 
 APPLIED MICRO (APM) X-GENE DEVICE TREE SUPPORT
 M:      Khuong Dinh <khuong@os.amperecomputing.com>
diff --git a/arch/arm/boot/dts/stm32h743-pinctrl.dtsi b/arch/arm/boot/dts/stm32h743-pinctrl.dtsi
index 24be8e63dec8..980b2769caf9 100644
--- a/arch/arm/boot/dts/stm32h743-pinctrl.dtsi
+++ b/arch/arm/boot/dts/stm32h743-pinctrl.dtsi
@@ -173,6 +173,21 @@
                                 };
                         };
 
+                        ethernet_rmii: rmii@0 {
+                                pins {
+                                        pinmux = <STM32_PINMUX('G', 11, AF11)>,
+                                                 <STM32_PINMUX('G', 13, AF11)>,
+                                                 <STM32_PINMUX('G', 12, AF11)>,
+                                                 <STM32_PINMUX('C', 4, AF11)>,
+                                                 <STM32_PINMUX('C', 5, AF11)>,
+                                                 <STM32_PINMUX('A', 7, AF11)>,
+                                                 <STM32_PINMUX('C', 1, AF11)>,
+                                                 <STM32_PINMUX('A', 2, AF11)>,
+                                                 <STM32_PINMUX('A', 1, AF11)>;
+                                        slew-rate = <2>;
+                                };
+                        };
+
                         usart1_pins: usart1@0 {
                                 pins1 {
                                         pinmux = <STM32_PINMUX('B', 14, AF4)>; /* USART1_TX */
diff --git a/arch/arm/boot/dts/stm32h743.dtsi b/arch/arm/boot/dts/stm32h743.dtsi
index 299af0723790..5cac79ebebb1 100644
--- a/arch/arm/boot/dts/stm32h743.dtsi
+++ b/arch/arm/boot/dts/stm32h743.dtsi
@@ -513,6 +513,19 @@
                                 status = "disabled";
                         };
                 };
+
+                mac: ethernet@40028000 {
+                        compatible = "st,stm32-dwmac", "snps,dwmac-4.10a";
+                        reg = <0x40028000 0x8000>;
+                        reg-names = "stmmaceth";
+                        interrupts = <61>;
+                        interrupt-names = "macirq";
+                        clock-names = "stmmaceth", "mac-clk-tx", "mac-clk-rx";
+                        clocks = <&rcc ETH1MAC_CK>, <&rcc ETH1TX_CK>, <&rcc ETH1RX_CK>;
+                        st,syscon = <&syscfg 0x4>;
+                        snps,pbl = <8>;
+                        status = "disabled";
+                };
         };
 };
 
diff --git a/arch/arm/boot/dts/stm32h743i-disco.dts b/arch/arm/boot/dts/stm32h743i-disco.dts
index f8040356fe2d..dd06c8f3d09a 100644
--- a/arch/arm/boot/dts/stm32h743i-disco.dts
+++ b/arch/arm/boot/dts/stm32h743i-disco.dts
@@ -67,6 +67,23 @@
         clock-frequency = <25000000>;
 };
 
+&mac {
+        status = "disabled";
+        pinctrl-0       = <&ethernet_rmii>;
+        pinctrl-names   = "default";
+        phy-mode        = "rmii";
+        phy-handle      = <&phy0>;
+
+        mdio0 {
+                #address-cells = <1>;
+                #size-cells = <0>;
+                compatible = "snps,dwmac-mdio";
+                phy0: ethernet-phy@0 {
+                        reg = <0>;
+                };
+        };
+};
+
 &usart2 {
         pinctrl-0 = <&usart2_pins>;
         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/stm32h743i-eval.dts b/arch/arm/boot/dts/stm32h743i-eval.dts
index ef34fa2f79ea..ebc3f0933f5c 100644
--- a/arch/arm/boot/dts/stm32h743i-eval.dts
+++ b/arch/arm/boot/dts/stm32h743i-eval.dts
@@ -105,6 +105,23 @@
         status = "okay";
 };
 
+&mac {
+        status = "disabled";
+        pinctrl-0       = <&ethernet_rmii>;
+        pinctrl-names   = "default";
+        phy-mode        = "rmii";
+        phy-handle      = <&phy0>;
+
+        mdio0 {
+                #address-cells = <1>;
+                #size-cells = <0>;
+                compatible = "snps,dwmac-mdio";
+                phy0: ethernet-phy@0 {
+                        reg = <0>;
+                };
+        };
+};
+
 &usart1 {
         pinctrl-0 = <&usart1_pins>;
         pinctrl-names = "default";
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index ed5e42461094..ad48fd52cb53 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -250,6 +250,7 @@ void proc_coredump_connector(struct task_struct *task)
 {
         struct cn_msg *msg;
         struct proc_event *ev;
+        struct task_struct *parent;
         __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
         if (atomic_read(&proc_event_num_listeners) < 1)
@@ -262,8 +263,14 @@ void proc_coredump_connector(struct task_struct *task)
         ev->what = PROC_EVENT_COREDUMP;
         ev->event_data.coredump.process_pid = task->pid;
         ev->event_data.coredump.process_tgid = task->tgid;
-        ev->event_data.coredump.parent_pid = task->real_parent->pid;
-        ev->event_data.coredump.parent_tgid = task->real_parent->tgid;
+
+        rcu_read_lock();
+        if (pid_alive(task)) {
+                parent = rcu_dereference(task->real_parent);
+                ev->event_data.coredump.parent_pid = parent->pid;
+                ev->event_data.coredump.parent_tgid = parent->tgid;
+        }
+        rcu_read_unlock();
 
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
@@ -276,6 +283,7 @@ void proc_exit_connector(struct task_struct *task)
 {
         struct cn_msg *msg;
         struct proc_event *ev;
+        struct task_struct *parent;
         __u8 buffer[CN_PROC_MSG_SIZE] __aligned(8);
 
         if (atomic_read(&proc_event_num_listeners) < 1)
@@ -290,8 +298,14 @@ void proc_exit_connector(struct task_struct *task)
         ev->event_data.exit.process_tgid = task->tgid;
         ev->event_data.exit.exit_code = task->exit_code;
         ev->event_data.exit.exit_signal = task->exit_signal;
-        ev->event_data.exit.parent_pid = task->real_parent->pid;
-        ev->event_data.exit.parent_tgid = task->real_parent->tgid;
+
+        rcu_read_lock();
+        if (pid_alive(task)) {
+                parent = rcu_dereference(task->real_parent);
+                ev->event_data.exit.parent_pid = parent->pid;
+                ev->event_data.exit.parent_tgid = parent->tgid;
+        }
+        rcu_read_unlock();
 
         memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
         msg->ack = 0; /* not used */
diff --git a/drivers/isdn/hardware/mISDN/mISDNinfineon.c b/drivers/isdn/hardware/mISDN/mISDNinfineon.c
index 3e01012be4ab..0fe6ddcb3fdc 100644
--- a/drivers/isdn/hardware/mISDN/mISDNinfineon.c
+++ b/drivers/isdn/hardware/mISDN/mISDNinfineon.c
@@ -712,8 +712,11 @@ setup_io(struct inf_hw *hw)
                                 (ulong)hw->addr.start, (ulong)hw->addr.size);
                         return err;
                 }
-                if (hw->ci->addr_mode == AM_MEMIO)
+                if (hw->ci->addr_mode == AM_MEMIO) {
                         hw->addr.p = ioremap(hw->addr.start, hw->addr.size);
+                        if (unlikely(!hw->addr.p))
+                                return -ENOMEM;
+                }
                 hw->addr.mode = hw->ci->addr_mode;
                 if (debug & DEBUG_HW)
                         pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n",
diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index f4253d468ae1..755c6bbc9553 100644
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -570,7 +570,7 @@ isdnloop_atimeout(isdnloop_card *card, int ch)
         char buf[60];
 
         spin_lock_irqsave(&card->isdnloop_lock, flags);
-        if (card->rcard) {
+        if (card->rcard[ch]) {
                 isdnloop_fake(card->rcard[ch], "DDIS_I", card->rch[ch] + 1);
                 card->rcard[ch]->rcard[card->rch[ch]] = NULL;
                 card->rcard[ch] = NULL;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index d516def846ab..b388406ac0f5 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -127,7 +127,7 @@ static u8 *pcan_msg_init_empty(struct pcan_usb_pro_msg *pm,
 /*
  * add one record to a message being built
  */
-static int pcan_msg_add_rec(struct pcan_usb_pro_msg *pm, u8 id, ...)
+static int pcan_msg_add_rec(struct pcan_usb_pro_msg *pm, int id, ...)
 {
         int len, i;
         u8 *pc;
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 96728d1e9824..f4e2db44ad91 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -569,6 +569,9 @@ int mv88e6xxx_port_setup_mac(struct mv88e6xxx_chip *chip, int port, int link,
                         goto restore_link;
         }
 
+        if (speed == SPEED_MAX && chip->info->ops->port_max_speed_mode)
+                mode = chip->info->ops->port_max_speed_mode(port);
+
         if (chip->info->ops->port_set_pause) {
                 err = chip->info->ops->port_set_pause(chip, port, pause);
                 if (err)
@@ -3067,6 +3070,7 @@ static const struct mv88e6xxx_ops mv88e6141_ops = {
         .port_set_duplex = mv88e6xxx_port_set_duplex,
         .port_set_rgmii_delay = mv88e6390_port_set_rgmii_delay,
         .port_set_speed = mv88e6341_port_set_speed,
+        .port_max_speed_mode = mv88e6341_port_max_speed_mode,
         .port_tag_remap = mv88e6095_port_tag_remap,
         .port_set_frame_mode = mv88e6351_port_set_frame_mode,
         .port_set_egress_floods = mv88e6352_port_set_egress_floods,
@@ -3385,6 +3389,7 @@ static const struct mv88e6xxx_ops mv88e6190_ops = {
         .port_set_duplex = mv88e6xxx_port_set_duplex,
         .port_set_rgmii_delay = mv88e6390_port_set_rgmii_delay,
         .port_set_speed = mv88e6390_port_set_speed,
+        .port_max_speed_mode = mv88e6390_port_max_speed_mode,
         .port_tag_remap = mv88e6390_port_tag_remap,
         .port_set_frame_mode = mv88e6351_port_set_frame_mode,
         .port_set_egress_floods = mv88e6352_port_set_egress_floods,
@@ -3429,6 +3434,7 @@ static const struct mv88e6xxx_ops mv88e6190x_ops = {
         .port_set_duplex = mv88e6xxx_port_set_duplex,
         .port_set_rgmii_delay = mv88e6390_port_set_rgmii_delay,
         .port_set_speed = mv88e6390x_port_set_speed,
+        .port_max_speed_mode = mv88e6390x_port_max_speed_mode,
         .port_tag_remap = mv88e6390_port_tag_remap,
         .port_set_frame_mode = mv88e6351_port_set_frame_mode,
         .port_set_egress_floods = mv88e6352_port_set_egress_floods,
@@ -3473,6 +3479,7 @@ static const struct mv88e6xxx_ops mv88e6191_ops = {
         .port_set_duplex = mv88e6xxx_port_set_duplex,
         .port_set_rgmii_delay = mv88e6390_port_set_rgmii_delay,
         .port_set_speed = mv88e6390_port_set_speed,
+        .port_max_speed_mode = mv88e6390_port_max_speed_mode,
         .port_tag_remap = mv88e6390_port_tag_remap,
         .port_set_frame_mode = mv88e6351_port_set_frame_mode,
         .port_set_egress_floods = mv88e6352_port_set_egress_floods,
@@ -3566,6 +3573,7 @@ static const struct mv88e6xxx_ops mv88e6290_ops = {
         .port_set_duplex = mv88e6xxx_port_set_duplex,
         .port_set_rgmii_delay = mv88e6390_port_set_rgmii_delay,
         .port_set_speed = mv88e6390_port_set_speed,
+        .port_max_speed_mode = mv88e6390_port_max_speed_mode,
         .port_tag_remap = mv88e6390_port_tag_remap,
         .port_set_frame_mode = mv88e6351_port_set_frame_mode,
         .port_set_egress_floods = mv88e6352_port_set_egress_floods,
@@ -3697,6 +3705,7 @@ static const struct mv88e6xxx_ops mv88e6341_ops = {
         .port_set_duplex = mv88e6xxx_port_set_duplex,
         .port_set_rgmii_delay = mv88e6390_port_set_rgmii_delay,
         .port_set_speed = mv88e6341_port_set_speed,
+        .port_max_speed_mode = mv88e6341_port_max_speed_mode,
         .port_tag_remap = mv88e6095_port_tag_remap,
         .port_set_frame_mode = mv88e6351_port_set_frame_mode,
         .port_set_egress_floods = mv88e6352_port_set_egress_floods,
@@ -3872,6 +3881,7 @@ static const struct mv88e6xxx_ops mv88e6390_ops = {
         .port_set_duplex = mv88e6xxx_port_set_duplex,
         .port_set_rgmii_delay = mv88e6390_port_set_rgmii_delay,
         .port_set_speed = mv88e6390_port_set_speed,
+        .port_max_speed_mode = mv88e6390_port_max_speed_mode,
         .port_tag_remap = mv88e6390_port_tag_remap,
         .port_set_frame_mode = mv88e6351_port_set_frame_mode,
         .port_set_egress_floods = mv88e6352_port_set_egress_floods,
@@ -3920,6 +3930,7 @@ static const struct mv88e6xxx_ops mv88e6390x_ops = {
         .port_set_duplex = mv88e6xxx_port_set_duplex,
         .port_set_rgmii_delay = mv88e6390_port_set_rgmii_delay,
         .port_set_speed = mv88e6390x_port_set_speed,
+        .port_max_speed_mode = mv88e6390x_port_max_speed_mode,
         .port_tag_remap = mv88e6390_port_tag_remap,
         .port_set_frame_mode = mv88e6351_port_set_frame_mode,
         .port_set_egress_floods = mv88e6352_port_set_egress_floods,
diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h
index adcf60779895..19c07dff0440 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.h
+++ b/drivers/net/dsa/mv88e6xxx/chip.h
@@ -377,6 +377,9 @@ struct mv88e6xxx_ops {
          */
         int (*port_set_speed)(struct mv88e6xxx_chip *chip, int port, int speed);
 
+        /* What interface mode should be used for maximum speed? */
+        phy_interface_t (*port_max_speed_mode)(int port);
+
         int (*port_tag_remap)(struct mv88e6xxx_chip *chip, int port);
 
         int (*port_set_frame_mode)(struct mv88e6xxx_chip *chip, int port,
diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
index 0796c6feec55..dce84a2a65c7 100644
--- a/drivers/net/dsa/mv88e6xxx/port.c
+++ b/drivers/net/dsa/mv88e6xxx/port.c
@@ -312,6 +312,14 @@ int mv88e6341_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed)
         return mv88e6xxx_port_set_speed(chip, port, speed, !port, true);
 }
 
+phy_interface_t mv88e6341_port_max_speed_mode(int port)
+{
+        if (port == 5)
+                return PHY_INTERFACE_MODE_2500BASEX;
+
+        return PHY_INTERFACE_MODE_NA;
+}
+
 /* Support 10, 100, 200, 1000 Mbps (e.g. 88E6352 family) */
 int mv88e6352_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed)
 {
@@ -345,6 +353,14 @@ int mv88e6390_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed)
         return mv88e6xxx_port_set_speed(chip, port, speed, true, true);
 }
 
+phy_interface_t mv88e6390_port_max_speed_mode(int port)
+{
+        if (port == 9 || port == 10)
+                return PHY_INTERFACE_MODE_2500BASEX;
+
+        return PHY_INTERFACE_MODE_NA;
+}
+
 /* Support 10, 100, 200, 1000, 2500, 10000 Mbps (e.g. 88E6190X) */
 int mv88e6390x_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed)
 {
@@ -360,6 +376,14 @@ int mv88e6390x_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed)
         return mv88e6xxx_port_set_speed(chip, port, speed, true, true);
 }
 
+phy_interface_t mv88e6390x_port_max_speed_mode(int port)
+{
+        if (port == 9 || port == 10)
+                return PHY_INTERFACE_MODE_XAUI;
+
+        return PHY_INTERFACE_MODE_NA;
+}
+
 int mv88e6390x_port_set_cmode(struct mv88e6xxx_chip *chip, int port,
                               phy_interface_t mode)
 {
diff --git a/drivers/net/dsa/mv88e6xxx/port.h b/drivers/net/dsa/mv88e6xxx/port.h
index 4aadf321edb7..c7bed263a0f4 100644
--- a/drivers/net/dsa/mv88e6xxx/port.h
+++ b/drivers/net/dsa/mv88e6xxx/port.h
@@ -285,6 +285,10 @@ int mv88e6352_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
 int mv88e6390_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
 int mv88e6390x_port_set_speed(struct mv88e6xxx_chip *chip, int port, int speed);
 
+phy_interface_t mv88e6341_port_max_speed_mode(int port);
+phy_interface_t mv88e6390_port_max_speed_mode(int port);
+phy_interface_t mv88e6390x_port_max_speed_mode(int port);
+
 int mv88e6xxx_port_set_state(struct mv88e6xxx_chip *chip, int port, u8 state);
 
 int mv88e6xxx_port_set_vlan_map(struct mv88e6xxx_chip *chip, int port, u16 map);
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 9a7f70db20c7..733d9172425b 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -119,7 +119,7 @@ static void enic_init_affinity_hint(struct enic *enic)
 
         for (i = 0; i < enic->intr_count; i++) {
                 if (enic_is_err_intr(enic, i) || enic_is_notify_intr(enic, i) ||
-                    (enic->msix[i].affinity_mask &&
+                    (cpumask_available(enic->msix[i].affinity_mask) &&
                      !cpumask_empty(enic->msix[i].affinity_mask)))
                         continue;
                 if (zalloc_cpumask_var(&enic->msix[i].affinity_mask,
@@ -148,7 +148,7 @@ static void enic_set_affinity_hint(struct enic *enic)
         for (i = 0; i < enic->intr_count; i++) {
                 if (enic_is_err_intr(enic, i)           ||
                     enic_is_notify_intr(enic, i)        ||
-                    !enic->msix[i].affinity_mask        ||
+                    !cpumask_available(enic->msix[i].affinity_mask) ||
                     cpumask_empty(enic->msix[i].affinity_mask))
                         continue;
                 err = irq_set_affinity_hint(enic->msix_entry[i].vector,
@@ -161,7 +161,7 @@ static void enic_set_affinity_hint(struct enic *enic)
         for (i = 0; i < enic->wq_count; i++) {
                 int wq_intr = enic_msix_wq_intr(enic, i);
 
-                if (enic->msix[wq_intr].affinity_mask &&
+                if (cpumask_available(enic->msix[wq_intr].affinity_mask) &&
                     !cpumask_empty(enic->msix[wq_intr].affinity_mask))
                         netif_set_xps_queue(enic->netdev,
                                             enic->msix[wq_intr].affinity_mask,
diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
index 66d7a8b80e76..38b430f11fc1 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
@@ -194,6 +194,7 @@ struct hnae3_ae_dev {
         const struct hnae3_ae_ops *ops;
         struct list_head node;
         u32 flag;
+        u8 override_pci_need_reset; /* fix to stop multiple reset happening */
         enum hnae3_dev_type dev_type;
         enum hnae3_reset_type reset_type;
         void *priv;
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 3cb43b1f1c2e..1c1f17ec6be2 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -1850,7 +1850,9 @@ static pci_ers_result_t hns3_slot_reset(struct pci_dev *pdev)
 
         /* request the reset */
         if (ae_dev->ops->reset_event) {
-                ae_dev->ops->reset_event(pdev, NULL);
+                if (!ae_dev->override_pci_need_reset)
+                        ae_dev->ops->reset_event(pdev, NULL);
+
                 return PCI_ERS_RESULT_RECOVERED;
         }
 
@@ -2321,8 +2323,8 @@ static void hns3_rx_checksum(struct hns3_enet_ring *ring, struct sk_buff *skb,
         if (!(bd_base_info & BIT(HNS3_RXD_L3L4P_B)))
                 return;
 
-        if (unlikely(l234info & (BIT(HNS3_RXD_L3E_B) | BIT(HNS3_RXD_L4E_B) ||
-                                 BIT(HNS3_RXD_OL3E_B) ||
+        if (unlikely(l234info & (BIT(HNS3_RXD_L3E_B) | BIT(HNS3_RXD_L4E_B) |
+                                 BIT(HNS3_RXD_OL3E_B) |
                                  BIT(HNS3_RXD_OL4E_B)))) {
                 u64_stats_update_begin(&ring->syncp);
                 ring->stats.l3l4_csum_err++;
@@ -2472,6 +2474,8 @@ static int hns3_add_frag(struct hns3_enet_ring *ring, struct hns3_desc *desc,
                 desc = &ring->desc[ring->next_to_clean];
                 desc_cb = &ring->desc_cb[ring->next_to_clean];
                 bd_base_info = le32_to_cpu(desc->rx.bd_base_info);
+                /* make sure HW write desc complete */
+                dma_rmb();
                 if (!(bd_base_info & BIT(HNS3_RXD_VLD_B)))
                         return -ENXIO;
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
index 1feceff1477c..1f52d11f77b5 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
@@ -1317,8 +1317,10 @@ pci_ers_result_t hclge_handle_hw_ras_error(struct hnae3_ae_dev *ae_dev)
                 hclge_handle_all_ras_errors(hdev);
         } else {
                 if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state) ||
-                    hdev->pdev->revision < 0x21)
+                    hdev->pdev->revision < 0x21) {
+                        ae_dev->override_pci_need_reset = 1;
                         return PCI_ERS_RESULT_RECOVERED;
+                }
         }
 
         if (status & HCLGE_RAS_REG_ROCEE_ERR_MASK) {
@@ -1327,8 +1329,11 @@ pci_ers_result_t hclge_handle_hw_ras_error(struct hnae3_ae_dev *ae_dev)
         }
 
         if (status & HCLGE_RAS_REG_NFE_MASK ||
-            status & HCLGE_RAS_REG_ROCEE_ERR_MASK)
+            status & HCLGE_RAS_REG_ROCEE_ERR_MASK) {
+                ae_dev->override_pci_need_reset = 0;
                 return PCI_ERS_RESULT_NEED_RESET;
+        }
+        ae_dev->override_pci_need_reset = 1;
 
         return PCI_ERS_RESULT_RECOVERED;
 }
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
index 166d7f71442e..372adea10e14 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ctrl.h
@@ -392,7 +392,7 @@
 #define NFP_NET_CFG_MBOX_SIMPLE_CMD     0x0
 #define NFP_NET_CFG_MBOX_SIMPLE_RET     0x4
 #define NFP_NET_CFG_MBOX_SIMPLE_VAL     0x8
-#define NFP_NET_CFG_MBOX_SIMPLE_LEN     0x12
+#define NFP_NET_CFG_MBOX_SIMPLE_LEN     12
 
 #define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_ADD 1
 #define NFP_NET_CFG_MBOX_CMD_CTAG_FILTER_KILL 2
diff --git a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
index c6238083e898..b4c8949933f1 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
@@ -1663,8 +1663,11 @@ static int qede_selftest_run_loopback(struct qede_dev *edev, u32 loopback_mode)
         /* Wait for loopback configuration to apply */
         msleep_interruptible(500);
 
-        /* prepare the loopback packet */
-        pkt_size = edev->ndev->mtu + ETH_HLEN;
+        /* Setting max packet size to 1.5K to avoid data being split over
+         * multiple BDs in cases where MTU > PAGE_SIZE.
+         */
+        pkt_size = (((edev->ndev->mtu < ETH_DATA_LEN) ?
+                     edev->ndev->mtu : ETH_DATA_LEN) + ETH_HLEN);
 
         skb = netdev_alloc_skb(edev->ndev, pkt_size);
         if (!skb) {
diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c
index 69d752f0b621..55d01266e615 100644
--- a/drivers/net/ethernet/realtek/8139too.c
+++ b/drivers/net/ethernet/realtek/8139too.c
@@ -258,6 +258,7 @@ static const struct pci_device_id rtl8139_pci_tbl[] = {
         {0x126c, 0x1211, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RTL8139 },
         {0x1743, 0x8139, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RTL8139 },
         {0x021b, 0x8139, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RTL8139 },
+        {0x16ec, 0xab06, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RTL8139 },
 
 #ifdef CONFIG_SH_SECUREEDGE5410
         /* Bogus 8139 silicon reports 8129 without external PROM :-( */
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index d28c8f9ca55b..8154b38c08f7 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -458,7 +458,7 @@ static int ravb_dmac_init(struct net_device *ndev)
                    RCR_EFFS | RCR_ENCF | RCR_ETS0 | RCR_ESF | 0x18000000, RCR);
 
         /* Set FIFO size */
-        ravb_write(ndev, TGC_TQP_AVBMODE1 | 0x00222200, TGC);
+        ravb_write(ndev, TGC_TQP_AVBMODE1 | 0x00112200, TGC);
 
         /* Timestamp enable */
         ravb_write(ndev, TCCR_TFEN, TCCR);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
index 7e2e79dedebf..062a600fa5a7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
@@ -25,9 +25,24 @@
 
 #define SYSCFG_MCU_ETH_MASK             BIT(23)
 #define SYSCFG_MP1_ETH_MASK             GENMASK(23, 16)
+#define SYSCFG_PMCCLRR_OFFSET           0x40
 
 #define SYSCFG_PMCR_ETH_CLK_SEL         BIT(16)
 #define SYSCFG_PMCR_ETH_REF_CLK_SEL     BIT(17)
+
+/*  Ethernet PHY interface selection in register SYSCFG Configuration
+ *------------------------------------------
+ * src   |BIT(23)| BIT(22)| BIT(21)|BIT(20)|
+ *------------------------------------------
+ * MII   |   0   |   0    |   0    |   1   |
+ *------------------------------------------
+ * GMII  |   0   |   0    |   0    |   0   |
+ *------------------------------------------
+ * RGMII |   0   |   0    |   1    |  n/a  |
+ *------------------------------------------
+ * RMII  |   1   |   0    |   0    |  n/a  |
+ *------------------------------------------
+ */
 #define SYSCFG_PMCR_ETH_SEL_MII         BIT(20)
 #define SYSCFG_PMCR_ETH_SEL_RGMII       BIT(21)
 #define SYSCFG_PMCR_ETH_SEL_RMII        BIT(23)
@@ -35,14 +50,54 @@
 #define SYSCFG_MCU_ETH_SEL_MII          0
 #define SYSCFG_MCU_ETH_SEL_RMII         1
 
+/* STM32MP1 register definitions
+ *
+ * Below table summarizes the clock requirement and clock sources for
+ * supported phy interface modes.
+ * __________________________________________________________________________
+ *|PHY_MODE | Normal | PHY wo crystal|   PHY wo crystal   |No 125Mhz from PHY|
+ *|         |        |      25MHz    |        50MHz       |                  |
+ * ---------------------------------------------------------------------------
+ *|  MII    |    -   |     eth-ck    |        n/a         |       n/a        |
+ *|         |        |               |                    |                  |
+ * ---------------------------------------------------------------------------
+ *|  GMII   |    -   |     eth-ck    |        n/a         |       n/a        |
+ *|         |        |               |                    |                  |
+ * ---------------------------------------------------------------------------
+ *| RGMII   |    -   |     eth-ck    |        n/a         |  eth-ck (no pin) |
+ *|         |        |               |                    |  st,eth-clk-sel  |
+ * ---------------------------------------------------------------------------
+ *| RMII    |    -   |     eth-ck    |      eth-ck        |       n/a        |
+ *|         |        |               | st,eth-ref-clk-sel |                  |
+ * ---------------------------------------------------------------------------
+ *
+ * BIT(17) : set this bit in RMII mode when you have PHY without crystal 50MHz
+ * BIT(16) : set this bit in GMII/RGMII PHY when you do not want use 125Mhz
+ * from PHY
+ *-----------------------------------------------------
+ * src   |         BIT(17)       |       BIT(16)      |
+ *-----------------------------------------------------
+ * MII   |           n/a         |         n/a        |
+ *-----------------------------------------------------
+ * GMII  |           n/a         |   st,eth-clk-sel   |
+ *-----------------------------------------------------
+ * RGMII |           n/a         |   st,eth-clk-sel   |
+ *-----------------------------------------------------
+ * RMII  |   st,eth-ref-clk-sel  |         n/a        |
+ *-----------------------------------------------------
+ *
+ */
+
 struct stm32_dwmac {
         struct clk *clk_tx;
         struct clk *clk_rx;
         struct clk *clk_eth_ck;
         struct clk *clk_ethstp;
         struct clk *syscfg_clk;
-        bool int_phyclk;        /* Clock from RCC to drive PHY */
-        u32 mode_reg;           /* MAC glue-logic mode register */
+        int eth_clk_sel_reg;
+        int eth_ref_clk_sel_reg;
+        int irq_pwr_wakeup;
+        u32 mode_reg;            /* MAC glue-logic mode register */
         struct regmap *regmap;
         u32 speed;
         const struct stm32_ops *ops;
@@ -102,7 +157,7 @@ static int stm32mp1_clk_prepare(struct stm32_dwmac *dwmac, bool prepare)
                 if (ret)
                         return ret;
 
-                if (dwmac->int_phyclk) {
+                if (dwmac->clk_eth_ck) {
                         ret = clk_prepare_enable(dwmac->clk_eth_ck);
                         if (ret) {
                                 clk_disable_unprepare(dwmac->syscfg_clk);
@@ -111,7 +166,7 @@ static int stm32mp1_clk_prepare(struct stm32_dwmac *dwmac, bool prepare)
                 }
         } else {
                 clk_disable_unprepare(dwmac->syscfg_clk);
-                if (dwmac->int_phyclk)
+                if (dwmac->clk_eth_ck)
                         clk_disable_unprepare(dwmac->clk_eth_ck);
         }
         return ret;
@@ -121,7 +176,7 @@ static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
 {
         struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
         u32 reg = dwmac->mode_reg;
-        int val;
+        int val, ret;
 
         switch (plat_dat->interface) {
         case PHY_INTERFACE_MODE_MII:
@@ -130,19 +185,22 @@ static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
                 break;
         case PHY_INTERFACE_MODE_GMII:
                 val = SYSCFG_PMCR_ETH_SEL_GMII;
-                if (dwmac->int_phyclk)
+                if (dwmac->eth_clk_sel_reg)
                         val |= SYSCFG_PMCR_ETH_CLK_SEL;
                 pr_debug("SYSCFG init : PHY_INTERFACE_MODE_GMII\n");
                 break;
         case PHY_INTERFACE_MODE_RMII:
                 val = SYSCFG_PMCR_ETH_SEL_RMII;
-                if (dwmac->int_phyclk)
+                if (dwmac->eth_ref_clk_sel_reg)
                         val |= SYSCFG_PMCR_ETH_REF_CLK_SEL;
                 pr_debug("SYSCFG init : PHY_INTERFACE_MODE_RMII\n");
                 break;
         case PHY_INTERFACE_MODE_RGMII:
+        case PHY_INTERFACE_MODE_RGMII_ID:
+        case PHY_INTERFACE_MODE_RGMII_RXID:
+        case PHY_INTERFACE_MODE_RGMII_TXID:
                 val = SYSCFG_PMCR_ETH_SEL_RGMII;
-                if (dwmac->int_phyclk)
+                if (dwmac->eth_clk_sel_reg)
                         val |= SYSCFG_PMCR_ETH_CLK_SEL;
                 pr_debug("SYSCFG init : PHY_INTERFACE_MODE_RGMII\n");
                 break;
@@ -153,6 +211,11 @@ static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
                 return -EINVAL;
         }
 
+        /* Need to update PMCCLRR (clear register) */
+        ret = regmap_write(dwmac->regmap, reg + SYSCFG_PMCCLRR_OFFSET,
+                           dwmac->ops->syscfg_eth_mask);
+
+        /* Update PMCSETR (set register) */
         return regmap_update_bits(dwmac->regmap, reg,
                                  dwmac->ops->syscfg_eth_mask, val);
 }
@@ -180,7 +243,7 @@ static int stm32mcu_set_mode(struct plat_stmmacenet_data *plat_dat)
         }
 
         return regmap_update_bits(dwmac->regmap, reg,
-                                 dwmac->ops->syscfg_eth_mask, val);
+                                 dwmac->ops->syscfg_eth_mask, val << 23);
 }
 
 static void stm32_dwmac_clk_disable(struct stm32_dwmac *dwmac)
@@ -232,24 +295,29 @@ static int stm32_dwmac_parse_data(struct stm32_dwmac *dwmac,
 static int stm32mp1_parse_data(struct stm32_dwmac *dwmac,
                                struct device *dev)
 {
+        struct platform_device *pdev = to_platform_device(dev);
         struct device_node *np = dev->of_node;
+        int err = 0;
 
-        dwmac->int_phyclk = of_property_read_bool(np, "st,int-phyclk");
+        /* Gigabit Ethernet 125MHz clock selection. */
+        dwmac->eth_clk_sel_reg = of_property_read_bool(np, "st,eth-clk-sel");
 
-        /* Check if internal clk from RCC selected */
-        if (dwmac->int_phyclk) {
-                /*  Get ETH_CLK clocks */
-                dwmac->clk_eth_ck = devm_clk_get(dev, "eth-ck");
-                if (IS_ERR(dwmac->clk_eth_ck)) {
-                        dev_err(dev, "No ETH CK clock provided...\n");
-                        return PTR_ERR(dwmac->clk_eth_ck);
-                }
+        /* Ethernet 50Mhz RMII clock selection */
+        dwmac->eth_ref_clk_sel_reg =
+                of_property_read_bool(np, "st,eth-ref-clk-sel");
+
+        /*  Get ETH_CLK clocks */
+        dwmac->clk_eth_ck = devm_clk_get(dev, "eth-ck");
+        if (IS_ERR(dwmac->clk_eth_ck)) {
+                dev_warn(dev, "No phy clock provided...\n");
+                dwmac->clk_eth_ck = NULL;
         }
 
         /*  Clock used for low power mode */
         dwmac->clk_ethstp = devm_clk_get(dev, "ethstp");
         if (IS_ERR(dwmac->clk_ethstp)) {
-                dev_err(dev, "No ETH peripheral clock provided for CStop mode ...\n");
+                dev_err(dev,
+                        "No ETH peripheral clock provided for CStop mode ...\n");
                 return PTR_ERR(dwmac->clk_ethstp);
         }
 
@@ -260,7 +328,26 @@ static int stm32mp1_parse_data(struct stm32_dwmac *dwmac,
                 return PTR_ERR(dwmac->syscfg_clk);
         }
 
-        return 0;
+        /* Get IRQ information early to have an ability to ask for deferred
+         * probe if needed before we went too far with resource allocation.
+         */
+        dwmac->irq_pwr_wakeup = platform_get_irq_byname(pdev,
+                                                        "stm32_pwr_wakeup");
+        if (!dwmac->clk_eth_ck && dwmac->irq_pwr_wakeup >= 0) {
+                err = device_init_wakeup(&pdev->dev, true);
+                if (err) {
+                        dev_err(&pdev->dev, "Failed to init wake up irq\n");
+                        return err;
+                }
+                err = dev_pm_set_dedicated_wake_irq(&pdev->dev,
+                                                    dwmac->irq_pwr_wakeup);
+                if (err) {
+                        dev_err(&pdev->dev, "Failed to set wake up irq\n");
+                        device_init_wakeup(&pdev->dev, false);
+                }
+                device_set_wakeup_enable(&pdev->dev, false);
+        }
+        return err;
 }
 
 static int stm32_dwmac_probe(struct platform_device *pdev)
@@ -326,9 +413,15 @@ static int stm32_dwmac_remove(struct platform_device *pdev)
         struct net_device *ndev = platform_get_drvdata(pdev);
         struct stmmac_priv *priv = netdev_priv(ndev);
         int ret = stmmac_dvr_remove(&pdev->dev);
+        struct stm32_dwmac *dwmac = priv->plat->bsp_priv;
 
         stm32_dwmac_clk_disable(priv->plat->bsp_priv);
 
+        if (dwmac->irq_pwr_wakeup >= 0) {
+                dev_pm_clear_wake_irq(&pdev->dev);
+                device_init_wakeup(&pdev->dev, false);
+        }
+
         return ret;
 }
 
@@ -342,7 +435,7 @@ static int stm32mp1_suspend(struct stm32_dwmac *dwmac)
 
         clk_disable_unprepare(dwmac->clk_tx);
         clk_disable_unprepare(dwmac->syscfg_clk);
-        if (dwmac->int_phyclk)
+        if (dwmac->clk_eth_ck)
                 clk_disable_unprepare(dwmac->clk_eth_ck);
 
         return ret;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index e2a13ec2e30b..97c5e1aad88f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -480,7 +480,7 @@ static void stmmac_get_tx_hwtstamp(struct stmmac_priv *priv,
                                    struct dma_desc *p, struct sk_buff *skb)
 {
         struct skb_shared_hwtstamps shhwtstamp;
-        u64 ns;
+        u64 ns = 0;
 
         if (!priv->hwts_tx_en)
                 return;
@@ -519,7 +519,7 @@ static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv, struct dma_desc *p,
 {
         struct skb_shared_hwtstamps *shhwtstamp = NULL;
         struct dma_desc *desc = p;
-        u64 ns;
+        u64 ns = 0;
 
         if (!priv->hwts_rx_en)
                 return;
@@ -564,8 +564,8 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr)
         u32 snap_type_sel = 0;
         u32 ts_master_en = 0;
         u32 ts_event_en = 0;
+        u32 sec_inc = 0;
         u32 value = 0;
-        u32 sec_inc;
         bool xmac;
 
         xmac = priv->plat->has_gmac4 || priv->plat->has_xgmac;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 2b800ce1d5bf..3031f2bf15d6 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -408,6 +408,9 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
         /* Default to phy auto-detection */
         plat->phy_addr = -1;
 
+        /* Get clk_csr from device tree */
+        of_property_read_u32(np, "clk_csr", &plat->clk_csr);
+
         /* "snps,phy-addr" is not a standard property. Mark it as deprecated
          * and warn of its use. Remove this when phy node support is added.
          */
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
index 2293e21f789f..cc60b3fb0892 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
@@ -105,7 +105,7 @@ static int stmmac_get_time(struct ptp_clock_info *ptp, struct timespec64 *ts)
         struct stmmac_priv *priv =
             container_of(ptp, struct stmmac_priv, ptp_clock_ops);
         unsigned long flags;
-        u64 ns;
+        u64 ns = 0;
 
         spin_lock_irqsave(&priv->ptp_lock, flags);
         stmmac_get_systime(priv, priv->ptpaddr, &ns);
diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index d84501441edd..6f99437a6962 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -7464,6 +7464,7 @@ static int niu_add_ethtool_tcam_entry(struct niu *np,
                                         class = CLASS_CODE_USER_PROG4;
                                         break;
                                 default:
+                                        class = CLASS_CODE_UNRECOG;
                                         break;
                                 }
                                 ret = tcam_user_ip_class_set(np, class, 0,
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 840820402cd0..57450b174fc4 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -2029,7 +2029,6 @@ static const struct dev_pm_ops davinci_emac_pm_ops = {
         .resume         = davinci_emac_resume,
 };
 
-#if IS_ENABLED(CONFIG_OF)
 static const struct emac_platform_data am3517_emac_data = {
         .version                = EMAC_VERSION_2,
         .hw_ram_addr            = 0x01e20000,
@@ -2046,14 +2045,13 @@ static const struct of_device_id davinci_emac_of_match[] = {
         {},
 };
 MODULE_DEVICE_TABLE(of, davinci_emac_of_match);
-#endif
 
 /* davinci_emac_driver: EMAC platform driver structure */
 static struct platform_driver davinci_emac_driver = {
         .driver = {
                 .name    = "davinci_emac",
                 .pm      = &davinci_emac_pm_ops,
-                .of_match_table = of_match_ptr(davinci_emac_of_match),
+                .of_match_table = davinci_emac_of_match,
         },
         .probe = davinci_emac_probe,
         .remove = davinci_emac_remove,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index a3c46d78d216..077f1b9f2761 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1731,6 +1731,14 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
                 goto drop;
         }
 
+        rcu_read_lock();
+
+        if (unlikely(!(vxlan->dev->flags & IFF_UP))) {
+                rcu_read_unlock();
+                atomic_long_inc(&vxlan->dev->rx_dropped);
+                goto drop;
+        }
+
         stats = this_cpu_ptr(vxlan->dev->tstats);
         u64_stats_update_begin(&stats->syncp);
         stats->rx_packets++;
@@ -1738,6 +1746,9 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
         u64_stats_update_end(&stats->syncp);
 
         gro_cells_receive(&vxlan->gro_cells, skb);
+
+        rcu_read_unlock();
+
         return 0;
 
 drop:
@@ -2690,7 +2701,7 @@ static void vxlan_cleanup(struct timer_list *t)
         for (h = 0; h < FDB_HASH_SIZE; ++h) {
                 struct hlist_node *p, *n;
 
-                spin_lock_bh(&vxlan->hash_lock);
+                spin_lock(&vxlan->hash_lock);
                 hlist_for_each_safe(p, n, &vxlan->fdb_head[h]) {
                         struct vxlan_fdb *f
                                 = container_of(p, struct vxlan_fdb, hlist);
@@ -2712,7 +2723,7 @@ static void vxlan_cleanup(struct timer_list *t)
                         } else if (time_before(timeout, next_timer))
                                 next_timer = timeout;
                 }
-                spin_unlock_bh(&vxlan->hash_lock);
+                spin_unlock(&vxlan->hash_lock);
         }
 
         mod_timer(&vxlan->age_timer, next_timer);
@@ -2767,6 +2778,8 @@ static void vxlan_uninit(struct net_device *dev)
 {
         struct vxlan_dev *vxlan = netdev_priv(dev);
 
+        gro_cells_destroy(&vxlan->gro_cells);
+
         vxlan_fdb_delete_default(vxlan, vxlan->cfg.vni);
 
         free_percpu(dev->tstats);
@@ -3942,7 +3955,6 @@ static void vxlan_dellink(struct net_device *dev, struct list_head *head)
 
         vxlan_flush(vxlan, true);
 
-        gro_cells_destroy(&vxlan->gro_cells);
         list_del(&vxlan->next);
         unregister_netdevice_queue(dev, head);
 }
diff --git a/include/linux/atalk.h b/include/linux/atalk.h
index 5a90f28d5ff2..d5cfc0b15b76 100644
--- a/include/linux/atalk.h
+++ b/include/linux/atalk.h
@@ -161,16 +161,26 @@ extern int sysctl_aarp_resolve_time;
 extern int atalk_register_sysctl(void);
 extern void atalk_unregister_sysctl(void);
 #else
-#define atalk_register_sysctl()         do { } while(0)
-#define atalk_unregister_sysctl()       do { } while(0)
+static inline int atalk_register_sysctl(void)
+{
+        return 0;
+}
+static inline void atalk_unregister_sysctl(void)
+{
+}
 #endif
 
 #ifdef CONFIG_PROC_FS
 extern int atalk_proc_init(void);
 extern void atalk_proc_exit(void);
 #else
-#define atalk_proc_init()       ({ 0; })
-#define atalk_proc_exit()       do { } while(0)
+static inline int atalk_proc_init(void)
+{
+        return 0;
+}
+static inline void atalk_proc_exit(void)
+{
+}
 #endif /* CONFIG_PROC_FS */
 
 #endif /* __LINUX_ATALK_H__ */
diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h
index 695b2a880d9a..a4c644c1c091 100644
--- a/include/linux/bpf-cgroup.h
+++ b/include/linux/bpf-cgroup.h
@@ -292,7 +292,7 @@ static inline int bpf_cgroup_storage_assign(struct bpf_prog *prog,
 static inline void bpf_cgroup_storage_release(struct bpf_prog *prog,
                                               struct bpf_map *map) {}
 static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(
-        struct bpf_prog *prog, enum bpf_cgroup_storage_type stype) { return 0; }
+        struct bpf_prog *prog, enum bpf_cgroup_storage_type stype) { return NULL; }
 static inline void bpf_cgroup_storage_free(
         struct bpf_cgroup_storage *storage) {}
 static inline int bpf_percpu_cgroup_storage_copy(struct bpf_map *map, void *key,
diff --git a/include/linux/igmp.h b/include/linux/igmp.h
index cc85f4524dbf..9c94b2ea789c 100644
--- a/include/linux/igmp.h
+++ b/include/linux/igmp.h
@@ -110,7 +110,7 @@ struct ip_mc_list {
 static inline int ip_mc_may_pull(struct sk_buff *skb, unsigned int len)
 {
         if (skb_transport_offset(skb) + ip_transport_len(skb) < len)
-                return -EINVAL;
+                return 0;
 
         return pskb_may_pull(skb, len);
 }
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index b48bb8b42fc8..9027a8c4219f 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -327,26 +327,49 @@ struct skb_frag_struct {
 #endif
 };
 
+/**
+ * skb_frag_size - Returns the size of a skb fragment
+ * @frag: skb fragment
+ */
 static inline unsigned int skb_frag_size(const skb_frag_t *frag)
 {
         return frag->size;
 }
 
+/**
+ * skb_frag_size_set - Sets the size of a skb fragment
+ * @frag: skb fragment
+ * @size: size of fragment
+ */
 static inline void skb_frag_size_set(skb_frag_t *frag, unsigned int size)
 {
         frag->size = size;
 }
 
+/**
+ * skb_frag_size_add - Incrementes the size of a skb fragment by %delta
+ * @frag: skb fragment
+ * @delta: value to add
+ */
 static inline void skb_frag_size_add(skb_frag_t *frag, int delta)
 {
         frag->size += delta;
 }
 
+/**
+ * skb_frag_size_sub - Decrements the size of a skb fragment by %delta
+ * @frag: skb fragment
+ * @delta: value to subtract
+ */
 static inline void skb_frag_size_sub(skb_frag_t *frag, int delta)
 {
         frag->size -= delta;
 }
 
+/**
+ * skb_frag_must_loop - Test if %p is a high memory page
+ * @p: fragment's page
+ */
 static inline bool skb_frag_must_loop(struct page *p)
 {
 #if defined(CONFIG_HIGHMEM)
@@ -590,7 +613,7 @@ typedef unsigned int sk_buff_data_t;
 typedef unsigned char *sk_buff_data_t;
 #endif
 
-/** 
+/**
  *      struct sk_buff - socket buffer
  *      @next: Next buffer in list
  *      @prev: Previous buffer in list
@@ -648,7 +671,7 @@ typedef unsigned char *sk_buff_data_t;
  *      @csum_not_inet: use CRC32c to resolve CHECKSUM_PARTIAL
  *      @dst_pending_confirm: need to confirm neighbour
  *      @decrypted: Decrypted SKB
-  *     @napi_id: id of the NAPI struct this skb came from
+ *      @napi_id: id of the NAPI struct this skb came from
  *      @secmark: security marking
  *      @mark: Generic packet mark
  *      @vlan_proto: vlan encapsulation protocol
@@ -883,7 +906,10 @@ struct sk_buff {
 #define SKB_ALLOC_RX            0x02
 #define SKB_ALLOC_NAPI          0x04
 
-/* Returns true if the skb was allocated from PFMEMALLOC reserves */
+/**
+ * skb_pfmemalloc - Test if the skb was allocated from PFMEMALLOC reserves
+ * @skb: buffer
+ */
 static inline bool skb_pfmemalloc(const struct sk_buff *skb)
 {
         return unlikely(skb->pfmemalloc);
@@ -905,7 +931,7 @@ static inline bool skb_pfmemalloc(const struct sk_buff *skb)
  */
 static inline struct dst_entry *skb_dst(const struct sk_buff *skb)
 {
-        /* If refdst was not refcounted, check we still are in a 
+        /* If refdst was not refcounted, check we still are in a
          * rcu_read_lock section
          */
         WARN_ON((skb->_skb_refdst & SKB_DST_NOREF) &&
@@ -952,6 +978,10 @@ static inline bool skb_dst_is_noref(const struct sk_buff *skb)
         return (skb->_skb_refdst & SKB_DST_NOREF) && skb_dst(skb);
 }
 
+/**
+ * skb_rtable - Returns the skb &rtable
+ * @skb: buffer
+ */
 static inline struct rtable *skb_rtable(const struct sk_buff *skb)
 {
         return (struct rtable *)skb_dst(skb);
@@ -966,6 +996,10 @@ static inline bool skb_pkt_type_ok(u32 ptype)
         return ptype <= PACKET_OTHERHOST;
 }
 
+/**
+ * skb_napi_id - Returns the skb's NAPI id
+ * @skb: buffer
+ */
 static inline unsigned int skb_napi_id(const struct sk_buff *skb)
 {
 #ifdef CONFIG_NET_RX_BUSY_POLL
@@ -975,7 +1009,12 @@ static inline unsigned int skb_napi_id(const struct sk_buff *skb)
 #endif
 }
 
-/* decrement the reference count and return true if we can free the skb */
+/**
+ * skb_unref - decrement the skb's reference count
+ * @skb: buffer
+ *
+ * Returns true if we can free the skb.
+ */
 static inline bool skb_unref(struct sk_buff *skb)
 {
         if (unlikely(!skb))
@@ -1005,6 +1044,14 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t priority, int flags,
                             int node);
 struct sk_buff *__build_skb(void *data, unsigned int frag_size);
 struct sk_buff *build_skb(void *data, unsigned int frag_size);
+
+/**
+ * alloc_skb - allocate a network buffer
+ * @size: size to allocate
+ * @priority: allocation mask
+ *
+ * This function is a convenient wrapper around __alloc_skb().
+ */
 static inline struct sk_buff *alloc_skb(unsigned int size,
                                         gfp_t priority)
 {
@@ -1047,6 +1094,13 @@ static inline bool skb_fclone_busy(const struct sock *sk,
                fclones->skb2.sk == sk;
 }
 
+/**
+ * alloc_skb_fclone - allocate a network buffer from fclone cache
+ * @size: size to allocate
+ * @priority: allocation mask
+ *
+ * This function is a convenient wrapper around __alloc_skb().
+ */
 static inline struct sk_buff *alloc_skb_fclone(unsigned int size,
                                                gfp_t priority)
 {
@@ -4232,10 +4286,10 @@ static inline bool skb_is_gso_sctp(const struct sk_buff *skb)
         return skb_shinfo(skb)->gso_type & SKB_GSO_SCTP;
 }
 
+/* Note: Should be called only if skb_is_gso(skb) is true */
 static inline bool skb_is_gso_tcp(const struct sk_buff *skb)
 {
-        return skb_is_gso(skb) &&
-               skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6);
+        return skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6);
 }
 
 static inline void skb_gso_reset(struct sk_buff *skb)
diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index 347015515a7d..21a5243fecd1 100644
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -108,7 +108,6 @@ reqsk_alloc(const struct request_sock_ops *ops, struct sock *sk_listener,
 
 static inline void reqsk_free(struct request_sock *req)
 {
-        /* temporary debugging */
         WARN_ON_ONCE(refcount_read(&req->rsk_refcnt) != 0);
 
         req->rsk_ops->destructor(req);
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 5b50fe4906d2..7b60fd186cfe 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -76,6 +76,7 @@ enum rxrpc_client_trace {
         rxrpc_client_chan_disconnect,
         rxrpc_client_chan_pass,
         rxrpc_client_chan_unstarted,
+        rxrpc_client_chan_wait_failed,
         rxrpc_client_cleanup,
         rxrpc_client_count,
         rxrpc_client_discard,
@@ -276,6 +277,7 @@ enum rxrpc_tx_point {
         EM(rxrpc_client_chan_disconnect,        "ChDisc") \
         EM(rxrpc_client_chan_pass,              "ChPass") \
         EM(rxrpc_client_chan_unstarted,         "ChUnst") \
+        EM(rxrpc_client_chan_wait_failed,       "ChWtFl") \
         EM(rxrpc_client_cleanup,                "Clean ") \
         EM(rxrpc_client_count,                  "Count ") \
         EM(rxrpc_client_discard,                "Discar") \
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index a7b96bf0e654..ce166a002d16 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6678,17 +6678,17 @@ static int replace_map_fd_with_map_ptr(struct bpf_verifier_env *env)
                                 /* valid generic load 64-bit imm */
                                 goto next_insn;
 
-                        if (insn->src_reg != BPF_PSEUDO_MAP_FD) {
-                                verbose(env,
-                                        "unrecognized bpf_ld_imm64 insn\n");
+                        if (insn[0].src_reg != BPF_PSEUDO_MAP_FD ||
+                            insn[1].imm != 0) {
+                                verbose(env, "unrecognized bpf_ld_imm64 insn\n");
                                 return -EINVAL;
                         }
 
-                        f = fdget(insn->imm);
+                        f = fdget(insn[0].imm);
                         map = __bpf_map_get(f);
                         if (IS_ERR(map)) {
                                 verbose(env, "fd %d is not pointing to valid bpf_map\n",
-                                        insn->imm);
+                                        insn[0].imm);
                                 return PTR_ERR(map);
                         }
 
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 3fb1405f3f8c..7bb3988425ee 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -3326,7 +3326,7 @@ int proc_doulongvec_ms_jiffies_minmax(struct ctl_table *table, int write,
 
 #endif /* CONFIG_PROC_SYSCTL */
 
-#ifdef CONFIG_BPF_SYSCALL
+#if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_SYSCTL)
 static int proc_dointvec_minmax_bpf_stats(struct ctl_table *table, int write,
                                           void __user *buffer, size_t *lenp,
                                           loff_t *ppos)
diff --git a/net/atm/resources.c b/net/atm/resources.c
index bada395ecdb1..889349c6d90d 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -203,13 +203,9 @@ int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat)
         int __user *sioc_len;
         int __user *iobuf_len;
 
-#ifndef CONFIG_COMPAT
-        compat = 0; /* Just so the compiler _knows_ */
-#endif
-
         switch (cmd) {
         case ATM_GETNAMES:
-                if (compat) {
+                if (IS_ENABLED(CONFIG_COMPAT) && compat) {
 #ifdef CONFIG_COMPAT
                         struct compat_atm_iobuf __user *ciobuf = arg;
                         compat_uptr_t cbuf;
@@ -253,7 +249,7 @@ int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat)
                 break;
         }
 
-        if (compat) {
+        if (IS_ENABLED(CONFIG_COMPAT) && compat) {
 #ifdef CONFIG_COMPAT
                 struct compat_atmif_sioc __user *csioc = arg;
                 compat_uptr_t carg;
@@ -417,7 +413,7 @@ int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat)
                 }
                 /* fall through */
         default:
-                if (compat) {
+                if (IS_ENABLED(CONFIG_COMPAT) && compat) {
 #ifdef CONFIG_COMPAT
                         if (!dev->ops->compat_ioctl) {
                                 error = -EINVAL;
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index da7051d62727..fab142b796ef 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -16,7 +16,7 @@
 static int bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat,
                         u32 *retval, u32 *time)
 {
-        struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = { 0 };
+        struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = { NULL };
         enum bpf_cgroup_storage_type stype;
         u64 time_start, time_spent = 0;
         int ret = 0;
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index d4918ffddda8..b1eb32419732 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -2319,9 +2319,10 @@ static int ethtool_set_tunable(struct net_device *dev, void __user *useraddr)
         return ret;
 }
 
-static int ethtool_get_per_queue_coalesce(struct net_device *dev,
-                                          void __user *useraddr,
-                                          struct ethtool_per_queue_op *per_queue_opt)
+static noinline_for_stack int
+ethtool_get_per_queue_coalesce(struct net_device *dev,
+                               void __user *useraddr,
+                               struct ethtool_per_queue_op *per_queue_opt)
 {
         u32 bit;
         int ret;
@@ -2349,9 +2350,10 @@ static int ethtool_get_per_queue_coalesce(struct net_device *dev,
         return 0;
 }
 
-static int ethtool_set_per_queue_coalesce(struct net_device *dev,
-                                          void __user *useraddr,
-                                          struct ethtool_per_queue_op *per_queue_opt)
+static noinline_for_stack int
+ethtool_set_per_queue_coalesce(struct net_device *dev,
+                               void __user *useraddr,
+                               struct ethtool_per_queue_op *per_queue_opt)
 {
         u32 bit;
         int i, ret = 0;
@@ -2405,7 +2407,7 @@ roll_back:
         return ret;
 }
 
-static int ethtool_set_per_queue(struct net_device *dev,
+static int noinline_for_stack ethtool_set_per_queue(struct net_device *dev,
                                  void __user *useraddr, u32 sub_cmd)
 {
         struct ethtool_per_queue_op per_queue_opt;
diff --git a/net/core/filter.c b/net/core/filter.c
index 5ceba98069d4..f274620945ff 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2804,7 +2804,7 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
         u32 off = skb_mac_header_len(skb);
         int ret;
 
-        if (!skb_is_gso_tcp(skb))
+        if (skb_is_gso(skb) && !skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_cow(skb, len_diff);
@@ -2845,7 +2845,7 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
         u32 off = skb_mac_header_len(skb);
         int ret;
 
-        if (!skb_is_gso_tcp(skb))
+        if (skb_is_gso(skb) && !skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_unclone(skb, GFP_ATOMIC);
@@ -2970,7 +2970,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff)
         u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
         int ret;
 
-        if (!skb_is_gso_tcp(skb))
+        if (skb_is_gso(skb) && !skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_cow(skb, len_diff);
@@ -2999,7 +2999,7 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
         u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
         int ret;
 
-        if (!skb_is_gso_tcp(skb))
+        if (skb_is_gso(skb) && !skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_unclone(skb, GFP_ATOMIC);
diff --git a/net/core/gro_cells.c b/net/core/gro_cells.c
index acf45ddbe924..e095fb871d91 100644
--- a/net/core/gro_cells.c
+++ b/net/core/gro_cells.c
@@ -13,22 +13,36 @@ int gro_cells_receive(struct gro_cells *gcells, struct sk_buff *skb)
 {
         struct net_device *dev = skb->dev;
         struct gro_cell *cell;
+        int res;
 
-        if (!gcells->cells || skb_cloned(skb) || netif_elide_gro(dev))
-                return netif_rx(skb);
+        rcu_read_lock();
+        if (unlikely(!(dev->flags & IFF_UP)))
+                goto drop;
+
+        if (!gcells->cells || skb_cloned(skb) || netif_elide_gro(dev)) {
+                res = netif_rx(skb);
+                goto unlock;
+        }
 
         cell = this_cpu_ptr(gcells->cells);
 
         if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) {
+drop:
                 atomic_long_inc(&dev->rx_dropped);
                 kfree_skb(skb);
-                return NET_RX_DROP;
+                res = NET_RX_DROP;
+                goto unlock;
         }
 
         __skb_queue_tail(&cell->napi_skbs, skb);
         if (skb_queue_len(&cell->napi_skbs) == 1)
                 napi_schedule(&cell->napi);
-        return NET_RX_SUCCESS;
+
+        res = NET_RX_SUCCESS;
+
+unlock:
+        rcu_read_unlock();
+        return res;
 }
 EXPORT_SYMBOL(gro_cells_receive);
 
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index cf2f8897ca19..126d31ff5ee3 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -625,6 +625,8 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
 
         /* push the encap headers and fix pointers */
         skb_reset_inner_headers(skb);
+        skb_reset_inner_mac_header(skb);  /* mac header is not yet set */
+        skb_set_inner_protocol(skb, skb->protocol);
         skb->encapsulation = 1;
         skb_push(skb, len);
         if (ingress)
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index ae6f06e45737..cc94d921476c 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -554,6 +554,7 @@ static void sk_psock_destroy_deferred(struct work_struct *gc)
         struct sk_psock *psock = container_of(gc, struct sk_psock, gc);
 
         /* No sk_callback_lock since already detached. */
+        strp_stop(&psock->parser.strp);
         strp_done(&psock->parser.strp);
 
         cancel_work_sync(&psock->work);
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index b8cd43c9ed5b..a97bf326b231 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -94,9 +94,8 @@ static void hsr_check_announce(struct net_device *hsr_dev,
                         && (old_operstate != IF_OPER_UP)) {
                 /* Went up */
                 hsr->announce_count = 0;
-                hsr->announce_timer.expires = jiffies +
-                                msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL);
-                add_timer(&hsr->announce_timer);
+                mod_timer(&hsr->announce_timer,
+                          jiffies + msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL));
         }
 
         if ((hsr_dev->operstate != IF_OPER_UP) && (old_operstate == IF_OPER_UP))
@@ -332,6 +331,7 @@ static void hsr_announce(struct timer_list *t)
 {
         struct hsr_priv *hsr;
         struct hsr_port *master;
+        unsigned long interval;
 
         hsr = from_timer(hsr, t, announce_timer);
 
@@ -343,18 +343,16 @@ static void hsr_announce(struct timer_list *t)
                                 hsr->protVersion);
                 hsr->announce_count++;
 
-                hsr->announce_timer.expires = jiffies +
-                                msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL);
+                interval = msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL);
         } else {
                 send_hsr_supervision_frame(master, HSR_TLV_LIFE_CHECK,
                                 hsr->protVersion);
 
-                hsr->announce_timer.expires = jiffies +
-                                msecs_to_jiffies(HSR_LIFE_CHECK_INTERVAL);
+                interval = msecs_to_jiffies(HSR_LIFE_CHECK_INTERVAL);
         }
 
         if (is_admin_up(master->dev))
-                add_timer(&hsr->announce_timer);
+                mod_timer(&hsr->announce_timer, jiffies + interval);
 
         rcu_read_unlock();
 }
@@ -486,7 +484,7 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
 
         res = hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER);
         if (res)
-                return res;
+                goto err_add_port;
 
         res = register_netdevice(hsr_dev);
         if (res)
@@ -506,6 +504,8 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
 fail:
         hsr_for_each_port(hsr, port)
                 hsr_del_port(port);
+err_add_port:
+        hsr_del_node(&hsr->self_node_db);
 
         return res;
 }
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 286ceb41ac0c..9af16cb68f76 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -124,6 +124,18 @@ int hsr_create_self_node(struct list_head *self_node_db,
         return 0;
 }
 
+void hsr_del_node(struct list_head *self_node_db)
+{
+        struct hsr_node *node;
+
+        rcu_read_lock();
+        node = list_first_or_null_rcu(self_node_db, struct hsr_node, mac_list);
+        rcu_read_unlock();
+        if (node) {
+                list_del_rcu(&node->mac_list);
+                kfree(node);
+        }
+}
 
 /* Allocate an hsr_node and add it to node_db. 'addr' is the node's AddressA;
  * seq_out is used to initialize filtering of outgoing duplicate frames
diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h
index 370b45998121..531fd3dfcac1 100644
--- a/net/hsr/hsr_framereg.h
+++ b/net/hsr/hsr_framereg.h
@@ -16,6 +16,7 @@
 
 struct hsr_node;
 
+void hsr_del_node(struct list_head *self_node_db);
 struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
                               u16 seq_out);
 struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index 437070d1ffb1..79e98e21cdd7 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -1024,7 +1024,7 @@ static int gue_err(struct sk_buff *skb, u32 info)
         int ret;
 
         len = sizeof(struct udphdr) + sizeof(struct guehdr);
-        if (!pskb_may_pull(skb, len))
+        if (!pskb_may_pull(skb, transport_offset + len))
                 return -EINVAL;
 
         guehdr = (struct guehdr *)&udp_hdr(skb)[1];
@@ -1059,7 +1059,7 @@ static int gue_err(struct sk_buff *skb, u32 info)
 
         optlen = guehdr->hlen << 2;
 
-        if (!pskb_may_pull(skb, len + optlen))
+        if (!pskb_may_pull(skb, transport_offset + len + optlen))
                 return -EINVAL;
 
         guehdr = (struct guehdr *)&udp_hdr(skb)[1];
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 2756fb725bf0..a5d8cad18ead 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -515,9 +515,10 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
                 mtu = dst_mtu(&rt->dst) - dev->hard_header_len
                                         - sizeof(struct iphdr) - tunnel_hlen;
         else
-                mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
+                mtu = skb_valid_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
 
-        skb_dst_update_pmtu(skb, mtu);
+        if (skb_valid_dst(skb))
+                skb_dst_update_pmtu(skb, mtu);
 
         if (skb->protocol == htons(ETH_P_IP)) {
                 if (!skb_is_gso(skb) &&
@@ -530,9 +531,11 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
         }
 #if IS_ENABLED(CONFIG_IPV6)
         else if (skb->protocol == htons(ETH_P_IPV6)) {
-                struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
+                struct rt6_info *rt6;
                 __be32 daddr;
 
+                rt6 = skb_valid_dst(skb) ? (struct rt6_info *)skb_dst(skb) :
+                                           NULL;
                 daddr = md ? dst : tunnel->parms.iph.daddr;
 
                 if (rt6 && mtu < dst_mtu(skb_dst(skb)) &&
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 738ff0a1a048..a5da63e5faa2 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1303,6 +1303,10 @@ static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
                 if (fnhe->fnhe_daddr == daddr) {
                         rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
                                 fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
+                        /* set fnhe_daddr to 0 to ensure it won't bind with
+                         * new dsts in rt_bind_exception().
+                         */
+                        fnhe->fnhe_daddr = 0;
                         fnhe_flush_routes(fnhe);
                         kfree_rcu(fnhe, rcu);
                         break;
@@ -2149,12 +2153,13 @@ int ip_route_input_rcu(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                 int our = 0;
                 int err = -EINVAL;
 
-                if (in_dev)
-                        our = ip_check_mc_rcu(in_dev, daddr, saddr,
-                                              ip_hdr(skb)->protocol);
+                if (!in_dev)
+                        return err;
+                our = ip_check_mc_rcu(in_dev, daddr, saddr,
+                                      ip_hdr(skb)->protocol);
 
                 /* check l3 master if no match yet */
-                if ((!in_dev || !our) && netif_is_l3_slave(dev)) {
+                if (!our && netif_is_l3_slave(dev)) {
                         struct in_device *l3_in_dev;
 
                         l3_in_dev = __in_dev_get_rcu(skb->dev);
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 606f868d9f3f..e531344611a0 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -216,7 +216,12 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
                 refcount_set(&req->rsk_refcnt, 1);
                 tcp_sk(child)->tsoffset = tsoff;
                 sock_rps_save_rxhash(child, skb);
-                inet_csk_reqsk_queue_add(sk, req, child);
+                if (!inet_csk_reqsk_queue_add(sk, req, child)) {
+                        bh_unlock_sock(child);
+                        sock_put(child);
+                        child = NULL;
+                        reqsk_put(req);
+                }
         } else {
                 reqsk_free(req);
         }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index ad07dd71063d..6baa6dc1b13b 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -943,6 +943,10 @@ ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset,
         ssize_t copied;
         long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
 
+        if (IS_ENABLED(CONFIG_DEBUG_VM) &&
+            WARN_ONCE(PageSlab(page), "page must not be a Slab one"))
+                return -EINVAL;
+
         /* Wait for a connection to finish. One exception is TCP Fast Open
          * (passive side) where data is allowed to be sent before a connection
          * is fully established.
@@ -1933,6 +1937,11 @@ static int tcp_inq_hint(struct sock *sk)
                 inq = tp->rcv_nxt - tp->copied_seq;
                 release_sock(sk);
         }
+        /* After receiving a FIN, tell the user-space to continue reading
+         * by returning a non-zero inq.
+         */
+        if (inq == 0 && sock_flag(sk, SOCK_DONE))
+                inq = 1;
         return inq;
 }
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 4eb0c8ca3c60..5def3c48870e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6498,7 +6498,13 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
                 af_ops->send_synack(fastopen_sk, dst, &fl, req,
                                     &foc, TCP_SYNACK_FASTOPEN);
                 /* Add the child socket directly into the accept queue */
-                inet_csk_reqsk_queue_add(sk, req, fastopen_sk);
+                if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
+                        reqsk_fastopen_remove(fastopen_sk, req, false);
+                        bh_unlock_sock(fastopen_sk);
+                        sock_put(fastopen_sk);
+                        reqsk_put(req);
+                        goto drop;
+                }
                 sk->sk_data_ready(sk);
                 bh_unlock_sock(fastopen_sk);
                 sock_put(fastopen_sk);
diff --git a/net/ipv6/fou6.c b/net/ipv6/fou6.c
index 867474abe269..ec4e2ed95f36 100644
--- a/net/ipv6/fou6.c
+++ b/net/ipv6/fou6.c
@@ -94,7 +94,7 @@ static int gue6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         int ret;
 
         len = sizeof(struct udphdr) + sizeof(struct guehdr);
-        if (!pskb_may_pull(skb, len))
+        if (!pskb_may_pull(skb, transport_offset + len))
                 return -EINVAL;
 
         guehdr = (struct guehdr *)&udp_hdr(skb)[1];
@@ -129,7 +129,7 @@ static int gue6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         optlen = guehdr->hlen << 2;
 
-        if (!pskb_may_pull(skb, len + optlen))
+        if (!pskb_may_pull(skb, transport_offset + len + optlen))
                 return -EINVAL;
 
         guehdr = (struct guehdr *)&udp_hdr(skb)[1];
diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
index b2adfa825363..83797b3949e2 100644
--- a/net/rxrpc/conn_client.c
+++ b/net/rxrpc/conn_client.c
@@ -353,7 +353,7 @@ static int rxrpc_get_client_conn(struct rxrpc_sock *rx,
          * normally have to take channel_lock but we do this before anyone else
          * can see the connection.
          */
-        list_add_tail(&call->chan_wait_link, &candidate->waiting_calls);
+        list_add(&call->chan_wait_link, &candidate->waiting_calls);
 
         if (cp->exclusive) {
                 call->conn = candidate;
@@ -432,7 +432,7 @@ found_extant_conn:
         call->conn = conn;
         call->security_ix = conn->security_ix;
         call->service_id = conn->service_id;
-        list_add(&call->chan_wait_link, &conn->waiting_calls);
+        list_add_tail(&call->chan_wait_link, &conn->waiting_calls);
         spin_unlock(&conn->channel_lock);
         _leave(" = 0 [extant %d]", conn->debug_id);
         return 0;
@@ -704,6 +704,7 @@ int rxrpc_connect_call(struct rxrpc_sock *rx,
 
         ret = rxrpc_wait_for_channel(call, gfp);
         if (ret < 0) {
+                trace_rxrpc_client(call->conn, ret, rxrpc_client_chan_wait_failed);
                 rxrpc_disconnect_client_call(call);
                 goto out;
         }
@@ -774,16 +775,22 @@ static void rxrpc_set_client_reap_timer(struct rxrpc_net *rxnet)
  */
 void rxrpc_disconnect_client_call(struct rxrpc_call *call)
 {
-        unsigned int channel = call->cid & RXRPC_CHANNELMASK;
         struct rxrpc_connection *conn = call->conn;
-        struct rxrpc_channel *chan = &conn->channels[channel];
+        struct rxrpc_channel *chan = NULL;
         struct rxrpc_net *rxnet = conn->params.local->rxnet;
+        unsigned int channel = -1;
+        u32 cid;
 
+        spin_lock(&conn->channel_lock);
+
+        cid = call->cid;
+        if (cid) {
+                channel = cid & RXRPC_CHANNELMASK;
+                chan = &conn->channels[channel];
+        }
         trace_rxrpc_client(conn, channel, rxrpc_client_chan_disconnect);
         call->conn = NULL;
 
-        spin_lock(&conn->channel_lock);
-
         /* Calls that have never actually been assigned a channel can simply be
          * discarded.  If the conn didn't get used either, it will follow
          * immediately unless someone else grabs it in the meantime.
@@ -807,7 +814,10 @@ void rxrpc_disconnect_client_call(struct rxrpc_call *call)
                 goto out;
         }
 
-        ASSERTCMP(rcu_access_pointer(chan->call), ==, call);
+        if (rcu_access_pointer(chan->call) != call) {
+                spin_unlock(&conn->channel_lock);
+                BUG();
+        }
 
         /* If a client call was exposed to the world, we save the result for
          * retransmission.
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 3beb4717d3b7..7c6591b991d5 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -201,14 +201,9 @@ static void tunnel_key_release_params(struct tcf_tunnel_key_params *p)
 {
         if (!p)
                 return;
-        if (p->tcft_action == TCA_TUNNEL_KEY_ACT_SET) {
-#ifdef CONFIG_DST_CACHE
-                struct ip_tunnel_info *info = &p->tcft_enc_metadata->u.tun_info;
-
-                dst_cache_destroy(&info->dst_cache);
-#endif
+        if (p->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
                 dst_release(&p->tcft_enc_metadata->dst);
-        }
+
         kfree_rcu(p, rcu);
 }
 
@@ -338,7 +333,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
                                                   &metadata->u.tun_info,
                                                   opts_len, extack);
                         if (ret < 0)
-                                goto release_dst_cache;
+                                goto release_tun_meta;
                 }
 
                 metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX;
@@ -354,14 +349,14 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
                                      &act_tunnel_key_ops, bind, true);
                 if (ret) {
                         NL_SET_ERR_MSG(extack, "Cannot create TC IDR");
-                        goto release_dst_cache;
+                        goto release_tun_meta;
                 }
 
                 ret = ACT_P_CREATED;
         } else if (!ovr) {
                 NL_SET_ERR_MSG(extack, "TC IDR already exists");
                 ret = -EEXIST;
-                goto release_dst_cache;
+                goto release_tun_meta;
         }
 
         t = to_tunnel_key(*a);
@@ -371,7 +366,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
                 NL_SET_ERR_MSG(extack, "Cannot allocate tunnel key parameters");
                 ret = -ENOMEM;
                 exists = true;
-                goto release_dst_cache;
+                goto release_tun_meta;
         }
         params_new->tcft_action = parm->t_action;
         params_new->tcft_enc_metadata = metadata;
@@ -388,12 +383,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
 
         return ret;
 
-release_dst_cache:
-#ifdef CONFIG_DST_CACHE
-        if (metadata)
-                dst_cache_destroy(&metadata->u.tun_info.dst_cache);
 release_tun_meta:
-#endif
         if (metadata)
                 dst_release(&metadata->dst);
 
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 478095d50f95..2c2aac4ac721 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -470,10 +470,9 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act,
 {
         struct tcf_block *block = chain->block;
         const struct tcf_proto_ops *tmplt_ops;
-        bool is_last, free_block = false;
+        bool free_block = false;
         unsigned int refcnt;
         void *tmplt_priv;
-        u32 chain_index;
 
         mutex_lock(&block->lock);
         if (explicitly_created) {
@@ -492,23 +491,21 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act,
          * save these to temporary variables.
          */
         refcnt = --chain->refcnt;
-        is_last = refcnt - chain->action_refcnt == 0;
         tmplt_ops = chain->tmplt_ops;
         tmplt_priv = chain->tmplt_priv;
-        chain_index = chain->index;
-
-        if (refcnt == 0)
-                free_block = tcf_chain_detach(chain);
-        mutex_unlock(&block->lock);
 
         /* The last dropped non-action reference will trigger notification. */
-        if (is_last && !by_act) {
-                tc_chain_notify_delete(tmplt_ops, tmplt_priv, chain_index,
+        if (refcnt - chain->action_refcnt == 0 && !by_act) {
+                tc_chain_notify_delete(tmplt_ops, tmplt_priv, chain->index,
                                        block, NULL, 0, 0, false);
                 /* Last reference to chain, no need to lock. */
                 chain->flushing = false;
         }
 
+        if (refcnt == 0)
+                free_block = tcf_chain_detach(chain);
+        mutex_unlock(&block->lock);
+
         if (refcnt == 0) {
                 tc_chain_tmplt_del(tmplt_ops, tmplt_priv);
                 tcf_chain_destroy(chain, free_block);
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 27300a3e76c7..c04247b403ed 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -1348,46 +1348,46 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
         if (err < 0)
                 goto errout;
 
-        if (!handle) {
-                handle = 1;
-                err = idr_alloc_u32(&head->handle_idr, fnew, &handle,
-                                    INT_MAX, GFP_KERNEL);
-        } else if (!fold) {
-                /* user specifies a handle and it doesn't exist */
-                err = idr_alloc_u32(&head->handle_idr, fnew, &handle,
-                                    handle, GFP_KERNEL);
-        }
-        if (err)
-                goto errout;
-        fnew->handle = handle;
-
         if (tb[TCA_FLOWER_FLAGS]) {
                 fnew->flags = nla_get_u32(tb[TCA_FLOWER_FLAGS]);
 
                 if (!tc_flags_valid(fnew->flags)) {
                         err = -EINVAL;
-                        goto errout_idr;
+                        goto errout;
                 }
         }
 
         err = fl_set_parms(net, tp, fnew, mask, base, tb, tca[TCA_RATE], ovr,
                            tp->chain->tmplt_priv, extack);
         if (err)
-                goto errout_idr;
+                goto errout;
 
         err = fl_check_assign_mask(head, fnew, fold, mask);
         if (err)
-                goto errout_idr;
+                goto errout;
+
+        if (!handle) {
+                handle = 1;
+                err = idr_alloc_u32(&head->handle_idr, fnew, &handle,
+                                    INT_MAX, GFP_KERNEL);
+        } else if (!fold) {
+                /* user specifies a handle and it doesn't exist */
+                err = idr_alloc_u32(&head->handle_idr, fnew, &handle,
+                                    handle, GFP_KERNEL);
+        }
+        if (err)
+                goto errout_mask;
+        fnew->handle = handle;
 
         if (!fold && __fl_lookup(fnew->mask, &fnew->mkey)) {
                 err = -EEXIST;
-                goto errout_mask;
+                goto errout_idr;
         }
 
         err = rhashtable_insert_fast(&fnew->mask->ht, &fnew->ht_node,
                                      fnew->mask->filter_ht_params);
         if (err)
-                goto errout_mask;
+                goto errout_idr;
 
         if (!tc_skip_hw(fnew->flags)) {
                 err = fl_hw_replace_filter(tp, fnew, extack);
@@ -1426,12 +1426,13 @@ errout_mask_ht:
         rhashtable_remove_fast(&fnew->mask->ht, &fnew->ht_node,
                                fnew->mask->filter_ht_params);
 
-errout_mask:
-        fl_mask_put(head, fnew->mask, false);
-
 errout_idr:
         if (!fold)
                 idr_remove(&head->handle_idr, fnew->handle);
+
+errout_mask:
+        fl_mask_put(head, fnew->mask, false);
+
 errout:
         tcf_exts_destroy(&fnew->exts);
         kfree(fnew);
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 5b537613946f..39d72e58b8e5 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -471,12 +471,6 @@ int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp)
         struct crypto_shash *tfm = NULL;
         __u16   id;
 
-        /* If AUTH extension is disabled, we are done */
-        if (!ep->auth_enable) {
-                ep->auth_hmacs = NULL;
-                return 0;
-        }
-
         /* If the transforms are already allocated, we are done */
         if (ep->auth_hmacs)
                 return 0;
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 40c7eb941bc9..0448b68fce74 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -107,6 +107,13 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
                         auth_chunks->param_hdr.length =
                                         htons(sizeof(struct sctp_paramhdr) + 2);
                 }
+
+                /* Allocate and initialize transorms arrays for supported
+                 * HMACs.
+                 */
+                err = sctp_auth_init_hmacs(ep, gfp);
+                if (err)
+                        goto nomem;
         }
 
         /* Initialize the base structure. */
@@ -150,15 +157,10 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         INIT_LIST_HEAD(&ep->endpoint_shared_keys);
         null_key = sctp_auth_shkey_create(0, gfp);
         if (!null_key)
-                goto nomem;
+                goto nomem_shkey;
 
         list_add(&null_key->key_list, &ep->endpoint_shared_keys);
 
-        /* Allocate and initialize transorms arrays for supported HMACs. */
-        err = sctp_auth_init_hmacs(ep, gfp);
-        if (err)
-                goto nomem_hmacs;
-
         /* Add the null key to the endpoint shared keys list and
          * set the hmcas and chunks pointers.
          */
@@ -169,8 +171,8 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
 
         return ep;
 
-nomem_hmacs:
-        sctp_auth_destroy_keys(&ep->endpoint_shared_keys);
+nomem_shkey:
+        sctp_auth_destroy_hmacs(ep->auth_hmacs);
 nomem:
         /* Free all allocations */
         kfree(auth_hmacs);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 533207dbeae9..6140471efd4b 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -102,9 +102,9 @@ static int sctp_send_asconf(struct sctp_association *asoc,
                             struct sctp_chunk *chunk);
 static int sctp_do_bind(struct sock *, union sctp_addr *, int);
 static int sctp_autobind(struct sock *sk);
-static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
-                              struct sctp_association *assoc,
-                              enum sctp_socket_type type);
+static int sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+                             struct sctp_association *assoc,
+                             enum sctp_socket_type type);
 
 static unsigned long sctp_memory_pressure;
 static atomic_long_t sctp_memory_allocated;
@@ -4891,7 +4891,11 @@ static struct sock *sctp_accept(struct sock *sk, int flags, int *err, bool kern)
         /* Populate the fields of the newsk from the oldsk and migrate the
          * asoc to the newsk.
          */
-        sctp_sock_migrate(sk, newsk, asoc, SCTP_SOCKET_TCP);
+        error = sctp_sock_migrate(sk, newsk, asoc, SCTP_SOCKET_TCP);
+        if (error) {
+                sk_common_release(newsk);
+                newsk = NULL;
+        }
 
 out:
         release_sock(sk);
@@ -5639,7 +5643,12 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
         /* Populate the fields of the newsk from the oldsk and migrate the
          * asoc to the newsk.
          */
-        sctp_sock_migrate(sk, sock->sk, asoc, SCTP_SOCKET_UDP_HIGH_BANDWIDTH);
+        err = sctp_sock_migrate(sk, sock->sk, asoc,
+                                SCTP_SOCKET_UDP_HIGH_BANDWIDTH);
+        if (err) {
+                sock_release(sock);
+                sock = NULL;
+        }
 
         *sockp = sock;
 
@@ -9171,9 +9180,9 @@ static inline void sctp_copy_descendant(struct sock *sk_to,
 /* Populate the fields of the newsk from the oldsk and migrate the assoc
  * and its messages to the newsk.
  */
-static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
-                              struct sctp_association *assoc,
-                              enum sctp_socket_type type)
+static int sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+                             struct sctp_association *assoc,
+                             enum sctp_socket_type type)
 {
         struct sctp_sock *oldsp = sctp_sk(oldsk);
         struct sctp_sock *newsp = sctp_sk(newsk);
@@ -9182,6 +9191,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         struct sk_buff *skb, *tmp;
         struct sctp_ulpevent *event;
         struct sctp_bind_hashbucket *head;
+        int err;
 
         /* Migrate socket buffer sizes and all the socket level options to the
          * new socket.
@@ -9210,8 +9220,20 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         /* Copy the bind_addr list from the original endpoint to the new
          * endpoint so that we can handle restarts properly
          */
-        sctp_bind_addr_dup(&newsp->ep->base.bind_addr,
-                                &oldsp->ep->base.bind_addr, GFP_KERNEL);
+        err = sctp_bind_addr_dup(&newsp->ep->base.bind_addr,
+                                 &oldsp->ep->base.bind_addr, GFP_KERNEL);
+        if (err)
+                return err;
+
+        /* New ep's auth_hmacs should be set if old ep's is set, in case
+         * that net->sctp.auth_enable has been changed to 0 by users and
+         * new ep's auth_hmacs couldn't be set in sctp_endpoint_init().
+         */
+        if (oldsp->ep->auth_hmacs) {
+                err = sctp_auth_init_hmacs(newsp->ep, GFP_KERNEL);
+                if (err)
+                        return err;
+        }
 
         /* Move any messages in the old socket's receive queue that are for the
          * peeled off association to the new socket's receive queue.
@@ -9296,6 +9318,8 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         }
 
         release_sock(newsk);
+
+        return 0;
 }
 
 
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 2936ed17bf9e..3b47457862cc 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -230,8 +230,6 @@ int sctp_stream_init(struct sctp_stream *stream, __u16 outcnt, __u16 incnt,
         for (i = 0; i < stream->outcnt; i++)
                 SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN;
 
-        sched->init(stream);
-
 in:
         sctp_stream_interleave_init(stream);
         if (!incnt)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index e482b342bfa8..3274ef625dba 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1333,7 +1333,7 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen)
 
         if (unlikely(!dest)) {
                 dest = &tsk->peer;
-                if (!syn || dest->family != AF_TIPC)
+                if (!syn && dest->family != AF_TIPC)
                         return -EDESTADDRREQ;
         }
 
diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index 3ae3a33da70b..602715fc9a75 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -662,6 +662,8 @@ static int virtio_transport_reset(struct vsock_sock *vsk,
  */
 static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt)
 {
+        const struct virtio_transport *t;
+        struct virtio_vsock_pkt *reply;
         struct virtio_vsock_pkt_info info = {
                 .op = VIRTIO_VSOCK_OP_RST,
                 .type = le16_to_cpu(pkt->hdr.type),
@@ -672,15 +674,21 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt)
         if (le16_to_cpu(pkt->hdr.op) == VIRTIO_VSOCK_OP_RST)
                 return 0;
 
-        pkt = virtio_transport_alloc_pkt(&info, 0,
-                                         le64_to_cpu(pkt->hdr.dst_cid),
-                                         le32_to_cpu(pkt->hdr.dst_port),
-                                         le64_to_cpu(pkt->hdr.src_cid),
-                                         le32_to_cpu(pkt->hdr.src_port));
-        if (!pkt)
+        reply = virtio_transport_alloc_pkt(&info, 0,
+                                           le64_to_cpu(pkt->hdr.dst_cid),
+                                           le32_to_cpu(pkt->hdr.dst_port),
+                                           le64_to_cpu(pkt->hdr.src_cid),
+                                           le32_to_cpu(pkt->hdr.src_port));
+        if (!reply)
                 return -ENOMEM;
 
-        return virtio_transport_get_ops()->send_pkt(pkt);
+        t = virtio_transport_get_ops();
+        if (!t) {
+                virtio_transport_free_pkt(reply);
+                return -ENOTCONN;
+        }
+
+        return t->send_pkt(reply);
 }
 
 static void virtio_transport_wait_close(struct sock *sk, long timeout)
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index eff31348e20b..27171ac6fe3b 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -820,8 +820,12 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
         sock->state = SS_CONNECTED;
         rc = 0;
 out_put_neigh:
-        if (rc)
+        if (rc) {
+                read_lock_bh(&x25_list_lock);
                 x25_neigh_put(x25->neighbour);
+                x25->neighbour = NULL;
+                read_unlock_bh(&x25_list_lock);
+        }
 out_put_route:
         x25_route_put(rt);
 out:
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 6697084e3fdf..a14e8864e4fa 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -407,6 +407,10 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
         if (sxdp->sxdp_family != AF_XDP)
                 return -EINVAL;
 
+        flags = sxdp->sxdp_flags;
+        if (flags & ~(XDP_SHARED_UMEM | XDP_COPY | XDP_ZEROCOPY))
+                return -EINVAL;
+
         mutex_lock(&xs->mutex);
         if (xs->dev) {
                 err = -EBUSY;
@@ -425,7 +429,6 @@ static int xsk_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
         }
 
         qid = sxdp->sxdp_queue_id;
-        flags = sxdp->sxdp_flags;
 
         if (flags & XDP_SHARED_UMEM) {
                 struct xdp_sock *umem_xs;
diff --git a/net/xdp/xsk_diag.c b/net/xdp/xsk_diag.c
index 661d007c3b28..d5e06c8e0cbf 100644
--- a/net/xdp/xsk_diag.c
+++ b/net/xdp/xsk_diag.c
@@ -68,9 +68,9 @@ static int xsk_diag_put_umem(const struct xdp_sock *xs, struct sk_buff *nlskb)
         err = nla_put(nlskb, XDP_DIAG_UMEM, sizeof(du), &du);
 
         if (!err && umem->fq)
-                err = xsk_diag_put_ring(xs->tx, XDP_DIAG_UMEM_FILL_RING, nlskb);
+                err = xsk_diag_put_ring(umem->fq, XDP_DIAG_UMEM_FILL_RING, nlskb);
         if (!err && umem->cq) {
-                err = xsk_diag_put_ring(xs->tx, XDP_DIAG_UMEM_COMPLETION_RING,
+                err = xsk_diag_put_ring(umem->cq, XDP_DIAG_UMEM_COMPLETION_RING,
                                         nlskb);
         }
         return err;
diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
index bcb5cbb40419..610c0bdc0c2b 100644
--- a/net/xdp/xsk_queue.h
+++ b/net/xdp/xsk_queue.h
@@ -174,8 +174,8 @@ static inline bool xskq_is_valid_desc(struct xsk_queue *q, struct xdp_desc *d)
         if (!xskq_is_valid_addr(q, d->addr))
                 return false;
 
-        if (((d->addr + d->len) & q->chunk_mask) !=
-            (d->addr & q->chunk_mask)) {
+        if (((d->addr + d->len) & q->chunk_mask) != (d->addr & q->chunk_mask) ||
+            d->options) {
                 q->invalid_descs++;
                 return false;
         }
diff --git a/samples/bpf/hbm.c b/samples/bpf/hbm.c
index 8408ccb7409f..a79828ab273f 100644
--- a/samples/bpf/hbm.c
+++ b/samples/bpf/hbm.c
@@ -18,7 +18,7 @@
  *              Default is /hbm1
  *    -r <rate> Rate limit in Mbps
  *    -s        Get HBM stats (marked, dropped, etc.)
- *    -t <time> Exit after specified seconds (deault is 0)
+ *    -t <time> Exit after specified seconds (default is 0)
  *    -w        Work conserving flag. cgroup can increase its bandwidth
  *              beyond the rate limit specified while there is available
  *              bandwidth. Current implementation assumes there is only
@@ -376,7 +376,7 @@ static void Usage(void)
                "               Default is /hbm1\n"
                "    -r <rate>  Rate in Mbps\n"
                "    -s         Update HBM stats\n"
-               "    -t <time>  Exit after specified seconds (deault is 0)\n"
+               "    -t <time>  Exit after specified seconds (default is 0)\n"
                "    -w         Work conserving flag. cgroup can increase\n"
                "               bandwidth beyond the rate limit specified\n"
                "               while there is available bandwidth. Current\n"
diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
index a05c43468bd0..61aaacf0cfa1 100644
--- a/tools/lib/bpf/Makefile
+++ b/tools/lib/bpf/Makefile
@@ -147,7 +147,8 @@ endif
 
 TARGETS = $(CMD_TARGETS)
 
-all: fixdep all_cmd
+all: fixdep
+        $(Q)$(MAKE) all_cmd
 
 all_cmd: $(CMD_TARGETS) check
 
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index f5eb60379c8d..d5b830d60601 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -838,6 +838,8 @@ static int bpf_object__elf_collect(struct bpf_object *obj, int flags)
                         if (IS_ERR(obj->btf) || btf__load(obj->btf)) {
                                 pr_warning("Error loading ELF section %s: %ld. Ignored and continue.\n",
                                            BTF_ELF_SEC, PTR_ERR(obj->btf));
+                                if (!IS_ERR(obj->btf))
+                                        btf__free(obj->btf);
                                 obj->btf = NULL;
                         }
                 } else if (strcmp(name, BTF_EXT_ELF_SEC) == 0) {
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 518cd587cd63..2aed37ea61a4 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -153,6 +153,9 @@ endif
 endif
 endif
 
+TEST_PROGS_CFLAGS := -I. -I$(OUTPUT)
+TEST_VERIFIER_CFLAGS := -I. -I$(OUTPUT) -Iverifier
+
 ifneq ($(SUBREG_CODEGEN),)
 ALU32_BUILD_DIR = $(OUTPUT)/alu32
 TEST_CUSTOM_PROGS += $(ALU32_BUILD_DIR)/test_progs_32
@@ -162,13 +165,15 @@ $(ALU32_BUILD_DIR):
 $(ALU32_BUILD_DIR)/urandom_read: $(OUTPUT)/urandom_read
         cp $< $@
 
-$(ALU32_BUILD_DIR)/test_progs_32: test_progs.c $(ALU32_BUILD_DIR) \
+$(ALU32_BUILD_DIR)/test_progs_32: test_progs.c $(OUTPUT)/libbpf.a\
+                                                $(ALU32_BUILD_DIR) \
                                                 $(ALU32_BUILD_DIR)/urandom_read
-        $(CC) $(CFLAGS) -o $(ALU32_BUILD_DIR)/test_progs_32 $< \
-                trace_helpers.c prog_tests/*.c $(OUTPUT)/libbpf.a $(LDLIBS)
+        $(CC) $(TEST_PROGS_CFLAGS) $(CFLAGS) \
+                -o $(ALU32_BUILD_DIR)/test_progs_32 \
+                test_progs.c trace_helpers.c prog_tests/*.c \
+                $(OUTPUT)/libbpf.a $(LDLIBS)
 
 $(ALU32_BUILD_DIR)/test_progs_32: $(PROG_TESTS_H)
-$(ALU32_BUILD_DIR)/test_progs_32: CFLAGS += -I$(OUTPUT)
 $(ALU32_BUILD_DIR)/test_progs_32: prog_tests/*.c
 
 $(ALU32_BUILD_DIR)/%.o: progs/%.c $(ALU32_BUILD_DIR) \
@@ -202,12 +207,16 @@ endif
 
 PROG_TESTS_H := $(OUTPUT)/prog_tests/tests.h
 $(OUTPUT)/test_progs: $(PROG_TESTS_H)
-$(OUTPUT)/test_progs: CFLAGS += -I$(OUTPUT)
+$(OUTPUT)/test_progs: CFLAGS += $(TEST_PROGS_CFLAGS)
 $(OUTPUT)/test_progs: prog_tests/*.c
 
+PROG_TESTS_DIR = $(OUTPUT)/prog_tests
+$(PROG_TESTS_DIR):
+        mkdir -p $@
+
 PROG_TESTS_FILES := $(wildcard prog_tests/*.c)
-$(PROG_TESTS_H): $(PROG_TESTS_FILES)
-        $(shell ( cd prog_tests/
+$(PROG_TESTS_H): $(PROG_TESTS_DIR) $(PROG_TESTS_FILES)
+        $(shell ( cd prog_tests/; \
                   echo '/* Generated header, do not edit */'; \
                   echo '#ifdef DECLARE'; \
                   ls *.c 2> /dev/null | \
@@ -221,11 +230,15 @@ $(PROG_TESTS_H): $(PROG_TESTS_FILES)
 
 VERIFIER_TESTS_H := $(OUTPUT)/verifier/tests.h
 $(OUTPUT)/test_verifier: $(VERIFIER_TESTS_H)
-$(OUTPUT)/test_verifier: CFLAGS += -I$(OUTPUT)
+$(OUTPUT)/test_verifier: CFLAGS += $(TEST_VERIFIER_CFLAGS)
+
+VERIFIER_TESTS_DIR = $(OUTPUT)/verifier
+$(VERIFIER_TESTS_DIR):
+        mkdir -p $@
 
 VERIFIER_TEST_FILES := $(wildcard verifier/*.c)
-$(OUTPUT)/verifier/tests.h: $(VERIFIER_TEST_FILES)
-        $(shell ( cd verifier/
+$(OUTPUT)/verifier/tests.h: $(VERIFIER_TESTS_DIR) $(VERIFIER_TEST_FILES)
+        $(shell ( cd verifier/; \
                   echo '/* Generated header, do not edit */'; \
                   echo '#ifdef FILL_ARRAY'; \
                   ls *.c 2> /dev/null | \
diff --git a/tools/testing/selftests/bpf/prog_tests/signal_pending.c b/tools/testing/selftests/bpf/prog_tests/signal_pending.c
index f2a37bbf91ab..996e808f43a2 100644
--- a/tools/testing/selftests/bpf/prog_tests/signal_pending.c
+++ b/tools/testing/selftests/bpf/prog_tests/signal_pending.c
@@ -12,7 +12,7 @@ static void test_signal_pending_by_type(enum bpf_prog_type prog_type)
         struct itimerval timeo = {
                 .it_value.tv_usec = 100000, /* 100ms */
         };
-        __u32 duration, retval;
+        __u32 duration = 0, retval;
         int prog_fd;
         int err;
         int i;
diff --git a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
index 612632c1425f..d4d3391cc13a 100755
--- a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
+++ b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
@@ -78,6 +78,8 @@ TEST_STATUS=0
 TESTS_SUCCEEDED=0
 TESTS_FAILED=0
 
+TMPFILE=""
+
 process_test_results()
 {
         if [[ "${TEST_STATUS}" -eq 0 ]] ; then
@@ -147,7 +149,6 @@ setup()
         ip -netns ${NS2} -6 addr add ${IPv6_7}/128 nodad dev veth7
         ip -netns ${NS3} -6 addr add ${IPv6_8}/128 nodad dev veth8
 
-
         ip -netns ${NS1} link set dev veth1 up
         ip -netns ${NS2} link set dev veth2 up
         ip -netns ${NS2} link set dev veth3 up
@@ -205,7 +206,7 @@ setup()
         # configure IPv4 GRE device in NS3, and a route to it via the "bottom" route
         ip -netns ${NS3} tunnel add gre_dev mode gre remote ${IPv4_1} local ${IPv4_GRE} ttl 255
         ip -netns ${NS3} link set gre_dev up
-        ip -netns ${NS3} addr add ${IPv4_GRE} nodad dev gre_dev
+        ip -netns ${NS3} addr add ${IPv4_GRE} dev gre_dev
         ip -netns ${NS1} route add ${IPv4_GRE}/32 dev veth5 via ${IPv4_6}
         ip -netns ${NS2} route add ${IPv4_GRE}/32 dev veth7 via ${IPv4_8}
 
@@ -222,12 +223,18 @@ setup()
         ip netns exec ${NS2} sysctl -wq net.ipv4.conf.all.rp_filter=0
         ip netns exec ${NS3} sysctl -wq net.ipv4.conf.all.rp_filter=0
 
+        TMPFILE=$(mktemp /tmp/test_lwt_ip_encap.XXXXXX)
+
         sleep 1  # reduce flakiness
         set +e
 }
 
 cleanup()
 {
+        if [ -f ${TMPFILE} ] ; then
+                rm ${TMPFILE}
+        fi
+
         ip netns del ${NS1} 2> /dev/null
         ip netns del ${NS2} 2> /dev/null
         ip netns del ${NS3} 2> /dev/null
@@ -278,6 +285,46 @@ test_ping()
         fi
 }
 
+test_gso()
+{
+        local readonly PROTO=$1
+        local readonly PKT_SZ=5000
+        local IP_DST=""
+        : > ${TMPFILE}  # trim the capture file
+
+        # check that nc is present
+        command -v nc >/dev/null 2>&1 || \
+                { echo >&2 "nc is not available: skipping TSO tests"; return; }
+
+        # listen on IPv*_DST, capture TCP into $TMPFILE
+        if [ "${PROTO}" == "IPv4" ] ; then
+                IP_DST=${IPv4_DST}
+                ip netns exec ${NS3} bash -c \
+                        "nc -4 -l -s ${IPv4_DST} -p 9000 > ${TMPFILE} &"
+        elif [ "${PROTO}" == "IPv6" ] ; then
+                IP_DST=${IPv6_DST}
+                ip netns exec ${NS3} bash -c \
+                        "nc -6 -l -s ${IPv6_DST} -p 9000 > ${TMPFILE} &"
+                RET=$?
+        else
+                echo "    test_gso: unknown PROTO: ${PROTO}"
+                TEST_STATUS=1
+        fi
+        sleep 1  # let nc start listening
+
+        # send a packet larger than MTU
+        ip netns exec ${NS1} bash -c \
+                "dd if=/dev/zero bs=$PKT_SZ count=1 > /dev/tcp/${IP_DST}/9000 2>/dev/null"
+        sleep 2 # let the packet get delivered
+
+        # verify we received all expected bytes
+        SZ=$(stat -c %s ${TMPFILE})
+        if [ "$SZ" != "$PKT_SZ" ] ; then
+                echo "    test_gso failed: ${PROTO}"
+                TEST_STATUS=1
+        fi
+}
+
 test_egress()
 {
         local readonly ENCAP=$1
@@ -307,6 +354,8 @@ test_egress()
         fi
         test_ping IPv4 0
         test_ping IPv6 0
+        test_gso IPv4
+        test_gso IPv6
 
         # a negative test: remove routes to GRE devices: ping fails
         remove_routes_to_gredev
@@ -350,6 +399,7 @@ test_ingress()
                 ip -netns ${NS2} -6 route add ${IPv6_DST} encap bpf in obj test_lwt_ip_encap.o sec encap_gre6 dev veth2
         else
                 echo "FAIL: unknown encap ${ENCAP}"
+                TEST_STATUS=1
         fi
         test_ping IPv4 0
         test_ping IPv6 0
diff --git a/tools/testing/selftests/bpf/verifier/ld_imm64.c b/tools/testing/selftests/bpf/verifier/ld_imm64.c
index 28b8c805a293..3856dba733e9 100644
--- a/tools/testing/selftests/bpf/verifier/ld_imm64.c
+++ b/tools/testing/selftests/bpf/verifier/ld_imm64.c
@@ -122,7 +122,7 @@
         .insns = {
         BPF_MOV64_IMM(BPF_REG_1, 0),
         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
-        BPF_RAW_INSN(0, 0, 0, 0, 1),
+        BPF_RAW_INSN(0, 0, 0, 0, 0),
         BPF_EXIT_INSN(),
         },
         .errstr = "not pointing to valid bpf_map",
@@ -139,3 +139,16 @@
         .errstr = "invalid bpf_ld_imm64 insn",
         .result = REJECT,
 },
+{
+        "test14 ld_imm64: reject 2nd imm != 0",
+        .insns = {
+        BPF_MOV64_IMM(BPF_REG_0, 0),
+        BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, BPF_REG_1,
+                     BPF_PSEUDO_MAP_FD, 0, 0),
+        BPF_RAW_INSN(0, 0, 0, 0, 0xfefefe),
+        BPF_EXIT_INSN(),
+        },
+        .fixup_map_hash_48b = { 1 },
+        .errstr = "unrecognized bpf_ld_imm64 insn",
+        .result = REJECT,
+},