113 files changed, 1234 insertions, 722 deletions
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 240ed70912d6..d78938e3e008 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -277,17 +277,23 @@ static u8 batadv_hop_penalty(u8 tq, const struct batadv_priv *bat_priv)
 * batadv_iv_ogm_aggr_packet() - checks if there is another OGM attached
 * @buff_pos: current position in the skb
 * @packet_len: total length of the skb
- * @tvlv_len: tvlv length of the previously considered OGM
+ * @ogm_packet: potential OGM in buffer
 *
 * Return: true if there is enough space for another OGM, false otherwise.
 */
-static bool batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len,
+static bool
-                                      __be16 tvlv_len)
+batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len,
+                          const struct batadv_ogm_packet *ogm_packet)
 {
        int next_buff_pos = 0;
-        next_buff_pos += buff_pos + BATADV_OGM_HLEN;
+        /* check if there is enough space for the header */
-        next_buff_pos += ntohs(tvlv_len);
+        next_buff_pos += buff_pos + sizeof(*ogm_packet);
+        if (next_buff_pos > packet_len)
+                return false;
+        /* check if there is enough space for the optional TVLV */
+        next_buff_pos += ntohs(ogm_packet->tvlv_len);
        return (next_buff_pos <= packet_len) &&
               (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES);
@@ -315,7 +321,7 @@ static void batadv_iv_ogm_send_to_if(struct batadv_forw_packet *forw_packet,
        /* adjust all flags and log packets */
        while (batadv_iv_ogm_aggr_packet(buff_pos, forw_packet->packet_len,
-                                         batadv_ogm_packet->tvlv_len)) {
+                                         batadv_ogm_packet)) {
                /* we might have aggregated direct link packets with an
                 * ordinary base packet
                 */
@@ -1704,7 +1710,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
        /* unpack the aggregated packets and process them one by one */
        while (batadv_iv_ogm_aggr_packet(ogm_offset, skb_headlen(skb),
-                                         ogm_packet->tvlv_len)) {
+                                         ogm_packet)) {
                batadv_iv_ogm_process(skb, ogm_offset, if_incoming);
                ogm_offset += BATADV_OGM_HLEN;
diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
index fad95ef64e01..bc06e3cdfa84 100644
--- a/net/batman-adv/bat_v_ogm.c
+++ b/net/batman-adv/bat_v_ogm.c
@@ -631,17 +631,23 @@ batadv_v_ogm_process_per_outif(struct batadv_priv *bat_priv,
 * batadv_v_ogm_aggr_packet() - checks if there is another OGM aggregated
 * @buff_pos: current position in the skb
 * @packet_len: total length of the skb
- * @tvlv_len: tvlv length of the previously considered OGM
+ * @ogm2_packet: potential OGM2 in buffer
 *
 * Return: true if there is enough space for another OGM, false otherwise.
 */
-static bool batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
+static bool
-                                     __be16 tvlv_len)
+batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
+                         const struct batadv_ogm2_packet *ogm2_packet)
 {
        int next_buff_pos = 0;
-        next_buff_pos += buff_pos + BATADV_OGM2_HLEN;
+        /* check if there is enough space for the header */
-        next_buff_pos += ntohs(tvlv_len);
+        next_buff_pos += buff_pos + sizeof(*ogm2_packet);
+        if (next_buff_pos > packet_len)
+                return false;
+        /* check if there is enough space for the optional TVLV */
+        next_buff_pos += ntohs(ogm2_packet->tvlv_len);
        return (next_buff_pos <= packet_len) &&
               (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES);
@@ -818,7 +824,7 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb,
        ogm_packet = (struct batadv_ogm2_packet *)skb->data;
        while (batadv_v_ogm_aggr_packet(ogm_offset, skb_headlen(skb),
-                                        ogm_packet->tvlv_len)) {
+                                        ogm_packet)) {
                batadv_v_ogm_process(skb, ogm_offset, if_incoming);
                ogm_offset += BATADV_OGM2_HLEN;
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index 67d7f83009ae..1d5bdf3a4b65 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -2303,7 +2303,7 @@ __batadv_mcast_flags_dump(struct sk_buff *msg, u32 portid,
        while (bucket_tmp < hash->size) {
                if (batadv_mcast_flags_dump_bucket(msg, portid, cb, hash,
-                                                   *bucket, &idx_tmp))
+                                                   bucket_tmp, &idx_tmp))
                        break;
                bucket_tmp++;
@@ -2420,8 +2420,10 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig)
        batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);
        batadv_mcast_want_ipv4_update(bat_priv, orig, BATADV_NO_FLAGS);
        batadv_mcast_want_ipv6_update(bat_priv, orig, BATADV_NO_FLAGS);
-        batadv_mcast_want_rtr4_update(bat_priv, orig, BATADV_NO_FLAGS);
+        batadv_mcast_want_rtr4_update(bat_priv, orig,
-        batadv_mcast_want_rtr6_update(bat_priv, orig, BATADV_NO_FLAGS);
+                                      BATADV_MCAST_WANT_NO_RTR4);
+        batadv_mcast_want_rtr6_update(bat_priv, orig,
+                                      BATADV_MCAST_WANT_NO_RTR6);
        spin_unlock_bh(&orig->mcast_handler_lock);
 }
diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c
index 6f08fd122a8d..7e052d6f759b 100644
--- a/net/batman-adv/netlink.c
+++ b/net/batman-adv/netlink.c
@@ -164,7 +164,7 @@ batadv_netlink_get_ifindex(const struct nlmsghdr *nlh, int attrtype)
 {
        struct nlattr *attr = nlmsg_find_attr(nlh, GENL_HDRLEN, attrtype);
-        return attr ? nla_get_u32(attr) : 0;
+        return (attr && nla_len(attr) == sizeof(u32)) ? nla_get_u32(attr) : 0;
 }
 /**
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b9585e7d9d2e..04bc79359a17 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3202,6 +3202,7 @@ struct hci_dev *hci_alloc_dev(void)
        hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
        hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
        hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
+        hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
        mutex_init(&hdev->lock);
        mutex_init(&hdev->req_lock);
diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index bb67f4a5479a..402e2cc54044 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -433,6 +433,35 @@ static int auto_accept_delay_set(void *data, u64 val)
        return 0;
 }
+static int min_encrypt_key_size_set(void *data, u64 val)
+{
+        struct hci_dev *hdev = data;
+        if (val < 1 || val > 16)
+                return -EINVAL;
+        hci_dev_lock(hdev);
+        hdev->min_enc_key_size = val;
+        hci_dev_unlock(hdev);
+        return 0;
+}
+static int min_encrypt_key_size_get(void *data, u64 *val)
+{
+        struct hci_dev *hdev = data;
+        hci_dev_lock(hdev);
+        *val = hdev->min_enc_key_size;
+        hci_dev_unlock(hdev);
+        return 0;
+}
+DEFINE_SIMPLE_ATTRIBUTE(min_encrypt_key_size_fops,
+                        min_encrypt_key_size_get,
+                        min_encrypt_key_size_set, "%llu\n");
 static int auto_accept_delay_get(void *data, u64 *val)
 {
        struct hci_dev *hdev = data;
@@ -545,6 +574,8 @@ void hci_debugfs_create_bredr(struct hci_dev *hdev)
        if (lmp_ssp_capable(hdev)) {
                debugfs_create_file("ssp_debug_mode", 0444, hdev->debugfs,
                                    hdev, &ssp_debug_mode_fops);
+                debugfs_create_file("min_encrypt_key_size", 0644, hdev->debugfs,
+                                    hdev, &min_encrypt_key_size_fops);
                debugfs_create_file("auto_accept_delay", 0644, hdev->debugfs,
                                    hdev, &auto_accept_delay_fops);
        }
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 5abd423b55fa..8d889969ae7e 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -101,6 +101,7 @@ static int hidp_send_message(struct hidp_session *session, struct socket *sock,
 {
        struct sk_buff *skb;
        struct sock *sk = sock->sk;
+        int ret;
        BT_DBG("session %p data %p size %d", session, data, size);
@@ -114,13 +115,17 @@ static int hidp_send_message(struct hidp_session *session, struct socket *sock,
        }
        skb_put_u8(skb, hdr);
-        if (data && size > 0)
+        if (data && size > 0) {
                skb_put_data(skb, data, size);
+                ret = size;
+        } else {
+                ret = 0;
+        }
        skb_queue_tail(transmit, skb);
        wake_up_interruptible(sk_sleep(sk));
-        return 0;
+        return ret;
 }
 static int hidp_send_ctrl_message(struct hidp_session *session,
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index cc506fe99b4d..dfc1edb168b7 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1361,7 +1361,7 @@ static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
         * actually encrypted before enforcing a key size.
         */
        return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
-                hcon->enc_key_size >= HCI_MIN_ENC_KEY_SIZE);
+                hcon->enc_key_size >= hcon->hdev->min_enc_key_size);
 }
 static void l2cap_do_start(struct l2cap_chan *chan)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index c8177a89f52c..4096d8a74a2b 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -221,7 +221,7 @@ unsigned int ebt_do_table(struct sk_buff *skb,
                        return NF_DROP;
                }
-                ADD_COUNTER(*(counter_base + i), 1, skb->len);
+                ADD_COUNTER(*(counter_base + i), skb->len, 1);
                /* these should only watch: not modify, nor tell us
                 * what to do with the packet
@@ -959,8 +959,8 @@ static void get_counters(const struct ebt_counter *oldcounters,
                        continue;
                counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
                for (i = 0; i < nentries; i++)
-                        ADD_COUNTER(counters[i], counter_base[i].pcnt,
+                        ADD_COUNTER(counters[i], counter_base[i].bcnt,
-                                    counter_base[i].bcnt);
+                                    counter_base[i].pcnt);
        }
 }
@@ -1280,7 +1280,7 @@ static int do_update_counters(struct net *net, const char *name,
        /* we add to the counters of the first cpu */
        for (i = 0; i < num_counters; i++)
-                ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt);
+                ADD_COUNTER(t->private->counters[i], tmp[i].bcnt, tmp[i].pcnt);
        write_unlock_bh(&t->lock);
        ret = 0;
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index 1804e867f715..7c9e92b2f806 100644
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -53,7 +53,7 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
                        goto err;
                br_vlan_get_proto(br_dev, &p_proto);
-                nft_reg_store16(dest, p_proto);
+                nft_reg_store16(dest, htons(p_proto));
                return;
        }
        default:
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
index 5d6724cee38f..4f75df40fb12 100644
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
@@ -136,8 +136,10 @@ void ceph_crypto_key_destroy(struct ceph_crypto_key *key)
        if (key) {
                kfree(key->key);
                key->key = NULL;
-                crypto_free_sync_skcipher(key->tfm);
+                if (key->tfm) {
-                key->tfm = NULL;
+                        crypto_free_sync_skcipher(key->tfm);
+                        key->tfm = NULL;
+                }
        }
 }
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 0b2df09b2554..78ae6e8c953d 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1496,7 +1496,7 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
        struct ceph_osds up, acting;
        bool force_resend = false;
        bool unpaused = false;
-        bool legacy_change;
+        bool legacy_change = false;
        bool split = false;
        bool sort_bitwise = ceph_osdmap_flag(osdc, CEPH_OSDMAP_SORTBITWISE);
        bool recovery_deletes = ceph_osdmap_flag(osdc,
@@ -1584,15 +1584,14 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
                t->osd = acting.primary;
        }
-        if (unpaused || legacy_change || force_resend ||
+        if (unpaused || legacy_change || force_resend || split)
-            (split && con && CEPH_HAVE_FEATURE(con->peer_features,
-                                               RESEND_ON_SPLIT)))
                ct_res = CALC_TARGET_NEED_RESEND;
        else
                ct_res = CALC_TARGET_NO_ACTION;
 out:
-        dout("%s t %p -> ct_res %d osd %d\n", __func__, t, ct_res, t->osd);
+        dout("%s t %p -> %d%d%d%d ct_res %d osd%d\n", __func__, t, unpaused,
+             legacy_change, force_resend, split, ct_res, t->osd);
        return ct_res;
 }
diff --git a/net/core/filter.c b/net/core/filter.c
index 7878f918b8c0..4c6a252d4212 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -8757,13 +8757,13 @@ sk_reuseport_is_valid_access(int off, int size,
                return size == size_default;
        /* Fields that allow narrowing */
-        case offsetof(struct sk_reuseport_md, eth_protocol):
+        case bpf_ctx_range(struct sk_reuseport_md, eth_protocol):
                if (size < FIELD_SIZEOF(struct sk_buff, protocol))
                        return false;
                /* fall through */
-        case offsetof(struct sk_reuseport_md, ip_protocol):
+        case bpf_ctx_range(struct sk_reuseport_md, ip_protocol):
-        case offsetof(struct sk_reuseport_md, bind_inany):
+        case bpf_ctx_range(struct sk_reuseport_md, bind_inany):
-        case offsetof(struct sk_reuseport_md, len):
+        case bpf_ctx_range(struct sk_reuseport_md, len):
                bpf_ctx_record_field_size(info, size_default);
                return bpf_ctx_narrow_access_ok(off, size, size_default);
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 3e6fedb57bc1..2470b4b404e6 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -142,8 +142,8 @@ int skb_flow_dissector_bpf_prog_detach(const union bpf_attr *attr)
                mutex_unlock(&flow_dissector_mutex);
                return -ENOENT;
        }
-        bpf_prog_put(attached);
        RCU_INIT_POINTER(net->flow_dissector_prog, NULL);
+        bpf_prog_put(attached);
        mutex_unlock(&flow_dissector_mutex);
        return 0;
 }
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 2cf27da1baeb..849380a622ef 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -122,7 +122,7 @@ static void queue_process(struct work_struct *work)
                txq = netdev_get_tx_queue(dev, q_index);
                HARD_TX_LOCK(dev, txq, smp_processor_id());
                if (netif_xmit_frozen_or_stopped(txq) ||
-                    netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) {
+                    !dev_xmit_complete(netpoll_start_xmit(skb, dev, txq))) {
                        skb_queue_head(&npinfo->txq, skb);
                        HARD_TX_UNLOCK(dev, txq);
                        local_irq_restore(flags);
@@ -335,7 +335,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                                HARD_TX_UNLOCK(dev, txq);
-                                if (status == NETDEV_TX_OK)
+                                if (dev_xmit_complete(status))
                                        break;
                        }
@@ -352,7 +352,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
        }
-        if (status != NETDEV_TX_OK) {
+        if (!dev_xmit_complete(status)) {
                skb_queue_tail(&npinfo->txq, skb);
                schedule_delayed_work(&npinfo->tx_work,0);
        }
diff --git a/net/core/sock.c b/net/core/sock.c
index d57b0cc995a0..545fac19a711 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1992,6 +1992,19 @@ void skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
 }
 EXPORT_SYMBOL(skb_set_owner_w);
+static bool can_skb_orphan_partial(const struct sk_buff *skb)
+{
+#ifdef CONFIG_TLS_DEVICE
+        /* Drivers depend on in-order delivery for crypto offload,
+         * partial orphan breaks out-of-order-OK logic.
+         */
+        if (skb->decrypted)
+                return false;
+#endif
+        return (skb->destructor == sock_wfree ||
+                (IS_ENABLED(CONFIG_INET) && skb->destructor == tcp_wfree));
+}
 /* This helper is used by netem, as it can hold packets in its
 * delay queue. We want to allow the owner socket to send more
 * packets, as if they were already TX completed by a typical driver.
@@ -2003,11 +2016,7 @@ void skb_orphan_partial(struct sk_buff *skb)
        if (skb_is_tcp_pure_ack(skb))
                return;
-        if (skb->destructor == sock_wfree
+        if (can_skb_orphan_partial(skb)) {
-#ifdef CONFIG_INET
-            || skb->destructor == tcp_wfree
-#endif
-                ) {
                struct sock *sk = skb->sk;
                if (refcount_inc_not_zero(&sk->sk_refcnt)) {
@@ -3278,16 +3287,17 @@ static __init int net_inuse_init(void)
 core_initcall(net_inuse_init);
-static void assign_proto_idx(struct proto *prot)
+static int assign_proto_idx(struct proto *prot)
 {
        prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
        if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
                pr_err("PROTO_INUSE_NR exhausted\n");
-                return;
+                return -ENOSPC;
        }
        set_bit(prot->inuse_idx, proto_inuse_idx);
+        return 0;
 }
 static void release_proto_idx(struct proto *prot)
@@ -3296,8 +3306,9 @@ static void release_proto_idx(struct proto *prot)
                clear_bit(prot->inuse_idx, proto_inuse_idx);
 }
 #else
-static inline void assign_proto_idx(struct proto *prot)
+static inline int assign_proto_idx(struct proto *prot)
 {
+        return 0;
 }
 static inline void release_proto_idx(struct proto *prot)
@@ -3346,6 +3357,8 @@ static int req_prot_init(const struct proto *prot)
 int proto_register(struct proto *prot, int alloc_slab)
 {
+        int ret = -ENOBUFS;
        if (alloc_slab) {
                prot->slab = kmem_cache_create_usercopy(prot->name,
                                        prot->obj_size, 0,
@@ -3382,20 +3395,27 @@ int proto_register(struct proto *prot, int alloc_slab)
        }
        mutex_lock(&proto_list_mutex);
+        ret = assign_proto_idx(prot);
+        if (ret) {
+                mutex_unlock(&proto_list_mutex);
+                goto out_free_timewait_sock_slab_name;
+        }
        list_add(&prot->node, &proto_list);
-        assign_proto_idx(prot);
        mutex_unlock(&proto_list_mutex);
-        return 0;
+        return ret;
 out_free_timewait_sock_slab_name:
-        kfree(prot->twsk_prot->twsk_slab_name);
+        if (alloc_slab && prot->twsk_prot)
+                kfree(prot->twsk_prot->twsk_slab_name);
 out_free_request_sock_slab:
-        req_prot_cleanup(prot->rsk_prot);
+        if (alloc_slab) {
+                req_prot_cleanup(prot->rsk_prot);
-        kmem_cache_destroy(prot->slab);
+                kmem_cache_destroy(prot->slab);
-        prot->slab = NULL;
+                prot->slab = NULL;
+        }
 out:
-        return -ENOBUFS;
+        return ret;
 }
 EXPORT_SYMBOL(proto_register);
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index 3312a5849a97..c13ffbd33d8d 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -19,6 +19,7 @@ static const struct sock_diag_handler *sock_diag_handlers[AF_MAX];
 static int (*inet_rcv_compat)(struct sk_buff *skb, struct nlmsghdr *nlh);
 static DEFINE_MUTEX(sock_diag_table_mutex);
 static struct workqueue_struct *broadcast_wq;
+static atomic64_t cookie_gen;
 u64 sock_gen_cookie(struct sock *sk)
 {
@@ -27,7 +28,7 @@ u64 sock_gen_cookie(struct sock *sk)
                if (res)
                        return res;
-                res = atomic64_inc_return(&sock_net(sk)->cookie_gen);
+                res = atomic64_inc_return(&cookie_gen);
                atomic64_cmpxchg(&sk->sk_cookie, 0, res);
        }
 }
diff --git a/net/core/stream.c b/net/core/stream.c
index e94bb02a5629..4f1d4aa5fb38 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -120,7 +120,6 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
        int err = 0;
        long vm_wait = 0;
        long current_timeo = *timeo_p;
-        bool noblock = (*timeo_p ? false : true);
        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        if (sk_stream_memory_free(sk))
@@ -133,11 +132,8 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
                if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
                        goto do_error;
-                if (!*timeo_p) {
+                if (!*timeo_p)
-                        if (noblock)
+                        goto do_eagain;
-                                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
-                        goto do_nonblock;
-                }
                if (signal_pending(current))
                        goto do_interrupted;
                sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
@@ -169,7 +165,13 @@ out:
 do_error:
        err = -EPIPE;
        goto out;
-do_nonblock:
+do_eagain:
+        /* Make sure that whenever EAGAIN is returned, EPOLLOUT event can
+         * be generated later.
+         * When TCP receives ACK packets that make room, tcp_check_space()
+         * only calls tcp_new_space() if SOCK_NOSPACE is set.
+         */
+        set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
        err = -EAGAIN;
        goto out;
 do_interrupted:
diff --git a/net/dsa/switch.c b/net/dsa/switch.c
index 4ec5b7f85d51..09d9286b27cc 100644
--- a/net/dsa/switch.c
+++ b/net/dsa/switch.c
@@ -153,6 +153,9 @@ static void dsa_switch_mdb_add_bitmap(struct dsa_switch *ds,
 {
        int port;
+        if (!ds->ops->port_mdb_add)
+                return;
        for_each_set_bit(port, bitmap, ds->num_ports)
                ds->ops->port_mdb_add(ds, port, mdb);
 }
diff --git a/net/dsa/tag_8021q.c b/net/dsa/tag_8021q.c
index 6ebbd799c4eb..67a1bc635a7b 100644
--- a/net/dsa/tag_8021q.c
+++ b/net/dsa/tag_8021q.c
@@ -28,6 +28,7 @@
 *
 * RSV - VID[9]:
 *      To be used for further expansion of SWITCH_ID or for other purposes.
+ *      Must be transmitted as zero and ignored on receive.
 *
 * SWITCH_ID - VID[8:6]:
 *      Index of switch within DSA tree. Must be between 0 and
@@ -35,6 +36,7 @@
 *
 * RSV - VID[5:4]:
 *      To be used for further expansion of PORT or for other purposes.
+ *      Must be transmitted as zero and ignored on receive.
 *
 * PORT - VID[3:0]:
 *      Index of switch port. Must be between 0 and DSA_MAX_PORTS - 1.
diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
index e4aba5d485be..bbe9b3b2d395 100644
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -170,7 +170,7 @@ static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *skb,
        reasm_data = inet_frag_reasm_prepare(&fq->q, skb, prev_tail);
        if (!reasm_data)
                goto out_oom;
-        inet_frag_reasm_finish(&fq->q, skb, reasm_data);
+        inet_frag_reasm_finish(&fq->q, skb, reasm_data, false);
        skb->dev = ldev;
        skb->tstamp = fq->q.stamp;
diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index dacbd58e1799..badc5cfe4dc6 100644
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -1092,7 +1092,7 @@ static struct packet_type ieee802154_packet_type = {
 static int __init af_ieee802154_init(void)
 {
-        int rc = -EINVAL;
+        int rc;
        rc = proto_register(&ieee802154_raw_prot, 1);
        if (rc)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 2b2b3d291ab0..1ab2fb6bb37d 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2145,7 +2145,7 @@ static int fn_trie_dump_leaf(struct key_vector *l, struct fib_table *tb,
                if (filter->dump_exceptions) {
                        err = fib_dump_info_fnhe(skb, cb, tb->tb_id, fi,
-                                                 &i_fa, s_fa);
+                                                 &i_fa, s_fa, flags);
                        if (err < 0)
                                goto stop;
                }
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 1510e951f451..4298aae74e0e 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -582,7 +582,13 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
        if (!rt)
                goto out;
-        net = dev_net(rt->dst.dev);
+        if (rt->dst.dev)
+                net = dev_net(rt->dst.dev);
+        else if (skb_in->dev)
+                net = dev_net(skb_in->dev);
+        else
+                goto out;
        /*
         *      Find the original header. It is expected to be valid, of course.
@@ -902,7 +908,7 @@ static bool icmp_redirect(struct sk_buff *skb)
                return false;
        }
-        icmp_socket_deliver(skb, icmp_hdr(skb)->un.gateway);
+        icmp_socket_deliver(skb, ntohl(icmp_hdr(skb)->un.gateway));
        return true;
 }
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 180f6896b98b..480d0b22db1a 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1475,7 +1475,7 @@ EXPORT_SYMBOL(__ip_mc_inc_group);
 void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 {
-        __ip_mc_inc_group(in_dev, addr, MCAST_EXCLUDE);
+        __ip_mc_inc_group(in_dev, addr, GFP_KERNEL);
 }
 EXPORT_SYMBOL(ip_mc_inc_group);
@@ -2197,7 +2197,7 @@ static int __ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr,
        iml->sflist = NULL;
        iml->sfmode = mode;
        rcu_assign_pointer(inet->mc_list, iml);
-        __ip_mc_inc_group(in_dev, addr, mode);
+        ____ip_mc_inc_group(in_dev, addr, mode, GFP_KERNEL);
        err = 0;
 done:
        return err;
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index a999451345f9..10d31733297d 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -475,11 +475,12 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
 EXPORT_SYMBOL(inet_frag_reasm_prepare);
 void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
-                            void *reasm_data)
+                            void *reasm_data, bool try_coalesce)
 {
        struct sk_buff **nextp = (struct sk_buff **)reasm_data;
        struct rb_node *rbn;
        struct sk_buff *fp;
+        int sum_truesize;
        skb_push(head, head->data - skb_network_header(head));
@@ -487,25 +488,41 @@ void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
        fp = FRAG_CB(head)->next_frag;
        rbn = rb_next(&head->rbnode);
        rb_erase(&head->rbnode, &q->rb_fragments);
+        sum_truesize = head->truesize;
        while (rbn || fp) {
                /* fp points to the next sk_buff in the current run;
                 * rbn points to the next run.
                 */
                /* Go through the current run. */
                while (fp) {
-                        *nextp = fp;
+                        struct sk_buff *next_frag = FRAG_CB(fp)->next_frag;
-                        nextp = &fp->next;
+                        bool stolen;
-                        fp->prev = NULL;
+                        int delta;
-                        memset(&fp->rbnode, 0, sizeof(fp->rbnode));
-                        fp->sk = NULL;
+                        sum_truesize += fp->truesize;
-                        head->data_len += fp->len;
-                        head->len += fp->len;
                        if (head->ip_summed != fp->ip_summed)
                                head->ip_summed = CHECKSUM_NONE;
                        else if (head->ip_summed == CHECKSUM_COMPLETE)
                                head->csum = csum_add(head->csum, fp->csum);
-                        head->truesize += fp->truesize;
-                        fp = FRAG_CB(fp)->next_frag;
+                        if (try_coalesce && skb_try_coalesce(head, fp, &stolen,
+                                                             &delta)) {
+                                kfree_skb_partial(fp, stolen);
+                        } else {
+                                fp->prev = NULL;
+                                memset(&fp->rbnode, 0, sizeof(fp->rbnode));
+                                fp->sk = NULL;
+                                head->data_len += fp->len;
+                                head->len += fp->len;
+                                head->truesize += fp->truesize;
+                                *nextp = fp;
+                                nextp = &fp->next;
+                        }
+                        fp = next_frag;
                }
                /* Move to the next run. */
                if (rbn) {
@@ -516,7 +533,7 @@ void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
                        rbn = rbnext;
                }
        }
-        sub_frag_mem_limit(q->fqdir, head->truesize);
+        sub_frag_mem_limit(q->fqdir, sum_truesize);
        *nextp = NULL;
        skb_mark_not_on_list(head);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 4385eb9e781f..cfeb8890f94e 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -393,6 +393,11 @@ err:
        return err;
 }
+static bool ip_frag_coalesce_ok(const struct ipq *qp)
+{
+        return qp->q.key.v4.user == IP_DEFRAG_LOCAL_DELIVER;
+}
 /* Build a new IP datagram from all its fragments. */
 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
                         struct sk_buff *prev_tail, struct net_device *dev)
@@ -421,7 +426,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
        if (len > 65535)
                goto out_oversize;
-        inet_frag_reasm_finish(&qp->q, skb, reasm_data);
+        inet_frag_reasm_finish(&qp->q, skb, reasm_data,
+                               ip_frag_coalesce_ok(qp));
        skb->dev = dev;
        IPCB(skb)->frag_max_size = max(qp->max_df_size, qp->q.max_size);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 517300d587a7..b6a6f18c3dd1 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2728,7 +2728,8 @@ EXPORT_SYMBOL_GPL(ip_route_output_flow);
 /* called with rcu_read_lock held */
 static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
                        struct rtable *rt, u32 table_id, struct flowi4 *fl4,
-                        struct sk_buff *skb, u32 portid, u32 seq)
+                        struct sk_buff *skb, u32 portid, u32 seq,
+                        unsigned int flags)
 {
        struct rtmsg *r;
        struct nlmsghdr *nlh;
@@ -2736,7 +2737,7 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
        u32 error;
        u32 metrics[RTAX_MAX];
-        nlh = nlmsg_put(skb, portid, seq, RTM_NEWROUTE, sizeof(*r), 0);
+        nlh = nlmsg_put(skb, portid, seq, RTM_NEWROUTE, sizeof(*r), flags);
        if (!nlh)
                return -EMSGSIZE;
@@ -2860,7 +2861,7 @@ nla_put_failure:
 static int fnhe_dump_bucket(struct net *net, struct sk_buff *skb,
                            struct netlink_callback *cb, u32 table_id,
                            struct fnhe_hash_bucket *bucket, int genid,
-                            int *fa_index, int fa_start)
+                            int *fa_index, int fa_start, unsigned int flags)
 {
        int i;
@@ -2891,7 +2892,7 @@ static int fnhe_dump_bucket(struct net *net, struct sk_buff *skb,
                        err = rt_fill_info(net, fnhe->fnhe_daddr, 0, rt,
                                           table_id, NULL, skb,
                                           NETLINK_CB(cb->skb).portid,
-                                           cb->nlh->nlmsg_seq);
+                                           cb->nlh->nlmsg_seq, flags);
                        if (err)
                                return err;
 next:
@@ -2904,7 +2905,7 @@ next:
 int fib_dump_info_fnhe(struct sk_buff *skb, struct netlink_callback *cb,
                       u32 table_id, struct fib_info *fi,
-                       int *fa_index, int fa_start)
+                       int *fa_index, int fa_start, unsigned int flags)
 {
        struct net *net = sock_net(cb->skb->sk);
        int nhsel, genid = fnhe_genid(net);
@@ -2922,7 +2923,8 @@ int fib_dump_info_fnhe(struct sk_buff *skb, struct netlink_callback *cb,
                err = 0;
                if (bucket)
                        err = fnhe_dump_bucket(net, skb, cb, table_id, bucket,
-                                               genid, fa_index, fa_start);
+                                               genid, fa_index, fa_start,
+                                               flags);
                rcu_read_unlock();
                if (err)
                        return err;
@@ -3183,7 +3185,8 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                                    fl4.flowi4_tos, res.fi, 0);
        } else {
                err = rt_fill_info(net, dst, src, rt, table_id, &fl4, skb,
-                                   NETLINK_CB(in_skb).portid, nlh->nlmsg_seq);
+                                   NETLINK_CB(in_skb).portid,
+                                   nlh->nlmsg_seq, 0);
        }
        if (err < 0)
                goto errout_rcu;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 776905899ac0..61082065b26a 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -935,6 +935,22 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags)
        return mss_now;
 }
+/* In some cases, both sendpage() and sendmsg() could have added
+ * an skb to the write queue, but failed adding payload on it.
+ * We need to remove it to consume less memory, but more
+ * importantly be able to generate EPOLLOUT for Edge Trigger epoll()
+ * users.
+ */
+static void tcp_remove_empty_skb(struct sock *sk, struct sk_buff *skb)
+{
+        if (skb && !skb->len) {
+                tcp_unlink_write_queue(skb, sk);
+                if (tcp_write_queue_empty(sk))
+                        tcp_chrono_stop(sk, TCP_CHRONO_BUSY);
+                sk_wmem_free_skb(sk, skb);
+        }
+}
 ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset,
                         size_t size, int flags)
 {
@@ -984,6 +1000,9 @@ new_segment:
                        if (!skb)
                                goto wait_for_memory;
+#ifdef CONFIG_TLS_DEVICE
+                        skb->decrypted = !!(flags & MSG_SENDPAGE_DECRYPTED);
+#endif
                        skb_entail(sk, skb);
                        copy = size_goal;
                }
@@ -1061,6 +1080,7 @@ out:
        return copied;
 do_error:
+        tcp_remove_empty_skb(sk, tcp_write_queue_tail(sk));
        if (copied)
                goto out;
 out_err:
@@ -1385,18 +1405,11 @@ out_nopush:
        sock_zerocopy_put(uarg);
        return copied + copied_syn;
+do_error:
+        skb = tcp_write_queue_tail(sk);
 do_fault:
-        if (!skb->len) {
+        tcp_remove_empty_skb(sk, skb);
-                tcp_unlink_write_queue(skb, sk);
-                /* It is the one place in all of TCP, except connection
-                 * reset, where we can be unlinking the send_head.
-                 */
-                if (tcp_write_queue_empty(sk))
-                        tcp_chrono_stop(sk, TCP_CHRONO_BUSY);
-                sk_wmem_free_skb(sk, skb);
-        }
-do_error:
        if (copied + copied_syn)
                goto out;
 out_err:
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index 3d1e15401384..8a56e09cfb0e 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -398,10 +398,14 @@ more_data:
 static int tcp_bpf_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 {
        struct sk_msg tmp, *msg_tx = NULL;
-        int flags = msg->msg_flags | MSG_NO_SHARED_FRAGS;
        int copied = 0, err = 0;
        struct sk_psock *psock;
        long timeo;
+        int flags;
+        /* Don't let internal do_tcp_sendpages() flags through */
+        flags = (msg->msg_flags & ~MSG_SENDPAGE_DECRYPTED);
+        flags |= MSG_NO_SHARED_FRAGS;
        psock = sk_psock_get(sk);
        if (unlikely(!psock))
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 6e4afc48d7bb..8a645f304e6c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1320,6 +1320,7 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
        buff = sk_stream_alloc_skb(sk, nsize, gfp, true);
        if (!buff)
                return -ENOMEM; /* We'll just try again later. */
+        skb_copy_decrypted(buff, skb);
        sk->sk_wmem_queued += buff->truesize;
        sk_mem_charge(sk, buff->truesize);
@@ -1874,6 +1875,7 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
        buff = sk_stream_alloc_skb(sk, 0, gfp, true);
        if (unlikely(!buff))
                return -ENOMEM;
+        skb_copy_decrypted(buff, skb);
        sk->sk_wmem_queued += buff->truesize;
        sk_mem_charge(sk, buff->truesize);
@@ -2051,7 +2053,7 @@ static bool tcp_can_coalesce_send_queue_head(struct sock *sk, int len)
                if (len <= skb->len)
                        break;
-                if (unlikely(TCP_SKB_CB(skb)->eor))
+                if (unlikely(TCP_SKB_CB(skb)->eor) || tcp_has_tx_tstamp(skb))
                        return false;
                len -= skb->len;
@@ -2143,6 +2145,7 @@ static int tcp_mtu_probe(struct sock *sk)
        sk_mem_charge(sk, nskb->truesize);
        skb = tcp_send_head(sk);
+        skb_copy_decrypted(nskb, skb);
        TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(skb)->seq;
        TCP_SKB_CB(nskb)->end_seq = TCP_SKB_CB(skb)->seq + probe_size;
@@ -2167,6 +2170,7 @@ static int tcp_mtu_probe(struct sock *sk)
                         * we need to propagate it to the new skb.
                         */
                        TCP_SKB_CB(nskb)->eor = TCP_SKB_CB(skb)->eor;
+                        tcp_skb_collapse_tstamp(nskb, skb);
                        tcp_unlink_write_queue(skb, sk);
                        sk_wmem_free_skb(sk, skb);
                } else {
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index dc73888c7859..6a576ff92c39 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -478,7 +478,7 @@ static struct inet6_dev *ipv6_find_idev(struct net_device *dev)
        if (!idev) {
                idev = ipv6_add_dev(dev);
                if (IS_ERR(idev))
-                        return NULL;
+                        return idev;
        }
        if (dev->flags&IFF_UP)
@@ -1045,7 +1045,8 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
        int err = 0;
        if (addr_type == IPV6_ADDR_ANY ||
-            addr_type & IPV6_ADDR_MULTICAST ||
+            (addr_type & IPV6_ADDR_MULTICAST &&
+             !(cfg->ifa_flags & IFA_F_MCAUTOJOIN)) ||
            (!(idev->dev->flags & IFF_LOOPBACK) &&
             !netif_is_l3_master(idev->dev) &&
             addr_type & IPV6_ADDR_LOOPBACK))
@@ -2465,8 +2466,8 @@ static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
        ASSERT_RTNL();
        idev = ipv6_find_idev(dev);
-        if (!idev)
+        if (IS_ERR(idev))
-                return ERR_PTR(-ENOBUFS);
+                return idev;
        if (idev->cnf.disable_ipv6)
                return ERR_PTR(-EACCES);
@@ -3158,7 +3159,7 @@ static void init_loopback(struct net_device *dev)
        ASSERT_RTNL();
        idev = ipv6_find_idev(dev);
-        if (!idev) {
+        if (IS_ERR(idev)) {
                pr_debug("%s: add_dev failed\n", __func__);
                return;
        }
@@ -3373,7 +3374,7 @@ static void addrconf_sit_config(struct net_device *dev)
         */
        idev = ipv6_find_idev(dev);
-        if (!idev) {
+        if (IS_ERR(idev)) {
                pr_debug("%s: add_dev failed\n", __func__);
                return;
        }
@@ -3398,7 +3399,7 @@ static void addrconf_gre_config(struct net_device *dev)
        ASSERT_RTNL();
        idev = ipv6_find_idev(dev);
-        if (!idev) {
+        if (IS_ERR(idev)) {
                pr_debug("%s: add_dev failed\n", __func__);
                return;
        }
@@ -4772,8 +4773,8 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh,
                         IFA_F_MCAUTOJOIN | IFA_F_OPTIMISTIC;
        idev = ipv6_find_idev(dev);
-        if (!idev)
+        if (IS_ERR(idev))
-                return -ENOBUFS;
+                return PTR_ERR(idev);
        if (!ipv6_allow_optimistic_dad(net, idev))
                cfg.ifa_flags &= ~IFA_F_OPTIMISTIC;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 7f3f13c37916..eaa4c2cc2fbb 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -787,14 +787,15 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
        if (pmc) {
                im->idev = pmc->idev;
                if (im->mca_sfmode == MCAST_INCLUDE) {
-                        im->mca_tomb = pmc->mca_tomb;
+                        swap(im->mca_tomb, pmc->mca_tomb);
-                        im->mca_sources = pmc->mca_sources;
+                        swap(im->mca_sources, pmc->mca_sources);
                        for (psf = im->mca_sources; psf; psf = psf->sf_next)
                                psf->sf_crcount = idev->mc_qrv;
                } else {
                        im->mca_crcount = idev->mc_qrv;
                }
                in6_dev_put(pmc->idev);
+                ip6_mc_clear_src(pmc);
                kfree(pmc);
        }
        spin_unlock_bh(&im->mca_lock);
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 0f82c150543b..fed9666a2f7d 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -348,7 +348,7 @@ static int nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *skb,
        skb_reset_transport_header(skb);
-        inet_frag_reasm_finish(&fq->q, skb, reasm_data);
+        inet_frag_reasm_finish(&fq->q, skb, reasm_data, false);
        skb->ignore_df = 1;
        skb->dev = dev;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index ca05b16f1bb9..1f5d4d196dcc 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -282,7 +282,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *skb,
        skb_reset_transport_header(skb);
-        inet_frag_reasm_finish(&fq->q, skb, reasm_data);
+        inet_frag_reasm_finish(&fq->q, skb, reasm_data, true);
        skb->dev = dev;
        ipv6_hdr(skb)->payload_len = htons(payload_len);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 4d458067d80d..111c400199ec 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1546,6 +1546,11 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        if (is_multicast_ether_addr(mac))
                return -EINVAL;
+        if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER) &&
+            sdata->vif.type == NL80211_IFTYPE_STATION &&
+            !sdata->u.mgd.associated)
+                return -EINVAL;
        sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
        if (!sta)
                return -ENOMEM;
@@ -1553,10 +1558,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
                sta->sta.tdls = true;
-        if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION &&
-            !sdata->u.mgd.associated)
-                return -EINVAL;
        err = sta_apply_parameters(local, sta, params);
        if (err) {
                sta_info_free(local, sta);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 3c1ab870fefe..768d14c9a716 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2447,11 +2447,13 @@ static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
                      skb->protocol == cpu_to_be16(ETH_P_PREAUTH)) &&
                     sdata->control_port_over_nl80211)) {
                struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-                bool noencrypt = status->flag & RX_FLAG_DECRYPTED;
+                bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);
                cfg80211_rx_control_port(dev, skb, noencrypt);
                dev_kfree_skb(skb);
        } else {
+                memset(skb->cb, 0, sizeof(skb->cb));
                /* deliver to local stack */
                if (rx->napi)
                        napi_gro_receive(rx->napi, skb);
@@ -2546,8 +2548,6 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
        if (skb) {
                skb->protocol = eth_type_trans(skb, dev);
-                memset(skb->cb, 0, sizeof(skb->cb));
                ieee80211_deliver_skb_to_local_stack(skb, rx);
        }
diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
index d25e91d7bdc1..44b675016393 100644
--- a/net/mpls/mpls_iptunnel.c
+++ b/net/mpls/mpls_iptunnel.c
@@ -133,12 +133,12 @@ static int mpls_xmit(struct sk_buff *skb)
        mpls_stats_inc_outucastpkts(out_dev, skb);
        if (rt) {
-                if (rt->rt_gw_family == AF_INET)
+                if (rt->rt_gw_family == AF_INET6)
-                        err = neigh_xmit(NEIGH_ARP_TABLE, out_dev, &rt->rt_gw4,
-                                         skb);
-                else if (rt->rt_gw_family == AF_INET6)
                        err = neigh_xmit(NEIGH_ND_TABLE, out_dev, &rt->rt_gw6,
                                         skb);
+                else
+                        err = neigh_xmit(NEIGH_ARP_TABLE, out_dev, &rt->rt_gw4,
+                                         skb);
        } else if (rt6) {
                if (ipv6_addr_v4mapped(&rt6->rt6i_gateway)) {
                        /* 6PE (RFC 4798) */
diff --git a/net/ncsi/ncsi-cmd.c b/net/ncsi/ncsi-cmd.c
index 5c3fad8cba57..0187e65176c0 100644
--- a/net/ncsi/ncsi-cmd.c
+++ b/net/ncsi/ncsi-cmd.c
@@ -54,7 +54,7 @@ static void ncsi_cmd_build_header(struct ncsi_pkt_hdr *h,
        checksum = ncsi_calculate_checksum((unsigned char *)h,
                                           sizeof(*h) + nca->payload);
        pchecksum = (__be32 *)((void *)h + sizeof(struct ncsi_pkt_hdr) +
-                    nca->payload);
+                    ALIGN(nca->payload, 4));
        *pchecksum = htonl(checksum);
 }
@@ -309,14 +309,21 @@ static struct ncsi_request *ncsi_alloc_command(struct ncsi_cmd_arg *nca)
 int ncsi_xmit_cmd(struct ncsi_cmd_arg *nca)
 {
+        struct ncsi_cmd_handler *nch = NULL;
        struct ncsi_request *nr;
+        unsigned char type;
        struct ethhdr *eh;
-        struct ncsi_cmd_handler *nch = NULL;
        int i, ret;
+        /* Use OEM generic handler for Netlink request */
+        if (nca->req_flags == NCSI_REQ_FLAG_NETLINK_DRIVEN)
+                type = NCSI_PKT_CMD_OEM;
+        else
+                type = nca->type;
        /* Search for the handler */
        for (i = 0; i < ARRAY_SIZE(ncsi_cmd_handlers); i++) {
-                if (ncsi_cmd_handlers[i].type == nca->type) {
+                if (ncsi_cmd_handlers[i].type == type) {
                        if (ncsi_cmd_handlers[i].handler)
                                nch = &ncsi_cmd_handlers[i];
                        else
diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
index 7581bf919885..d876bd55f356 100644
--- a/net/ncsi/ncsi-rsp.c
+++ b/net/ncsi/ncsi-rsp.c
@@ -47,7 +47,8 @@ static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
        if (ntohs(h->code) != NCSI_PKT_RSP_C_COMPLETED ||
            ntohs(h->reason) != NCSI_PKT_RSP_R_NO_ERROR) {
                netdev_dbg(nr->ndp->ndev.dev,
-                           "NCSI: non zero response/reason code\n");
+                           "NCSI: non zero response/reason code %04xh, %04xh\n",
+                            ntohs(h->code), ntohs(h->reason));
                return -EPERM;
        }
@@ -55,7 +56,7 @@ static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
         * sender doesn't support checksum according to NCSI
         * specification.
         */
-        pchecksum = (__be32 *)((void *)(h + 1) + payload - 4);
+        pchecksum = (__be32 *)((void *)(h + 1) + ALIGN(payload, 4) - 4);
        if (ntohl(*pchecksum) == 0)
                return 0;
@@ -63,7 +64,9 @@ static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
                                           sizeof(*h) + payload - 4);
        if (*pchecksum != htonl(checksum)) {
-                netdev_dbg(nr->ndp->ndev.dev, "NCSI: checksum mismatched\n");
+                netdev_dbg(nr->ndp->ndev.dev,
+                           "NCSI: checksum mismatched; recd: %08x calc: %08x\n",
+                           *pchecksum, htonl(checksum));
                return -EINVAL;
        }
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index a542761e90d1..81a8ef42b88d 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -453,13 +453,12 @@ EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
 * table location, we assume id gets exposed to userspace.
 *
 * Following nf_conn items do not change throughout lifetime
- * of the nf_conn after it has been committed to main hash table:
+ * of the nf_conn:
 *
 * 1. nf_conn address
- * 2. nf_conn->ext address
+ * 2. nf_conn->master address (normally NULL)
- * 3. nf_conn->master address (normally NULL)
+ * 3. the associated net namespace
- * 4. tuple
+ * 4. the original direction tuple
- * 5. the associated net namespace
 */
 u32 nf_ct_get_id(const struct nf_conn *ct)
 {
@@ -469,9 +468,10 @@ u32 nf_ct_get_id(const struct nf_conn *ct)
        net_get_random_once(&ct_id_seed, sizeof(ct_id_seed));
        a = (unsigned long)ct;
-        b = (unsigned long)ct->master ^ net_hash_mix(nf_ct_net(ct));
+        b = (unsigned long)ct->master;
-        c = (unsigned long)ct->ext;
+        c = (unsigned long)nf_ct_net(ct);
-        d = (unsigned long)siphash(&ct->tuplehash, sizeof(ct->tuplehash),
+        d = (unsigned long)siphash(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                                   sizeof(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple),
                                   &ct_id_seed);
 #ifdef CONFIG_64BIT
        return siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &ct_id_seed);
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 0ecb3e289ef2..8d96738b7dfd 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -322,7 +322,7 @@ static int find_pattern(const char *data, size_t dlen,
                i++;
        }
-        pr_debug("Skipped up to `%c'!\n", skip);
+        pr_debug("Skipped up to 0x%hhx delimiter!\n", skip);
        *numoff = i;
        *numlen = getnum(data + i, dlen - i, cmd, term, numoff);
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index e0d392cb3075..0006503d2da9 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -1037,9 +1037,14 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
        table[NF_SYSCTL_CT_COUNT].data = &net->ct.count;
        table[NF_SYSCTL_CT_CHECKSUM].data = &net->ct.sysctl_checksum;
        table[NF_SYSCTL_CT_LOG_INVALID].data = &net->ct.sysctl_log_invalid;
+        table[NF_SYSCTL_CT_ACCT].data = &net->ct.sysctl_acct;
+        table[NF_SYSCTL_CT_HELPER].data = &net->ct.sysctl_auto_assign_helper;
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
        table[NF_SYSCTL_CT_EVENTS].data = &net->ct.sysctl_events;
 #endif
+#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
+        table[NF_SYSCTL_CT_TIMESTAMP].data = &net->ct.sysctl_tstamp;
+#endif
        table[NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC].data = &nf_generic_pernet(net)->timeout;
        table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP].data = &nf_icmp_pernet(net)->timeout;
        table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6].data = &nf_icmpv6_pernet(net)->timeout;
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index e3d797252a98..80a8f9ae4c93 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -111,15 +111,16 @@ static void flow_offload_fixup_tcp(struct ip_ct_tcp *tcp)
 #define NF_FLOWTABLE_TCP_PICKUP_TIMEOUT (120 * HZ)
 #define NF_FLOWTABLE_UDP_PICKUP_TIMEOUT (30 * HZ)
-static void flow_offload_fixup_ct_state(struct nf_conn *ct)
+static inline __s32 nf_flow_timeout_delta(unsigned int timeout)
+{
+        return (__s32)(timeout - (u32)jiffies);
+}
+static void flow_offload_fixup_ct_timeout(struct nf_conn *ct)
 {
        const struct nf_conntrack_l4proto *l4proto;
+        int l4num = nf_ct_protonum(ct);
        unsigned int timeout;
-        int l4num;
-        l4num = nf_ct_protonum(ct);
-        if (l4num == IPPROTO_TCP)
-                flow_offload_fixup_tcp(&ct->proto.tcp);
        l4proto = nf_ct_l4proto_find(l4num);
        if (!l4proto)
@@ -132,7 +133,20 @@ static void flow_offload_fixup_ct_state(struct nf_conn *ct)
        else
                return;
-        ct->timeout = nfct_time_stamp + timeout;
+        if (nf_flow_timeout_delta(ct->timeout) > (__s32)timeout)
+                ct->timeout = nfct_time_stamp + timeout;
+}
+static void flow_offload_fixup_ct_state(struct nf_conn *ct)
+{
+        if (nf_ct_protonum(ct) == IPPROTO_TCP)
+                flow_offload_fixup_tcp(&ct->proto.tcp);
+}
+static void flow_offload_fixup_ct(struct nf_conn *ct)
+{
+        flow_offload_fixup_ct_state(ct);
+        flow_offload_fixup_ct_timeout(ct);
 }
 void flow_offload_free(struct flow_offload *flow)
@@ -208,6 +222,11 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
 }
 EXPORT_SYMBOL_GPL(flow_offload_add);
+static inline bool nf_flow_has_expired(const struct flow_offload *flow)
+{
+        return nf_flow_timeout_delta(flow->timeout) <= 0;
+}
 static void flow_offload_del(struct nf_flowtable *flow_table,
                             struct flow_offload *flow)
 {
@@ -223,6 +242,11 @@ static void flow_offload_del(struct nf_flowtable *flow_table,
        e = container_of(flow, struct flow_offload_entry, flow);
        clear_bit(IPS_OFFLOAD_BIT, &e->ct->status);
+        if (nf_flow_has_expired(flow))
+                flow_offload_fixup_ct(e->ct);
+        else if (flow->flags & FLOW_OFFLOAD_TEARDOWN)
+                flow_offload_fixup_ct_timeout(e->ct);
        flow_offload_free(flow);
 }
@@ -298,11 +322,6 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table,
        return err;
 }
-static inline bool nf_flow_has_expired(const struct flow_offload *flow)
-{
-        return (__s32)(flow->timeout - (u32)jiffies) <= 0;
-}
 static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)
 {
        struct nf_flowtable *flow_table = data;
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index cdfc33517e85..b9e7dd6e60ce 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -214,6 +214,24 @@ static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
        return true;
 }
+static int nf_flow_offload_dst_check(struct dst_entry *dst)
+{
+        if (unlikely(dst_xfrm(dst)))
+                return dst_check(dst, 0) ? 0 : -1;
+        return 0;
+}
+static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
+                                      const struct nf_hook_state *state,
+                                      struct dst_entry *dst)
+{
+        skb_orphan(skb);
+        skb_dst_set_noref(skb, dst);
+        dst_output(state->net, state->sk, skb);
+        return NF_STOLEN;
+}
 unsigned int
 nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
                        const struct nf_hook_state *state)
@@ -254,12 +272,25 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
        if (nf_flow_state_check(flow, ip_hdr(skb)->protocol, skb, thoff))
                return NF_ACCEPT;
+        if (nf_flow_offload_dst_check(&rt->dst)) {
+                flow_offload_teardown(flow);
+                return NF_ACCEPT;
+        }
        if (nf_flow_nat_ip(flow, skb, thoff, dir) < 0)
                return NF_DROP;
        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
        iph = ip_hdr(skb);
        ip_decrease_ttl(iph);
+        skb->tstamp = 0;
+        if (unlikely(dst_xfrm(&rt->dst))) {
+                memset(skb->cb, 0, sizeof(struct inet_skb_parm));
+                IPCB(skb)->iif = skb->dev->ifindex;
+                IPCB(skb)->flags = IPSKB_FORWARDED;
+                return nf_flow_xmit_xfrm(skb, state, &rt->dst);
+        }
        skb->dev = outdev;
        nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
@@ -467,6 +498,11 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
                                sizeof(*ip6h)))
                return NF_ACCEPT;
+        if (nf_flow_offload_dst_check(&rt->dst)) {
+                flow_offload_teardown(flow);
+                return NF_ACCEPT;
+        }
        if (skb_try_make_writable(skb, sizeof(*ip6h)))
                return NF_DROP;
@@ -476,6 +512,14 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
        ip6h = ipv6_hdr(skb);
        ip6h->hop_limit--;
+        skb->tstamp = 0;
+        if (unlikely(dst_xfrm(&rt->dst))) {
+                memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
+                IP6CB(skb)->iif = skb->dev->ifindex;
+                IP6CB(skb)->flags = IP6SKB_FORWARDED;
+                return nf_flow_xmit_xfrm(skb, state, &rt->dst);
+        }
        skb->dev = outdev;
        nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 605a7cfe7ca7..d47469f824a1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -138,9 +138,14 @@ static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
                return;
        list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
-                if (trans->msg_type == NFT_MSG_NEWSET &&
+                switch (trans->msg_type) {
-                    nft_trans_set(trans) == set) {
+                case NFT_MSG_NEWSET:
-                        set->bound = true;
+                        if (nft_trans_set(trans) == set)
+                                nft_trans_set_bound(trans) = true;
+                        break;
+                case NFT_MSG_NEWSETELEM:
+                        if (nft_trans_elem_set(trans) == set)
+                                nft_trans_elem_set_bound(trans) = true;
                        break;
                }
        }
@@ -1662,6 +1667,10 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
                chain->flags |= NFT_BASE_CHAIN | flags;
                basechain->policy = NF_ACCEPT;
+                if (chain->flags & NFT_CHAIN_HW_OFFLOAD &&
+                    nft_chain_offload_priority(basechain) < 0)
+                        return -EOPNOTSUPP;
                flow_block_init(&basechain->flow_block);
        } else {
                chain = kzalloc(sizeof(*chain), GFP_KERNEL);
@@ -6906,7 +6915,7 @@ static int __nf_tables_abort(struct net *net)
                        break;
                case NFT_MSG_NEWSET:
                        trans->ctx.table->use--;
-                        if (nft_trans_set(trans)->bound) {
+                        if (nft_trans_set_bound(trans)) {
                                nft_trans_destroy(trans);
                                break;
                        }
@@ -6918,7 +6927,7 @@ static int __nf_tables_abort(struct net *net)
                        nft_trans_destroy(trans);
                        break;
                case NFT_MSG_NEWSETELEM:
-                        if (nft_trans_elem_set(trans)->bound) {
+                        if (nft_trans_elem_set_bound(trans)) {
                                nft_trans_destroy(trans);
                                break;
                        }
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 64f5fd5f240e..c0d18c1d77ac 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -103,10 +103,11 @@ void nft_offload_update_dependency(struct nft_offload_ctx *ctx,
 }
 static void nft_flow_offload_common_init(struct flow_cls_common_offload *common,
-                                         __be16 proto,
+                                         __be16 proto, int priority,
-                                        struct netlink_ext_ack *extack)
+                                         struct netlink_ext_ack *extack)
 {
        common->protocol = proto;
+        common->prio = priority;
        common->extack = extack;
 }
@@ -124,6 +125,15 @@ static int nft_setup_cb_call(struct nft_base_chain *basechain,
        return 0;
 }
+int nft_chain_offload_priority(struct nft_base_chain *basechain)
+{
+        if (basechain->ops.priority <= 0 ||
+            basechain->ops.priority > USHRT_MAX)
+                return -1;
+        return 0;
+}
 static int nft_flow_offload_rule(struct nft_trans *trans,
                                 enum flow_cls_command command)
 {
@@ -142,7 +152,8 @@ static int nft_flow_offload_rule(struct nft_trans *trans,
        if (flow)
                proto = flow->proto;
-        nft_flow_offload_common_init(&cls_flow.common, proto, &extack);
+        nft_flow_offload_common_init(&cls_flow.common, proto,
+                                     basechain->ops.priority, &extack);
        cls_flow.command = command;
        cls_flow.cookie = (unsigned long) rule;
        if (flow)
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index aa5f571d4361..01705ad74a9a 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -72,11 +72,11 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
 {
        struct nft_flow_offload *priv = nft_expr_priv(expr);
        struct nf_flowtable *flowtable = &priv->flowtable->data;
+        struct tcphdr _tcph, *tcph = NULL;
        enum ip_conntrack_info ctinfo;
        struct nf_flow_route route;
        struct flow_offload *flow;
        enum ip_conntrack_dir dir;
-        bool is_tcp = false;
        struct nf_conn *ct;
        int ret;
@@ -89,7 +89,10 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
        switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) {
        case IPPROTO_TCP:
-                is_tcp = true;
+                tcph = skb_header_pointer(pkt->skb, pkt->xt.thoff,
+                                          sizeof(_tcph), &_tcph);
+                if (unlikely(!tcph || tcph->fin || tcph->rst))
+                        goto out;
                break;
        case IPPROTO_UDP:
                break;
@@ -115,7 +118,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
        if (!flow)
                goto err_flow_alloc;
-        if (is_tcp) {
+        if (tcph) {
                ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
                ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
        }
@@ -146,6 +149,11 @@ static int nft_flow_offload_validate(const struct nft_ctx *ctx,
        return nft_chain_validate_hooks(ctx->chain, hook_mask);
 }
+static const struct nla_policy nft_flow_offload_policy[NFTA_FLOW_MAX + 1] = {
+        [NFTA_FLOW_TABLE_NAME]  = { .type = NLA_STRING,
+                                    .len = NFT_NAME_MAXLEN - 1 },
+};
 static int nft_flow_offload_init(const struct nft_ctx *ctx,
                                 const struct nft_expr *expr,
                                 const struct nlattr * const tb[])
@@ -204,6 +212,7 @@ static const struct nft_expr_ops nft_flow_offload_ops = {
 static struct nft_expr_type nft_flow_offload_type __read_mostly = {
        .name           = "flow_offload",
        .ops            = &nft_flow_offload_ops,
+        .policy         = nft_flow_offload_policy,
        .maxattr        = NFTA_FLOW_MAX,
        .owner          = THIS_MODULE,
 };
diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
index d0ab1adf5bff..5aab6df74e0f 100644
--- a/net/netfilter/xt_nfacct.c
+++ b/net/netfilter/xt_nfacct.c
@@ -54,25 +54,39 @@ nfacct_mt_destroy(const struct xt_mtdtor_param *par)
        nfnl_acct_put(info->nfacct);
 }
-static struct xt_match nfacct_mt_reg __read_mostly = {
+static struct xt_match nfacct_mt_reg[] __read_mostly = {
-        .name       = "nfacct",
+        {
-        .family     = NFPROTO_UNSPEC,
+                .name       = "nfacct",
-        .checkentry = nfacct_mt_checkentry,
+                .revision   = 0,
-        .match      = nfacct_mt,
+                .family     = NFPROTO_UNSPEC,
-        .destroy    = nfacct_mt_destroy,
+                .checkentry = nfacct_mt_checkentry,
-        .matchsize  = sizeof(struct xt_nfacct_match_info),
+                .match      = nfacct_mt,
-        .usersize   = offsetof(struct xt_nfacct_match_info, nfacct),
+                .destroy    = nfacct_mt_destroy,
-        .me         = THIS_MODULE,
+                .matchsize  = sizeof(struct xt_nfacct_match_info),
+                .usersize   = offsetof(struct xt_nfacct_match_info, nfacct),
+                .me         = THIS_MODULE,
+        },
+        {
+                .name       = "nfacct",
+                .revision   = 1,
+                .family     = NFPROTO_UNSPEC,
+                .checkentry = nfacct_mt_checkentry,
+                .match      = nfacct_mt,
+                .destroy    = nfacct_mt_destroy,
+                .matchsize  = sizeof(struct xt_nfacct_match_info_v1),
+                .usersize   = offsetof(struct xt_nfacct_match_info_v1, nfacct),
+                .me         = THIS_MODULE,
+        },
 };
 static int __init nfacct_mt_init(void)
 {
-        return xt_register_match(&nfacct_mt_reg);
+        return xt_register_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
 }
 static void __exit nfacct_mt_exit(void)
 {
-        xt_unregister_match(&nfacct_mt_reg);
+        xt_unregister_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
 }
 module_init(nfacct_mt_init);
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index ead7c6022208..b92b22ce8abd 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -101,11 +101,9 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
        if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) &&
            (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
             info->invert & XT_PHYSDEV_OP_BRIDGED) &&
-            par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
+            par->hook_mask & (1 << NF_INET_LOCAL_OUT)) {
-            (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
                pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n");
-                if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
+                return -EINVAL;
-                        return -EINVAL;
        }
        if (!brnf_probed) {
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 848c6eb55064..05249eb45082 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -67,6 +67,7 @@ struct ovs_conntrack_info {
        struct md_mark mark;
        struct md_labels labels;
        char timeout[CTNL_TIMEOUT_NAME_MAX];
+        struct nf_ct_timeout *nf_ct_timeout;
 #if IS_ENABLED(CONFIG_NF_NAT)
        struct nf_nat_range2 range;  /* Only present for SRC NAT and DST NAT. */
 #endif
@@ -524,6 +525,11 @@ static int handle_fragments(struct net *net, struct sw_flow_key *key,
                return -EPFNOSUPPORT;
        }
+        /* The key extracted from the fragment that completed this datagram
+         * likely didn't have an L4 header, so regenerate it.
+         */
+        ovs_flow_key_update_l3l4(skb, key);
        key->ip.frag = OVS_FRAG_TYPE_NONE;
        skb_clear_hash(skb);
        skb->ignore_df = 1;
@@ -697,6 +703,14 @@ static bool skb_nfct_cached(struct net *net,
                if (help && rcu_access_pointer(help->helper) != info->helper)
                        return false;
        }
+        if (info->nf_ct_timeout) {
+                struct nf_conn_timeout *timeout_ext;
+                timeout_ext = nf_ct_timeout_find(ct);
+                if (!timeout_ext || info->nf_ct_timeout !=
+                    rcu_dereference(timeout_ext->timeout))
+                        return false;
+        }
        /* Force conntrack entry direction to the current packet? */
        if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
                /* Delete the conntrack entry if confirmed, else just release
@@ -1565,7 +1579,7 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
                case OVS_CT_ATTR_TIMEOUT:
                        memcpy(info->timeout, nla_data(a), nla_len(a));
                        if (!memchr(info->timeout, '\0', nla_len(a))) {
-                                OVS_NLERR(log, "Invalid conntrack helper");
+                                OVS_NLERR(log, "Invalid conntrack timeout");
                                return -EINVAL;
                        }
                        break;
@@ -1657,6 +1671,10 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
                                      ct_info.timeout))
                        pr_info_ratelimited("Failed to associated timeout "
                                            "policy `%s'\n", ct_info.timeout);
+                else
+                        ct_info.nf_ct_timeout = rcu_dereference(
+                                nf_ct_timeout_find(ct_info.ct)->timeout);
        }
        if (helper) {
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index bc89e16e0505..9d81d2c7bf82 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -523,78 +523,15 @@ static int parse_nsh(struct sk_buff *skb, struct sw_flow_key *key)
 }
 /**
- * key_extract - extracts a flow key from an Ethernet frame.
+ * key_extract_l3l4 - extracts L3/L4 header information.
 * @skb: sk_buff that contains the frame, with skb->data pointing to the
- * Ethernet header
+ *       L3 header
 * @key: output flow key
 *
- * The caller must ensure that skb->len >= ETH_HLEN.
- *
- * Returns 0 if successful, otherwise a negative errno value.
- *
- * Initializes @skb header fields as follows:
- *
- *    - skb->mac_header: the L2 header.
- *
- *    - skb->network_header: just past the L2 header, or just past the
- *      VLAN header, to the first byte of the L2 payload.
- *
- *    - skb->transport_header: If key->eth.type is ETH_P_IP or ETH_P_IPV6
- *      on output, then just past the IP header, if one is present and
- *      of a correct length, otherwise the same as skb->network_header.
- *      For other key->eth.type values it is left untouched.
- *
- *    - skb->protocol: the type of the data starting at skb->network_header.
- *      Equals to key->eth.type.
 */
-static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
+static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key)
 {
        int error;
-        struct ethhdr *eth;
-        /* Flags are always used as part of stats */
-        key->tp.flags = 0;
-        skb_reset_mac_header(skb);
-        /* Link layer. */
-        clear_vlan(key);
-        if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) {
-                if (unlikely(eth_type_vlan(skb->protocol)))
-                        return -EINVAL;
-                skb_reset_network_header(skb);
-                key->eth.type = skb->protocol;
-        } else {
-                eth = eth_hdr(skb);
-                ether_addr_copy(key->eth.src, eth->h_source);
-                ether_addr_copy(key->eth.dst, eth->h_dest);
-                __skb_pull(skb, 2 * ETH_ALEN);
-                /* We are going to push all headers that we pull, so no need to
-                * update skb->csum here.
-                */
-                if (unlikely(parse_vlan(skb, key)))
-                        return -ENOMEM;
-                key->eth.type = parse_ethertype(skb);
-                if (unlikely(key->eth.type == htons(0)))
-                        return -ENOMEM;
-                /* Multiple tagged packets need to retain TPID to satisfy
-                 * skb_vlan_pop(), which will later shift the ethertype into
-                 * skb->protocol.
-                 */
-                if (key->eth.cvlan.tci & htons(VLAN_CFI_MASK))
-                        skb->protocol = key->eth.cvlan.tpid;
-                else
-                        skb->protocol = key->eth.type;
-                skb_reset_network_header(skb);
-                __skb_push(skb, skb->data - skb_mac_header(skb));
-        }
-        skb_reset_mac_len(skb);
        /* Network layer. */
        if (key->eth.type == htons(ETH_P_IP)) {
@@ -623,6 +560,7 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
                offset = nh->frag_off & htons(IP_OFFSET);
                if (offset) {
                        key->ip.frag = OVS_FRAG_TYPE_LATER;
+                        memset(&key->tp, 0, sizeof(key->tp));
                        return 0;
                }
                if (nh->frag_off & htons(IP_MF) ||
@@ -740,8 +678,10 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
                        return error;
                }
-                if (key->ip.frag == OVS_FRAG_TYPE_LATER)
+                if (key->ip.frag == OVS_FRAG_TYPE_LATER) {
+                        memset(&key->tp, 0, sizeof(key->tp));
                        return 0;
+                }
                if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
                        key->ip.frag = OVS_FRAG_TYPE_FIRST;
@@ -788,6 +728,92 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
        return 0;
 }
+/**
+ * key_extract - extracts a flow key from an Ethernet frame.
+ * @skb: sk_buff that contains the frame, with skb->data pointing to the
+ * Ethernet header
+ * @key: output flow key
+ *
+ * The caller must ensure that skb->len >= ETH_HLEN.
+ *
+ * Returns 0 if successful, otherwise a negative errno value.
+ *
+ * Initializes @skb header fields as follows:
+ *
+ *    - skb->mac_header: the L2 header.
+ *
+ *    - skb->network_header: just past the L2 header, or just past the
+ *      VLAN header, to the first byte of the L2 payload.
+ *
+ *    - skb->transport_header: If key->eth.type is ETH_P_IP or ETH_P_IPV6
+ *      on output, then just past the IP header, if one is present and
+ *      of a correct length, otherwise the same as skb->network_header.
+ *      For other key->eth.type values it is left untouched.
+ *
+ *    - skb->protocol: the type of the data starting at skb->network_header.
+ *      Equals to key->eth.type.
+ */
+static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
+{
+        struct ethhdr *eth;
+        /* Flags are always used as part of stats */
+        key->tp.flags = 0;
+        skb_reset_mac_header(skb);
+        /* Link layer. */
+        clear_vlan(key);
+        if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) {
+                if (unlikely(eth_type_vlan(skb->protocol)))
+                        return -EINVAL;
+                skb_reset_network_header(skb);
+                key->eth.type = skb->protocol;
+        } else {
+                eth = eth_hdr(skb);
+                ether_addr_copy(key->eth.src, eth->h_source);
+                ether_addr_copy(key->eth.dst, eth->h_dest);
+                __skb_pull(skb, 2 * ETH_ALEN);
+                /* We are going to push all headers that we pull, so no need to
+                 * update skb->csum here.
+                 */
+                if (unlikely(parse_vlan(skb, key)))
+                        return -ENOMEM;
+                key->eth.type = parse_ethertype(skb);
+                if (unlikely(key->eth.type == htons(0)))
+                        return -ENOMEM;
+                /* Multiple tagged packets need to retain TPID to satisfy
+                 * skb_vlan_pop(), which will later shift the ethertype into
+                 * skb->protocol.
+                 */
+                if (key->eth.cvlan.tci & htons(VLAN_CFI_MASK))
+                        skb->protocol = key->eth.cvlan.tpid;
+                else
+                        skb->protocol = key->eth.type;
+                skb_reset_network_header(skb);
+                __skb_push(skb, skb->data - skb_mac_header(skb));
+        }
+        skb_reset_mac_len(skb);
+        /* Fill out L3/L4 key info, if any */
+        return key_extract_l3l4(skb, key);
+}
+/* In the case of conntrack fragment handling it expects L3 headers,
+ * add a helper.
+ */
+int ovs_flow_key_update_l3l4(struct sk_buff *skb, struct sw_flow_key *key)
+{
+        return key_extract_l3l4(skb, key);
+}
 int ovs_flow_key_update(struct sk_buff *skb, struct sw_flow_key *key)
 {
        int res;
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index a5506e2d4b7a..b830d5ff7af4 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -270,6 +270,7 @@ void ovs_flow_stats_clear(struct sw_flow *);
 u64 ovs_flow_used_time(unsigned long flow_jiffies);
 int ovs_flow_key_update(struct sk_buff *skb, struct sw_flow_key *key);
+int ovs_flow_key_update_l3l4(struct sk_buff *skb, struct sw_flow_key *key);
 int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
                         struct sk_buff *skb,
                         struct sw_flow_key *key);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8d54f3047768..e2742b006d25 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2618,6 +2618,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
        mutex_lock(&po->pg_vec_lock);
+        /* packet_sendmsg() check on tx_ring.pg_vec was lockless,
+         * we need to confirm it under protection of pg_vec_lock.
+         */
+        if (unlikely(!po->tx_ring.pg_vec)) {
+                err = -EBUSY;
+                goto out;
+        }
        if (likely(saddr == NULL)) {
                dev     = packet_cached_dev_get(po);
                proto   = po->num;
diff --git a/net/psample/psample.c b/net/psample/psample.c
index 841f198ea1a8..66e4b61a350d 100644
--- a/net/psample/psample.c
+++ b/net/psample/psample.c
@@ -154,7 +154,7 @@ static void psample_group_destroy(struct psample_group *group)
 {
        psample_group_notify(group, PSAMPLE_CMD_DEL_GROUP);
        list_del(&group->list);
-        kfree(group);
+        kfree_rcu(group, rcu);
 }
 static struct psample_group *
diff --git a/net/rds/ib.c b/net/rds/ib.c
index ec05d91aa9a2..45acab2de0cf 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -291,7 +291,7 @@ static int rds_ib_conn_info_visitor(struct rds_connection *conn,
                                    void *buffer)
 {
        struct rds_info_rdma_connection *iinfo = buffer;
-        struct rds_ib_connection *ic;
+        struct rds_ib_connection *ic = conn->c_transport_data;
        /* We will only ever look at IB transports */
        if (conn->c_trans != &rds_ib_transport)
@@ -301,15 +301,16 @@ static int rds_ib_conn_info_visitor(struct rds_connection *conn,
        iinfo->src_addr = conn->c_laddr.s6_addr32[3];
        iinfo->dst_addr = conn->c_faddr.s6_addr32[3];
-        iinfo->tos = conn->c_tos;
+        if (ic) {
+                iinfo->tos = conn->c_tos;
+                iinfo->sl = ic->i_sl;
+        }
        memset(&iinfo->src_gid, 0, sizeof(iinfo->src_gid));
        memset(&iinfo->dst_gid, 0, sizeof(iinfo->dst_gid));
        if (rds_conn_state(conn) == RDS_CONN_UP) {
                struct rds_ib_device *rds_ibdev;
-                ic = conn->c_transport_data;
                rdma_read_gids(ic->i_cm_id, (union ib_gid *)&iinfo->src_gid,
                               (union ib_gid *)&iinfo->dst_gid);
@@ -329,7 +330,7 @@ static int rds6_ib_conn_info_visitor(struct rds_connection *conn,
                                     void *buffer)
 {
        struct rds6_info_rdma_connection *iinfo6 = buffer;
-        struct rds_ib_connection *ic;
+        struct rds_ib_connection *ic = conn->c_transport_data;
        /* We will only ever look at IB transports */
        if (conn->c_trans != &rds_ib_transport)
@@ -337,6 +338,10 @@ static int rds6_ib_conn_info_visitor(struct rds_connection *conn,
        iinfo6->src_addr = conn->c_laddr;
        iinfo6->dst_addr = conn->c_faddr;
+        if (ic) {
+                iinfo6->tos = conn->c_tos;
+                iinfo6->sl = ic->i_sl;
+        }
        memset(&iinfo6->src_gid, 0, sizeof(iinfo6->src_gid));
        memset(&iinfo6->dst_gid, 0, sizeof(iinfo6->dst_gid));
@@ -344,7 +349,6 @@ static int rds6_ib_conn_info_visitor(struct rds_connection *conn,
        if (rds_conn_state(conn) == RDS_CONN_UP) {
                struct rds_ib_device *rds_ibdev;
-                ic = conn->c_transport_data;
                rdma_read_gids(ic->i_cm_id, (union ib_gid *)&iinfo6->src_gid,
                               (union ib_gid *)&iinfo6->dst_gid);
                rds_ibdev = ic->rds_ibdev;
diff --git a/net/rds/ib.h b/net/rds/ib.h
index 303c6ee8bdb7..f2b558e8b5ea 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -220,6 +220,7 @@ struct rds_ib_connection {
        /* Send/Recv vectors */
        int                     i_scq_vector;
        int                     i_rcq_vector;
+        u8                      i_sl;
 };
 /* This assumes that atomic_t is at least 32 bits */
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index fddaa09f7b0d..233f1368162b 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -152,6 +152,9 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
                  RDS_PROTOCOL_MINOR(conn->c_version),
                  ic->i_flowctl ? ", flow control" : "");
+        /* receive sl from the peer */
+        ic->i_sl = ic->i_cm_id->route.path_rec->sl;
        atomic_set(&ic->i_cq_quiesce, 0);
        /* Init rings and fill recv. this needs to wait until protocol
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index 9986d6065c4d..5f741e51b4ba 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -43,6 +43,9 @@ static struct rdma_cm_id *rds_rdma_listen_id;
 static struct rdma_cm_id *rds6_rdma_listen_id;
 #endif
+/* Per IB specification 7.7.3, service level is a 4-bit field. */
+#define TOS_TO_SL(tos)          ((tos) & 0xF)
 static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id,
                                         struct rdma_cm_event *event,
                                         bool isv6)
@@ -97,10 +100,13 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id,
                        struct rds_ib_connection *ibic;
                        ibic = conn->c_transport_data;
-                        if (ibic && ibic->i_cm_id == cm_id)
+                        if (ibic && ibic->i_cm_id == cm_id) {
+                                cm_id->route.path_rec[0].sl =
+                                        TOS_TO_SL(conn->c_tos);
                                ret = trans->cm_initiate_connect(cm_id, isv6);
-                        else
+                        } else {
                                rds_conn_drop(conn);
+                        }
                }
                break;
diff --git a/net/rds/recv.c b/net/rds/recv.c
index 853de4876088..a42ba7fa06d5 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006, 2018 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2006, 2019 Oracle and/or its affiliates. All rights reserved.
 *
 * This software is available to you under a choice of one of two
 * licenses.  You may choose to be licensed under the terms of the GNU
@@ -811,6 +811,7 @@ void rds6_inc_info_copy(struct rds_incoming *inc,
        minfo6.seq = be64_to_cpu(inc->i_hdr.h_sequence);
        minfo6.len = be32_to_cpu(inc->i_hdr.h_len);
+        minfo6.tos = inc->i_conn->c_tos;
        if (flip) {
                minfo6.laddr = *daddr;
@@ -824,6 +825,8 @@ void rds6_inc_info_copy(struct rds_incoming *inc,
                minfo6.fport = inc->i_hdr.h_dport;
        }
+        minfo6.flags = 0;
        rds_info_copy(iter, &minfo6, sizeof(minfo6));
 }
 #endif
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index d09eaf153544..d72ddb67bb74 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -193,7 +193,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
 service_in_use:
        write_unlock(&local->services_lock);
-        rxrpc_put_local(local);
+        rxrpc_unuse_local(local);
        ret = -EADDRINUSE;
 error_unlock:
        release_sock(&rx->sk);
@@ -402,7 +402,7 @@ EXPORT_SYMBOL(rxrpc_kernel_check_life);
 */
 void rxrpc_kernel_probe_life(struct socket *sock, struct rxrpc_call *call)
 {
-        rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, false,
+        rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, false,
                          rxrpc_propose_ack_ping_for_check_life);
        rxrpc_send_ack_packet(call, true, NULL);
 }
@@ -862,7 +862,6 @@ static void rxrpc_sock_destructor(struct sock *sk)
 static int rxrpc_release_sock(struct sock *sk)
 {
        struct rxrpc_sock *rx = rxrpc_sk(sk);
-        struct rxrpc_net *rxnet = rxrpc_net(sock_net(&rx->sk));
        _enter("%p{%d,%d}", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
@@ -898,10 +897,8 @@ static int rxrpc_release_sock(struct sock *sk)
        rxrpc_release_calls_on_socket(rx);
        flush_workqueue(rxrpc_workqueue);
        rxrpc_purge_queue(&sk->sk_receive_queue);
-        rxrpc_queue_work(&rxnet->service_conn_reaper);
-        rxrpc_queue_work(&rxnet->client_conn_reaper);
-        rxrpc_put_local(rx->local);
+        rxrpc_unuse_local(rx->local);
        rx->local = NULL;
        key_put(rx->key);
        rx->key = NULL;
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 822f45386e31..8051dfdcf26d 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -185,11 +185,17 @@ struct rxrpc_host_header {
 * - max 48 bytes (struct sk_buff::cb)
 */
 struct rxrpc_skb_priv {
-        union {
+        atomic_t        nr_ring_pins;           /* Number of rxtx ring pins */
-                u8              nr_jumbo;       /* Number of jumbo subpackets */
+        u8              nr_subpackets;          /* Number of subpackets */
-        };
+        u8              rx_flags;               /* Received packet flags */
+#define RXRPC_SKB_INCL_LAST     0x01            /* - Includes last packet */
+#define RXRPC_SKB_TX_BUFFER     0x02            /* - Is transmit buffer */
        union {
                int             remain;         /* amount of space remaining for next write */
+                /* List of requested ACKs on subpackets */
+                unsigned long   rx_req_ack[(RXRPC_MAX_NR_JUMBO + BITS_PER_LONG - 1) /
+                                           BITS_PER_LONG];
        };
        struct rxrpc_host_header hdr;           /* RxRPC packet header from this packet */
@@ -254,7 +260,8 @@ struct rxrpc_security {
 */
 struct rxrpc_local {
        struct rcu_head         rcu;
-        atomic_t                usage;
+        atomic_t                active_users;   /* Number of users of the local endpoint */
+        atomic_t                usage;          /* Number of references to the structure */
        struct rxrpc_net        *rxnet;         /* The network ns in which this resides */
        struct list_head        link;
        struct socket           *socket;        /* my UDP socket */
@@ -612,8 +619,7 @@ struct rxrpc_call {
 #define RXRPC_TX_ANNO_LAST      0x04
 #define RXRPC_TX_ANNO_RESENT    0x08
-#define RXRPC_RX_ANNO_JUMBO     0x3f            /* Jumbo subpacket number + 1 if not zero */
+#define RXRPC_RX_ANNO_SUBPACKET 0x3f            /* Subpacket number in jumbogram */
-#define RXRPC_RX_ANNO_JLAST     0x40            /* Set if last element of a jumbo packet */
 #define RXRPC_RX_ANNO_VERIFIED  0x80            /* Set if verified and decrypted */
        rxrpc_seq_t             tx_hard_ack;    /* Dead slot in buffer; the first transmitted but
                                                 * not hard-ACK'd packet follows this.
@@ -649,7 +655,6 @@ struct rxrpc_call {
        /* receive-phase ACK management */
        u8                      ackr_reason;    /* reason to ACK */
-        u16                     ackr_skew;      /* skew on packet being ACK'd */
        rxrpc_serial_t          ackr_serial;    /* serial of packet being ACK'd */
        rxrpc_serial_t          ackr_first_seq; /* first sequence number received */
        rxrpc_seq_t             ackr_prev_seq;  /* previous sequence number received */
@@ -743,7 +748,7 @@ int rxrpc_reject_call(struct rxrpc_sock *);
 /*
 * call_event.c
 */
-void rxrpc_propose_ACK(struct rxrpc_call *, u8, u16, u32, bool, bool,
+void rxrpc_propose_ACK(struct rxrpc_call *, u8, u32, bool, bool,
                       enum rxrpc_propose_ack_trace);
 void rxrpc_process_call(struct work_struct *);
@@ -905,6 +910,7 @@ void rxrpc_disconnect_client_call(struct rxrpc_call *);
 void rxrpc_put_client_conn(struct rxrpc_connection *);
 void rxrpc_discard_expired_client_conns(struct work_struct *);
 void rxrpc_destroy_all_client_connections(struct rxrpc_net *);
+void rxrpc_clean_up_local_conns(struct rxrpc_local *);
 /*
 * conn_event.c
@@ -1002,6 +1008,8 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *, const struct sockaddr_rxrpc
 struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *);
 struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *);
 void rxrpc_put_local(struct rxrpc_local *);
+struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *);
+void rxrpc_unuse_local(struct rxrpc_local *);
 void rxrpc_queue_local(struct rxrpc_local *);
 void rxrpc_destroy_all_locals(struct rxrpc_net *);
@@ -1103,6 +1111,7 @@ void rxrpc_kernel_data_consumed(struct rxrpc_call *, struct sk_buff *);
 void rxrpc_packet_destructor(struct sk_buff *);
 void rxrpc_new_skb(struct sk_buff *, enum rxrpc_skb_trace);
 void rxrpc_see_skb(struct sk_buff *, enum rxrpc_skb_trace);
+void rxrpc_eaten_skb(struct sk_buff *, enum rxrpc_skb_trace);
 void rxrpc_get_skb(struct sk_buff *, enum rxrpc_skb_trace);
 void rxrpc_free_skb(struct sk_buff *, enum rxrpc_skb_trace);
 void rxrpc_purge_queue(struct sk_buff_head *);
diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index bc2adeb3acb9..cedbbb3a7c2e 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -43,8 +43,7 @@ static void rxrpc_propose_ping(struct rxrpc_call *call,
 * propose an ACK be sent
 */
 static void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
-                                u16 skew, u32 serial, bool immediate,
+                                u32 serial, bool immediate, bool background,
-                                bool background,
                                enum rxrpc_propose_ack_trace why)
 {
        enum rxrpc_propose_ack_outcome outcome = rxrpc_propose_ack_use;
@@ -69,14 +68,12 @@ static void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
                if (RXRPC_ACK_UPDATEABLE & (1 << ack_reason)) {
                        outcome = rxrpc_propose_ack_update;
                        call->ackr_serial = serial;
-                        call->ackr_skew = skew;
                }
                if (!immediate)
                        goto trace;
        } else if (prior > rxrpc_ack_priority[call->ackr_reason]) {
                call->ackr_reason = ack_reason;
                call->ackr_serial = serial;
-                call->ackr_skew = skew;
        } else {
                outcome = rxrpc_propose_ack_subsume;
        }
@@ -137,11 +134,11 @@ trace:
 * propose an ACK be sent, locking the call structure
 */
 void rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
-                       u16 skew, u32 serial, bool immediate, bool background,
+                       u32 serial, bool immediate, bool background,
                       enum rxrpc_propose_ack_trace why)
 {
        spin_lock_bh(&call->lock);
-        __rxrpc_propose_ACK(call, ack_reason, skew, serial,
+        __rxrpc_propose_ACK(call, ack_reason, serial,
                            immediate, background, why);
        spin_unlock_bh(&call->lock);
 }
@@ -202,7 +199,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
                        continue;
                skb = call->rxtx_buffer[ix];
-                rxrpc_see_skb(skb, rxrpc_skb_tx_seen);
+                rxrpc_see_skb(skb, rxrpc_skb_seen);
                if (anno_type == RXRPC_TX_ANNO_UNACK) {
                        if (ktime_after(skb->tstamp, max_age)) {
@@ -239,7 +236,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
                ack_ts = ktime_sub(now, call->acks_latest_ts);
                if (ktime_to_ns(ack_ts) < call->peer->rtt)
                        goto out;
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, false,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, false,
                                  rxrpc_propose_ack_ping_for_lost_ack);
                rxrpc_send_ack_packet(call, true, NULL);
                goto out;
@@ -258,18 +255,18 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
                        continue;
                skb = call->rxtx_buffer[ix];
-                rxrpc_get_skb(skb, rxrpc_skb_tx_got);
+                rxrpc_get_skb(skb, rxrpc_skb_got);
                spin_unlock_bh(&call->lock);
                if (rxrpc_send_data_packet(call, skb, true) < 0) {
-                        rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
+                        rxrpc_free_skb(skb, rxrpc_skb_freed);
                        return;
                }
                if (rxrpc_is_client_call(call))
                        rxrpc_expose_client_call(call);
-                rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
                spin_lock_bh(&call->lock);
                /* We need to clear the retransmit state, but there are two
@@ -372,7 +369,7 @@ recheck_state:
        if (time_after_eq(now, t)) {
                trace_rxrpc_timer(call, rxrpc_timer_exp_keepalive, now);
                cmpxchg(&call->keepalive_at, t, now + MAX_JIFFY_OFFSET);
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, true,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, true,
                                  rxrpc_propose_ack_ping_for_keepalive);
                set_bit(RXRPC_CALL_EV_PING, &call->events);
        }
@@ -407,7 +404,7 @@ recheck_state:
        send_ack = NULL;
        if (test_and_clear_bit(RXRPC_CALL_EV_ACK_LOST, &call->events)) {
                call->acks_lost_top = call->tx_top;
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, false,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, false,
                                  rxrpc_propose_ack_ping_for_lost_ack);
                send_ack = &call->acks_lost_ping;
        }
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index 217b12be9e08..014548c259ce 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -422,6 +422,19 @@ void rxrpc_get_call(struct rxrpc_call *call, enum rxrpc_call_trace op)
 }
 /*
+ * Clean up the RxTx skb ring.
+ */
+static void rxrpc_cleanup_ring(struct rxrpc_call *call)
+{
+        int i;
+        for (i = 0; i < RXRPC_RXTX_BUFF_SIZE; i++) {
+                rxrpc_free_skb(call->rxtx_buffer[i], rxrpc_skb_cleaned);
+                call->rxtx_buffer[i] = NULL;
+        }
+}
+/*
 * Detach a call from its owning socket.
 */
 void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call)
@@ -429,7 +442,6 @@ void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call)
        const void *here = __builtin_return_address(0);
        struct rxrpc_connection *conn = call->conn;
        bool put = false;
-        int i;
        _enter("{%d,%d}", call->debug_id, atomic_read(&call->usage));
@@ -479,13 +491,7 @@ void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call)
        if (conn)
                rxrpc_disconnect_call(call);
-        for (i = 0; i < RXRPC_RXTX_BUFF_SIZE; i++) {
+        rxrpc_cleanup_ring(call);
-                rxrpc_free_skb(call->rxtx_buffer[i],
-                               (call->tx_phase ? rxrpc_skb_tx_cleaned :
-                                rxrpc_skb_rx_cleaned));
-                call->rxtx_buffer[i] = NULL;
-        }
        _leave("");
 }
@@ -568,8 +574,6 @@ static void rxrpc_rcu_destroy_call(struct rcu_head *rcu)
 */
 void rxrpc_cleanup_call(struct rxrpc_call *call)
 {
-        int i;
        _net("DESTROY CALL %d", call->debug_id);
        memset(&call->sock_node, 0xcd, sizeof(call->sock_node));
@@ -580,13 +584,8 @@ void rxrpc_cleanup_call(struct rxrpc_call *call)
        ASSERT(test_bit(RXRPC_CALL_RELEASED, &call->flags));
        ASSERTCMP(call->conn, ==, NULL);
-        /* Clean up the Rx/Tx buffer */
+        rxrpc_cleanup_ring(call);
-        for (i = 0; i < RXRPC_RXTX_BUFF_SIZE; i++)
+        rxrpc_free_skb(call->tx_pending, rxrpc_skb_cleaned);
-                rxrpc_free_skb(call->rxtx_buffer[i],
-                               (call->tx_phase ? rxrpc_skb_tx_cleaned :
-                                rxrpc_skb_rx_cleaned));
-        rxrpc_free_skb(call->tx_pending, rxrpc_skb_tx_cleaned);
        call_rcu(&call->rcu, rxrpc_rcu_destroy_call);
 }
diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
index aea82f909c60..3f1da1b49f69 100644
--- a/net/rxrpc/conn_client.c
+++ b/net/rxrpc/conn_client.c
@@ -1162,3 +1162,47 @@ void rxrpc_destroy_all_client_connections(struct rxrpc_net *rxnet)
        _leave("");
 }
+/*
+ * Clean up the client connections on a local endpoint.
+ */
+void rxrpc_clean_up_local_conns(struct rxrpc_local *local)
+{
+        struct rxrpc_connection *conn, *tmp;
+        struct rxrpc_net *rxnet = local->rxnet;
+        unsigned int nr_active;
+        LIST_HEAD(graveyard);
+        _enter("");
+        spin_lock(&rxnet->client_conn_cache_lock);
+        nr_active = rxnet->nr_active_client_conns;
+        list_for_each_entry_safe(conn, tmp, &rxnet->idle_client_conns,
+                                 cache_link) {
+                if (conn->params.local == local) {
+                        ASSERTCMP(conn->cache_state, ==, RXRPC_CONN_CLIENT_IDLE);
+                        trace_rxrpc_client(conn, -1, rxrpc_client_discard);
+                        if (!test_and_clear_bit(RXRPC_CONN_EXPOSED, &conn->flags))
+                                BUG();
+                        conn->cache_state = RXRPC_CONN_CLIENT_INACTIVE;
+                        list_move(&conn->cache_link, &graveyard);
+                        nr_active--;
+                }
+        }
+        rxnet->nr_active_client_conns = nr_active;
+        spin_unlock(&rxnet->client_conn_cache_lock);
+        ASSERTCMP(nr_active, >=, 0);
+        while (!list_empty(&graveyard)) {
+                conn = list_entry(graveyard.next,
+                                  struct rxrpc_connection, cache_link);
+                list_del_init(&conn->cache_link);
+                rxrpc_put_connection(conn);
+        }
+        _leave(" [culled]");
+}
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index df6624c140be..a1ceef4f5cd0 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -472,7 +472,7 @@ void rxrpc_process_connection(struct work_struct *work)
        /* go through the conn-level event packets, releasing the ref on this
         * connection that each one has when we've finished with it */
        while ((skb = skb_dequeue(&conn->rx_queue))) {
-                rxrpc_see_skb(skb, rxrpc_skb_rx_seen);
+                rxrpc_see_skb(skb, rxrpc_skb_seen);
                ret = rxrpc_process_event(conn, skb, &abort_code);
                switch (ret) {
                case -EPROTO:
@@ -484,7 +484,7 @@ void rxrpc_process_connection(struct work_struct *work)
                        goto requeue_and_leave;
                case -ECONNABORTED:
                default:
-                        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                        rxrpc_free_skb(skb, rxrpc_skb_freed);
                        break;
                }
        }
@@ -501,6 +501,6 @@ requeue_and_leave:
 protocol_error:
        if (rxrpc_abort_connection(conn, ret, abort_code) < 0)
                goto requeue_and_leave;
-        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
        goto out;
 }
diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
index 434ef392212b..ed05b6922132 100644
--- a/net/rxrpc/conn_object.c
+++ b/net/rxrpc/conn_object.c
@@ -398,7 +398,7 @@ void rxrpc_service_connection_reaper(struct work_struct *work)
                if (conn->state == RXRPC_CONN_SERVICE_PREALLOC)
                        continue;
-                if (rxnet->live) {
+                if (rxnet->live && !conn->params.local->dead) {
                        idle_timestamp = READ_ONCE(conn->idle_timestamp);
                        expire_at = idle_timestamp + rxrpc_connection_expiry * HZ;
                        if (conn->params.local->service_closed)
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 5bd6f1546e5c..d122c53c8697 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -196,15 +196,14 @@ send_extra_data:
 * Ping the other end to fill our RTT cache and to retrieve the rwind
 * and MTU parameters.
 */
-static void rxrpc_send_ping(struct rxrpc_call *call, struct sk_buff *skb,
+static void rxrpc_send_ping(struct rxrpc_call *call, struct sk_buff *skb)
-                            int skew)
 {
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        ktime_t now = skb->tstamp;
        if (call->peer->rtt_usage < 3 ||
            ktime_before(ktime_add_ms(call->peer->rtt_last_req, 1000), now))
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, skew, sp->hdr.serial,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, sp->hdr.serial,
                                  true, true,
                                  rxrpc_propose_ack_ping_for_params);
 }
@@ -234,7 +233,7 @@ static bool rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to,
                ix = call->tx_hard_ack & RXRPC_RXTX_BUFF_MASK;
                skb = call->rxtx_buffer[ix];
                annotation = call->rxtx_annotations[ix];
-                rxrpc_see_skb(skb, rxrpc_skb_tx_rotated);
+                rxrpc_see_skb(skb, rxrpc_skb_rotated);
                call->rxtx_buffer[ix] = NULL;
                call->rxtx_annotations[ix] = 0;
                skb->next = list;
@@ -259,7 +258,7 @@ static bool rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to,
                skb = list;
                list = skb->next;
                skb_mark_not_on_list(skb);
-                rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
        }
        return rot_last;
@@ -348,7 +347,7 @@ static bool rxrpc_receiving_reply(struct rxrpc_call *call)
 }
 /*
- * Scan a jumbo packet to validate its structure and to work out how many
+ * Scan a data packet to validate its structure and to work out how many
 * subpackets it contains.
 *
 * A jumbo packet is a collection of consecutive packets glued together with
@@ -359,16 +358,21 @@ static bool rxrpc_receiving_reply(struct rxrpc_call *call)
 * the last are RXRPC_JUMBO_DATALEN in size.  The last subpacket may be of any
 * size.
 */
-static bool rxrpc_validate_jumbo(struct sk_buff *skb)
+static bool rxrpc_validate_data(struct sk_buff *skb)
 {
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        unsigned int offset = sizeof(struct rxrpc_wire_header);
        unsigned int len = skb->len;
-        int nr_jumbo = 1;
        u8 flags = sp->hdr.flags;
-        do {
+        for (;;) {
-                nr_jumbo++;
+                if (flags & RXRPC_REQUEST_ACK)
+                        __set_bit(sp->nr_subpackets, sp->rx_req_ack);
+                sp->nr_subpackets++;
+                if (!(flags & RXRPC_JUMBO_PACKET))
+                        break;
                if (len - offset < RXRPC_JUMBO_SUBPKTLEN)
                        goto protocol_error;
                if (flags & RXRPC_LAST_PACKET)
@@ -377,9 +381,10 @@ static bool rxrpc_validate_jumbo(struct sk_buff *skb)
                if (skb_copy_bits(skb, offset, &flags, 1) < 0)
                        goto protocol_error;
                offset += sizeof(struct rxrpc_jumbo_header);
-        } while (flags & RXRPC_JUMBO_PACKET);
+        }
-        sp->nr_jumbo = nr_jumbo;
+        if (flags & RXRPC_LAST_PACKET)
+                sp->rx_flags |= RXRPC_SKB_INCL_LAST;
        return true;
 protocol_error:
@@ -400,10 +405,10 @@ protocol_error:
 * (that information is encoded in the ACK packet).
 */
 static void rxrpc_input_dup_data(struct rxrpc_call *call, rxrpc_seq_t seq,
-                                 u8 annotation, bool *_jumbo_bad)
+                                 bool is_jumbo, bool *_jumbo_bad)
 {
        /* Discard normal packets that are duplicates. */
-        if (annotation == 0)
+        if (is_jumbo)
                return;
        /* Skip jumbo subpackets that are duplicates.  When we've had three or
@@ -417,30 +422,30 @@ static void rxrpc_input_dup_data(struct rxrpc_call *call, rxrpc_seq_t seq,
 }
 /*
- * Process a DATA packet, adding the packet to the Rx ring.
+ * Process a DATA packet, adding the packet to the Rx ring.  The caller's
+ * packet ref must be passed on or discarded.
 */
-static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
+static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb)
-                             u16 skew)
 {
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        enum rxrpc_call_state state;
-        unsigned int offset = sizeof(struct rxrpc_wire_header);
+        unsigned int j;
-        unsigned int ix;
        rxrpc_serial_t serial = sp->hdr.serial, ack_serial = 0;
-        rxrpc_seq_t seq = sp->hdr.seq, hard_ack;
+        rxrpc_seq_t seq0 = sp->hdr.seq, hard_ack;
-        bool immediate_ack = false, jumbo_bad = false, queued;
+        bool immediate_ack = false, jumbo_bad = false;
-        u16 len;
+        u8 ack = 0;
-        u8 ack = 0, flags, annotation = 0;
        _enter("{%u,%u},{%u,%u}",
-               call->rx_hard_ack, call->rx_top, skb->len, seq);
+               call->rx_hard_ack, call->rx_top, skb->len, seq0);
-        _proto("Rx DATA %%%u { #%u f=%02x }",
+        _proto("Rx DATA %%%u { #%u f=%02x n=%u }",
-               sp->hdr.serial, seq, sp->hdr.flags);
+               sp->hdr.serial, seq0, sp->hdr.flags, sp->nr_subpackets);
        state = READ_ONCE(call->state);
-        if (state >= RXRPC_CALL_COMPLETE)
+        if (state >= RXRPC_CALL_COMPLETE) {
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
                return;
+        }
        if (call->state == RXRPC_CALL_SERVER_RECV_REQUEST) {
                unsigned long timo = READ_ONCE(call->next_req_timo);
@@ -465,156 +470,157 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
            !rxrpc_receiving_reply(call))
                goto unlock;
-        call->ackr_prev_seq = seq;
+        call->ackr_prev_seq = seq0;
        hard_ack = READ_ONCE(call->rx_hard_ack);
-        if (after(seq, hard_ack + call->rx_winsize)) {
-                ack = RXRPC_ACK_EXCEEDS_WINDOW;
-                ack_serial = serial;
-                goto ack;
-        }
-        flags = sp->hdr.flags;
+        if (sp->nr_subpackets > 1) {
-        if (flags & RXRPC_JUMBO_PACKET) {
                if (call->nr_jumbo_bad > 3) {
                        ack = RXRPC_ACK_NOSPACE;
                        ack_serial = serial;
                        goto ack;
                }
-                annotation = 1;
        }
-next_subpacket:
+        for (j = 0; j < sp->nr_subpackets; j++) {
-        queued = false;
+                rxrpc_serial_t serial = sp->hdr.serial + j;
-        ix = seq & RXRPC_RXTX_BUFF_MASK;
+                rxrpc_seq_t seq = seq0 + j;
-        len = skb->len;
+                unsigned int ix = seq & RXRPC_RXTX_BUFF_MASK;
-        if (flags & RXRPC_JUMBO_PACKET)
+                bool terminal = (j == sp->nr_subpackets - 1);
-                len = RXRPC_JUMBO_DATALEN;
+                bool last = terminal && (sp->rx_flags & RXRPC_SKB_INCL_LAST);
+                u8 flags, annotation = j;
-        if (flags & RXRPC_LAST_PACKET) {
-                if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
+                _proto("Rx DATA+%u %%%u { #%x t=%u l=%u }",
-                    seq != call->rx_top) {
+                     j, serial, seq, terminal, last);
-                        rxrpc_proto_abort("LSN", call, seq);
-                        goto unlock;
+                if (last) {
-                }
+                        if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
-        } else {
+                            seq != call->rx_top) {
-                if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
+                                rxrpc_proto_abort("LSN", call, seq);
-                    after_eq(seq, call->rx_top)) {
+                                goto unlock;
-                        rxrpc_proto_abort("LSA", call, seq);
+                        }
-                        goto unlock;
+                } else {
+                        if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
+                            after_eq(seq, call->rx_top)) {
+                                rxrpc_proto_abort("LSA", call, seq);
+                                goto unlock;
+                        }
                }
-        }
-        trace_rxrpc_rx_data(call->debug_id, seq, serial, flags, annotation);
-        if (before_eq(seq, hard_ack)) {
-                ack = RXRPC_ACK_DUPLICATE;
-                ack_serial = serial;
-                goto skip;
-        }
-        if (flags & RXRPC_REQUEST_ACK && !ack) {
+                flags = 0;
-                ack = RXRPC_ACK_REQUESTED;
+                if (last)
-                ack_serial = serial;
+                        flags |= RXRPC_LAST_PACKET;
-        }
+                if (!terminal)
+                        flags |= RXRPC_JUMBO_PACKET;
+                if (test_bit(j, sp->rx_req_ack))
+                        flags |= RXRPC_REQUEST_ACK;
+                trace_rxrpc_rx_data(call->debug_id, seq, serial, flags, annotation);
-        if (call->rxtx_buffer[ix]) {
+                if (before_eq(seq, hard_ack)) {
-                rxrpc_input_dup_data(call, seq, annotation, &jumbo_bad);
-                if (ack != RXRPC_ACK_DUPLICATE) {
                        ack = RXRPC_ACK_DUPLICATE;
                        ack_serial = serial;
+                        continue;
                }
-                immediate_ack = true;
-                goto skip;
-        }
-        /* Queue the packet.  We use a couple of memory barriers here as need
-         * to make sure that rx_top is perceived to be set after the buffer
-         * pointer and that the buffer pointer is set after the annotation and
-         * the skb data.
-         *
-         * Barriers against rxrpc_recvmsg_data() and rxrpc_rotate_rx_window()
-         * and also rxrpc_fill_out_ack().
-         */
-        rxrpc_get_skb(skb, rxrpc_skb_rx_got);
-        call->rxtx_annotations[ix] = annotation;
-        smp_wmb();
-        call->rxtx_buffer[ix] = skb;
-        if (after(seq, call->rx_top)) {
-                smp_store_release(&call->rx_top, seq);
-        } else if (before(seq, call->rx_top)) {
-                /* Send an immediate ACK if we fill in a hole */
-                if (!ack) {
-                        ack = RXRPC_ACK_DELAY;
-                        ack_serial = serial;
-                }
-                immediate_ack = true;
-        }
-        if (flags & RXRPC_LAST_PACKET) {
-                set_bit(RXRPC_CALL_RX_LAST, &call->flags);
-                trace_rxrpc_receive(call, rxrpc_receive_queue_last, serial, seq);
-        } else {
-                trace_rxrpc_receive(call, rxrpc_receive_queue, serial, seq);
-        }
-        queued = true;
-        if (after_eq(seq, call->rx_expect_next)) {
+                if (call->rxtx_buffer[ix]) {
-                if (after(seq, call->rx_expect_next)) {
+                        rxrpc_input_dup_data(call, seq, sp->nr_subpackets > 1,
-                        _net("OOS %u > %u", seq, call->rx_expect_next);
+                                             &jumbo_bad);
-                        ack = RXRPC_ACK_OUT_OF_SEQUENCE;
+                        if (ack != RXRPC_ACK_DUPLICATE) {
-                        ack_serial = serial;
+                                ack = RXRPC_ACK_DUPLICATE;
+                                ack_serial = serial;
+                        }
+                        immediate_ack = true;
+                        continue;
                }
-                call->rx_expect_next = seq + 1;
-        }
-skip:
-        offset += len;
-        if (flags & RXRPC_JUMBO_PACKET) {
-                if (skb_copy_bits(skb, offset, &flags, 1) < 0) {
-                        rxrpc_proto_abort("XJF", call, seq);
-                        goto unlock;
-                }
-                offset += sizeof(struct rxrpc_jumbo_header);
-                seq++;
-                serial++;
-                annotation++;
-                if (flags & RXRPC_JUMBO_PACKET)
-                        annotation |= RXRPC_RX_ANNO_JLAST;
                if (after(seq, hard_ack + call->rx_winsize)) {
                        ack = RXRPC_ACK_EXCEEDS_WINDOW;
                        ack_serial = serial;
-                        if (!jumbo_bad) {
+                        if (flags & RXRPC_JUMBO_PACKET) {
-                                call->nr_jumbo_bad++;
+                                if (!jumbo_bad) {
-                                jumbo_bad = true;
+                                        call->nr_jumbo_bad++;
+                                        jumbo_bad = true;
+                                }
                        }
                        goto ack;
                }
-                _proto("Rx DATA Jumbo %%%u", serial);
+                if (flags & RXRPC_REQUEST_ACK && !ack) {
-                goto next_subpacket;
+                        ack = RXRPC_ACK_REQUESTED;
-        }
+                        ack_serial = serial;
+                }
+                /* Queue the packet.  We use a couple of memory barriers here as need
+                 * to make sure that rx_top is perceived to be set after the buffer
+                 * pointer and that the buffer pointer is set after the annotation and
+                 * the skb data.
+                 *
+                 * Barriers against rxrpc_recvmsg_data() and rxrpc_rotate_rx_window()
+                 * and also rxrpc_fill_out_ack().
+                 */
+                if (!terminal)
+                        rxrpc_get_skb(skb, rxrpc_skb_got);
+                call->rxtx_annotations[ix] = annotation;
+                smp_wmb();
+                call->rxtx_buffer[ix] = skb;
+                if (after(seq, call->rx_top)) {
+                        smp_store_release(&call->rx_top, seq);
+                } else if (before(seq, call->rx_top)) {
+                        /* Send an immediate ACK if we fill in a hole */
+                        if (!ack) {
+                                ack = RXRPC_ACK_DELAY;
+                                ack_serial = serial;
+                        }
+                        immediate_ack = true;
+                }
-        if (queued && flags & RXRPC_LAST_PACKET && !ack) {
+                if (terminal) {
-                ack = RXRPC_ACK_DELAY;
+                        /* From this point on, we're not allowed to touch the
-                ack_serial = serial;
+                         * packet any longer as its ref now belongs to the Rx
+                         * ring.
+                         */
+                        skb = NULL;
+                }
+                if (last) {
+                        set_bit(RXRPC_CALL_RX_LAST, &call->flags);
+                        if (!ack) {
+                                ack = RXRPC_ACK_DELAY;
+                                ack_serial = serial;
+                        }
+                        trace_rxrpc_receive(call, rxrpc_receive_queue_last, serial, seq);
+                } else {
+                        trace_rxrpc_receive(call, rxrpc_receive_queue, serial, seq);
+                }
+                if (after_eq(seq, call->rx_expect_next)) {
+                        if (after(seq, call->rx_expect_next)) {
+                                _net("OOS %u > %u", seq, call->rx_expect_next);
+                                ack = RXRPC_ACK_OUT_OF_SEQUENCE;
+                                ack_serial = serial;
+                        }
+                        call->rx_expect_next = seq + 1;
+                }
        }
 ack:
        if (ack)
-                rxrpc_propose_ACK(call, ack, skew, ack_serial,
+                rxrpc_propose_ACK(call, ack, ack_serial,
                                  immediate_ack, true,
                                  rxrpc_propose_ack_input_data);
        else
-                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, skew, serial,
+                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, serial,
                                  false, true,
                                  rxrpc_propose_ack_input_data);
-        if (sp->hdr.seq == READ_ONCE(call->rx_hard_ack) + 1) {
+        if (seq0 == READ_ONCE(call->rx_hard_ack) + 1) {
                trace_rxrpc_notify_socket(call->debug_id, serial);
                rxrpc_notify_socket(call);
        }
 unlock:
        spin_unlock(&call->input_lock);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
        _leave(" [queued]");
 }
@@ -822,8 +828,7 @@ static void rxrpc_input_soft_acks(struct rxrpc_call *call, u8 *acks,
 * soft-ACK means that the packet may be discarded and retransmission
 * requested.  A phase is complete when all packets are hard-ACK'd.
 */
-static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)
-                            u16 skew)
 {
        struct rxrpc_ack_summary summary = { 0 };
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
@@ -867,11 +872,11 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
        if (buf.ack.reason == RXRPC_ACK_PING) {
                _proto("Rx ACK %%%u PING Request", sp->hdr.serial);
                rxrpc_propose_ACK(call, RXRPC_ACK_PING_RESPONSE,
-                                  skew, sp->hdr.serial, true, true,
+                                  sp->hdr.serial, true, true,
                                  rxrpc_propose_ack_respond_to_ping);
        } else if (sp->hdr.flags & RXRPC_REQUEST_ACK) {
                rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED,
-                                  skew, sp->hdr.serial, true, true,
+                                  sp->hdr.serial, true, true,
                                  rxrpc_propose_ack_respond_to_ack);
        }
@@ -948,7 +953,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
            RXRPC_TX_ANNO_LAST &&
            summary.nr_acks == call->tx_top - hard_ack &&
            rxrpc_is_client_call(call))
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, skew, sp->hdr.serial,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, sp->hdr.serial,
                                  false, true,
                                  rxrpc_propose_ack_ping_for_lost_reply);
@@ -1004,7 +1009,7 @@ static void rxrpc_input_abort(struct rxrpc_call *call, struct sk_buff *skb)
 * Process an incoming call packet.
 */
 static void rxrpc_input_call_packet(struct rxrpc_call *call,
-                                    struct sk_buff *skb, u16 skew)
+                                    struct sk_buff *skb)
 {
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        unsigned long timo;
@@ -1023,11 +1028,11 @@ static void rxrpc_input_call_packet(struct rxrpc_call *call,
        switch (sp->hdr.type) {
        case RXRPC_PACKET_TYPE_DATA:
-                rxrpc_input_data(call, skb, skew);
+                rxrpc_input_data(call, skb);
-                break;
+                goto no_free;
        case RXRPC_PACKET_TYPE_ACK:
-                rxrpc_input_ack(call, skb, skew);
+                rxrpc_input_ack(call, skb);
                break;
        case RXRPC_PACKET_TYPE_BUSY:
@@ -1051,6 +1056,8 @@ static void rxrpc_input_call_packet(struct rxrpc_call *call,
                break;
        }
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
+no_free:
        _leave("");
 }
@@ -1108,8 +1115,12 @@ static void rxrpc_post_packet_to_local(struct rxrpc_local *local,
 {
        _enter("%p,%p", local, skb);
-        skb_queue_tail(&local->event_queue, skb);
+        if (rxrpc_get_local_maybe(local)) {
-        rxrpc_queue_local(local);
+                skb_queue_tail(&local->event_queue, skb);
+                rxrpc_queue_local(local);
+        } else {
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
+        }
 }
 /*
@@ -1119,8 +1130,12 @@ static void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb)
 {
        CHECK_SLAB_OKAY(&local->usage);
-        skb_queue_tail(&local->reject_queue, skb);
+        if (rxrpc_get_local_maybe(local)) {
-        rxrpc_queue_local(local);
+                skb_queue_tail(&local->reject_queue, skb);
+                rxrpc_queue_local(local);
+        } else {
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
+        }
 }
 /*
@@ -1173,7 +1188,6 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
        struct rxrpc_peer *peer = NULL;
        struct rxrpc_sock *rx = NULL;
        unsigned int channel;
-        int skew = 0;
        _enter("%p", udp_sk);
@@ -1184,7 +1198,7 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
        if (skb->tstamp == 0)
                skb->tstamp = ktime_get_real();
-        rxrpc_new_skb(skb, rxrpc_skb_rx_received);
+        rxrpc_new_skb(skb, rxrpc_skb_received);
        skb_pull(skb, sizeof(struct udphdr));
@@ -1201,7 +1215,7 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                static int lose;
                if ((lose++ & 7) == 7) {
                        trace_rxrpc_rx_lose(sp);
-                        rxrpc_free_skb(skb, rxrpc_skb_rx_lost);
+                        rxrpc_free_skb(skb, rxrpc_skb_lost);
                        return 0;
                }
        }
@@ -1233,9 +1247,26 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                if (sp->hdr.callNumber == 0 ||
                    sp->hdr.seq == 0)
                        goto bad_message;
-                if (sp->hdr.flags & RXRPC_JUMBO_PACKET &&
+                if (!rxrpc_validate_data(skb))
-                    !rxrpc_validate_jumbo(skb))
                        goto bad_message;
+                /* Unshare the packet so that it can be modified for in-place
+                 * decryption.
+                 */
+                if (sp->hdr.securityIndex != 0) {
+                        struct sk_buff *nskb = skb_unshare(skb, GFP_ATOMIC);
+                        if (!nskb) {
+                                rxrpc_eaten_skb(skb, rxrpc_skb_unshared_nomem);
+                                goto out;
+                        }
+                        if (nskb != skb) {
+                                rxrpc_eaten_skb(skb, rxrpc_skb_received);
+                                rxrpc_new_skb(skb, rxrpc_skb_unshared);
+                                skb = nskb;
+                                sp = rxrpc_skb(skb);
+                        }
+                }
                break;
        case RXRPC_PACKET_TYPE_CHALLENGE:
@@ -1301,15 +1332,8 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                        goto out;
                }
-                /* Note the serial number skew here */
+                if ((int)sp->hdr.serial - (int)conn->hi_serial > 0)
-                skew = (int)sp->hdr.serial - (int)conn->hi_serial;
+                        conn->hi_serial = sp->hdr.serial;
-                if (skew >= 0) {
-                        if (skew > 0)
-                                conn->hi_serial = sp->hdr.serial;
-                } else {
-                        skew = -skew;
-                        skew = min(skew, 65535);
-                }
                /* Call-bound packets are routed by connection channel. */
                channel = sp->hdr.cid & RXRPC_CHANNELMASK;
@@ -1372,15 +1396,18 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                call = rxrpc_new_incoming_call(local, rx, skb);
                if (!call)
                        goto reject_packet;
-                rxrpc_send_ping(call, skb, skew);
+                rxrpc_send_ping(call, skb);
                mutex_unlock(&call->user_mutex);
        }
-        rxrpc_input_call_packet(call, skb, skew);
+        /* Process a call packet; this either discards or passes on the ref
-        goto discard;
+         * elsewhere.
+         */
+        rxrpc_input_call_packet(call, skb);
+        goto out;
 discard:
-        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
 out:
        trace_rxrpc_rx_done(0, 0);
        return 0;
diff --git a/net/rxrpc/local_event.c b/net/rxrpc/local_event.c
index e93a78f7c05e..3ce6d628cd75 100644
--- a/net/rxrpc/local_event.c
+++ b/net/rxrpc/local_event.c
@@ -90,7 +90,7 @@ void rxrpc_process_local_events(struct rxrpc_local *local)
        if (skb) {
                struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
-                rxrpc_see_skb(skb, rxrpc_skb_rx_seen);
+                rxrpc_see_skb(skb, rxrpc_skb_seen);
                _debug("{%d},{%u}", local->debug_id, sp->hdr.type);
                switch (sp->hdr.type) {
@@ -108,7 +108,7 @@ void rxrpc_process_local_events(struct rxrpc_local *local)
                        break;
                }
-                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
        }
        _leave("");
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index b1c71bad510b..36587260cabd 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -79,6 +79,7 @@ static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
        local = kzalloc(sizeof(struct rxrpc_local), GFP_KERNEL);
        if (local) {
                atomic_set(&local->usage, 1);
+                atomic_set(&local->active_users, 1);
                local->rxnet = rxnet;
                INIT_LIST_HEAD(&local->link);
                INIT_WORK(&local->processor, rxrpc_local_processor);
@@ -92,7 +93,7 @@ static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
                local->debug_id = atomic_inc_return(&rxrpc_debug_id);
                memcpy(&local->srx, srx, sizeof(*srx));
                local->srx.srx_service = 0;
-                trace_rxrpc_local(local, rxrpc_local_new, 1, NULL);
+                trace_rxrpc_local(local->debug_id, rxrpc_local_new, 1, NULL);
        }
        _leave(" = %p", local);
@@ -266,11 +267,8 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
                 * bind the transport socket may still fail if we're attempting
                 * to use a local address that the dying object is still using.
                 */
-                if (!rxrpc_get_local_maybe(local)) {
+                if (!rxrpc_use_local(local))
-                        cursor = cursor->next;
-                        list_del_init(&local->link);
                        break;
-                }
                age = "old";
                goto found;
@@ -284,7 +282,10 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
        if (ret < 0)
                goto sock_error;
-        list_add_tail(&local->link, cursor);
+        if (cursor != &rxnet->local_endpoints)
+                list_replace_init(cursor, &local->link);
+        else
+                list_add_tail(&local->link, cursor);
        age = "new";
 found:
@@ -320,7 +321,7 @@ struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *local)
        int n;
        n = atomic_inc_return(&local->usage);
-        trace_rxrpc_local(local, rxrpc_local_got, n, here);
+        trace_rxrpc_local(local->debug_id, rxrpc_local_got, n, here);
        return local;
 }
@@ -334,7 +335,8 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
        if (local) {
                int n = atomic_fetch_add_unless(&local->usage, 1, 0);
                if (n > 0)
-                        trace_rxrpc_local(local, rxrpc_local_got, n + 1, here);
+                        trace_rxrpc_local(local->debug_id, rxrpc_local_got,
+                                          n + 1, here);
                else
                        local = NULL;
        }
@@ -342,24 +344,18 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
 }
 /*
- * Queue a local endpoint.
+ * Queue a local endpoint and pass the caller's reference to the work item.
 */
 void rxrpc_queue_local(struct rxrpc_local *local)
 {
        const void *here = __builtin_return_address(0);
+        unsigned int debug_id = local->debug_id;
+        int n = atomic_read(&local->usage);
        if (rxrpc_queue_work(&local->processor))
-                trace_rxrpc_local(local, rxrpc_local_queued,
+                trace_rxrpc_local(debug_id, rxrpc_local_queued, n, here);
-                                  atomic_read(&local->usage), here);
+        else
-}
+                rxrpc_put_local(local);
-/*
- * A local endpoint reached its end of life.
- */
-static void __rxrpc_put_local(struct rxrpc_local *local)
-{
-        _enter("%d", local->debug_id);
-        rxrpc_queue_work(&local->processor);
 }
 /*
@@ -372,10 +368,47 @@ void rxrpc_put_local(struct rxrpc_local *local)
        if (local) {
                n = atomic_dec_return(&local->usage);
-                trace_rxrpc_local(local, rxrpc_local_put, n, here);
+                trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here);
                if (n == 0)
-                        __rxrpc_put_local(local);
+                        call_rcu(&local->rcu, rxrpc_local_rcu);
+        }
+}
+/*
+ * Start using a local endpoint.
+ */
+struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *local)
+{
+        unsigned int au;
+        local = rxrpc_get_local_maybe(local);
+        if (!local)
+                return NULL;
+        au = atomic_fetch_add_unless(&local->active_users, 1, 0);
+        if (au == 0) {
+                rxrpc_put_local(local);
+                return NULL;
+        }
+        return local;
+}
+/*
+ * Cease using a local endpoint.  Once the number of active users reaches 0, we
+ * start the closure of the transport in the work processor.
+ */
+void rxrpc_unuse_local(struct rxrpc_local *local)
+{
+        unsigned int au;
+        if (local) {
+                au = atomic_dec_return(&local->active_users);
+                if (au == 0)
+                        rxrpc_queue_local(local);
+                else
+                        rxrpc_put_local(local);
        }
 }
@@ -393,21 +426,14 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
        _enter("%d", local->debug_id);
-        /* We can get a race between an incoming call packet queueing the
-         * processor again and the work processor starting the destruction
-         * process which will shut down the UDP socket.
-         */
-        if (local->dead) {
-                _leave(" [already dead]");
-                return;
-        }
        local->dead = true;
        mutex_lock(&rxnet->local_mutex);
        list_del_init(&local->link);
        mutex_unlock(&rxnet->local_mutex);
-        ASSERT(RB_EMPTY_ROOT(&local->client_conns));
+        rxrpc_clean_up_local_conns(local);
+        rxrpc_service_connection_reaper(&rxnet->service_conn_reaper);
        ASSERT(!local->service);
        if (socket) {
@@ -422,13 +448,11 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
         */
        rxrpc_purge_queue(&local->reject_queue);
        rxrpc_purge_queue(&local->event_queue);
-        _debug("rcu local %d", local->debug_id);
-        call_rcu(&local->rcu, rxrpc_local_rcu);
 }
 /*
- * Process events on an endpoint
+ * Process events on an endpoint.  The work item carries a ref which
+ * we must release.
 */
 static void rxrpc_local_processor(struct work_struct *work)
 {
@@ -436,13 +460,15 @@ static void rxrpc_local_processor(struct work_struct *work)
                container_of(work, struct rxrpc_local, processor);
        bool again;
-        trace_rxrpc_local(local, rxrpc_local_processing,
+        trace_rxrpc_local(local->debug_id, rxrpc_local_processing,
                          atomic_read(&local->usage), NULL);
        do {
                again = false;
-                if (atomic_read(&local->usage) == 0)
+                if (atomic_read(&local->active_users) == 0) {
-                        return rxrpc_local_destroyer(local);
+                        rxrpc_local_destroyer(local);
+                        break;
+                }
                if (!skb_queue_empty(&local->reject_queue)) {
                        rxrpc_reject_packets(local);
@@ -454,6 +480,8 @@ static void rxrpc_local_processor(struct work_struct *work)
                        again = true;
                }
        } while (again);
+        rxrpc_put_local(local);
 }
 /*
diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
index 948e3fe249ec..935bb60fff56 100644
--- a/net/rxrpc/output.c
+++ b/net/rxrpc/output.c
@@ -87,7 +87,7 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn,
        *_top = top;
        pkt->ack.bufferSpace    = htons(8);
-        pkt->ack.maxSkew        = htons(call->ackr_skew);
+        pkt->ack.maxSkew        = htons(0);
        pkt->ack.firstPacket    = htonl(hard_ack + 1);
        pkt->ack.previousPacket = htonl(call->ackr_prev_seq);
        pkt->ack.serial         = htonl(serial);
@@ -228,7 +228,6 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
                        if (ping)
                                clear_bit(RXRPC_CALL_PINGING, &call->flags);
                        rxrpc_propose_ACK(call, pkt->ack.reason,
-                                          ntohs(pkt->ack.maxSkew),
                                          ntohl(pkt->ack.serial),
                                          false, true,
                                          rxrpc_propose_ack_retry_tx);
@@ -566,7 +565,7 @@ void rxrpc_reject_packets(struct rxrpc_local *local)
        memset(&whdr, 0, sizeof(whdr));
        while ((skb = skb_dequeue(&local->reject_queue))) {
-                rxrpc_see_skb(skb, rxrpc_skb_rx_seen);
+                rxrpc_see_skb(skb, rxrpc_skb_seen);
                sp = rxrpc_skb(skb);
                switch (skb->mark) {
@@ -582,7 +581,7 @@ void rxrpc_reject_packets(struct rxrpc_local *local)
                        ioc = 2;
                        break;
                default:
-                        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                        rxrpc_free_skb(skb, rxrpc_skb_freed);
                        continue;
                }
@@ -607,7 +606,7 @@ void rxrpc_reject_packets(struct rxrpc_local *local)
                                                      rxrpc_tx_point_reject);
                }
-                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
        }
        _leave("");
diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
index 7666ec72d37e..c97ebdc043e4 100644
--- a/net/rxrpc/peer_event.c
+++ b/net/rxrpc/peer_event.c
@@ -163,11 +163,11 @@ void rxrpc_error_report(struct sock *sk)
                _leave("UDP socket errqueue empty");
                return;
        }
-        rxrpc_new_skb(skb, rxrpc_skb_rx_received);
+        rxrpc_new_skb(skb, rxrpc_skb_received);
        serr = SKB_EXT_ERR(skb);
        if (!skb->len && serr->ee.ee_origin == SO_EE_ORIGIN_TIMESTAMPING) {
                _leave("UDP empty message");
-                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
                return;
        }
@@ -177,7 +177,7 @@ void rxrpc_error_report(struct sock *sk)
                peer = NULL;
        if (!peer) {
                rcu_read_unlock();
-                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
                _leave(" [no peer]");
                return;
        }
@@ -189,7 +189,7 @@ void rxrpc_error_report(struct sock *sk)
             serr->ee.ee_code == ICMP_FRAG_NEEDED)) {
                rxrpc_adjust_mtu(peer, serr);
                rcu_read_unlock();
-                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
                rxrpc_put_peer(peer);
                _leave(" [MTU update]");
                return;
@@ -197,7 +197,7 @@ void rxrpc_error_report(struct sock *sk)
        rxrpc_store_error(peer, serr);
        rcu_read_unlock();
-        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
        rxrpc_put_peer(peer);
        _leave("");
diff --git a/net/rxrpc/protocol.h b/net/rxrpc/protocol.h
index 99ce322d7caa..49bb972539aa 100644
--- a/net/rxrpc/protocol.h
+++ b/net/rxrpc/protocol.h
@@ -89,6 +89,15 @@ struct rxrpc_jumbo_header {
 #define RXRPC_JUMBO_DATALEN     1412    /* non-terminal jumbo packet data length */
 #define RXRPC_JUMBO_SUBPKTLEN   (RXRPC_JUMBO_DATALEN + sizeof(struct rxrpc_jumbo_header))
+/*
+ * The maximum number of subpackets that can possibly fit in a UDP packet is:
+ *
+ *      ((max_IP - IP_hdr - UDP_hdr) / RXRPC_JUMBO_SUBPKTLEN) + 1
+ *      = ((65535 - 28 - 28) / 1416) + 1
+ *      = 46 non-terminal packets and 1 terminal packet.
+ */
+#define RXRPC_MAX_NR_JUMBO      47
 /*****************************************************************************/
 /*
 * on-the-wire Rx ACK packet data payload
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index 5abf46cf9e6c..3b0becb12041 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -141,7 +141,7 @@ static void rxrpc_end_rx_phase(struct rxrpc_call *call, rxrpc_serial_t serial)
        ASSERTCMP(call->rx_hard_ack, ==, call->rx_top);
        if (call->state == RXRPC_CALL_CLIENT_RECV_REPLY) {
-                rxrpc_propose_ACK(call, RXRPC_ACK_IDLE, 0, serial, false, true,
+                rxrpc_propose_ACK(call, RXRPC_ACK_IDLE, serial, false, true,
                                  rxrpc_propose_ack_terminal_ack);
                //rxrpc_send_ack_packet(call, false, NULL);
        }
@@ -159,7 +159,7 @@ static void rxrpc_end_rx_phase(struct rxrpc_call *call, rxrpc_serial_t serial)
                call->state = RXRPC_CALL_SERVER_ACK_REQUEST;
                call->expect_req_by = jiffies + MAX_JIFFY_OFFSET;
                write_unlock_bh(&call->state_lock);
-                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, 0, serial, false, true,
+                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, serial, false, true,
                                  rxrpc_propose_ack_processing_op);
                break;
        default:
@@ -177,7 +177,8 @@ static void rxrpc_rotate_rx_window(struct rxrpc_call *call)
        struct sk_buff *skb;
        rxrpc_serial_t serial;
        rxrpc_seq_t hard_ack, top;
-        u8 flags;
+        bool last = false;
+        u8 subpacket;
        int ix;
        _enter("%d", call->debug_id);
@@ -189,30 +190,32 @@ static void rxrpc_rotate_rx_window(struct rxrpc_call *call)
        hard_ack++;
        ix = hard_ack & RXRPC_RXTX_BUFF_MASK;
        skb = call->rxtx_buffer[ix];
-        rxrpc_see_skb(skb, rxrpc_skb_rx_rotated);
+        rxrpc_see_skb(skb, rxrpc_skb_rotated);
        sp = rxrpc_skb(skb);
-        flags = sp->hdr.flags;
-        serial = sp->hdr.serial;
+        subpacket = call->rxtx_annotations[ix] & RXRPC_RX_ANNO_SUBPACKET;
-        if (call->rxtx_annotations[ix] & RXRPC_RX_ANNO_JUMBO)
+        serial = sp->hdr.serial + subpacket;
-                serial += (call->rxtx_annotations[ix] & RXRPC_RX_ANNO_JUMBO) - 1;
+        if (subpacket == sp->nr_subpackets - 1 &&
+            sp->rx_flags & RXRPC_SKB_INCL_LAST)
+                last = true;
        call->rxtx_buffer[ix] = NULL;
        call->rxtx_annotations[ix] = 0;
        /* Barrier against rxrpc_input_data(). */
        smp_store_release(&call->rx_hard_ack, hard_ack);
-        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
-        _debug("%u,%u,%02x", hard_ack, top, flags);
        trace_rxrpc_receive(call, rxrpc_receive_rotate, serial, hard_ack);
-        if (flags & RXRPC_LAST_PACKET) {
+        if (last) {
                rxrpc_end_rx_phase(call, serial);
        } else {
                /* Check to see if there's an ACK that needs sending. */
                if (after_eq(hard_ack, call->ackr_consumed + 2) ||
                    after_eq(top, call->ackr_seen + 2) ||
                    (hard_ack == top && after(hard_ack, call->ackr_consumed)))
-                        rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, 0, serial,
+                        rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, serial,
                                          true, true,
                                          rxrpc_propose_ack_rotate_rx);
                if (call->ackr_reason && call->ackr_reason != RXRPC_ACK_DELAY)
@@ -233,18 +236,19 @@ static int rxrpc_verify_packet(struct rxrpc_call *call, struct sk_buff *skb,
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        rxrpc_seq_t seq = sp->hdr.seq;
        u16 cksum = sp->hdr.cksum;
+        u8 subpacket = annotation & RXRPC_RX_ANNO_SUBPACKET;
        _enter("");
        /* For all but the head jumbo subpacket, the security checksum is in a
         * jumbo header immediately prior to the data.
         */
-        if ((annotation & RXRPC_RX_ANNO_JUMBO) > 1) {
+        if (subpacket > 0) {
                __be16 tmp;
                if (skb_copy_bits(skb, offset - 2, &tmp, 2) < 0)
                        BUG();
                cksum = ntohs(tmp);
-                seq += (annotation & RXRPC_RX_ANNO_JUMBO) - 1;
+                seq += subpacket;
        }
        return call->conn->security->verify_packet(call, skb, offset, len,
@@ -265,19 +269,18 @@ static int rxrpc_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
                             u8 *_annotation,
                             unsigned int *_offset, unsigned int *_len)
 {
+        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        unsigned int offset = sizeof(struct rxrpc_wire_header);
        unsigned int len;
        int ret;
        u8 annotation = *_annotation;
+        u8 subpacket = annotation & RXRPC_RX_ANNO_SUBPACKET;
        /* Locate the subpacket */
+        offset += subpacket * RXRPC_JUMBO_SUBPKTLEN;
        len = skb->len - offset;
-        if ((annotation & RXRPC_RX_ANNO_JUMBO) > 0) {
+        if (subpacket < sp->nr_subpackets - 1)
-                offset += (((annotation & RXRPC_RX_ANNO_JUMBO) - 1) *
+                len = RXRPC_JUMBO_DATALEN;
-                           RXRPC_JUMBO_SUBPKTLEN);
-                len = (annotation & RXRPC_RX_ANNO_JLAST) ?
-                        skb->len - offset : RXRPC_JUMBO_SUBPKTLEN;
-        }
        if (!(annotation & RXRPC_RX_ANNO_VERIFIED)) {
                ret = rxrpc_verify_packet(call, skb, annotation, offset, len);
@@ -303,6 +306,7 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
 {
        struct rxrpc_skb_priv *sp;
        struct sk_buff *skb;
+        rxrpc_serial_t serial;
        rxrpc_seq_t hard_ack, top, seq;
        size_t remain;
        bool last;
@@ -336,12 +340,15 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
                        break;
                }
                smp_rmb();
-                rxrpc_see_skb(skb, rxrpc_skb_rx_seen);
+                rxrpc_see_skb(skb, rxrpc_skb_seen);
                sp = rxrpc_skb(skb);
-                if (!(flags & MSG_PEEK))
+                if (!(flags & MSG_PEEK)) {
+                        serial = sp->hdr.serial;
+                        serial += call->rxtx_annotations[ix] & RXRPC_RX_ANNO_SUBPACKET;
                        trace_rxrpc_receive(call, rxrpc_receive_front,
-                                            sp->hdr.serial, seq);
+                                            serial, seq);
+                }
                if (msg)
                        sock_recv_timestamp(msg, sock->sk, skb);
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index ae8cd8926456..c60c520fde7c 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -187,10 +187,8 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
        struct rxrpc_skb_priv *sp;
        struct rxrpc_crypt iv;
        struct scatterlist sg[16];
-        struct sk_buff *trailer;
        unsigned int len;
        u16 check;
-        int nsg;
        int err;
        sp = rxrpc_skb(skb);
@@ -214,15 +212,14 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
        crypto_skcipher_encrypt(req);
        /* we want to encrypt the skbuff in-place */
-        nsg = skb_cow_data(skb, 0, &trailer);
+        err = -EMSGSIZE;
-        err = -ENOMEM;
+        if (skb_shinfo(skb)->nr_frags > 16)
-        if (nsg < 0 || nsg > 16)
                goto out;
        len = data_size + call->conn->size_align - 1;
        len &= ~(call->conn->size_align - 1);
-        sg_init_table(sg, nsg);
+        sg_init_table(sg, ARRAY_SIZE(sg));
        err = skb_to_sgvec(skb, sg, 0, len);
        if (unlikely(err < 0))
                goto out;
@@ -319,11 +316,10 @@ static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
        struct rxkad_level1_hdr sechdr;
        struct rxrpc_crypt iv;
        struct scatterlist sg[16];
-        struct sk_buff *trailer;
        bool aborted;
        u32 data_size, buf;
        u16 check;
-        int nsg, ret;
+        int ret;
        _enter("");
@@ -336,11 +332,7 @@ static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
        /* Decrypt the skbuff in-place.  TODO: We really want to decrypt
         * directly into the target buffer.
         */
-        nsg = skb_cow_data(skb, 0, &trailer);
+        sg_init_table(sg, ARRAY_SIZE(sg));
-        if (nsg < 0 || nsg > 16)
-                goto nomem;
-        sg_init_table(sg, nsg);
        ret = skb_to_sgvec(skb, sg, offset, 8);
        if (unlikely(ret < 0))
                return ret;
@@ -388,10 +380,6 @@ protocol_error:
        if (aborted)
                rxrpc_send_abort_packet(call);
        return -EPROTO;
-nomem:
-        _leave(" = -ENOMEM");
-        return -ENOMEM;
 }
 /*
@@ -406,7 +394,6 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
        struct rxkad_level2_hdr sechdr;
        struct rxrpc_crypt iv;
        struct scatterlist _sg[4], *sg;
-        struct sk_buff *trailer;
        bool aborted;
        u32 data_size, buf;
        u16 check;
@@ -423,12 +410,11 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
        /* Decrypt the skbuff in-place.  TODO: We really want to decrypt
         * directly into the target buffer.
         */
-        nsg = skb_cow_data(skb, 0, &trailer);
-        if (nsg < 0)
-                goto nomem;
        sg = _sg;
-        if (unlikely(nsg > 4)) {
+        nsg = skb_shinfo(skb)->nr_frags;
+        if (nsg <= 4) {
+                nsg = 4;
+        } else {
                sg = kmalloc_array(nsg, sizeof(*sg), GFP_NOIO);
                if (!sg)
                        goto nomem;
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index bae14438f869..6a1547b270fe 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -176,7 +176,7 @@ static int rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
        skb->tstamp = ktime_get_real();
        ix = seq & RXRPC_RXTX_BUFF_MASK;
-        rxrpc_get_skb(skb, rxrpc_skb_tx_got);
+        rxrpc_get_skb(skb, rxrpc_skb_got);
        call->rxtx_annotations[ix] = annotation;
        smp_wmb();
        call->rxtx_buffer[ix] = skb;
@@ -248,7 +248,7 @@ static int rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
        }
 out:
-        rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
        _leave(" = %d", ret);
        return ret;
 }
@@ -289,7 +289,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
        skb = call->tx_pending;
        call->tx_pending = NULL;
-        rxrpc_see_skb(skb, rxrpc_skb_tx_seen);
+        rxrpc_see_skb(skb, rxrpc_skb_seen);
        copied = 0;
        do {
@@ -336,7 +336,9 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
                        if (!skb)
                                goto maybe_error;
-                        rxrpc_new_skb(skb, rxrpc_skb_tx_new);
+                        sp = rxrpc_skb(skb);
+                        sp->rx_flags |= RXRPC_SKB_TX_BUFFER;
+                        rxrpc_new_skb(skb, rxrpc_skb_new);
                        _debug("ALLOC SEND %p", skb);
@@ -346,7 +348,6 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
                        skb_reserve(skb, call->conn->security_size);
                        skb->len += call->conn->security_size;
-                        sp = rxrpc_skb(skb);
                        sp->remain = chunk;
                        if (sp->remain > skb_tailroom(skb))
                                sp->remain = skb_tailroom(skb);
@@ -439,7 +440,7 @@ out:
        return ret;
 call_terminated:
-        rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
        _leave(" = %d", call->error);
        return call->error;
diff --git a/net/rxrpc/skbuff.c b/net/rxrpc/skbuff.c
index 9ad5045b7c2f..0348d2bf6f7d 100644
--- a/net/rxrpc/skbuff.c
+++ b/net/rxrpc/skbuff.c
@@ -14,7 +14,8 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
-#define select_skb_count(op) (op >= rxrpc_skb_tx_cleaned ? &rxrpc_n_tx_skbs : &rxrpc_n_rx_skbs)
+#define is_tx_skb(skb) (rxrpc_skb(skb)->rx_flags & RXRPC_SKB_TX_BUFFER)
+#define select_skb_count(skb) (is_tx_skb(skb) ? &rxrpc_n_tx_skbs : &rxrpc_n_rx_skbs)
 /*
 * Note the allocation or reception of a socket buffer.
@@ -22,8 +23,9 @@
 void rxrpc_new_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
 {
        const void *here = __builtin_return_address(0);
-        int n = atomic_inc_return(select_skb_count(op));
+        int n = atomic_inc_return(select_skb_count(skb));
-        trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n, here);
+        trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n,
+                        rxrpc_skb(skb)->rx_flags, here);
 }
 /*
@@ -33,8 +35,9 @@ void rxrpc_see_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
 {
        const void *here = __builtin_return_address(0);
        if (skb) {
-                int n = atomic_read(select_skb_count(op));
+                int n = atomic_read(select_skb_count(skb));
-                trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n, here);
+                trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n,
+                                rxrpc_skb(skb)->rx_flags, here);
        }
 }
@@ -44,12 +47,23 @@ void rxrpc_see_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
 void rxrpc_get_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
 {
        const void *here = __builtin_return_address(0);
-        int n = atomic_inc_return(select_skb_count(op));
+        int n = atomic_inc_return(select_skb_count(skb));
-        trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n, here);
+        trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n,
+                        rxrpc_skb(skb)->rx_flags, here);
        skb_get(skb);
 }
 /*
+ * Note the dropping of a ref on a socket buffer by the core.
+ */
+void rxrpc_eaten_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
+{
+        const void *here = __builtin_return_address(0);
+        int n = atomic_inc_return(&rxrpc_n_rx_skbs);
+        trace_rxrpc_skb(skb, op, 0, n, 0, here);
+}
+/*
 * Note the destruction of a socket buffer.
 */
 void rxrpc_free_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
@@ -58,8 +72,9 @@ void rxrpc_free_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
        if (skb) {
                int n;
                CHECK_SLAB_OKAY(&skb->users);
-                n = atomic_dec_return(select_skb_count(op));
+                n = atomic_dec_return(select_skb_count(skb));
-                trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n, here);
+                trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n,
+                                rxrpc_skb(skb)->rx_flags, here);
                kfree_skb(skb);
        }
 }
@@ -72,9 +87,10 @@ void rxrpc_purge_queue(struct sk_buff_head *list)
        const void *here = __builtin_return_address(0);
        struct sk_buff *skb;
        while ((skb = skb_dequeue((list))) != NULL) {
-                int n = atomic_dec_return(select_skb_count(rxrpc_skb_rx_purged));
+                int n = atomic_dec_return(select_skb_count(skb));
-                trace_rxrpc_skb(skb, rxrpc_skb_rx_purged,
+                trace_rxrpc_skb(skb, rxrpc_skb_purged,
-                                refcount_read(&skb->users), n, here);
+                                refcount_read(&skb->users), n,
+                                rxrpc_skb(skb)->rx_flags, here);
                kfree_skb(skb);
        }
 }
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index fd1f7e799e23..04b7bd4ec751 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -422,7 +422,7 @@ static __net_init int bpf_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, bpf_net_id);
-        return tc_action_net_init(tn, &act_bpf_ops);
+        return tc_action_net_init(net, tn, &act_bpf_ops);
 }
 static void __net_exit bpf_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index 32ac04d77a45..2b43cacf82af 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -231,7 +231,7 @@ static __net_init int connmark_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, connmark_net_id);
-        return tc_action_net_init(tn, &act_connmark_ops);
+        return tc_action_net_init(net, tn, &act_connmark_ops);
 }
 static void __net_exit connmark_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 9b9288267a54..d3cfad88dc3a 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -714,7 +714,7 @@ static __net_init int csum_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, csum_net_id);
-        return tc_action_net_init(tn, &act_csum_ops);
+        return tc_action_net_init(net, tn, &act_csum_ops);
 }
 static void __net_exit csum_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index 33a1a7406e87..cdd6f3818097 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -939,7 +939,7 @@ static __net_init int ct_init_net(struct net *net)
                tn->labels = true;
        }
-        return tc_action_net_init(&tn->tn, &act_ct_ops);
+        return tc_action_net_init(net, &tn->tn, &act_ct_ops);
 }
 static void __net_exit ct_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_ctinfo.c b/net/sched/act_ctinfo.c
index 06ef74b74911..0dbcfd1dca7b 100644
--- a/net/sched/act_ctinfo.c
+++ b/net/sched/act_ctinfo.c
@@ -376,7 +376,7 @@ static __net_init int ctinfo_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
-        return tc_action_net_init(tn, &act_ctinfo_ops);
+        return tc_action_net_init(net, tn, &act_ctinfo_ops);
 }
 static void __net_exit ctinfo_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index 8f0140c6ca58..324f1d1f6d47 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -278,7 +278,7 @@ static __net_init int gact_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, gact_net_id);
-        return tc_action_net_init(tn, &act_gact_ops);
+        return tc_action_net_init(net, tn, &act_gact_ops);
 }
 static void __net_exit gact_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 92ee853d43e6..3a31e241c647 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -890,7 +890,7 @@ static __net_init int ife_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, ife_net_id);
-        return tc_action_net_init(tn, &act_ife_ops);
+        return tc_action_net_init(net, tn, &act_ife_ops);
 }
 static void __net_exit ife_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index ce2c30a591d2..214a03d405cf 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -61,12 +61,13 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
        return 0;
 }
-static void ipt_destroy_target(struct xt_entry_target *t)
+static void ipt_destroy_target(struct xt_entry_target *t, struct net *net)
 {
        struct xt_tgdtor_param par = {
                .target   = t->u.kernel.target,
                .targinfo = t->data,
                .family   = NFPROTO_IPV4,
+                .net      = net,
        };
        if (par.target->destroy != NULL)
                par.target->destroy(&par);
@@ -78,7 +79,7 @@ static void tcf_ipt_release(struct tc_action *a)
        struct tcf_ipt *ipt = to_ipt(a);
        if (ipt->tcfi_t) {
-                ipt_destroy_target(ipt->tcfi_t);
+                ipt_destroy_target(ipt->tcfi_t, a->idrinfo->net);
                kfree(ipt->tcfi_t);
        }
        kfree(ipt->tcfi_tname);
@@ -180,7 +181,7 @@ static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla,
        spin_lock_bh(&ipt->tcf_lock);
        if (ret != ACT_P_CREATED) {
-                ipt_destroy_target(ipt->tcfi_t);
+                ipt_destroy_target(ipt->tcfi_t, net);
                kfree(ipt->tcfi_tname);
                kfree(ipt->tcfi_t);
        }
@@ -350,7 +351,7 @@ static __net_init int ipt_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, ipt_net_id);
-        return tc_action_net_init(tn, &act_ipt_ops);
+        return tc_action_net_init(net, tn, &act_ipt_ops);
 }
 static void __net_exit ipt_exit_net(struct list_head *net_list)
@@ -399,7 +400,7 @@ static __net_init int xt_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, xt_net_id);
-        return tc_action_net_init(tn, &act_xt_ops);
+        return tc_action_net_init(net, tn, &act_xt_ops);
 }
 static void __net_exit xt_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index be3f88dfc37e..9d1bf508075a 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -453,7 +453,7 @@ static __net_init int mirred_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, mirred_net_id);
-        return tc_action_net_init(tn, &act_mirred_ops);
+        return tc_action_net_init(net, tn, &act_mirred_ops);
 }
 static void __net_exit mirred_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_mpls.c b/net/sched/act_mpls.c
index 0f299e3b618c..e168df0e008a 100644
--- a/net/sched/act_mpls.c
+++ b/net/sched/act_mpls.c
@@ -375,7 +375,7 @@ static __net_init int mpls_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, mpls_net_id);
-        return tc_action_net_init(tn, &act_mpls_ops);
+        return tc_action_net_init(net, tn, &act_mpls_ops);
 }
 static void __net_exit mpls_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 7b858c11b1b5..ea4c5359e7df 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -327,7 +327,7 @@ static __net_init int nat_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, nat_net_id);
-        return tc_action_net_init(tn, &act_nat_ops);
+        return tc_action_net_init(net, tn, &act_nat_ops);
 }
 static void __net_exit nat_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 17360c6faeaa..cdfaa79382a2 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -498,7 +498,7 @@ static __net_init int pedit_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, pedit_net_id);
-        return tc_action_net_init(tn, &act_pedit_ops);
+        return tc_action_net_init(net, tn, &act_pedit_ops);
 }
 static void __net_exit pedit_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 49cec3e64a4d..6315e0f8d26e 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -371,7 +371,7 @@ static __net_init int police_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, police_net_id);
-        return tc_action_net_init(tn, &act_police_ops);
+        return tc_action_net_init(net, tn, &act_police_ops);
 }
 static void __net_exit police_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 595308d60133..10229124a992 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -102,13 +102,17 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
        goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
        s->rate = rate;
        s->psample_group_num = psample_group_num;
-        RCU_INIT_POINTER(s->psample_group, psample_group);
+        rcu_swap_protected(s->psample_group, psample_group,
+                           lockdep_is_held(&s->tcf_lock));
        if (tb[TCA_SAMPLE_TRUNC_SIZE]) {
                s->truncate = true;
                s->trunc_size = nla_get_u32(tb[TCA_SAMPLE_TRUNC_SIZE]);
        }
        spin_unlock_bh(&s->tcf_lock);
+        if (psample_group)
+                psample_group_put(psample_group);
        if (goto_ch)
                tcf_chain_put_by_act(goto_ch);
@@ -265,7 +269,7 @@ static __net_init int sample_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, sample_net_id);
-        return tc_action_net_init(tn, &act_sample_ops);
+        return tc_action_net_init(net, tn, &act_sample_ops);
 }
 static void __net_exit sample_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 33aefa25b545..6120e56117ca 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -232,7 +232,7 @@ static __net_init int simp_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, simp_net_id);
-        return tc_action_net_init(tn, &act_simp_ops);
+        return tc_action_net_init(net, tn, &act_simp_ops);
 }
 static void __net_exit simp_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index b100870f02a6..6a8d3337c577 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -307,6 +307,17 @@ static int tcf_skbedit_search(struct net *net, struct tc_action **a, u32 index)
        return tcf_idr_search(tn, a, index);
 }
+static size_t tcf_skbedit_get_fill_size(const struct tc_action *act)
+{
+        return nla_total_size(sizeof(struct tc_skbedit))
+                + nla_total_size(sizeof(u32)) /* TCA_SKBEDIT_PRIORITY */
+                + nla_total_size(sizeof(u16)) /* TCA_SKBEDIT_QUEUE_MAPPING */
+                + nla_total_size(sizeof(u32)) /* TCA_SKBEDIT_MARK */
+                + nla_total_size(sizeof(u16)) /* TCA_SKBEDIT_PTYPE */
+                + nla_total_size(sizeof(u32)) /* TCA_SKBEDIT_MASK */
+                + nla_total_size_64bit(sizeof(u64)); /* TCA_SKBEDIT_FLAGS */
+}
 static struct tc_action_ops act_skbedit_ops = {
        .kind           =       "skbedit",
        .id             =       TCA_ID_SKBEDIT,
@@ -316,6 +327,7 @@ static struct tc_action_ops act_skbedit_ops = {
        .init           =       tcf_skbedit_init,
        .cleanup        =       tcf_skbedit_cleanup,
        .walk           =       tcf_skbedit_walker,
+        .get_fill_size  =       tcf_skbedit_get_fill_size,
        .lookup         =       tcf_skbedit_search,
        .size           =       sizeof(struct tcf_skbedit),
 };
@@ -324,7 +336,7 @@ static __net_init int skbedit_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, skbedit_net_id);
-        return tc_action_net_init(tn, &act_skbedit_ops);
+        return tc_action_net_init(net, tn, &act_skbedit_ops);
 }
 static void __net_exit skbedit_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index 7da3518e18ef..888437f97ba6 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -287,7 +287,7 @@ static __net_init int skbmod_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, skbmod_net_id);
-        return tc_action_net_init(tn, &act_skbmod_ops);
+        return tc_action_net_init(net, tn, &act_skbmod_ops);
 }
 static void __net_exit skbmod_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 6d0debdc9b97..2f83a79f76aa 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -600,7 +600,7 @@ static __net_init int tunnel_key_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
-        return tc_action_net_init(tn, &act_tunnel_key_ops);
+        return tc_action_net_init(net, tn, &act_tunnel_key_ops);
 }
 static void __net_exit tunnel_key_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index a3c9eea1ee8a..287a30bf8930 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -334,7 +334,7 @@ static __net_init int vlan_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, vlan_net_id);
-        return tc_action_net_init(tn, &act_vlan_ops);
+        return tc_action_net_init(net, tn, &act_vlan_ops);
 }
 static void __net_exit vlan_exit_net(struct list_head *net_list)
diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
index 732e109c3055..810645b5c086 100644
--- a/net/sched/sch_cbs.c
+++ b/net/sched/sch_cbs.c
@@ -181,11 +181,6 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
        s64 credits;
        int len;
-        if (atomic64_read(&q->port_rate) == -1) {
-                WARN_ONCE(1, "cbs: dequeue() called with unknown port rate.");
-                return NULL;
-        }
        if (q->credits < 0) {
                credits = timediff_to_credits(now - q->last, q->idleslope);
@@ -303,11 +298,19 @@ static int cbs_enable_offload(struct net_device *dev, struct cbs_sched_data *q,
 static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
 {
        struct ethtool_link_ksettings ecmd;
+        int speed = SPEED_10;
        int port_rate = -1;
+        int err;
+        err = __ethtool_get_link_ksettings(dev, &ecmd);
+        if (err < 0)
+                goto skip;
+        if (ecmd.base.speed != SPEED_UNKNOWN)
+                speed = ecmd.base.speed;
-        if (!__ethtool_get_link_ksettings(dev, &ecmd) &&
+skip:
-            ecmd.base.speed != SPEED_UNKNOWN)
+        port_rate = speed * 1000 * BYTES_PER_KBIT;
-                port_rate = ecmd.base.speed * 1000 * BYTES_PER_KBIT;
        atomic64_set(&q->port_rate, port_rate);
        netdev_dbg(dev, "cbs: set %s's port_rate to: %lld, linkspeed: %d\n",
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 11c03cf4aa74..137db1cbde85 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -624,8 +624,12 @@ static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc *qdisc,
        err = skb_array_produce(q, skb);
-        if (unlikely(err))
+        if (unlikely(err)) {
-                return qdisc_drop_cpu(skb, qdisc, to_free);
+                if (qdisc_is_percpu_stats(qdisc))
+                        return qdisc_drop_cpu(skb, qdisc, to_free);
+                else
+                        return qdisc_drop(skb, qdisc, to_free);
+        }
        qdisc_update_stats_at_enqueue(qdisc, pkt_len);
        return NET_XMIT_SUCCESS;
@@ -688,11 +692,14 @@ static void pfifo_fast_reset(struct Qdisc *qdisc)
                        kfree_skb(skb);
        }
-        for_each_possible_cpu(i) {
+        if (qdisc_is_percpu_stats(qdisc)) {
-                struct gnet_stats_queue *q = per_cpu_ptr(qdisc->cpu_qstats, i);
+                for_each_possible_cpu(i) {
+                        struct gnet_stats_queue *q;
-                q->backlog = 0;
+                        q = per_cpu_ptr(qdisc->cpu_qstats, i);
-                q->qlen = 0;
+                        q->backlog = 0;
+                        q->qlen = 0;
+                }
        }
 }
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index c39db507ba3f..8d8bc2ec5cd6 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -477,11 +477,6 @@ static struct sk_buff *taprio_dequeue(struct Qdisc *sch)
        u32 gate_mask;
        int i;
-        if (atomic64_read(&q->picos_per_byte) == -1) {
-                WARN_ONCE(1, "taprio: dequeue() called with unknown picos per byte.");
-                return NULL;
-        }
        rcu_read_lock();
        entry = rcu_dereference(q->current_entry);
        /* if there's no entry, it means that the schedule didn't
@@ -958,12 +953,20 @@ static void taprio_set_picos_per_byte(struct net_device *dev,
                                      struct taprio_sched *q)
 {
        struct ethtool_link_ksettings ecmd;
-        int picos_per_byte = -1;
+        int speed = SPEED_10;
+        int picos_per_byte;
+        int err;
-        if (!__ethtool_get_link_ksettings(dev, &ecmd) &&
+        err = __ethtool_get_link_ksettings(dev, &ecmd);
-            ecmd.base.speed != SPEED_UNKNOWN)
+        if (err < 0)
-                picos_per_byte = div64_s64(NSEC_PER_SEC * 1000LL * 8,
+                goto skip;
-                                           ecmd.base.speed * 1000 * 1000);
+        if (ecmd.base.speed != SPEED_UNKNOWN)
+                speed = ecmd.base.speed;
+skip:
+        picos_per_byte = div64_s64(NSEC_PER_SEC * 1000LL * 8,
+                                   speed * 1000 * 1000);
        atomic64_set(&q->picos_per_byte, picos_per_byte);
        netdev_dbg(dev, "taprio: set %s's picos_per_byte to: %lld, linkspeed: %d\n",
@@ -1195,7 +1198,8 @@ unlock:
        spin_unlock_bh(qdisc_lock(sch));
 free_sched:
-        kfree(new_admin);
+        if (new_admin)
+                call_rcu(&new_admin->rcu, taprio_free_sched_cb);
        return err;
 }
@@ -1248,6 +1252,10 @@ static int taprio_init(struct Qdisc *sch, struct nlattr *opt,
         */
        q->clockid = -1;
+        spin_lock(&taprio_list_lock);
+        list_add(&q->taprio_list, &taprio_list);
+        spin_unlock(&taprio_list_lock);
        if (sch->parent != TC_H_ROOT)
                return -EOPNOTSUPP;
@@ -1265,10 +1273,6 @@ static int taprio_init(struct Qdisc *sch, struct nlattr *opt,
        if (!opt)
                return -EINVAL;
-        spin_lock(&taprio_list_lock);
-        list_add(&q->taprio_list, &taprio_list);
-        spin_unlock(&taprio_list_lock);
        for (i = 0; i < dev->num_tx_queues; i++) {
                struct netdev_queue *dev_queue;
                struct Qdisc *qdisc;
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index a554d6d15d1b..1cf5bb5b73c4 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -546,7 +546,7 @@ static void sctp_do_8_2_transport_strike(struct sctp_cmd_seq *commands,
         */
        if (net->sctp.pf_enable &&
           (transport->state == SCTP_ACTIVE) &&
-           (asoc->pf_retrans < transport->pathmaxrxt) &&
+           (transport->error_count < transport->pathmaxrxt) &&
           (transport->error_count > asoc->pf_retrans)) {
                sctp_assoc_control_transport(asoc, transport,
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 25946604af85..e83cdaa2ab76 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -316,6 +316,7 @@ int sctp_send_reset_streams(struct sctp_association *asoc,
                nstr_list[i] = htons(str_list[i]);
        if (out && !sctp_stream_outq_is_empty(stream, str_nums, nstr_list)) {
+                kfree(nstr_list);
                retval = -EAGAIN;
                goto out;
        }
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index f0de323d15d6..6c8f09c1ce51 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -76,13 +76,11 @@ static int smc_tx_wait(struct smc_sock *smc, int flags)
        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        struct smc_connection *conn = &smc->conn;
        struct sock *sk = &smc->sk;
-        bool noblock;
        long timeo;
        int rc = 0;
        /* similar to sk_stream_wait_memory */
        timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
-        noblock = timeo ? false : true;
        add_wait_queue(sk_sleep(sk), &wait);
        while (1) {
                sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
@@ -97,8 +95,8 @@ static int smc_tx_wait(struct smc_sock *smc, int flags)
                        break;
                }
                if (!timeo) {
-                        if (noblock)
+                        /* ensure EPOLLOUT is subsequently generated */
-                                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+                        set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
                        rc = -EAGAIN;
                        break;
                }
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index d8679b6027e9..a07b516e503a 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1970,6 +1970,7 @@ call_bind(struct rpc_task *task)
 static void
 call_bind_status(struct rpc_task *task)
 {
+        struct rpc_xprt *xprt = task->tk_rqstp->rq_xprt;
        int status = -EIO;
        if (rpc_task_transmitted(task)) {
@@ -1977,14 +1978,15 @@ call_bind_status(struct rpc_task *task)
                return;
        }
-        if (task->tk_status >= 0) {
+        dprint_status(task);
-                dprint_status(task);
+        trace_rpc_bind_status(task);
+        if (task->tk_status >= 0)
+                goto out_next;
+        if (xprt_bound(xprt)) {
                task->tk_status = 0;
-                task->tk_action = call_connect;
+                goto out_next;
-                return;
        }
-        trace_rpc_bind_status(task);
        switch (task->tk_status) {
        case -ENOMEM:
                dprintk("RPC: %5u rpcbind out of memory\n", task->tk_pid);
@@ -2003,6 +2005,9 @@ call_bind_status(struct rpc_task *task)
                task->tk_rebind_retry--;
                rpc_delay(task, 3*HZ);
                goto retry_timeout;
+        case -ENOBUFS:
+                rpc_delay(task, HZ >> 2);
+                goto retry_timeout;
        case -EAGAIN:
                goto retry_timeout;
        case -ETIMEDOUT:
@@ -2026,7 +2031,6 @@ call_bind_status(struct rpc_task *task)
        case -ENETDOWN:
        case -EHOSTUNREACH:
        case -ENETUNREACH:
-        case -ENOBUFS:
        case -EPIPE:
                dprintk("RPC: %5u remote rpcbind unreachable: %d\n",
                                task->tk_pid, task->tk_status);
@@ -2043,7 +2047,9 @@ call_bind_status(struct rpc_task *task)
        rpc_call_rpcerror(task, status);
        return;
+out_next:
+        task->tk_action = call_connect;
+        return;
 retry_timeout:
        task->tk_status = 0;
        task->tk_action = call_bind;
@@ -2090,6 +2096,7 @@ call_connect(struct rpc_task *task)
 static void
 call_connect_status(struct rpc_task *task)
 {
+        struct rpc_xprt *xprt = task->tk_rqstp->rq_xprt;
        struct rpc_clnt *clnt = task->tk_client;
        int status = task->tk_status;
@@ -2099,8 +2106,17 @@ call_connect_status(struct rpc_task *task)
        }
        dprint_status(task);
        trace_rpc_connect_status(task);
+        if (task->tk_status == 0) {
+                clnt->cl_stats->netreconn++;
+                goto out_next;
+        }
+        if (xprt_connected(xprt)) {
+                task->tk_status = 0;
+                goto out_next;
+        }
        task->tk_status = 0;
        switch (status) {
        case -ECONNREFUSED:
@@ -2117,8 +2133,6 @@ call_connect_status(struct rpc_task *task)
        case -ENETDOWN:
        case -ENETUNREACH:
        case -EHOSTUNREACH:
-        case -EADDRINUSE:
-        case -ENOBUFS:
        case -EPIPE:
                xprt_conditional_disconnect(task->tk_rqstp->rq_xprt,
                                            task->tk_rqstp->rq_connect_cookie);
@@ -2127,17 +2141,20 @@ call_connect_status(struct rpc_task *task)
                /* retry with existing socket, after a delay */
                rpc_delay(task, 3*HZ);
                /* fall through */
+        case -EADDRINUSE:
        case -ENOTCONN:
        case -EAGAIN:
        case -ETIMEDOUT:
                goto out_retry;
-        case 0:
+        case -ENOBUFS:
-                clnt->cl_stats->netreconn++;
+                rpc_delay(task, HZ >> 2);
-                task->tk_action = call_transmit;
+                goto out_retry;
-                return;
        }
        rpc_call_rpcerror(task, status);
        return;
+out_next:
+        task->tk_action = call_transmit;
+        return;
 out_retry:
        /* Check for timeouts before looping back to call_bind */
        task->tk_action = call_bind;
@@ -2365,7 +2382,7 @@ call_status(struct rpc_task *task)
        case -ECONNABORTED:
        case -ENOTCONN:
                rpc_force_rebind(clnt);
-                /* fall through */
+                break;
        case -EADDRINUSE:
                rpc_delay(task, 3*HZ);
                /* fall through */
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 783748dc5e6f..2e71f5455c6c 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1408,13 +1408,6 @@ xprt_request_transmit(struct rpc_rqst *req, struct rpc_task *snd_task)
                        status = -EBADMSG;
                        goto out_dequeue;
                }
-                if (task->tk_ops->rpc_call_prepare_transmit) {
-                        task->tk_ops->rpc_call_prepare_transmit(task,
-                                        task->tk_calldata);
-                        status = task->tk_status;
-                        if (status < 0)
-                                goto out_dequeue;
-                }
                if (RPC_SIGNALLED(task)) {
                        status = -ERESTARTSYS;
                        goto out_dequeue;
diff --git a/net/tipc/addr.c b/net/tipc/addr.c
index b88d48d00913..0f1eaed1bd1b 100644
--- a/net/tipc/addr.c
+++ b/net/tipc/addr.c
@@ -75,6 +75,7 @@ void tipc_set_node_addr(struct net *net, u32 addr)
                tipc_set_node_id(net, node_id);
        }
        tn->trial_addr = addr;
+        tn->addr_trial_end = jiffies;
        pr_info("32-bit node address hash set to %x\n", addr);
 }
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 66d3a07bc571..c2c5c53cad22 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -106,8 +106,6 @@ struct tipc_stats {
 * @transmitq: queue for sent, non-acked messages
 * @backlogq: queue for messages waiting to be sent
 * @snt_nxt: next sequence number to use for outbound messages
- * @prev_from: sequence number of most previous retransmission request
- * @stale_limit: time when repeated identical retransmits must force link reset
 * @ackers: # of peers that needs to ack each packet before it can be released
 * @acked: # last packet acked by a certain peer. Used for broadcast.
 * @rcv_nxt: next sequence number to expect for inbound messages
@@ -164,9 +162,7 @@ struct tipc_link {
                u16 limit;
        } backlog[5];
        u16 snd_nxt;
-        u16 prev_from;
        u16 window;
-        unsigned long stale_limit;
        /* Reception */
        u16 rcv_nxt;
@@ -1044,47 +1040,53 @@ static void tipc_link_advance_backlog(struct tipc_link *l,
 * link_retransmit_failure() - Detect repeated retransmit failures
 * @l: tipc link sender
 * @r: tipc link receiver (= l in case of unicast)
- * @from: seqno of the 1st packet in retransmit request
 * @rc: returned code
 *
 * Return: true if the repeated retransmit failures happens, otherwise
 * false
 */
 static bool link_retransmit_failure(struct tipc_link *l, struct tipc_link *r,
-                                    u16 from, int *rc)
+                                    int *rc)
 {
        struct sk_buff *skb = skb_peek(&l->transmq);
        struct tipc_msg *hdr;
        if (!skb)
                return false;
-        hdr = buf_msg(skb);
-        /* Detect repeated retransmit failures on same packet */
+        if (!TIPC_SKB_CB(skb)->retr_cnt)
-        if (r->prev_from != from) {
+                return false;
-                r->prev_from = from;
-                r->stale_limit = jiffies + msecs_to_jiffies(r->tolerance);
-        } else if (time_after(jiffies, r->stale_limit)) {
-                pr_warn("Retransmission failure on link <%s>\n", l->name);
-                link_print(l, "State of link ");
-                pr_info("Failed msg: usr %u, typ %u, len %u, err %u\n",
-                        msg_user(hdr), msg_type(hdr), msg_size(hdr),
-                        msg_errcode(hdr));
-                pr_info("sqno %u, prev: %x, src: %x\n",
-                        msg_seqno(hdr), msg_prevnode(hdr), msg_orignode(hdr));
-                trace_tipc_list_dump(&l->transmq, true, "retrans failure!");
-                trace_tipc_link_dump(l, TIPC_DUMP_NONE, "retrans failure!");
-                trace_tipc_link_dump(r, TIPC_DUMP_NONE, "retrans failure!");
-                if (link_is_bc_sndlink(l))
+        if (!time_after(jiffies, TIPC_SKB_CB(skb)->retr_stamp +
-                        *rc = TIPC_LINK_DOWN_EVT;
+                        msecs_to_jiffies(r->tolerance)))
+                return false;
+        hdr = buf_msg(skb);
+        if (link_is_bc_sndlink(l) && !less(r->acked, msg_seqno(hdr)))
+                return false;
+        pr_warn("Retransmission failure on link <%s>\n", l->name);
+        link_print(l, "State of link ");
+        pr_info("Failed msg: usr %u, typ %u, len %u, err %u\n",
+                msg_user(hdr), msg_type(hdr), msg_size(hdr), msg_errcode(hdr));
+        pr_info("sqno %u, prev: %x, dest: %x\n",
+                msg_seqno(hdr), msg_prevnode(hdr), msg_destnode(hdr));
+        pr_info("retr_stamp %d, retr_cnt %d\n",
+                jiffies_to_msecs(TIPC_SKB_CB(skb)->retr_stamp),
+                TIPC_SKB_CB(skb)->retr_cnt);
+        trace_tipc_list_dump(&l->transmq, true, "retrans failure!");
+        trace_tipc_link_dump(l, TIPC_DUMP_NONE, "retrans failure!");
+        trace_tipc_link_dump(r, TIPC_DUMP_NONE, "retrans failure!");
+        if (link_is_bc_sndlink(l)) {
+                r->state = LINK_RESET;
+                *rc = TIPC_LINK_DOWN_EVT;
+        } else {
                *rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
-                return true;
        }
-        return false;
+        return true;
 }
 /* tipc_link_bc_retrans() - retransmit zero or more packets
@@ -1110,7 +1112,7 @@ static int tipc_link_bc_retrans(struct tipc_link *l, struct tipc_link *r,
        trace_tipc_link_retrans(r, from, to, &l->transmq);
-        if (link_retransmit_failure(l, r, from, &rc))
+        if (link_retransmit_failure(l, r, &rc))
                return rc;
        skb_queue_walk(&l->transmq, skb) {
@@ -1119,11 +1121,10 @@ static int tipc_link_bc_retrans(struct tipc_link *l, struct tipc_link *r,
                        continue;
                if (more(msg_seqno(hdr), to))
                        break;
-                if (link_is_bc_sndlink(l)) {
-                        if (time_before(jiffies, TIPC_SKB_CB(skb)->nxt_retr))
+                if (time_before(jiffies, TIPC_SKB_CB(skb)->nxt_retr))
-                                continue;
+                        continue;
-                        TIPC_SKB_CB(skb)->nxt_retr = TIPC_BC_RETR_LIM;
+                TIPC_SKB_CB(skb)->nxt_retr = TIPC_BC_RETR_LIM;
-                }
                _skb = __pskb_copy(skb, LL_MAX_HEADER + MIN_H_SIZE, GFP_ATOMIC);
                if (!_skb)
                        return 0;
@@ -1133,6 +1134,10 @@ static int tipc_link_bc_retrans(struct tipc_link *l, struct tipc_link *r,
                _skb->priority = TC_PRIO_CONTROL;
                __skb_queue_tail(xmitq, _skb);
                l->stats.retransmitted++;
+                /* Increase actual retrans counter & mark first time */
+                if (!TIPC_SKB_CB(skb)->retr_cnt++)
+                        TIPC_SKB_CB(skb)->retr_stamp = jiffies;
        }
        return 0;
 }
@@ -1357,12 +1362,10 @@ static int tipc_link_advance_transmq(struct tipc_link *l, u16 acked, u16 gap,
        struct tipc_msg *hdr;
        u16 bc_ack = l->bc_rcvlink->rcv_nxt - 1;
        u16 ack = l->rcv_nxt - 1;
+        bool passed = false;
        u16 seqno, n = 0;
        int rc = 0;
-        if (gap && link_retransmit_failure(l, l, acked + 1, &rc))
-                return rc;
        skb_queue_walk_safe(&l->transmq, skb, tmp) {
                seqno = buf_seqno(skb);
@@ -1372,12 +1375,17 @@ next_gap_ack:
                        __skb_unlink(skb, &l->transmq);
                        kfree_skb(skb);
                } else if (less_eq(seqno, acked + gap)) {
-                        /* retransmit skb */
+                        /* First, check if repeated retrans failures occurs? */
+                        if (!passed && link_retransmit_failure(l, l, &rc))
+                                return rc;
+                        passed = true;
+                        /* retransmit skb if unrestricted*/
                        if (time_before(jiffies, TIPC_SKB_CB(skb)->nxt_retr))
                                continue;
                        TIPC_SKB_CB(skb)->nxt_retr = TIPC_UC_RETR_TIME;
+                        _skb = __pskb_copy(skb, LL_MAX_HEADER + MIN_H_SIZE,
-                        _skb = __pskb_copy(skb, MIN_H_SIZE, GFP_ATOMIC);
+                                           GFP_ATOMIC);
                        if (!_skb)
                                continue;
                        hdr = buf_msg(_skb);
@@ -1386,6 +1394,10 @@ next_gap_ack:
                        _skb->priority = TC_PRIO_CONTROL;
                        __skb_queue_tail(xmitq, _skb);
                        l->stats.retransmitted++;
+                        /* Increase actual retrans counter & mark first time */
+                        if (!TIPC_SKB_CB(skb)->retr_cnt++)
+                                TIPC_SKB_CB(skb)->retr_stamp = jiffies;
                } else {
                        /* retry with Gap ACK blocks if any */
                        if (!ga || n >= ga->gack_cnt)
@@ -2577,7 +2589,7 @@ int tipc_link_dump(struct tipc_link *l, u16 dqueues, char *buf)
        i += scnprintf(buf + i, sz - i, " %x", l->peer_caps);
        i += scnprintf(buf + i, sz - i, " %u", l->silent_intv_cnt);
        i += scnprintf(buf + i, sz - i, " %u", l->rst_cnt);
-        i += scnprintf(buf + i, sz - i, " %u", l->prev_from);
+        i += scnprintf(buf + i, sz - i, " %u", 0);
        i += scnprintf(buf + i, sz - i, " %u", 0);
        i += scnprintf(buf + i, sz - i, " %u", l->acked);
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index da509f0eb9ca..d7ebc9e955f6 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -102,13 +102,15 @@ struct plist;
 #define TIPC_MEDIA_INFO_OFFSET  5
 struct tipc_skb_cb {
-        u32 bytes_read;
-        u32 orig_member;
        struct sk_buff *tail;
        unsigned long nxt_retr;
-        bool validated;
+        unsigned long retr_stamp;
+        u32 bytes_read;
+        u32 orig_member;
        u16 chain_imp;
        u16 ackers;
+        u16 retr_cnt;
+        bool validated;
 };
 #define TIPC_SKB_CB(__skb) ((struct tipc_skb_cb *)&((__skb)->cb[0]))
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index 7c0b2b778703..43922d86e510 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -373,9 +373,9 @@ static int tls_push_data(struct sock *sk,
        struct tls_context *tls_ctx = tls_get_ctx(sk);
        struct tls_prot_info *prot = &tls_ctx->prot_info;
        struct tls_offload_context_tx *ctx = tls_offload_ctx_tx(tls_ctx);
-        int tls_push_record_flags = flags | MSG_SENDPAGE_NOTLAST;
        int more = flags & (MSG_SENDPAGE_NOTLAST | MSG_MORE);
        struct tls_record_info *record = ctx->open_record;
+        int tls_push_record_flags;
        struct page_frag *pfrag;
        size_t orig_size = size;
        u32 max_open_record_len;
@@ -390,6 +390,9 @@ static int tls_push_data(struct sock *sk,
        if (sk->sk_err)
                return -sk->sk_err;
+        flags |= MSG_SENDPAGE_DECRYPTED;
+        tls_push_record_flags = flags | MSG_SENDPAGE_NOTLAST;
        timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
        if (tls_is_partially_sent_record(tls_ctx)) {
                rc = tls_push_partial_record(sk, tls_ctx, flags);
@@ -576,7 +579,9 @@ void tls_device_write_space(struct sock *sk, struct tls_context *ctx)
                gfp_t sk_allocation = sk->sk_allocation;
                sk->sk_allocation = GFP_ATOMIC;
-                tls_push_partial_record(sk, ctx, MSG_DONTWAIT | MSG_NOSIGNAL);
+                tls_push_partial_record(sk, ctx,
+                                        MSG_DONTWAIT | MSG_NOSIGNAL |
+                                        MSG_SENDPAGE_DECRYPTED);
                sk->sk_allocation = sk_allocation;
        }
 }
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 9cbbae606ced..43252a801c3f 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -308,6 +308,8 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
        if (free_ctx)
                icsk->icsk_ulp_data = NULL;
        sk->sk_prot = ctx->sk_proto;
+        if (sk->sk_write_space == tls_write_space)
+                sk->sk_write_space = ctx->sk_write_space;
        write_unlock_bh(&sk->sk_callback_lock);
        release_sock(sk);
        if (ctx->tx_conf == TLS_SW)
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 4831ad745f91..327479ce69f5 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2788,7 +2788,7 @@ static void reg_process_pending_hints(void)
        /* When last_request->processed becomes true this will be rescheduled */
        if (lr && !lr->processed) {
-                reg_process_hint(lr);
+                pr_debug("Pending regulatory request, waiting for it to be processed...\n");
                return;
        }
diff --git a/net/wireless/util.c b/net/wireless/util.c
index d0e35b7b9e35..e74837824cea 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -233,25 +233,30 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
        switch (params->cipher) {
        case WLAN_CIPHER_SUITE_TKIP:
+                /* Extended Key ID can only be used with CCMP/GCMP ciphers */
+                if ((pairwise && key_idx) ||
+                    params->mode != NL80211_KEY_RX_TX)
+                        return -EINVAL;
+                break;
        case WLAN_CIPHER_SUITE_CCMP:
        case WLAN_CIPHER_SUITE_CCMP_256:
        case WLAN_CIPHER_SUITE_GCMP:
        case WLAN_CIPHER_SUITE_GCMP_256:
-                /* IEEE802.11-2016 allows only 0 and - when using Extended Key
+                /* IEEE802.11-2016 allows only 0 and - when supporting
-                 * ID - 1 as index for pairwise keys.
+                 * Extended Key ID - 1 as index for pairwise keys.
                 * @NL80211_KEY_NO_TX is only allowed for pairwise keys when
                 * the driver supports Extended Key ID.
                 * @NL80211_KEY_SET_TX can't be set when installing and
                 * validating a key.
                 */
-                if (params->mode == NL80211_KEY_NO_TX) {
+                if ((params->mode == NL80211_KEY_NO_TX && !pairwise) ||
-                        if (!wiphy_ext_feature_isset(&rdev->wiphy,
+                    params->mode == NL80211_KEY_SET_TX)
-                                                     NL80211_EXT_FEATURE_EXT_KEY_ID))
+                        return -EINVAL;
-                                return -EINVAL;
+                if (wiphy_ext_feature_isset(&rdev->wiphy,
-                        else if (!pairwise || key_idx < 0 || key_idx > 1)
+                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
+                        if (pairwise && (key_idx < 0 || key_idx > 1))
                                return -EINVAL;
-                } else if ((pairwise && key_idx) ||
+                } else if (pairwise && key_idx) {
-                           params->mode == NL80211_KEY_SET_TX) {
                        return -EINVAL;
                }
                break;
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 83de74ca729a..688aac7a6943 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -365,7 +365,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
        umem->pages = kcalloc(umem->npgs, sizeof(*umem->pages), GFP_KERNEL);
        if (!umem->pages) {
                err = -ENOMEM;
-                goto out_account;
+                goto out_pin;
        }
        for (i = 0; i < umem->npgs; i++)
@@ -373,6 +373,8 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
        return 0;
+out_pin:
+        xdp_umem_unpin_pages(umem);
 out_account:
        xdp_umem_unaccount_pages(umem);
        return err;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 8ca637a72697..ec94f5795ea4 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -3269,7 +3269,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse)
        struct flowi4 *fl4 = &fl->u.ip4;
        int oif = 0;
-        if (skb_dst(skb))
+        if (skb_dst(skb) && skb_dst(skb)->dev)
                oif = skb_dst(skb)->dev->ifindex;
        memset(fl4, 0, sizeof(struct flowi4));
@@ -3387,7 +3387,7 @@ decode_session6(struct sk_buff *skb, struct flowi *fl, bool reverse)
        nexthdr = nh[nhoff];
-        if (skb_dst(skb))
+        if (skb_dst(skb) && skb_dst(skb)->dev)
                oif = skb_dst(skb)->dev->ifindex;
        memset(fl6, 0, sizeof(struct flowi6));