148 files changed, 1730 insertions, 1006 deletions
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 240ed70912d6..d78938e3e008 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -277,17 +277,23 @@ static u8 batadv_hop_penalty(u8 tq, const struct batadv_priv *bat_priv)
 * batadv_iv_ogm_aggr_packet() - checks if there is another OGM attached
 * @buff_pos: current position in the skb
 * @packet_len: total length of the skb
- * @tvlv_len: tvlv length of the previously considered OGM
+ * @ogm_packet: potential OGM in buffer
 *
 * Return: true if there is enough space for another OGM, false otherwise.
 */
-static bool batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len,
+static bool
-                                      __be16 tvlv_len)
+batadv_iv_ogm_aggr_packet(int buff_pos, int packet_len,
+                          const struct batadv_ogm_packet *ogm_packet)
 {
        int next_buff_pos = 0;
-        next_buff_pos += buff_pos + BATADV_OGM_HLEN;
+        /* check if there is enough space for the header */
-        next_buff_pos += ntohs(tvlv_len);
+        next_buff_pos += buff_pos + sizeof(*ogm_packet);
+        if (next_buff_pos > packet_len)
+                return false;
+        /* check if there is enough space for the optional TVLV */
+        next_buff_pos += ntohs(ogm_packet->tvlv_len);
        return (next_buff_pos <= packet_len) &&
               (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES);
@@ -315,7 +321,7 @@ static void batadv_iv_ogm_send_to_if(struct batadv_forw_packet *forw_packet,
        /* adjust all flags and log packets */
        while (batadv_iv_ogm_aggr_packet(buff_pos, forw_packet->packet_len,
-                                         batadv_ogm_packet->tvlv_len)) {
+                                         batadv_ogm_packet)) {
                /* we might have aggregated direct link packets with an
                 * ordinary base packet
                 */
@@ -1704,7 +1710,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
        /* unpack the aggregated packets and process them one by one */
        while (batadv_iv_ogm_aggr_packet(ogm_offset, skb_headlen(skb),
-                                         ogm_packet->tvlv_len)) {
+                                         ogm_packet)) {
                batadv_iv_ogm_process(skb, ogm_offset, if_incoming);
                ogm_offset += BATADV_OGM_HLEN;
diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
index fad95ef64e01..bc06e3cdfa84 100644
--- a/net/batman-adv/bat_v_ogm.c
+++ b/net/batman-adv/bat_v_ogm.c
@@ -631,17 +631,23 @@ batadv_v_ogm_process_per_outif(struct batadv_priv *bat_priv,
 * batadv_v_ogm_aggr_packet() - checks if there is another OGM aggregated
 * @buff_pos: current position in the skb
 * @packet_len: total length of the skb
- * @tvlv_len: tvlv length of the previously considered OGM
+ * @ogm2_packet: potential OGM2 in buffer
 *
 * Return: true if there is enough space for another OGM, false otherwise.
 */
-static bool batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
+static bool
-                                     __be16 tvlv_len)
+batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
+                         const struct batadv_ogm2_packet *ogm2_packet)
 {
        int next_buff_pos = 0;
-        next_buff_pos += buff_pos + BATADV_OGM2_HLEN;
+        /* check if there is enough space for the header */
-        next_buff_pos += ntohs(tvlv_len);
+        next_buff_pos += buff_pos + sizeof(*ogm2_packet);
+        if (next_buff_pos > packet_len)
+                return false;
+        /* check if there is enough space for the optional TVLV */
+        next_buff_pos += ntohs(ogm2_packet->tvlv_len);
        return (next_buff_pos <= packet_len) &&
               (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES);
@@ -818,7 +824,7 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb,
        ogm_packet = (struct batadv_ogm2_packet *)skb->data;
        while (batadv_v_ogm_aggr_packet(ogm_offset, skb_headlen(skb),
-                                        ogm_packet->tvlv_len)) {
+                                        ogm_packet)) {
                batadv_v_ogm_process(skb, ogm_offset, if_incoming);
                ogm_offset += BATADV_OGM2_HLEN;
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index 67d7f83009ae..1d5bdf3a4b65 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -2303,7 +2303,7 @@ __batadv_mcast_flags_dump(struct sk_buff *msg, u32 portid,
        while (bucket_tmp < hash->size) {
                if (batadv_mcast_flags_dump_bucket(msg, portid, cb, hash,
-                                                   *bucket, &idx_tmp))
+                                                   bucket_tmp, &idx_tmp))
                        break;
                bucket_tmp++;
@@ -2420,8 +2420,10 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig)
        batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);
        batadv_mcast_want_ipv4_update(bat_priv, orig, BATADV_NO_FLAGS);
        batadv_mcast_want_ipv6_update(bat_priv, orig, BATADV_NO_FLAGS);
-        batadv_mcast_want_rtr4_update(bat_priv, orig, BATADV_NO_FLAGS);
+        batadv_mcast_want_rtr4_update(bat_priv, orig,
-        batadv_mcast_want_rtr6_update(bat_priv, orig, BATADV_NO_FLAGS);
+                                      BATADV_MCAST_WANT_NO_RTR4);
+        batadv_mcast_want_rtr6_update(bat_priv, orig,
+                                      BATADV_MCAST_WANT_NO_RTR6);
        spin_unlock_bh(&orig->mcast_handler_lock);
 }
diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c
index 6f08fd122a8d..7e052d6f759b 100644
--- a/net/batman-adv/netlink.c
+++ b/net/batman-adv/netlink.c
@@ -164,7 +164,7 @@ batadv_netlink_get_ifindex(const struct nlmsghdr *nlh, int attrtype)
 {
        struct nlattr *attr = nlmsg_find_attr(nlh, GENL_HDRLEN, attrtype);
-        return attr ? nla_get_u32(attr) : 0;
+        return (attr && nla_len(attr) == sizeof(u32)) ? nla_get_u32(attr) : 0;
 }
 /**
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b9585e7d9d2e..04bc79359a17 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3202,6 +3202,7 @@ struct hci_dev *hci_alloc_dev(void)
        hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
        hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
        hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
+        hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
        mutex_init(&hdev->lock);
        mutex_init(&hdev->req_lock);
diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index bb67f4a5479a..402e2cc54044 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -433,6 +433,35 @@ static int auto_accept_delay_set(void *data, u64 val)
        return 0;
 }
+static int min_encrypt_key_size_set(void *data, u64 val)
+{
+        struct hci_dev *hdev = data;
+        if (val < 1 || val > 16)
+                return -EINVAL;
+        hci_dev_lock(hdev);
+        hdev->min_enc_key_size = val;
+        hci_dev_unlock(hdev);
+        return 0;
+}
+static int min_encrypt_key_size_get(void *data, u64 *val)
+{
+        struct hci_dev *hdev = data;
+        hci_dev_lock(hdev);
+        *val = hdev->min_enc_key_size;
+        hci_dev_unlock(hdev);
+        return 0;
+}
+DEFINE_SIMPLE_ATTRIBUTE(min_encrypt_key_size_fops,
+                        min_encrypt_key_size_get,
+                        min_encrypt_key_size_set, "%llu\n");
 static int auto_accept_delay_get(void *data, u64 *val)
 {
        struct hci_dev *hdev = data;
@@ -545,6 +574,8 @@ void hci_debugfs_create_bredr(struct hci_dev *hdev)
        if (lmp_ssp_capable(hdev)) {
                debugfs_create_file("ssp_debug_mode", 0444, hdev->debugfs,
                                    hdev, &ssp_debug_mode_fops);
+                debugfs_create_file("min_encrypt_key_size", 0644, hdev->debugfs,
+                                    hdev, &min_encrypt_key_size_fops);
                debugfs_create_file("auto_accept_delay", 0644, hdev->debugfs,
                                    hdev, &auto_accept_delay_fops);
        }
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 5abd423b55fa..8d889969ae7e 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -101,6 +101,7 @@ static int hidp_send_message(struct hidp_session *session, struct socket *sock,
 {
        struct sk_buff *skb;
        struct sock *sk = sock->sk;
+        int ret;
        BT_DBG("session %p data %p size %d", session, data, size);
@@ -114,13 +115,17 @@ static int hidp_send_message(struct hidp_session *session, struct socket *sock,
        }
        skb_put_u8(skb, hdr);
-        if (data && size > 0)
+        if (data && size > 0) {
                skb_put_data(skb, data, size);
+                ret = size;
+        } else {
+                ret = 0;
+        }
        skb_queue_tail(transmit, skb);
        wake_up_interruptible(sk_sleep(sk));
-        return 0;
+        return ret;
 }
 static int hidp_send_ctrl_message(struct hidp_session *session,
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index cc506fe99b4d..dfc1edb168b7 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1361,7 +1361,7 @@ static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
         * actually encrypted before enforcing a key size.
         */
        return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
-                hcon->enc_key_size >= HCI_MIN_ENC_KEY_SIZE);
+                hcon->enc_key_size >= hcon->hdev->min_enc_key_size);
 }
 static void l2cap_do_start(struct l2cap_chan *chan)
diff --git a/net/bridge/br.c b/net/bridge/br.c
index d164f63a4345..8a8f9e5f264f 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -37,12 +37,15 @@ static int br_device_event(struct notifier_block *unused, unsigned long event, v
        int err;
        if (dev->priv_flags & IFF_EBRIDGE) {
+                err = br_vlan_bridge_event(dev, event, ptr);
+                if (err)
+                        return notifier_from_errno(err);
                if (event == NETDEV_REGISTER) {
                        /* register of bridge completed, add sysfs entries */
                        br_sysfs_addbr(dev);
                        return NOTIFY_DONE;
                }
-                br_vlan_bridge_event(dev, event, ptr);
        }
        /* not a port of a bridge */
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 3d8deac2353d..f8cac3702712 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1388,6 +1388,9 @@ br_multicast_leave_group(struct net_bridge *br,
                        if (!br_port_group_equal(p, port, src))
                                continue;
+                        if (p->flags & MDB_PG_FLAGS_PERMANENT)
+                                break;
                        rcu_assign_pointer(*pp, p->next);
                        hlist_del_init(&p->mglist);
                        del_timer(&p->timer);
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index e8cf03b43b7d..646504db0220 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -894,8 +894,8 @@ int nbp_get_num_vlan_infos(struct net_bridge_port *p, u32 filter_mask);
 void br_vlan_get_stats(const struct net_bridge_vlan *v,
                       struct br_vlan_stats *stats);
 void br_vlan_port_event(struct net_bridge_port *p, unsigned long event);
-void br_vlan_bridge_event(struct net_device *dev, unsigned long event,
+int br_vlan_bridge_event(struct net_device *dev, unsigned long event,
-                          void *ptr);
+                         void *ptr);
 static inline struct net_bridge_vlan_group *br_vlan_group(
                                        const struct net_bridge *br)
@@ -1085,9 +1085,10 @@ static inline void br_vlan_port_event(struct net_bridge_port *p,
 {
 }
-static inline void br_vlan_bridge_event(struct net_device *dev,
+static inline int br_vlan_bridge_event(struct net_device *dev,
-                                        unsigned long event, void *ptr)
+                                       unsigned long event, void *ptr)
 {
+        return 0;
 }
 #endif
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 021cc9f66804..f5b2aeebbfe9 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -1053,7 +1053,6 @@ int br_vlan_init(struct net_bridge *br)
 {
        struct net_bridge_vlan_group *vg;
        int ret = -ENOMEM;
-        bool changed;
        vg = kzalloc(sizeof(*vg), GFP_KERNEL);
        if (!vg)
@@ -1068,17 +1067,10 @@ int br_vlan_init(struct net_bridge *br)
        br->vlan_proto = htons(ETH_P_8021Q);
        br->default_pvid = 1;
        rcu_assign_pointer(br->vlgrp, vg);
-        ret = br_vlan_add(br, 1,
-                          BRIDGE_VLAN_INFO_PVID | BRIDGE_VLAN_INFO_UNTAGGED |
-                          BRIDGE_VLAN_INFO_BRENTRY, &changed, NULL);
-        if (ret)
-                goto err_vlan_add;
 out:
        return ret;
-err_vlan_add:
-        vlan_tunnel_deinit(vg);
 err_tunnel_init:
        rhashtable_destroy(&vg->vlan_hash);
 err_rhtbl:
@@ -1464,13 +1456,23 @@ static void nbp_vlan_set_vlan_dev_state(struct net_bridge_port *p, u16 vid)
 }
 /* Must be protected by RTNL. */
-void br_vlan_bridge_event(struct net_device *dev, unsigned long event,
+int br_vlan_bridge_event(struct net_device *dev, unsigned long event, void *ptr)
-                          void *ptr)
 {
        struct netdev_notifier_changeupper_info *info;
-        struct net_bridge *br;
+        struct net_bridge *br = netdev_priv(dev);
+        bool changed;
+        int ret = 0;
        switch (event) {
+        case NETDEV_REGISTER:
+                ret = br_vlan_add(br, br->default_pvid,
+                                  BRIDGE_VLAN_INFO_PVID |
+                                  BRIDGE_VLAN_INFO_UNTAGGED |
+                                  BRIDGE_VLAN_INFO_BRENTRY, &changed, NULL);
+                break;
+        case NETDEV_UNREGISTER:
+                br_vlan_delete(br, br->default_pvid);
+                break;
        case NETDEV_CHANGEUPPER:
                info = ptr;
                br_vlan_upper_change(dev, info->upper_dev, info->linking);
@@ -1478,12 +1480,13 @@ void br_vlan_bridge_event(struct net_device *dev, unsigned long event,
        case NETDEV_CHANGE:
        case NETDEV_UP:
-                br = netdev_priv(dev);
                if (!br_opt_get(br, BROPT_VLAN_BRIDGE_BINDING))
-                        return;
+                        break;
                br_vlan_link_state_change(dev, br);
                break;
        }
+        return ret;
 }
 /* Must be protected by RTNL. */
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 963dfdc14827..4096d8a74a2b 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -221,7 +221,7 @@ unsigned int ebt_do_table(struct sk_buff *skb,
                        return NF_DROP;
                }
-                ADD_COUNTER(*(counter_base + i), 1, skb->len);
+                ADD_COUNTER(*(counter_base + i), skb->len, 1);
                /* these should only watch: not modify, nor tell us
                 * what to do with the packet
@@ -959,8 +959,8 @@ static void get_counters(const struct ebt_counter *oldcounters,
                        continue;
                counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
                for (i = 0; i < nentries; i++)
-                        ADD_COUNTER(counters[i], counter_base[i].pcnt,
+                        ADD_COUNTER(counters[i], counter_base[i].bcnt,
-                                    counter_base[i].bcnt);
+                                    counter_base[i].pcnt);
        }
 }
@@ -1280,7 +1280,7 @@ static int do_update_counters(struct net *net, const char *name,
        /* we add to the counters of the first cpu */
        for (i = 0; i < num_counters; i++)
-                ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt);
+                ADD_COUNTER(t->private->counters[i], tmp[i].bcnt, tmp[i].pcnt);
        write_unlock_bh(&t->lock);
        ret = 0;
@@ -1770,20 +1770,28 @@ static int compat_calc_entry(const struct ebt_entry *e,
        return 0;
 }
+static int ebt_compat_init_offsets(unsigned int number)
+{
+        if (number > INT_MAX)
+                return -EINVAL;
+        /* also count the base chain policies */
+        number += NF_BR_NUMHOOKS;
+        return xt_compat_init_offsets(NFPROTO_BRIDGE, number);
+}
 static int compat_table_info(const struct ebt_table_info *info,
                             struct compat_ebt_replace *newinfo)
 {
        unsigned int size = info->entries_size;
        const void *entries = info->entries;
+        int ret;
        newinfo->entries_size = size;
-        if (info->nentries) {
+        ret = ebt_compat_init_offsets(info->nentries);
-                int ret = xt_compat_init_offsets(NFPROTO_BRIDGE,
+        if (ret)
-                                                 info->nentries);
+                return ret;
-                if (ret)
-                        return ret;
-        }
        return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info,
                                                        entries, newinfo);
@@ -2234,11 +2242,9 @@ static int compat_do_replace(struct net *net, void __user *user,
        xt_compat_lock(NFPROTO_BRIDGE);
-        if (tmp.nentries) {
+        ret = ebt_compat_init_offsets(tmp.nentries);
-                ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries);
+        if (ret < 0)
-                if (ret < 0)
+                goto out_unlock;
-                        goto out_unlock;
-        }
        ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
        if (ret < 0)
@@ -2261,8 +2267,10 @@ static int compat_do_replace(struct net *net, void __user *user,
        state.buf_kern_len = size64;
        ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
-        if (WARN_ON(ret < 0))
+        if (WARN_ON(ret < 0)) {
+                vfree(entries_tmp);
                goto out_unlock;
+        }
        vfree(entries_tmp);
        tmp.entries_size = size64;
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index bed66f536b34..7c9e92b2f806 100644
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -30,13 +30,9 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
        switch (priv->key) {
        case NFT_META_BRI_IIFNAME:
                br_dev = nft_meta_get_bridge(in);
-                if (!br_dev)
-                        goto err;
                break;
        case NFT_META_BRI_OIFNAME:
                br_dev = nft_meta_get_bridge(out);
-                if (!br_dev)
-                        goto err;
                break;
        case NFT_META_BRI_IIFPVID: {
                u16 p_pvid;
@@ -57,17 +53,15 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
                        goto err;
                br_vlan_get_proto(br_dev, &p_proto);
-                nft_reg_store16(dest, p_proto);
+                nft_reg_store16(dest, htons(p_proto));
                return;
        }
        default:
-                goto out;
+                return nft_meta_get_eval(expr, regs, pkt);
        }
-        strncpy((char *)dest, br_dev->name, IFNAMSIZ);
+        strncpy((char *)dest, br_dev ? br_dev->name : "", IFNAMSIZ);
        return;
-out:
-        return nft_meta_get_eval(expr, regs, pkt);
 err:
        regs->verdict.code = NFT_BREAK;
 }
diff --git a/net/can/gw.c b/net/can/gw.c
index 5275ddf580bc..72711053ebe6 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -1046,32 +1046,50 @@ static __init int cgw_module_init(void)
        pr_info("can: netlink gateway (rev " CAN_GW_VERSION ") max_hops=%d\n",
                max_hops);
-        register_pernet_subsys(&cangw_pernet_ops);
+        ret = register_pernet_subsys(&cangw_pernet_ops);
+        if (ret)
+                return ret;
+        ret = -ENOMEM;
        cgw_cache = kmem_cache_create("can_gw", sizeof(struct cgw_job),
                                      0, 0, NULL);
        if (!cgw_cache)
-                return -ENOMEM;
+                goto out_cache_create;
        /* set notifier */
        notifier.notifier_call = cgw_notifier;
-        register_netdevice_notifier(&notifier);
+        ret = register_netdevice_notifier(&notifier);
+        if (ret)
+                goto out_register_notifier;
        ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_GETROUTE,
                                   NULL, cgw_dump_jobs, 0);
-        if (ret) {
+        if (ret)
-                unregister_netdevice_notifier(&notifier);
+                goto out_rtnl_register1;
-                kmem_cache_destroy(cgw_cache);
-                return -ENOBUFS;
+        ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_NEWROUTE,
-        }
+                                   cgw_create_job, NULL, 0);
+        if (ret)
-        /* Only the first call to rtnl_register_module can fail */
+                goto out_rtnl_register2;
-        rtnl_register_module(THIS_MODULE, PF_CAN, RTM_NEWROUTE,
+        ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_DELROUTE,
-                             cgw_create_job, NULL, 0);
+                                   cgw_remove_job, NULL, 0);
-        rtnl_register_module(THIS_MODULE, PF_CAN, RTM_DELROUTE,
+        if (ret)
-                             cgw_remove_job, NULL, 0);
+                goto out_rtnl_register3;
        return 0;
+out_rtnl_register3:
+        rtnl_unregister(PF_CAN, RTM_NEWROUTE);
+out_rtnl_register2:
+        rtnl_unregister(PF_CAN, RTM_GETROUTE);
+out_rtnl_register1:
+        unregister_netdevice_notifier(&notifier);
+out_register_notifier:
+        kmem_cache_destroy(cgw_cache);
+out_cache_create:
+        unregister_pernet_subsys(&cangw_pernet_ops);
+        return ret;
 }
 static __exit void cgw_module_exit(void)
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
index 5d6724cee38f..4f75df40fb12 100644
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
@@ -136,8 +136,10 @@ void ceph_crypto_key_destroy(struct ceph_crypto_key *key)
        if (key) {
                kfree(key->key);
                key->key = NULL;
-                crypto_free_sync_skcipher(key->tfm);
+                if (key->tfm) {
-                key->tfm = NULL;
+                        crypto_free_sync_skcipher(key->tfm);
+                        key->tfm = NULL;
+                }
        }
 }
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 0b2df09b2554..78ae6e8c953d 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1496,7 +1496,7 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
        struct ceph_osds up, acting;
        bool force_resend = false;
        bool unpaused = false;
-        bool legacy_change;
+        bool legacy_change = false;
        bool split = false;
        bool sort_bitwise = ceph_osdmap_flag(osdc, CEPH_OSDMAP_SORTBITWISE);
        bool recovery_deletes = ceph_osdmap_flag(osdc,
@@ -1584,15 +1584,14 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
                t->osd = acting.primary;
        }
-        if (unpaused || legacy_change || force_resend ||
+        if (unpaused || legacy_change || force_resend || split)
-            (split && con && CEPH_HAVE_FEATURE(con->peer_features,
-                                               RESEND_ON_SPLIT)))
                ct_res = CALC_TARGET_NEED_RESEND;
        else
                ct_res = CALC_TARGET_NO_ACTION;
 out:
-        dout("%s t %p -> ct_res %d osd %d\n", __func__, t, ct_res, t->osd);
+        dout("%s t %p -> %d%d%d%d ct_res %d osd%d\n", __func__, t, unpaused,
+             legacy_change, force_resend, split, ct_res, t->osd);
        return ct_res;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index fc676b2610e3..0891f499c1bb 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4374,12 +4374,17 @@ static u32 netif_receive_generic_xdp(struct sk_buff *skb,
        act = bpf_prog_run_xdp(xdp_prog, xdp);
+        /* check if bpf_xdp_adjust_head was used */
        off = xdp->data - orig_data;
-        if (off > 0)
+        if (off) {
-                __skb_pull(skb, off);
+                if (off > 0)
-        else if (off < 0)
+                        __skb_pull(skb, off);
-                __skb_push(skb, -off);
+                else if (off < 0)
-        skb->mac_header += off;
+                        __skb_push(skb, -off);
+                skb->mac_header += off;
+                skb_reset_network_header(skb);
+        }
        /* check if bpf_xdp_adjust_tail was used. it can only "shrink"
         * pckt.
@@ -9701,6 +9706,8 @@ static void __net_exit default_device_exit(struct net *net)
                /* Push remaining network devices to init_net */
                snprintf(fb_name, IFNAMSIZ, "dev%d", dev->ifindex);
+                if (__dev_get_by_name(&init_net, fb_name))
+                        snprintf(fb_name, IFNAMSIZ, "dev%%d");
                err = dev_change_net_namespace(dev, &init_net, fb_name);
                if (err) {
                        pr_emerg("%s: failed to move %s to init_net: %d\n",
diff --git a/net/core/filter.c b/net/core/filter.c
index 4e2a79b2fd77..4c6a252d4212 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -7455,12 +7455,12 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
        case offsetof(struct __sk_buff, gso_segs):
                /* si->dst_reg = skb_shinfo(SKB); */
 #ifdef NET_SKBUFF_DATA_USES_OFFSET
-                *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(struct sk_buff, head),
-                                      si->dst_reg, si->src_reg,
-                                      offsetof(struct sk_buff, head));
                *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(struct sk_buff, end),
                                      BPF_REG_AX, si->src_reg,
                                      offsetof(struct sk_buff, end));
+                *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(struct sk_buff, head),
+                                      si->dst_reg, si->src_reg,
+                                      offsetof(struct sk_buff, head));
                *insn++ = BPF_ALU64_REG(BPF_ADD, si->dst_reg, BPF_REG_AX);
 #else
                *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(struct sk_buff, end),
@@ -8757,13 +8757,13 @@ sk_reuseport_is_valid_access(int off, int size,
                return size == size_default;
        /* Fields that allow narrowing */
-        case offsetof(struct sk_reuseport_md, eth_protocol):
+        case bpf_ctx_range(struct sk_reuseport_md, eth_protocol):
                if (size < FIELD_SIZEOF(struct sk_buff, protocol))
                        return false;
                /* fall through */
-        case offsetof(struct sk_reuseport_md, ip_protocol):
+        case bpf_ctx_range(struct sk_reuseport_md, ip_protocol):
-        case offsetof(struct sk_reuseport_md, bind_inany):
+        case bpf_ctx_range(struct sk_reuseport_md, bind_inany):
-        case offsetof(struct sk_reuseport_md, len):
+        case bpf_ctx_range(struct sk_reuseport_md, len):
                bpf_ctx_record_field_size(info, size_default);
                return bpf_ctx_narrow_access_ok(off, size, size_default);
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 3e6fedb57bc1..2470b4b404e6 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -142,8 +142,8 @@ int skb_flow_dissector_bpf_prog_detach(const union bpf_attr *attr)
                mutex_unlock(&flow_dissector_mutex);
                return -ENOENT;
        }
-        bpf_prog_put(attached);
        RCU_INIT_POINTER(net->flow_dissector_prog, NULL);
+        bpf_prog_put(attached);
        mutex_unlock(&flow_dissector_mutex);
        return 0;
 }
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 2cf27da1baeb..849380a622ef 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -122,7 +122,7 @@ static void queue_process(struct work_struct *work)
                txq = netdev_get_tx_queue(dev, q_index);
                HARD_TX_LOCK(dev, txq, smp_processor_id());
                if (netif_xmit_frozen_or_stopped(txq) ||
-                    netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) {
+                    !dev_xmit_complete(netpoll_start_xmit(skb, dev, txq))) {
                        skb_queue_head(&npinfo->txq, skb);
                        HARD_TX_UNLOCK(dev, txq);
                        local_irq_restore(flags);
@@ -335,7 +335,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                                HARD_TX_UNLOCK(dev, txq);
-                                if (status == NETDEV_TX_OK)
+                                if (dev_xmit_complete(status))
                                        break;
                        }
@@ -352,7 +352,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
        }
-        if (status != NETDEV_TX_OK) {
+        if (!dev_xmit_complete(status)) {
                skb_queue_tail(&npinfo->txq, skb);
                schedule_delayed_work(&npinfo->tx_work,0);
        }
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 93bffaad2135..6832eeb4b785 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -585,12 +585,12 @@ EXPORT_SYMBOL_GPL(sk_psock_destroy);
 void sk_psock_drop(struct sock *sk, struct sk_psock *psock)
 {
-        rcu_assign_sk_user_data(sk, NULL);
        sk_psock_cork_free(psock);
        sk_psock_zap_ingress(psock);
-        sk_psock_restore_proto(sk, psock);
        write_lock_bh(&sk->sk_callback_lock);
+        sk_psock_restore_proto(sk, psock);
+        rcu_assign_sk_user_data(sk, NULL);
        if (psock->progs.skb_parser)
                sk_psock_stop_strp(sk, psock);
        write_unlock_bh(&sk->sk_callback_lock);
diff --git a/net/core/sock.c b/net/core/sock.c
index d57b0cc995a0..545fac19a711 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1992,6 +1992,19 @@ void skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
 }
 EXPORT_SYMBOL(skb_set_owner_w);
+static bool can_skb_orphan_partial(const struct sk_buff *skb)
+{
+#ifdef CONFIG_TLS_DEVICE
+        /* Drivers depend on in-order delivery for crypto offload,
+         * partial orphan breaks out-of-order-OK logic.
+         */
+        if (skb->decrypted)
+                return false;
+#endif
+        return (skb->destructor == sock_wfree ||
+                (IS_ENABLED(CONFIG_INET) && skb->destructor == tcp_wfree));
+}
 /* This helper is used by netem, as it can hold packets in its
 * delay queue. We want to allow the owner socket to send more
 * packets, as if they were already TX completed by a typical driver.
@@ -2003,11 +2016,7 @@ void skb_orphan_partial(struct sk_buff *skb)
        if (skb_is_tcp_pure_ack(skb))
                return;
-        if (skb->destructor == sock_wfree
+        if (can_skb_orphan_partial(skb)) {
-#ifdef CONFIG_INET
-            || skb->destructor == tcp_wfree
-#endif
-                ) {
                struct sock *sk = skb->sk;
                if (refcount_inc_not_zero(&sk->sk_refcnt)) {
@@ -3278,16 +3287,17 @@ static __init int net_inuse_init(void)
 core_initcall(net_inuse_init);
-static void assign_proto_idx(struct proto *prot)
+static int assign_proto_idx(struct proto *prot)
 {
        prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
        if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
                pr_err("PROTO_INUSE_NR exhausted\n");
-                return;
+                return -ENOSPC;
        }
        set_bit(prot->inuse_idx, proto_inuse_idx);
+        return 0;
 }
 static void release_proto_idx(struct proto *prot)
@@ -3296,8 +3306,9 @@ static void release_proto_idx(struct proto *prot)
                clear_bit(prot->inuse_idx, proto_inuse_idx);
 }
 #else
-static inline void assign_proto_idx(struct proto *prot)
+static inline int assign_proto_idx(struct proto *prot)
 {
+        return 0;
 }
 static inline void release_proto_idx(struct proto *prot)
@@ -3346,6 +3357,8 @@ static int req_prot_init(const struct proto *prot)
 int proto_register(struct proto *prot, int alloc_slab)
 {
+        int ret = -ENOBUFS;
        if (alloc_slab) {
                prot->slab = kmem_cache_create_usercopy(prot->name,
                                        prot->obj_size, 0,
@@ -3382,20 +3395,27 @@ int proto_register(struct proto *prot, int alloc_slab)
        }
        mutex_lock(&proto_list_mutex);
+        ret = assign_proto_idx(prot);
+        if (ret) {
+                mutex_unlock(&proto_list_mutex);
+                goto out_free_timewait_sock_slab_name;
+        }
        list_add(&prot->node, &proto_list);
-        assign_proto_idx(prot);
        mutex_unlock(&proto_list_mutex);
-        return 0;
+        return ret;
 out_free_timewait_sock_slab_name:
-        kfree(prot->twsk_prot->twsk_slab_name);
+        if (alloc_slab && prot->twsk_prot)
+                kfree(prot->twsk_prot->twsk_slab_name);
 out_free_request_sock_slab:
-        req_prot_cleanup(prot->rsk_prot);
+        if (alloc_slab) {
+                req_prot_cleanup(prot->rsk_prot);
-        kmem_cache_destroy(prot->slab);
+                kmem_cache_destroy(prot->slab);
-        prot->slab = NULL;
+                prot->slab = NULL;
+        }
 out:
-        return -ENOBUFS;
+        return ret;
 }
 EXPORT_SYMBOL(proto_register);
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index 3312a5849a97..c13ffbd33d8d 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -19,6 +19,7 @@ static const struct sock_diag_handler *sock_diag_handlers[AF_MAX];
 static int (*inet_rcv_compat)(struct sk_buff *skb, struct nlmsghdr *nlh);
 static DEFINE_MUTEX(sock_diag_table_mutex);
 static struct workqueue_struct *broadcast_wq;
+static atomic64_t cookie_gen;
 u64 sock_gen_cookie(struct sock *sk)
 {
@@ -27,7 +28,7 @@ u64 sock_gen_cookie(struct sock *sk)
                if (res)
                        return res;
-                res = atomic64_inc_return(&sock_net(sk)->cookie_gen);
+                res = atomic64_inc_return(&cookie_gen);
                atomic64_cmpxchg(&sk->sk_cookie, 0, res);
        }
 }
diff --git a/net/core/sock_map.c b/net/core/sock_map.c
index 52d4faeee18b..1330a7442e5b 100644
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -247,6 +247,8 @@ static void sock_map_free(struct bpf_map *map)
        raw_spin_unlock_bh(&stab->lock);
        rcu_read_unlock();
+        synchronize_rcu();
        bpf_map_area_free(stab->sks);
        kfree(stab);
 }
@@ -276,16 +278,20 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
                             struct sock **psk)
 {
        struct sock *sk;
+        int err = 0;
        raw_spin_lock_bh(&stab->lock);
        sk = *psk;
        if (!sk_test || sk_test == sk)
-                *psk = NULL;
+                sk = xchg(psk, NULL);
+        if (likely(sk))
+                sock_map_unref(sk, psk);
+        else
+                err = -EINVAL;
        raw_spin_unlock_bh(&stab->lock);
-        if (unlikely(!sk))
+        return err;
-                return -EINVAL;
-        sock_map_unref(sk, psk);
-        return 0;
 }
 static void sock_map_delete_from_link(struct bpf_map *map, struct sock *sk,
@@ -328,6 +334,7 @@ static int sock_map_update_common(struct bpf_map *map, u32 idx,
                                  struct sock *sk, u64 flags)
 {
        struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
+        struct inet_connection_sock *icsk = inet_csk(sk);
        struct sk_psock_link *link;
        struct sk_psock *psock;
        struct sock *osk;
@@ -338,6 +345,8 @@ static int sock_map_update_common(struct bpf_map *map, u32 idx,
                return -EINVAL;
        if (unlikely(idx >= map->max_entries))
                return -E2BIG;
+        if (unlikely(icsk->icsk_ulp_data))
+                return -EINVAL;
        link = sk_psock_init_link();
        if (!link)
diff --git a/net/core/stream.c b/net/core/stream.c
index e94bb02a5629..4f1d4aa5fb38 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -120,7 +120,6 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
        int err = 0;
        long vm_wait = 0;
        long current_timeo = *timeo_p;
-        bool noblock = (*timeo_p ? false : true);
        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        if (sk_stream_memory_free(sk))
@@ -133,11 +132,8 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
                if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
                        goto do_error;
-                if (!*timeo_p) {
+                if (!*timeo_p)
-                        if (noblock)
+                        goto do_eagain;
-                                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
-                        goto do_nonblock;
-                }
                if (signal_pending(current))
                        goto do_interrupted;
                sk_clear_bit(SOCKWQ_ASYNC_NOSPACE, sk);
@@ -169,7 +165,13 @@ out:
 do_error:
        err = -EPIPE;
        goto out;
-do_nonblock:
+do_eagain:
+        /* Make sure that whenever EAGAIN is returned, EPOLLOUT event can
+         * be generated later.
+         * When TCP receives ACK packets that make room, tcp_check_space()
+         * only calls tcp_new_space() if SOCK_NOSPACE is set.
+         */
+        set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
        err = -EAGAIN;
        goto out;
 do_interrupted:
diff --git a/net/dsa/switch.c b/net/dsa/switch.c
index 4ec5b7f85d51..09d9286b27cc 100644
--- a/net/dsa/switch.c
+++ b/net/dsa/switch.c
@@ -153,6 +153,9 @@ static void dsa_switch_mdb_add_bitmap(struct dsa_switch *ds,
 {
        int port;
+        if (!ds->ops->port_mdb_add)
+                return;
        for_each_set_bit(port, bitmap, ds->num_ports)
                ds->ops->port_mdb_add(ds, port, mdb);
 }
diff --git a/net/dsa/tag_8021q.c b/net/dsa/tag_8021q.c
index 6ebbd799c4eb..67a1bc635a7b 100644
--- a/net/dsa/tag_8021q.c
+++ b/net/dsa/tag_8021q.c
@@ -28,6 +28,7 @@
 *
 * RSV - VID[9]:
 *      To be used for further expansion of SWITCH_ID or for other purposes.
+ *      Must be transmitted as zero and ignored on receive.
 *
 * SWITCH_ID - VID[8:6]:
 *      Index of switch within DSA tree. Must be between 0 and
@@ -35,6 +36,7 @@
 *
 * RSV - VID[5:4]:
 *      To be used for further expansion of PORT or for other purposes.
+ *      Must be transmitted as zero and ignored on receive.
 *
 * PORT - VID[3:0]:
 *      Index of switch port. Must be between 0 and DSA_MAX_PORTS - 1.
diff --git a/net/dsa/tag_sja1105.c b/net/dsa/tag_sja1105.c
index 26363d72d25b..47ee88163a9d 100644
--- a/net/dsa/tag_sja1105.c
+++ b/net/dsa/tag_sja1105.c
@@ -165,6 +165,7 @@ static struct sk_buff
                                            "Expected meta frame, is %12llx "
                                            "in the DSA master multicast filter?\n",
                                            SJA1105_META_DMAC);
+                        kfree_skb(sp->data->stampable_skb);
                }
                /* Hold a reference to avoid dsa_switch_rcv
@@ -211,17 +212,8 @@ static struct sk_buff
                 * for further processing up the network stack.
                 */
                kfree_skb(skb);
+                skb = stampable_skb;
-                skb = skb_copy(stampable_skb, GFP_ATOMIC);
-                if (!skb) {
-                        dev_err_ratelimited(dp->ds->dev,
-                                            "Failed to copy stampable skb\n");
-                        spin_unlock(&sp->data->meta_lock);
-                        return NULL;
-                }
                sja1105_transfer_meta(skb, meta);
-                /* The cached copy will be freed now */
-                skb_unref(stampable_skb);
                spin_unlock(&sp->data->meta_lock);
        }
diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
index e4aba5d485be..bbe9b3b2d395 100644
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -170,7 +170,7 @@ static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *skb,
        reasm_data = inet_frag_reasm_prepare(&fq->q, skb, prev_tail);
        if (!reasm_data)
                goto out_oom;
-        inet_frag_reasm_finish(&fq->q, skb, reasm_data);
+        inet_frag_reasm_finish(&fq->q, skb, reasm_data, false);
        skb->dev = ldev;
        skb->tstamp = fq->q.stamp;
diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index dacbd58e1799..badc5cfe4dc6 100644
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -1092,7 +1092,7 @@ static struct packet_type ieee802154_packet_type = {
 static int __init af_ieee802154_init(void)
 {
-        int rc = -EINVAL;
+        int rc;
        rc = proto_register(&ieee802154_raw_prot, 1);
        if (rc)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 2b2b3d291ab0..1ab2fb6bb37d 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2145,7 +2145,7 @@ static int fn_trie_dump_leaf(struct key_vector *l, struct fib_table *tb,
                if (filter->dump_exceptions) {
                        err = fib_dump_info_fnhe(skb, cb, tb->tb_id, fi,
-                                                 &i_fa, s_fa);
+                                                 &i_fa, s_fa, flags);
                        if (err < 0)
                                goto stop;
                }
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 1510e951f451..4298aae74e0e 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -582,7 +582,13 @@ void __icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info,
        if (!rt)
                goto out;
-        net = dev_net(rt->dst.dev);
+        if (rt->dst.dev)
+                net = dev_net(rt->dst.dev);
+        else if (skb_in->dev)
+                net = dev_net(skb_in->dev);
+        else
+                goto out;
        /*
         *      Find the original header. It is expected to be valid, of course.
@@ -902,7 +908,7 @@ static bool icmp_redirect(struct sk_buff *skb)
                return false;
        }
-        icmp_socket_deliver(skb, icmp_hdr(skb)->un.gateway);
+        icmp_socket_deliver(skb, ntohl(icmp_hdr(skb)->un.gateway));
        return true;
 }
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 180f6896b98b..480d0b22db1a 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1475,7 +1475,7 @@ EXPORT_SYMBOL(__ip_mc_inc_group);
 void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 {
-        __ip_mc_inc_group(in_dev, addr, MCAST_EXCLUDE);
+        __ip_mc_inc_group(in_dev, addr, GFP_KERNEL);
 }
 EXPORT_SYMBOL(ip_mc_inc_group);
@@ -2197,7 +2197,7 @@ static int __ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr,
        iml->sflist = NULL;
        iml->sfmode = mode;
        rcu_assign_pointer(inet->mc_list, iml);
-        __ip_mc_inc_group(in_dev, addr, mode);
+        ____ip_mc_inc_group(in_dev, addr, mode, GFP_KERNEL);
        err = 0;
 done:
        return err;
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index d666756be5f1..10d31733297d 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -331,7 +331,7 @@ struct inet_frag_queue *inet_frag_find(struct fqdir *fqdir, void *key)
        prev = rhashtable_lookup(&fqdir->rhashtable, key, fqdir->f->rhash_params);
        if (!prev)
                fq = inet_frag_create(fqdir, key, &prev);
-        if (prev && !IS_ERR(prev)) {
+        if (!IS_ERR_OR_NULL(prev)) {
                fq = prev;
                if (!refcount_inc_not_zero(&fq->refcnt))
                        fq = NULL;
@@ -475,11 +475,12 @@ void *inet_frag_reasm_prepare(struct inet_frag_queue *q, struct sk_buff *skb,
 EXPORT_SYMBOL(inet_frag_reasm_prepare);
 void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
-                            void *reasm_data)
+                            void *reasm_data, bool try_coalesce)
 {
        struct sk_buff **nextp = (struct sk_buff **)reasm_data;
        struct rb_node *rbn;
        struct sk_buff *fp;
+        int sum_truesize;
        skb_push(head, head->data - skb_network_header(head));
@@ -487,25 +488,41 @@ void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
        fp = FRAG_CB(head)->next_frag;
        rbn = rb_next(&head->rbnode);
        rb_erase(&head->rbnode, &q->rb_fragments);
+        sum_truesize = head->truesize;
        while (rbn || fp) {
                /* fp points to the next sk_buff in the current run;
                 * rbn points to the next run.
                 */
                /* Go through the current run. */
                while (fp) {
-                        *nextp = fp;
+                        struct sk_buff *next_frag = FRAG_CB(fp)->next_frag;
-                        nextp = &fp->next;
+                        bool stolen;
-                        fp->prev = NULL;
+                        int delta;
-                        memset(&fp->rbnode, 0, sizeof(fp->rbnode));
-                        fp->sk = NULL;
+                        sum_truesize += fp->truesize;
-                        head->data_len += fp->len;
-                        head->len += fp->len;
                        if (head->ip_summed != fp->ip_summed)
                                head->ip_summed = CHECKSUM_NONE;
                        else if (head->ip_summed == CHECKSUM_COMPLETE)
                                head->csum = csum_add(head->csum, fp->csum);
-                        head->truesize += fp->truesize;
-                        fp = FRAG_CB(fp)->next_frag;
+                        if (try_coalesce && skb_try_coalesce(head, fp, &stolen,
+                                                             &delta)) {
+                                kfree_skb_partial(fp, stolen);
+                        } else {
+                                fp->prev = NULL;
+                                memset(&fp->rbnode, 0, sizeof(fp->rbnode));
+                                fp->sk = NULL;
+                                head->data_len += fp->len;
+                                head->len += fp->len;
+                                head->truesize += fp->truesize;
+                                *nextp = fp;
+                                nextp = &fp->next;
+                        }
+                        fp = next_frag;
                }
                /* Move to the next run. */
                if (rbn) {
@@ -516,7 +533,7 @@ void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
                        rbn = rbnext;
                }
        }
-        sub_frag_mem_limit(q->fqdir, head->truesize);
+        sub_frag_mem_limit(q->fqdir, sum_truesize);
        *nextp = NULL;
        skb_mark_not_on_list(head);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 4385eb9e781f..cfeb8890f94e 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -393,6 +393,11 @@ err:
        return err;
 }
+static bool ip_frag_coalesce_ok(const struct ipq *qp)
+{
+        return qp->q.key.v4.user == IP_DEFRAG_LOCAL_DELIVER;
+}
 /* Build a new IP datagram from all its fragments. */
 static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
                         struct sk_buff *prev_tail, struct net_device *dev)
@@ -421,7 +426,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
        if (len > 65535)
                goto out_oversize;
-        inet_frag_reasm_finish(&qp->q, skb, reasm_data);
+        inet_frag_reasm_finish(&qp->q, skb, reasm_data,
+                               ip_frag_coalesce_ok(qp));
        skb->dev = dev;
        IPCB(skb)->frag_max_size = max(qp->max_df_size, qp->q.max_size);
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 43adfc1641ba..2f01cf6fa0de 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -275,6 +275,9 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb,
        const struct iphdr  *tiph = &tunnel->parms.iph;
        u8 ipproto;
+        if (!pskb_inet_may_pull(skb))
+                goto tx_error;
        switch (skb->protocol) {
        case htons(ETH_P_IP):
                ipproto = IPPROTO_IPIP;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 517300d587a7..b6a6f18c3dd1 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2728,7 +2728,8 @@ EXPORT_SYMBOL_GPL(ip_route_output_flow);
 /* called with rcu_read_lock held */
 static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
                        struct rtable *rt, u32 table_id, struct flowi4 *fl4,
-                        struct sk_buff *skb, u32 portid, u32 seq)
+                        struct sk_buff *skb, u32 portid, u32 seq,
+                        unsigned int flags)
 {
        struct rtmsg *r;
        struct nlmsghdr *nlh;
@@ -2736,7 +2737,7 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
        u32 error;
        u32 metrics[RTAX_MAX];
-        nlh = nlmsg_put(skb, portid, seq, RTM_NEWROUTE, sizeof(*r), 0);
+        nlh = nlmsg_put(skb, portid, seq, RTM_NEWROUTE, sizeof(*r), flags);
        if (!nlh)
                return -EMSGSIZE;
@@ -2860,7 +2861,7 @@ nla_put_failure:
 static int fnhe_dump_bucket(struct net *net, struct sk_buff *skb,
                            struct netlink_callback *cb, u32 table_id,
                            struct fnhe_hash_bucket *bucket, int genid,
-                            int *fa_index, int fa_start)
+                            int *fa_index, int fa_start, unsigned int flags)
 {
        int i;
@@ -2891,7 +2892,7 @@ static int fnhe_dump_bucket(struct net *net, struct sk_buff *skb,
                        err = rt_fill_info(net, fnhe->fnhe_daddr, 0, rt,
                                           table_id, NULL, skb,
                                           NETLINK_CB(cb->skb).portid,
-                                           cb->nlh->nlmsg_seq);
+                                           cb->nlh->nlmsg_seq, flags);
                        if (err)
                                return err;
 next:
@@ -2904,7 +2905,7 @@ next:
 int fib_dump_info_fnhe(struct sk_buff *skb, struct netlink_callback *cb,
                       u32 table_id, struct fib_info *fi,
-                       int *fa_index, int fa_start)
+                       int *fa_index, int fa_start, unsigned int flags)
 {
        struct net *net = sock_net(cb->skb->sk);
        int nhsel, genid = fnhe_genid(net);
@@ -2922,7 +2923,8 @@ int fib_dump_info_fnhe(struct sk_buff *skb, struct netlink_callback *cb,
                err = 0;
                if (bucket)
                        err = fnhe_dump_bucket(net, skb, cb, table_id, bucket,
-                                               genid, fa_index, fa_start);
+                                               genid, fa_index, fa_start,
+                                               flags);
                rcu_read_unlock();
                if (err)
                        return err;
@@ -3183,7 +3185,8 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                                    fl4.flowi4_tos, res.fi, 0);
        } else {
                err = rt_fill_info(net, dst, src, rt, table_id, &fl4, skb,
-                                   NETLINK_CB(in_skb).portid, nlh->nlmsg_seq);
+                                   NETLINK_CB(in_skb).portid,
+                                   nlh->nlmsg_seq, 0);
        }
        if (err < 0)
                goto errout_rcu;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 776905899ac0..61082065b26a 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -935,6 +935,22 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags)
        return mss_now;
 }
+/* In some cases, both sendpage() and sendmsg() could have added
+ * an skb to the write queue, but failed adding payload on it.
+ * We need to remove it to consume less memory, but more
+ * importantly be able to generate EPOLLOUT for Edge Trigger epoll()
+ * users.
+ */
+static void tcp_remove_empty_skb(struct sock *sk, struct sk_buff *skb)
+{
+        if (skb && !skb->len) {
+                tcp_unlink_write_queue(skb, sk);
+                if (tcp_write_queue_empty(sk))
+                        tcp_chrono_stop(sk, TCP_CHRONO_BUSY);
+                sk_wmem_free_skb(sk, skb);
+        }
+}
 ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset,
                         size_t size, int flags)
 {
@@ -984,6 +1000,9 @@ new_segment:
                        if (!skb)
                                goto wait_for_memory;
+#ifdef CONFIG_TLS_DEVICE
+                        skb->decrypted = !!(flags & MSG_SENDPAGE_DECRYPTED);
+#endif
                        skb_entail(sk, skb);
                        copy = size_goal;
                }
@@ -1061,6 +1080,7 @@ out:
        return copied;
 do_error:
+        tcp_remove_empty_skb(sk, tcp_write_queue_tail(sk));
        if (copied)
                goto out;
 out_err:
@@ -1385,18 +1405,11 @@ out_nopush:
        sock_zerocopy_put(uarg);
        return copied + copied_syn;
+do_error:
+        skb = tcp_write_queue_tail(sk);
 do_fault:
-        if (!skb->len) {
+        tcp_remove_empty_skb(sk, skb);
-                tcp_unlink_write_queue(skb, sk);
-                /* It is the one place in all of TCP, except connection
-                 * reset, where we can be unlinking the send_head.
-                 */
-                if (tcp_write_queue_empty(sk))
-                        tcp_chrono_stop(sk, TCP_CHRONO_BUSY);
-                sk_wmem_free_skb(sk, skb);
-        }
-do_error:
        if (copied + copied_syn)
                goto out;
 out_err:
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index 3d1e15401384..8a56e09cfb0e 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -398,10 +398,14 @@ more_data:
 static int tcp_bpf_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
 {
        struct sk_msg tmp, *msg_tx = NULL;
-        int flags = msg->msg_flags | MSG_NO_SHARED_FRAGS;
        int copied = 0, err = 0;
        struct sk_psock *psock;
        long timeo;
+        int flags;
+        /* Don't let internal do_tcp_sendpages() flags through */
+        flags = (msg->msg_flags & ~MSG_SENDPAGE_DECRYPTED);
+        flags |= MSG_NO_SHARED_FRAGS;
        psock = sk_psock_get(sk);
        if (unlikely(!psock))
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 6e4afc48d7bb..8a645f304e6c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1320,6 +1320,7 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
        buff = sk_stream_alloc_skb(sk, nsize, gfp, true);
        if (!buff)
                return -ENOMEM; /* We'll just try again later. */
+        skb_copy_decrypted(buff, skb);
        sk->sk_wmem_queued += buff->truesize;
        sk_mem_charge(sk, buff->truesize);
@@ -1874,6 +1875,7 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
        buff = sk_stream_alloc_skb(sk, 0, gfp, true);
        if (unlikely(!buff))
                return -ENOMEM;
+        skb_copy_decrypted(buff, skb);
        sk->sk_wmem_queued += buff->truesize;
        sk_mem_charge(sk, buff->truesize);
@@ -2051,7 +2053,7 @@ static bool tcp_can_coalesce_send_queue_head(struct sock *sk, int len)
                if (len <= skb->len)
                        break;
-                if (unlikely(TCP_SKB_CB(skb)->eor))
+                if (unlikely(TCP_SKB_CB(skb)->eor) || tcp_has_tx_tstamp(skb))
                        return false;
                len -= skb->len;
@@ -2143,6 +2145,7 @@ static int tcp_mtu_probe(struct sock *sk)
        sk_mem_charge(sk, nskb->truesize);
        skb = tcp_send_head(sk);
+        skb_copy_decrypted(nskb, skb);
        TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(skb)->seq;
        TCP_SKB_CB(nskb)->end_seq = TCP_SKB_CB(skb)->seq + probe_size;
@@ -2167,6 +2170,7 @@ static int tcp_mtu_probe(struct sock *sk)
                         * we need to propagate it to the new skb.
                         */
                        TCP_SKB_CB(nskb)->eor = TCP_SKB_CB(skb)->eor;
+                        tcp_skb_collapse_tstamp(nskb, skb);
                        tcp_unlink_write_queue(skb, sk);
                        sk_wmem_free_skb(sk, skb);
                } else {
diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c
index 3d8a1d835471..4849edb62d52 100644
--- a/net/ipv4/tcp_ulp.c
+++ b/net/ipv4/tcp_ulp.c
@@ -96,6 +96,19 @@ void tcp_get_available_ulp(char *buf, size_t maxlen)
        rcu_read_unlock();
 }
+void tcp_update_ulp(struct sock *sk, struct proto *proto)
+{
+        struct inet_connection_sock *icsk = inet_csk(sk);
+        if (!icsk->icsk_ulp_ops) {
+                sk->sk_prot = proto;
+                return;
+        }
+        if (icsk->icsk_ulp_ops->update)
+                icsk->icsk_ulp_ops->update(sk, proto);
+}
 void tcp_cleanup_ulp(struct sock *sk)
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index dc73888c7859..6a576ff92c39 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -478,7 +478,7 @@ static struct inet6_dev *ipv6_find_idev(struct net_device *dev)
        if (!idev) {
                idev = ipv6_add_dev(dev);
                if (IS_ERR(idev))
-                        return NULL;
+                        return idev;
        }
        if (dev->flags&IFF_UP)
@@ -1045,7 +1045,8 @@ ipv6_add_addr(struct inet6_dev *idev, struct ifa6_config *cfg,
        int err = 0;
        if (addr_type == IPV6_ADDR_ANY ||
-            addr_type & IPV6_ADDR_MULTICAST ||
+            (addr_type & IPV6_ADDR_MULTICAST &&
+             !(cfg->ifa_flags & IFA_F_MCAUTOJOIN)) ||
            (!(idev->dev->flags & IFF_LOOPBACK) &&
             !netif_is_l3_master(idev->dev) &&
             addr_type & IPV6_ADDR_LOOPBACK))
@@ -2465,8 +2466,8 @@ static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
        ASSERT_RTNL();
        idev = ipv6_find_idev(dev);
-        if (!idev)
+        if (IS_ERR(idev))
-                return ERR_PTR(-ENOBUFS);
+                return idev;
        if (idev->cnf.disable_ipv6)
                return ERR_PTR(-EACCES);
@@ -3158,7 +3159,7 @@ static void init_loopback(struct net_device *dev)
        ASSERT_RTNL();
        idev = ipv6_find_idev(dev);
-        if (!idev) {
+        if (IS_ERR(idev)) {
                pr_debug("%s: add_dev failed\n", __func__);
                return;
        }
@@ -3373,7 +3374,7 @@ static void addrconf_sit_config(struct net_device *dev)
         */
        idev = ipv6_find_idev(dev);
-        if (!idev) {
+        if (IS_ERR(idev)) {
                pr_debug("%s: add_dev failed\n", __func__);
                return;
        }
@@ -3398,7 +3399,7 @@ static void addrconf_gre_config(struct net_device *dev)
        ASSERT_RTNL();
        idev = ipv6_find_idev(dev);
-        if (!idev) {
+        if (IS_ERR(idev)) {
                pr_debug("%s: add_dev failed\n", __func__);
                return;
        }
@@ -4772,8 +4773,8 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh,
                         IFA_F_MCAUTOJOIN | IFA_F_OPTIMISTIC;
        idev = ipv6_find_idev(dev);
-        if (!idev)
+        if (IS_ERR(idev))
-                return -ENOBUFS;
+                return PTR_ERR(idev);
        if (!ipv6_allow_optimistic_dad(net, idev))
                cfg.ifa_flags &= ~IFA_F_OPTIMISTIC;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index c2049c72f3e5..dd2d0b963260 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -660,12 +660,13 @@ static int prepare_ip6gre_xmit_ipv6(struct sk_buff *skb,
                                    struct flowi6 *fl6, __u8 *dsfield,
                                    int *encap_limit)
 {
-        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+        struct ipv6hdr *ipv6h;
        struct ip6_tnl *t = netdev_priv(dev);
        __u16 offset;
        offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
        /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
+        ipv6h = ipv6_hdr(skb);
        if (offset > 0) {
                struct ipv6_tlv_tnl_enc_lim *tel;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 3134fbb65d7f..754a484d35df 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1278,12 +1278,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        }
        fl6.flowi6_uid = sock_net_uid(dev_net(dev), NULL);
+        dsfield = INET_ECN_encapsulate(dsfield, ipv4_get_dsfield(iph));
        if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
                return -1;
-        dsfield = INET_ECN_encapsulate(dsfield, ipv4_get_dsfield(iph));
        skb_set_inner_ipproto(skb, IPPROTO_IPIP);
        err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
@@ -1367,12 +1366,11 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        }
        fl6.flowi6_uid = sock_net_uid(dev_net(dev), NULL);
+        dsfield = INET_ECN_encapsulate(dsfield, ipv6_get_dsfield(ipv6h));
        if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
                return -1;
-        dsfield = INET_ECN_encapsulate(dsfield, ipv6_get_dsfield(ipv6h));
        skb_set_inner_ipproto(skb, IPPROTO_IPV6);
        err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 7f3f13c37916..eaa4c2cc2fbb 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -787,14 +787,15 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
        if (pmc) {
                im->idev = pmc->idev;
                if (im->mca_sfmode == MCAST_INCLUDE) {
-                        im->mca_tomb = pmc->mca_tomb;
+                        swap(im->mca_tomb, pmc->mca_tomb);
-                        im->mca_sources = pmc->mca_sources;
+                        swap(im->mca_sources, pmc->mca_sources);
                        for (psf = im->mca_sources; psf; psf = psf->sf_next)
                                psf->sf_crcount = idev->mc_qrv;
                } else {
                        im->mca_crcount = idev->mc_qrv;
                }
                in6_dev_put(pmc->idev);
+                ip6_mc_clear_src(pmc);
                kfree(pmc);
        }
        spin_unlock_bh(&im->mca_lock);
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 0f82c150543b..fed9666a2f7d 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -348,7 +348,7 @@ static int nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *skb,
        skb_reset_transport_header(skb);
-        inet_frag_reasm_finish(&fq->q, skb, reasm_data);
+        inet_frag_reasm_finish(&fq->q, skb, reasm_data, false);
        skb->ignore_df = 1;
        skb->dev = dev;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index ca05b16f1bb9..1f5d4d196dcc 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -282,7 +282,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *skb,
        skb_reset_transport_header(skb);
-        inet_frag_reasm_finish(&fq->q, skb, reasm_data);
+        inet_frag_reasm_finish(&fq->q, skb, reasm_data, true);
        skb->dev = dev;
        ipv6_hdr(skb)->payload_len = htons(payload_len);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index e49fec767a10..fd059e08785a 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1951,7 +1951,7 @@ static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
                nexthop_for_each_fib6_nh(from->nh, fib6_nh_find_match, &arg);
                if (!arg.match)
-                        return;
+                        goto unlock;
                fib6_nh = arg.match;
        } else {
                fib6_nh = from->fib6_nh;
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 09e1694b6d34..ebb62a4ebe30 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -512,7 +512,9 @@ static void iucv_sock_close(struct sock *sk)
                        sk->sk_state = IUCV_DISCONN;
                        sk->sk_state_change(sk);
                }
-        case IUCV_DISCONN:   /* fall through */
+                /* fall through */
+        case IUCV_DISCONN:
                sk->sk_state = IUCV_CLOSING;
                sk->sk_state_change(sk);
@@ -525,8 +527,9 @@ static void iucv_sock_close(struct sock *sk)
                                        iucv_sock_in_state(sk, IUCV_CLOSED, 0),
                                        timeo);
                }
+                /* fall through */
-        case IUCV_CLOSING:   /* fall through */
+        case IUCV_CLOSING:
                sk->sk_state = IUCV_CLOSED;
                sk->sk_state_change(sk);
@@ -535,8 +538,9 @@ static void iucv_sock_close(struct sock *sk)
                skb_queue_purge(&iucv->send_skb_q);
                skb_queue_purge(&iucv->backlog_skb_q);
+                /* fall through */
-        default:   /* fall through */
+        default:
                iucv_sever_path(sk, 1);
        }
@@ -2247,10 +2251,10 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
                        kfree_skb(skb);
                        break;
                }
-                /* fall through and receive non-zero length data */
+                /* fall through - and receive non-zero length data */
        case (AF_IUCV_FLAG_SHT):
                /* shutdown request */
-                /* fall through and receive zero length data */
+                /* fall through - and receive zero length data */
        case 0:
                /* plain data frame */
                IUCV_SKB_CB(skb)->class = trans_hdr->iucv_hdr.class;
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 1d0e5904dedf..c54cb59593ef 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1681,6 +1681,9 @@ static const struct proto_ops pppol2tp_ops = {
        .recvmsg        = pppol2tp_recvmsg,
        .mmap           = sock_no_mmap,
        .ioctl          = pppox_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl = pppox_compat_ioctl,
+#endif
 };
 static const struct pppox_proto pppol2tp_proto = {
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 4d458067d80d..111c400199ec 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1546,6 +1546,11 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        if (is_multicast_ether_addr(mac))
                return -EINVAL;
+        if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER) &&
+            sdata->vif.type == NL80211_IFTYPE_STATION &&
+            !sdata->u.mgd.associated)
+                return -EINVAL;
        sta = sta_info_alloc(sdata, mac, GFP_KERNEL);
        if (!sta)
                return -ENOMEM;
@@ -1553,10 +1558,6 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
        if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
                sta->sta.tdls = true;
-        if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION &&
-            !sdata->u.mgd.associated)
-                return -EINVAL;
        err = sta_apply_parameters(local, sta, params);
        if (err) {
                sta_info_free(local, sta);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 06aac0aaae64..8dc6580e1787 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1222,7 +1222,6 @@ static void ieee80211_if_setup(struct net_device *dev)
 static void ieee80211_if_setup_no_queue(struct net_device *dev)
 {
        ieee80211_if_setup(dev);
-        dev->features |= NETIF_F_LLTX;
        dev->priv_flags |= IFF_NO_QUEUE;
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a99ad0325309..4c888dc9bd81 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2042,6 +2042,16 @@ ieee80211_sta_wmm_params(struct ieee80211_local *local,
                ieee80211_regulatory_limit_wmm_params(sdata, &params[ac], ac);
        }
+        /* WMM specification requires all 4 ACIs. */
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                if (params[ac].cw_min == 0) {
+                        sdata_info(sdata,
+                                   "AP has invalid WMM params (missing AC %d), using defaults\n",
+                                   ac);
+                        return false;
+                }
+        }
        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                mlme_dbg(sdata,
                         "WMM AC=%d acm=%d aifs=%d cWmin=%d cWmax=%d txop=%d uapsd=%d, downgraded=%d\n",
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 3c1ab870fefe..768d14c9a716 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2447,11 +2447,13 @@ static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
                      skb->protocol == cpu_to_be16(ETH_P_PREAUTH)) &&
                     sdata->control_port_over_nl80211)) {
                struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-                bool noencrypt = status->flag & RX_FLAG_DECRYPTED;
+                bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);
                cfg80211_rx_control_port(dev, skb, noencrypt);
                dev_kfree_skb(skb);
        } else {
+                memset(skb->cb, 0, sizeof(skb->cb));
                /* deliver to local stack */
                if (rx->napi)
                        napi_gro_receive(rx->napi, skb);
@@ -2546,8 +2548,6 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
        if (skb) {
                skb->protocol = eth_type_trans(skb, dev);
-                memset(skb->cb, 0, sizeof(skb->cb));
                ieee80211_deliver_skb_to_local_stack(skb, rx);
        }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 1b224fa27367..ad1e58184c4e 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -3796,9 +3796,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
        }
        /* Always allow software iftypes */
-        if (local->hw.wiphy->software_iftypes & BIT(iftype) ||
+        if (cfg80211_iftype_allowed(local->hw.wiphy, iftype, 0, 1)) {
-            (iftype == NL80211_IFTYPE_AP_VLAN &&
-             local->hw.wiphy->flags & WIPHY_FLAG_4ADDR_AP)) {
                if (radar_detect)
                        return -EINVAL;
                return 0;
@@ -3833,7 +3831,8 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
                if (sdata_iter == sdata ||
                    !ieee80211_sdata_running(sdata_iter) ||
-                    local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
+                    cfg80211_iftype_allowed(local->hw.wiphy,
+                                            wdev_iter->iftype, 0, 1))
                        continue;
                params.iftype_num[wdev_iter->iftype]++;
diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
index d25e91d7bdc1..44b675016393 100644
--- a/net/mpls/mpls_iptunnel.c
+++ b/net/mpls/mpls_iptunnel.c
@@ -133,12 +133,12 @@ static int mpls_xmit(struct sk_buff *skb)
        mpls_stats_inc_outucastpkts(out_dev, skb);
        if (rt) {
-                if (rt->rt_gw_family == AF_INET)
+                if (rt->rt_gw_family == AF_INET6)
-                        err = neigh_xmit(NEIGH_ARP_TABLE, out_dev, &rt->rt_gw4,
-                                         skb);
-                else if (rt->rt_gw_family == AF_INET6)
                        err = neigh_xmit(NEIGH_ND_TABLE, out_dev, &rt->rt_gw6,
                                         skb);
+                else
+                        err = neigh_xmit(NEIGH_ARP_TABLE, out_dev, &rt->rt_gw4,
+                                         skb);
        } else if (rt6) {
                if (ipv6_addr_v4mapped(&rt6->rt6i_gateway)) {
                        /* 6PE (RFC 4798) */
diff --git a/net/ncsi/ncsi-cmd.c b/net/ncsi/ncsi-cmd.c
index 5c3fad8cba57..0187e65176c0 100644
--- a/net/ncsi/ncsi-cmd.c
+++ b/net/ncsi/ncsi-cmd.c
@@ -54,7 +54,7 @@ static void ncsi_cmd_build_header(struct ncsi_pkt_hdr *h,
        checksum = ncsi_calculate_checksum((unsigned char *)h,
                                           sizeof(*h) + nca->payload);
        pchecksum = (__be32 *)((void *)h + sizeof(struct ncsi_pkt_hdr) +
-                    nca->payload);
+                    ALIGN(nca->payload, 4));
        *pchecksum = htonl(checksum);
 }
@@ -309,14 +309,21 @@ static struct ncsi_request *ncsi_alloc_command(struct ncsi_cmd_arg *nca)
 int ncsi_xmit_cmd(struct ncsi_cmd_arg *nca)
 {
+        struct ncsi_cmd_handler *nch = NULL;
        struct ncsi_request *nr;
+        unsigned char type;
        struct ethhdr *eh;
-        struct ncsi_cmd_handler *nch = NULL;
        int i, ret;
+        /* Use OEM generic handler for Netlink request */
+        if (nca->req_flags == NCSI_REQ_FLAG_NETLINK_DRIVEN)
+                type = NCSI_PKT_CMD_OEM;
+        else
+                type = nca->type;
        /* Search for the handler */
        for (i = 0; i < ARRAY_SIZE(ncsi_cmd_handlers); i++) {
-                if (ncsi_cmd_handlers[i].type == nca->type) {
+                if (ncsi_cmd_handlers[i].type == type) {
                        if (ncsi_cmd_handlers[i].handler)
                                nch = &ncsi_cmd_handlers[i];
                        else
diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
index 7581bf919885..d876bd55f356 100644
--- a/net/ncsi/ncsi-rsp.c
+++ b/net/ncsi/ncsi-rsp.c
@@ -47,7 +47,8 @@ static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
        if (ntohs(h->code) != NCSI_PKT_RSP_C_COMPLETED ||
            ntohs(h->reason) != NCSI_PKT_RSP_R_NO_ERROR) {
                netdev_dbg(nr->ndp->ndev.dev,
-                           "NCSI: non zero response/reason code\n");
+                           "NCSI: non zero response/reason code %04xh, %04xh\n",
+                            ntohs(h->code), ntohs(h->reason));
                return -EPERM;
        }
@@ -55,7 +56,7 @@ static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
         * sender doesn't support checksum according to NCSI
         * specification.
         */
-        pchecksum = (__be32 *)((void *)(h + 1) + payload - 4);
+        pchecksum = (__be32 *)((void *)(h + 1) + ALIGN(payload, 4) - 4);
        if (ntohl(*pchecksum) == 0)
                return 0;
@@ -63,7 +64,9 @@ static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
                                           sizeof(*h) + payload - 4);
        if (*pchecksum != htonl(checksum)) {
-                netdev_dbg(nr->ndp->ndev.dev, "NCSI: checksum mismatched\n");
+                netdev_dbg(nr->ndp->ndev.dev,
+                           "NCSI: checksum mismatched; recd: %08x calc: %08x\n",
+                           *pchecksum, htonl(checksum));
                return -EINVAL;
        }
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index ca7ac4a25ada..1d4e63326e68 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -226,7 +226,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
        e.id = ip_to_id(map, ip);
-        if (opt->flags & IPSET_DIM_ONE_SRC)
+        if (opt->flags & IPSET_DIM_TWO_SRC)
                ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
        else
                ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 2e151856ad99..e64d5f9a89dd 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1161,7 +1161,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
                return -ENOENT;
        write_lock_bh(&ip_set_ref_lock);
-        if (set->ref != 0) {
+        if (set->ref != 0 || set->ref_netlink != 0) {
                ret = -IPSET_ERR_REFERENCED;
                goto out;
        }
diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
index faf59b6a998f..24d8f4df4230 100644
--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
+++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
@@ -89,15 +89,11 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
        struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
        struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
-         /* MAC can be src only */
-        if (!(opt->flags & IPSET_DIM_TWO_SRC))
-                return 0;
        if (skb_mac_header(skb) < skb->head ||
            (skb_mac_header(skb) + ETH_HLEN) > skb->data)
                return -EINVAL;
-        if (opt->flags & IPSET_DIM_ONE_SRC)
+        if (opt->flags & IPSET_DIM_TWO_SRC)
                ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
        else
                ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index a542761e90d1..81a8ef42b88d 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -453,13 +453,12 @@ EXPORT_SYMBOL_GPL(nf_ct_invert_tuple);
 * table location, we assume id gets exposed to userspace.
 *
 * Following nf_conn items do not change throughout lifetime
- * of the nf_conn after it has been committed to main hash table:
+ * of the nf_conn:
 *
 * 1. nf_conn address
- * 2. nf_conn->ext address
+ * 2. nf_conn->master address (normally NULL)
- * 3. nf_conn->master address (normally NULL)
+ * 3. the associated net namespace
- * 4. tuple
+ * 4. the original direction tuple
- * 5. the associated net namespace
 */
 u32 nf_ct_get_id(const struct nf_conn *ct)
 {
@@ -469,9 +468,10 @@ u32 nf_ct_get_id(const struct nf_conn *ct)
        net_get_random_once(&ct_id_seed, sizeof(ct_id_seed));
        a = (unsigned long)ct;
-        b = (unsigned long)ct->master ^ net_hash_mix(nf_ct_net(ct));
+        b = (unsigned long)ct->master;
-        c = (unsigned long)ct->ext;
+        c = (unsigned long)nf_ct_net(ct);
-        d = (unsigned long)siphash(&ct->tuplehash, sizeof(ct->tuplehash),
+        d = (unsigned long)siphash(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                                   sizeof(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple),
                                   &ct_id_seed);
 #ifdef CONFIG_64BIT
        return siphash_4u64((u64)a, (u64)b, (u64)c, (u64)d, &ct_id_seed);
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 0ecb3e289ef2..8d96738b7dfd 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -322,7 +322,7 @@ static int find_pattern(const char *data, size_t dlen,
                i++;
        }
-        pr_debug("Skipped up to `%c'!\n", skip);
+        pr_debug("Skipped up to 0x%hhx delimiter!\n", skip);
        *numoff = i;
        *numlen = getnum(data + i, dlen - i, cmd, term, numoff);
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index e0d392cb3075..0006503d2da9 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -1037,9 +1037,14 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
        table[NF_SYSCTL_CT_COUNT].data = &net->ct.count;
        table[NF_SYSCTL_CT_CHECKSUM].data = &net->ct.sysctl_checksum;
        table[NF_SYSCTL_CT_LOG_INVALID].data = &net->ct.sysctl_log_invalid;
+        table[NF_SYSCTL_CT_ACCT].data = &net->ct.sysctl_acct;
+        table[NF_SYSCTL_CT_HELPER].data = &net->ct.sysctl_auto_assign_helper;
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
        table[NF_SYSCTL_CT_EVENTS].data = &net->ct.sysctl_events;
 #endif
+#ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
+        table[NF_SYSCTL_CT_TIMESTAMP].data = &net->ct.sysctl_tstamp;
+#endif
        table[NF_SYSCTL_CT_PROTO_TIMEOUT_GENERIC].data = &nf_generic_pernet(net)->timeout;
        table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMP].data = &nf_icmp_pernet(net)->timeout;
        table[NF_SYSCTL_CT_PROTO_TIMEOUT_ICMPV6].data = &nf_icmpv6_pernet(net)->timeout;
diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index e3d797252a98..80a8f9ae4c93 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -111,15 +111,16 @@ static void flow_offload_fixup_tcp(struct ip_ct_tcp *tcp)
 #define NF_FLOWTABLE_TCP_PICKUP_TIMEOUT (120 * HZ)
 #define NF_FLOWTABLE_UDP_PICKUP_TIMEOUT (30 * HZ)
-static void flow_offload_fixup_ct_state(struct nf_conn *ct)
+static inline __s32 nf_flow_timeout_delta(unsigned int timeout)
+{
+        return (__s32)(timeout - (u32)jiffies);
+}
+static void flow_offload_fixup_ct_timeout(struct nf_conn *ct)
 {
        const struct nf_conntrack_l4proto *l4proto;
+        int l4num = nf_ct_protonum(ct);
        unsigned int timeout;
-        int l4num;
-        l4num = nf_ct_protonum(ct);
-        if (l4num == IPPROTO_TCP)
-                flow_offload_fixup_tcp(&ct->proto.tcp);
        l4proto = nf_ct_l4proto_find(l4num);
        if (!l4proto)
@@ -132,7 +133,20 @@ static void flow_offload_fixup_ct_state(struct nf_conn *ct)
        else
                return;
-        ct->timeout = nfct_time_stamp + timeout;
+        if (nf_flow_timeout_delta(ct->timeout) > (__s32)timeout)
+                ct->timeout = nfct_time_stamp + timeout;
+}
+static void flow_offload_fixup_ct_state(struct nf_conn *ct)
+{
+        if (nf_ct_protonum(ct) == IPPROTO_TCP)
+                flow_offload_fixup_tcp(&ct->proto.tcp);
+}
+static void flow_offload_fixup_ct(struct nf_conn *ct)
+{
+        flow_offload_fixup_ct_state(ct);
+        flow_offload_fixup_ct_timeout(ct);
 }
 void flow_offload_free(struct flow_offload *flow)
@@ -208,6 +222,11 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
 }
 EXPORT_SYMBOL_GPL(flow_offload_add);
+static inline bool nf_flow_has_expired(const struct flow_offload *flow)
+{
+        return nf_flow_timeout_delta(flow->timeout) <= 0;
+}
 static void flow_offload_del(struct nf_flowtable *flow_table,
                             struct flow_offload *flow)
 {
@@ -223,6 +242,11 @@ static void flow_offload_del(struct nf_flowtable *flow_table,
        e = container_of(flow, struct flow_offload_entry, flow);
        clear_bit(IPS_OFFLOAD_BIT, &e->ct->status);
+        if (nf_flow_has_expired(flow))
+                flow_offload_fixup_ct(e->ct);
+        else if (flow->flags & FLOW_OFFLOAD_TEARDOWN)
+                flow_offload_fixup_ct_timeout(e->ct);
        flow_offload_free(flow);
 }
@@ -298,11 +322,6 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table,
        return err;
 }
-static inline bool nf_flow_has_expired(const struct flow_offload *flow)
-{
-        return (__s32)(flow->timeout - (u32)jiffies) <= 0;
-}
 static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)
 {
        struct nf_flowtable *flow_table = data;
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index cdfc33517e85..b9e7dd6e60ce 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -214,6 +214,24 @@ static bool nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
        return true;
 }
+static int nf_flow_offload_dst_check(struct dst_entry *dst)
+{
+        if (unlikely(dst_xfrm(dst)))
+                return dst_check(dst, 0) ? 0 : -1;
+        return 0;
+}
+static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
+                                      const struct nf_hook_state *state,
+                                      struct dst_entry *dst)
+{
+        skb_orphan(skb);
+        skb_dst_set_noref(skb, dst);
+        dst_output(state->net, state->sk, skb);
+        return NF_STOLEN;
+}
 unsigned int
 nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
                        const struct nf_hook_state *state)
@@ -254,12 +272,25 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
        if (nf_flow_state_check(flow, ip_hdr(skb)->protocol, skb, thoff))
                return NF_ACCEPT;
+        if (nf_flow_offload_dst_check(&rt->dst)) {
+                flow_offload_teardown(flow);
+                return NF_ACCEPT;
+        }
        if (nf_flow_nat_ip(flow, skb, thoff, dir) < 0)
                return NF_DROP;
        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
        iph = ip_hdr(skb);
        ip_decrease_ttl(iph);
+        skb->tstamp = 0;
+        if (unlikely(dst_xfrm(&rt->dst))) {
+                memset(skb->cb, 0, sizeof(struct inet_skb_parm));
+                IPCB(skb)->iif = skb->dev->ifindex;
+                IPCB(skb)->flags = IPSKB_FORWARDED;
+                return nf_flow_xmit_xfrm(skb, state, &rt->dst);
+        }
        skb->dev = outdev;
        nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
@@ -467,6 +498,11 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
                                sizeof(*ip6h)))
                return NF_ACCEPT;
+        if (nf_flow_offload_dst_check(&rt->dst)) {
+                flow_offload_teardown(flow);
+                return NF_ACCEPT;
+        }
        if (skb_try_make_writable(skb, sizeof(*ip6h)))
                return NF_DROP;
@@ -476,6 +512,14 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
        flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
        ip6h = ipv6_hdr(skb);
        ip6h->hop_limit--;
+        skb->tstamp = 0;
+        if (unlikely(dst_xfrm(&rt->dst))) {
+                memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
+                IP6CB(skb)->iif = skb->dev->ifindex;
+                IP6CB(skb)->flags = IP6SKB_FORWARDED;
+                return nf_flow_xmit_xfrm(skb, state, &rt->dst);
+        }
        skb->dev = outdev;
        nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 605a7cfe7ca7..d47469f824a1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -138,9 +138,14 @@ static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
                return;
        list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
-                if (trans->msg_type == NFT_MSG_NEWSET &&
+                switch (trans->msg_type) {
-                    nft_trans_set(trans) == set) {
+                case NFT_MSG_NEWSET:
-                        set->bound = true;
+                        if (nft_trans_set(trans) == set)
+                                nft_trans_set_bound(trans) = true;
+                        break;
+                case NFT_MSG_NEWSETELEM:
+                        if (nft_trans_elem_set(trans) == set)
+                                nft_trans_elem_set_bound(trans) = true;
                        break;
                }
        }
@@ -1662,6 +1667,10 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
                chain->flags |= NFT_BASE_CHAIN | flags;
                basechain->policy = NF_ACCEPT;
+                if (chain->flags & NFT_CHAIN_HW_OFFLOAD &&
+                    nft_chain_offload_priority(basechain) < 0)
+                        return -EOPNOTSUPP;
                flow_block_init(&basechain->flow_block);
        } else {
                chain = kzalloc(sizeof(*chain), GFP_KERNEL);
@@ -6906,7 +6915,7 @@ static int __nf_tables_abort(struct net *net)
                        break;
                case NFT_MSG_NEWSET:
                        trans->ctx.table->use--;
-                        if (nft_trans_set(trans)->bound) {
+                        if (nft_trans_set_bound(trans)) {
                                nft_trans_destroy(trans);
                                break;
                        }
@@ -6918,7 +6927,7 @@ static int __nf_tables_abort(struct net *net)
                        nft_trans_destroy(trans);
                        break;
                case NFT_MSG_NEWSETELEM:
-                        if (nft_trans_elem_set(trans)->bound) {
+                        if (nft_trans_elem_set_bound(trans)) {
                                nft_trans_destroy(trans);
                                break;
                        }
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 64f5fd5f240e..c0d18c1d77ac 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -103,10 +103,11 @@ void nft_offload_update_dependency(struct nft_offload_ctx *ctx,
 }
 static void nft_flow_offload_common_init(struct flow_cls_common_offload *common,
-                                         __be16 proto,
+                                         __be16 proto, int priority,
-                                        struct netlink_ext_ack *extack)
+                                         struct netlink_ext_ack *extack)
 {
        common->protocol = proto;
+        common->prio = priority;
        common->extack = extack;
 }
@@ -124,6 +125,15 @@ static int nft_setup_cb_call(struct nft_base_chain *basechain,
        return 0;
 }
+int nft_chain_offload_priority(struct nft_base_chain *basechain)
+{
+        if (basechain->ops.priority <= 0 ||
+            basechain->ops.priority > USHRT_MAX)
+                return -1;
+        return 0;
+}
 static int nft_flow_offload_rule(struct nft_trans *trans,
                                 enum flow_cls_command command)
 {
@@ -142,7 +152,8 @@ static int nft_flow_offload_rule(struct nft_trans *trans,
        if (flow)
                proto = flow->proto;
-        nft_flow_offload_common_init(&cls_flow.common, proto, &extack);
+        nft_flow_offload_common_init(&cls_flow.common, proto,
+                                     basechain->ops.priority, &extack);
        cls_flow.command = command;
        cls_flow.cookie = (unsigned long) rule;
        if (flow)
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index aa5f571d4361..01705ad74a9a 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c
@@ -72,11 +72,11 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
 {
        struct nft_flow_offload *priv = nft_expr_priv(expr);
        struct nf_flowtable *flowtable = &priv->flowtable->data;
+        struct tcphdr _tcph, *tcph = NULL;
        enum ip_conntrack_info ctinfo;
        struct nf_flow_route route;
        struct flow_offload *flow;
        enum ip_conntrack_dir dir;
-        bool is_tcp = false;
        struct nf_conn *ct;
        int ret;
@@ -89,7 +89,10 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
        switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) {
        case IPPROTO_TCP:
-                is_tcp = true;
+                tcph = skb_header_pointer(pkt->skb, pkt->xt.thoff,
+                                          sizeof(_tcph), &_tcph);
+                if (unlikely(!tcph || tcph->fin || tcph->rst))
+                        goto out;
                break;
        case IPPROTO_UDP:
                break;
@@ -115,7 +118,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
        if (!flow)
                goto err_flow_alloc;
-        if (is_tcp) {
+        if (tcph) {
                ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
                ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
        }
@@ -146,6 +149,11 @@ static int nft_flow_offload_validate(const struct nft_ctx *ctx,
        return nft_chain_validate_hooks(ctx->chain, hook_mask);
 }
+static const struct nla_policy nft_flow_offload_policy[NFTA_FLOW_MAX + 1] = {
+        [NFTA_FLOW_TABLE_NAME]  = { .type = NLA_STRING,
+                                    .len = NFT_NAME_MAXLEN - 1 },
+};
 static int nft_flow_offload_init(const struct nft_ctx *ctx,
                                 const struct nft_expr *expr,
                                 const struct nlattr * const tb[])
@@ -204,6 +212,7 @@ static const struct nft_expr_ops nft_flow_offload_ops = {
 static struct nft_expr_type nft_flow_offload_type __read_mostly = {
        .name           = "flow_offload",
        .ops            = &nft_flow_offload_ops,
+        .policy         = nft_flow_offload_policy,
        .maxattr        = NFTA_FLOW_MAX,
        .owner          = THIS_MODULE,
 };
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index f1b1d948c07b..f69afb9ff3cb 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -60,24 +60,16 @@ void nft_meta_get_eval(const struct nft_expr *expr,
                *dest = skb->mark;
                break;
        case NFT_META_IIF:
-                if (in == NULL)
+                *dest = in ? in->ifindex : 0;
-                        goto err;
-                *dest = in->ifindex;
                break;
        case NFT_META_OIF:
-                if (out == NULL)
+                *dest = out ? out->ifindex : 0;
-                        goto err;
-                *dest = out->ifindex;
                break;
        case NFT_META_IIFNAME:
-                if (in == NULL)
+                strncpy((char *)dest, in ? in->name : "", IFNAMSIZ);
-                        goto err;
-                strncpy((char *)dest, in->name, IFNAMSIZ);
                break;
        case NFT_META_OIFNAME:
-                if (out == NULL)
+                strncpy((char *)dest, out ? out->name : "", IFNAMSIZ);
-                        goto err;
-                strncpy((char *)dest, out->name, IFNAMSIZ);
                break;
        case NFT_META_IIFTYPE:
                if (in == NULL)
diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
index d0ab1adf5bff..5aab6df74e0f 100644
--- a/net/netfilter/xt_nfacct.c
+++ b/net/netfilter/xt_nfacct.c
@@ -54,25 +54,39 @@ nfacct_mt_destroy(const struct xt_mtdtor_param *par)
        nfnl_acct_put(info->nfacct);
 }
-static struct xt_match nfacct_mt_reg __read_mostly = {
+static struct xt_match nfacct_mt_reg[] __read_mostly = {
-        .name       = "nfacct",
+        {
-        .family     = NFPROTO_UNSPEC,
+                .name       = "nfacct",
-        .checkentry = nfacct_mt_checkentry,
+                .revision   = 0,
-        .match      = nfacct_mt,
+                .family     = NFPROTO_UNSPEC,
-        .destroy    = nfacct_mt_destroy,
+                .checkentry = nfacct_mt_checkentry,
-        .matchsize  = sizeof(struct xt_nfacct_match_info),
+                .match      = nfacct_mt,
-        .usersize   = offsetof(struct xt_nfacct_match_info, nfacct),
+                .destroy    = nfacct_mt_destroy,
-        .me         = THIS_MODULE,
+                .matchsize  = sizeof(struct xt_nfacct_match_info),
+                .usersize   = offsetof(struct xt_nfacct_match_info, nfacct),
+                .me         = THIS_MODULE,
+        },
+        {
+                .name       = "nfacct",
+                .revision   = 1,
+                .family     = NFPROTO_UNSPEC,
+                .checkentry = nfacct_mt_checkentry,
+                .match      = nfacct_mt,
+                .destroy    = nfacct_mt_destroy,
+                .matchsize  = sizeof(struct xt_nfacct_match_info_v1),
+                .usersize   = offsetof(struct xt_nfacct_match_info_v1, nfacct),
+                .me         = THIS_MODULE,
+        },
 };
 static int __init nfacct_mt_init(void)
 {
-        return xt_register_match(&nfacct_mt_reg);
+        return xt_register_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
 }
 static void __exit nfacct_mt_exit(void)
 {
-        xt_unregister_match(&nfacct_mt_reg);
+        xt_unregister_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
 }
 module_init(nfacct_mt_init);
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index ead7c6022208..b92b22ce8abd 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -101,11 +101,9 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
        if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) &&
            (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
             info->invert & XT_PHYSDEV_OP_BRIDGED) &&
-            par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
+            par->hook_mask & (1 << NF_INET_LOCAL_OUT)) {
-            (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
                pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n");
-                if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
+                return -EINVAL;
-                        return -EINVAL;
        }
        if (!brnf_probed) {
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 96740d389377..c4f54ad2b98a 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -967,6 +967,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
        window = skb->data[20];
+        sock_hold(make);
        skb->sk             = make;
        skb->destructor     = sock_efree;
        make->sk_state      = TCP_ESTABLISHED;
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 848c6eb55064..05249eb45082 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -67,6 +67,7 @@ struct ovs_conntrack_info {
        struct md_mark mark;
        struct md_labels labels;
        char timeout[CTNL_TIMEOUT_NAME_MAX];
+        struct nf_ct_timeout *nf_ct_timeout;
 #if IS_ENABLED(CONFIG_NF_NAT)
        struct nf_nat_range2 range;  /* Only present for SRC NAT and DST NAT. */
 #endif
@@ -524,6 +525,11 @@ static int handle_fragments(struct net *net, struct sw_flow_key *key,
                return -EPFNOSUPPORT;
        }
+        /* The key extracted from the fragment that completed this datagram
+         * likely didn't have an L4 header, so regenerate it.
+         */
+        ovs_flow_key_update_l3l4(skb, key);
        key->ip.frag = OVS_FRAG_TYPE_NONE;
        skb_clear_hash(skb);
        skb->ignore_df = 1;
@@ -697,6 +703,14 @@ static bool skb_nfct_cached(struct net *net,
                if (help && rcu_access_pointer(help->helper) != info->helper)
                        return false;
        }
+        if (info->nf_ct_timeout) {
+                struct nf_conn_timeout *timeout_ext;
+                timeout_ext = nf_ct_timeout_find(ct);
+                if (!timeout_ext || info->nf_ct_timeout !=
+                    rcu_dereference(timeout_ext->timeout))
+                        return false;
+        }
        /* Force conntrack entry direction to the current packet? */
        if (info->force && CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL) {
                /* Delete the conntrack entry if confirmed, else just release
@@ -1565,7 +1579,7 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
                case OVS_CT_ATTR_TIMEOUT:
                        memcpy(info->timeout, nla_data(a), nla_len(a));
                        if (!memchr(info->timeout, '\0', nla_len(a))) {
-                                OVS_NLERR(log, "Invalid conntrack helper");
+                                OVS_NLERR(log, "Invalid conntrack timeout");
                                return -EINVAL;
                        }
                        break;
@@ -1657,6 +1671,10 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
                                      ct_info.timeout))
                        pr_info_ratelimited("Failed to associated timeout "
                                            "policy `%s'\n", ct_info.timeout);
+                else
+                        ct_info.nf_ct_timeout = rcu_dereference(
+                                nf_ct_timeout_find(ct_info.ct)->timeout);
        }
        if (helper) {
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 892287d06c17..d01410e52097 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1047,7 +1047,7 @@ error:
 }
 /* Factor out action copy to avoid "Wframe-larger-than=1024" warning. */
-static struct sw_flow_actions *get_flow_actions(struct net *net,
+static noinline_for_stack struct sw_flow_actions *get_flow_actions(struct net *net,
                                                const struct nlattr *a,
                                                const struct sw_flow_key *key,
                                                const struct sw_flow_mask *mask,
@@ -1081,12 +1081,13 @@ static struct sw_flow_actions *get_flow_actions(struct net *net,
 * we should not to return match object with dangling reference
 * to mask.
 * */
-static int ovs_nla_init_match_and_action(struct net *net,
+static noinline_for_stack int
-                                         struct sw_flow_match *match,
+ovs_nla_init_match_and_action(struct net *net,
-                                         struct sw_flow_key *key,
+                              struct sw_flow_match *match,
-                                         struct nlattr **a,
+                              struct sw_flow_key *key,
-                                         struct sw_flow_actions **acts,
+                              struct nlattr **a,
-                                         bool log)
+                              struct sw_flow_actions **acts,
+                              bool log)
 {
        struct sw_flow_mask mask;
        int error = 0;
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index bc89e16e0505..9d81d2c7bf82 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -523,78 +523,15 @@ static int parse_nsh(struct sk_buff *skb, struct sw_flow_key *key)
 }
 /**
- * key_extract - extracts a flow key from an Ethernet frame.
+ * key_extract_l3l4 - extracts L3/L4 header information.
 * @skb: sk_buff that contains the frame, with skb->data pointing to the
- * Ethernet header
+ *       L3 header
 * @key: output flow key
 *
- * The caller must ensure that skb->len >= ETH_HLEN.
- *
- * Returns 0 if successful, otherwise a negative errno value.
- *
- * Initializes @skb header fields as follows:
- *
- *    - skb->mac_header: the L2 header.
- *
- *    - skb->network_header: just past the L2 header, or just past the
- *      VLAN header, to the first byte of the L2 payload.
- *
- *    - skb->transport_header: If key->eth.type is ETH_P_IP or ETH_P_IPV6
- *      on output, then just past the IP header, if one is present and
- *      of a correct length, otherwise the same as skb->network_header.
- *      For other key->eth.type values it is left untouched.
- *
- *    - skb->protocol: the type of the data starting at skb->network_header.
- *      Equals to key->eth.type.
 */
-static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
+static int key_extract_l3l4(struct sk_buff *skb, struct sw_flow_key *key)
 {
        int error;
-        struct ethhdr *eth;
-        /* Flags are always used as part of stats */
-        key->tp.flags = 0;
-        skb_reset_mac_header(skb);
-        /* Link layer. */
-        clear_vlan(key);
-        if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) {
-                if (unlikely(eth_type_vlan(skb->protocol)))
-                        return -EINVAL;
-                skb_reset_network_header(skb);
-                key->eth.type = skb->protocol;
-        } else {
-                eth = eth_hdr(skb);
-                ether_addr_copy(key->eth.src, eth->h_source);
-                ether_addr_copy(key->eth.dst, eth->h_dest);
-                __skb_pull(skb, 2 * ETH_ALEN);
-                /* We are going to push all headers that we pull, so no need to
-                * update skb->csum here.
-                */
-                if (unlikely(parse_vlan(skb, key)))
-                        return -ENOMEM;
-                key->eth.type = parse_ethertype(skb);
-                if (unlikely(key->eth.type == htons(0)))
-                        return -ENOMEM;
-                /* Multiple tagged packets need to retain TPID to satisfy
-                 * skb_vlan_pop(), which will later shift the ethertype into
-                 * skb->protocol.
-                 */
-                if (key->eth.cvlan.tci & htons(VLAN_CFI_MASK))
-                        skb->protocol = key->eth.cvlan.tpid;
-                else
-                        skb->protocol = key->eth.type;
-                skb_reset_network_header(skb);
-                __skb_push(skb, skb->data - skb_mac_header(skb));
-        }
-        skb_reset_mac_len(skb);
        /* Network layer. */
        if (key->eth.type == htons(ETH_P_IP)) {
@@ -623,6 +560,7 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
                offset = nh->frag_off & htons(IP_OFFSET);
                if (offset) {
                        key->ip.frag = OVS_FRAG_TYPE_LATER;
+                        memset(&key->tp, 0, sizeof(key->tp));
                        return 0;
                }
                if (nh->frag_off & htons(IP_MF) ||
@@ -740,8 +678,10 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
                        return error;
                }
-                if (key->ip.frag == OVS_FRAG_TYPE_LATER)
+                if (key->ip.frag == OVS_FRAG_TYPE_LATER) {
+                        memset(&key->tp, 0, sizeof(key->tp));
                        return 0;
+                }
                if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
                        key->ip.frag = OVS_FRAG_TYPE_FIRST;
@@ -788,6 +728,92 @@ static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
        return 0;
 }
+/**
+ * key_extract - extracts a flow key from an Ethernet frame.
+ * @skb: sk_buff that contains the frame, with skb->data pointing to the
+ * Ethernet header
+ * @key: output flow key
+ *
+ * The caller must ensure that skb->len >= ETH_HLEN.
+ *
+ * Returns 0 if successful, otherwise a negative errno value.
+ *
+ * Initializes @skb header fields as follows:
+ *
+ *    - skb->mac_header: the L2 header.
+ *
+ *    - skb->network_header: just past the L2 header, or just past the
+ *      VLAN header, to the first byte of the L2 payload.
+ *
+ *    - skb->transport_header: If key->eth.type is ETH_P_IP or ETH_P_IPV6
+ *      on output, then just past the IP header, if one is present and
+ *      of a correct length, otherwise the same as skb->network_header.
+ *      For other key->eth.type values it is left untouched.
+ *
+ *    - skb->protocol: the type of the data starting at skb->network_header.
+ *      Equals to key->eth.type.
+ */
+static int key_extract(struct sk_buff *skb, struct sw_flow_key *key)
+{
+        struct ethhdr *eth;
+        /* Flags are always used as part of stats */
+        key->tp.flags = 0;
+        skb_reset_mac_header(skb);
+        /* Link layer. */
+        clear_vlan(key);
+        if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) {
+                if (unlikely(eth_type_vlan(skb->protocol)))
+                        return -EINVAL;
+                skb_reset_network_header(skb);
+                key->eth.type = skb->protocol;
+        } else {
+                eth = eth_hdr(skb);
+                ether_addr_copy(key->eth.src, eth->h_source);
+                ether_addr_copy(key->eth.dst, eth->h_dest);
+                __skb_pull(skb, 2 * ETH_ALEN);
+                /* We are going to push all headers that we pull, so no need to
+                 * update skb->csum here.
+                 */
+                if (unlikely(parse_vlan(skb, key)))
+                        return -ENOMEM;
+                key->eth.type = parse_ethertype(skb);
+                if (unlikely(key->eth.type == htons(0)))
+                        return -ENOMEM;
+                /* Multiple tagged packets need to retain TPID to satisfy
+                 * skb_vlan_pop(), which will later shift the ethertype into
+                 * skb->protocol.
+                 */
+                if (key->eth.cvlan.tci & htons(VLAN_CFI_MASK))
+                        skb->protocol = key->eth.cvlan.tpid;
+                else
+                        skb->protocol = key->eth.type;
+                skb_reset_network_header(skb);
+                __skb_push(skb, skb->data - skb_mac_header(skb));
+        }
+        skb_reset_mac_len(skb);
+        /* Fill out L3/L4 key info, if any */
+        return key_extract_l3l4(skb, key);
+}
+/* In the case of conntrack fragment handling it expects L3 headers,
+ * add a helper.
+ */
+int ovs_flow_key_update_l3l4(struct sk_buff *skb, struct sw_flow_key *key)
+{
+        return key_extract_l3l4(skb, key);
+}
 int ovs_flow_key_update(struct sk_buff *skb, struct sw_flow_key *key)
 {
        int res;
diff --git a/net/openvswitch/flow.h b/net/openvswitch/flow.h
index a5506e2d4b7a..b830d5ff7af4 100644
--- a/net/openvswitch/flow.h
+++ b/net/openvswitch/flow.h
@@ -270,6 +270,7 @@ void ovs_flow_stats_clear(struct sw_flow *);
 u64 ovs_flow_used_time(unsigned long flow_jiffies);
 int ovs_flow_key_update(struct sk_buff *skb, struct sw_flow_key *key);
+int ovs_flow_key_update_l3l4(struct sk_buff *skb, struct sw_flow_key *key);
 int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
                         struct sk_buff *skb,
                         struct sw_flow_key *key);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8d54f3047768..e2742b006d25 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2618,6 +2618,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
        mutex_lock(&po->pg_vec_lock);
+        /* packet_sendmsg() check on tx_ring.pg_vec was lockless,
+         * we need to confirm it under protection of pg_vec_lock.
+         */
+        if (unlikely(!po->tx_ring.pg_vec)) {
+                err = -EBUSY;
+                goto out;
+        }
        if (likely(saddr == NULL)) {
                dev     = packet_cached_dev_get(po);
                proto   = po->num;
diff --git a/net/psample/psample.c b/net/psample/psample.c
index 841f198ea1a8..66e4b61a350d 100644
--- a/net/psample/psample.c
+++ b/net/psample/psample.c
@@ -154,7 +154,7 @@ static void psample_group_destroy(struct psample_group *group)
 {
        psample_group_notify(group, PSAMPLE_CMD_DEL_GROUP);
        list_del(&group->list);
-        kfree(group);
+        kfree_rcu(group, rcu);
 }
 static struct psample_group *
diff --git a/net/rds/ib.c b/net/rds/ib.c
index ec05d91aa9a2..45acab2de0cf 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -291,7 +291,7 @@ static int rds_ib_conn_info_visitor(struct rds_connection *conn,
                                    void *buffer)
 {
        struct rds_info_rdma_connection *iinfo = buffer;
-        struct rds_ib_connection *ic;
+        struct rds_ib_connection *ic = conn->c_transport_data;
        /* We will only ever look at IB transports */
        if (conn->c_trans != &rds_ib_transport)
@@ -301,15 +301,16 @@ static int rds_ib_conn_info_visitor(struct rds_connection *conn,
        iinfo->src_addr = conn->c_laddr.s6_addr32[3];
        iinfo->dst_addr = conn->c_faddr.s6_addr32[3];
-        iinfo->tos = conn->c_tos;
+        if (ic) {
+                iinfo->tos = conn->c_tos;
+                iinfo->sl = ic->i_sl;
+        }
        memset(&iinfo->src_gid, 0, sizeof(iinfo->src_gid));
        memset(&iinfo->dst_gid, 0, sizeof(iinfo->dst_gid));
        if (rds_conn_state(conn) == RDS_CONN_UP) {
                struct rds_ib_device *rds_ibdev;
-                ic = conn->c_transport_data;
                rdma_read_gids(ic->i_cm_id, (union ib_gid *)&iinfo->src_gid,
                               (union ib_gid *)&iinfo->dst_gid);
@@ -329,7 +330,7 @@ static int rds6_ib_conn_info_visitor(struct rds_connection *conn,
                                     void *buffer)
 {
        struct rds6_info_rdma_connection *iinfo6 = buffer;
-        struct rds_ib_connection *ic;
+        struct rds_ib_connection *ic = conn->c_transport_data;
        /* We will only ever look at IB transports */
        if (conn->c_trans != &rds_ib_transport)
@@ -337,6 +338,10 @@ static int rds6_ib_conn_info_visitor(struct rds_connection *conn,
        iinfo6->src_addr = conn->c_laddr;
        iinfo6->dst_addr = conn->c_faddr;
+        if (ic) {
+                iinfo6->tos = conn->c_tos;
+                iinfo6->sl = ic->i_sl;
+        }
        memset(&iinfo6->src_gid, 0, sizeof(iinfo6->src_gid));
        memset(&iinfo6->dst_gid, 0, sizeof(iinfo6->dst_gid));
@@ -344,7 +349,6 @@ static int rds6_ib_conn_info_visitor(struct rds_connection *conn,
        if (rds_conn_state(conn) == RDS_CONN_UP) {
                struct rds_ib_device *rds_ibdev;
-                ic = conn->c_transport_data;
                rdma_read_gids(ic->i_cm_id, (union ib_gid *)&iinfo6->src_gid,
                               (union ib_gid *)&iinfo6->dst_gid);
                rds_ibdev = ic->rds_ibdev;
diff --git a/net/rds/ib.h b/net/rds/ib.h
index 303c6ee8bdb7..f2b558e8b5ea 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -220,6 +220,7 @@ struct rds_ib_connection {
        /* Send/Recv vectors */
        int                     i_scq_vector;
        int                     i_rcq_vector;
+        u8                      i_sl;
 };
 /* This assumes that atomic_t is at least 32 bits */
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index fddaa09f7b0d..233f1368162b 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -152,6 +152,9 @@ void rds_ib_cm_connect_complete(struct rds_connection *conn, struct rdma_cm_even
                  RDS_PROTOCOL_MINOR(conn->c_version),
                  ic->i_flowctl ? ", flow control" : "");
+        /* receive sl from the peer */
+        ic->i_sl = ic->i_cm_id->route.path_rec->sl;
        atomic_set(&ic->i_cq_quiesce, 0);
        /* Init rings and fill recv. this needs to wait until protocol
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index ff74c4bbb9fc..5f741e51b4ba 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -43,6 +43,9 @@ static struct rdma_cm_id *rds_rdma_listen_id;
 static struct rdma_cm_id *rds6_rdma_listen_id;
 #endif
+/* Per IB specification 7.7.3, service level is a 4-bit field. */
+#define TOS_TO_SL(tos)          ((tos) & 0xF)
 static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id,
                                         struct rdma_cm_event *event,
                                         bool isv6)
@@ -97,15 +100,19 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id,
                        struct rds_ib_connection *ibic;
                        ibic = conn->c_transport_data;
-                        if (ibic && ibic->i_cm_id == cm_id)
+                        if (ibic && ibic->i_cm_id == cm_id) {
+                                cm_id->route.path_rec[0].sl =
+                                        TOS_TO_SL(conn->c_tos);
                                ret = trans->cm_initiate_connect(cm_id, isv6);
-                        else
+                        } else {
                                rds_conn_drop(conn);
+                        }
                }
                break;
        case RDMA_CM_EVENT_ESTABLISHED:
-                trans->cm_connect_complete(conn, event);
+                if (conn)
+                        trans->cm_connect_complete(conn, event);
                break;
        case RDMA_CM_EVENT_REJECTED:
@@ -137,6 +144,8 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id,
                break;
        case RDMA_CM_EVENT_DISCONNECTED:
+                if (!conn)
+                        break;
                rdsdebug("DISCONNECT event - dropping connection "
                         "%pI6c->%pI6c\n", &conn->c_laddr,
                         &conn->c_faddr);
diff --git a/net/rds/recv.c b/net/rds/recv.c
index 853de4876088..a42ba7fa06d5 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006, 2018 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2006, 2019 Oracle and/or its affiliates. All rights reserved.
 *
 * This software is available to you under a choice of one of two
 * licenses.  You may choose to be licensed under the terms of the GNU
@@ -811,6 +811,7 @@ void rds6_inc_info_copy(struct rds_incoming *inc,
        minfo6.seq = be64_to_cpu(inc->i_hdr.h_sequence);
        minfo6.len = be32_to_cpu(inc->i_hdr.h_len);
+        minfo6.tos = inc->i_conn->c_tos;
        if (flip) {
                minfo6.laddr = *daddr;
@@ -824,6 +825,8 @@ void rds6_inc_info_copy(struct rds_incoming *inc,
                minfo6.fport = inc->i_hdr.h_dport;
        }
+        minfo6.flags = 0;
        rds_info_copy(iter, &minfo6, sizeof(minfo6));
 }
 #endif
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index d09eaf153544..d72ddb67bb74 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -193,7 +193,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
 service_in_use:
        write_unlock(&local->services_lock);
-        rxrpc_put_local(local);
+        rxrpc_unuse_local(local);
        ret = -EADDRINUSE;
 error_unlock:
        release_sock(&rx->sk);
@@ -402,7 +402,7 @@ EXPORT_SYMBOL(rxrpc_kernel_check_life);
 */
 void rxrpc_kernel_probe_life(struct socket *sock, struct rxrpc_call *call)
 {
-        rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, false,
+        rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, false,
                          rxrpc_propose_ack_ping_for_check_life);
        rxrpc_send_ack_packet(call, true, NULL);
 }
@@ -862,7 +862,6 @@ static void rxrpc_sock_destructor(struct sock *sk)
 static int rxrpc_release_sock(struct sock *sk)
 {
        struct rxrpc_sock *rx = rxrpc_sk(sk);
-        struct rxrpc_net *rxnet = rxrpc_net(sock_net(&rx->sk));
        _enter("%p{%d,%d}", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
@@ -898,10 +897,8 @@ static int rxrpc_release_sock(struct sock *sk)
        rxrpc_release_calls_on_socket(rx);
        flush_workqueue(rxrpc_workqueue);
        rxrpc_purge_queue(&sk->sk_receive_queue);
-        rxrpc_queue_work(&rxnet->service_conn_reaper);
-        rxrpc_queue_work(&rxnet->client_conn_reaper);
-        rxrpc_put_local(rx->local);
+        rxrpc_unuse_local(rx->local);
        rx->local = NULL;
        key_put(rx->key);
        rx->key = NULL;
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 80335b4ee4fd..8051dfdcf26d 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -185,11 +185,17 @@ struct rxrpc_host_header {
 * - max 48 bytes (struct sk_buff::cb)
 */
 struct rxrpc_skb_priv {
-        union {
+        atomic_t        nr_ring_pins;           /* Number of rxtx ring pins */
-                u8              nr_jumbo;       /* Number of jumbo subpackets */
+        u8              nr_subpackets;          /* Number of subpackets */
-        };
+        u8              rx_flags;               /* Received packet flags */
+#define RXRPC_SKB_INCL_LAST     0x01            /* - Includes last packet */
+#define RXRPC_SKB_TX_BUFFER     0x02            /* - Is transmit buffer */
        union {
                int             remain;         /* amount of space remaining for next write */
+                /* List of requested ACKs on subpackets */
+                unsigned long   rx_req_ack[(RXRPC_MAX_NR_JUMBO + BITS_PER_LONG - 1) /
+                                           BITS_PER_LONG];
        };
        struct rxrpc_host_header hdr;           /* RxRPC packet header from this packet */
@@ -254,7 +260,8 @@ struct rxrpc_security {
 */
 struct rxrpc_local {
        struct rcu_head         rcu;
-        atomic_t                usage;
+        atomic_t                active_users;   /* Number of users of the local endpoint */
+        atomic_t                usage;          /* Number of references to the structure */
        struct rxrpc_net        *rxnet;         /* The network ns in which this resides */
        struct list_head        link;
        struct socket           *socket;        /* my UDP socket */
@@ -612,8 +619,7 @@ struct rxrpc_call {
 #define RXRPC_TX_ANNO_LAST      0x04
 #define RXRPC_TX_ANNO_RESENT    0x08
-#define RXRPC_RX_ANNO_JUMBO     0x3f            /* Jumbo subpacket number + 1 if not zero */
+#define RXRPC_RX_ANNO_SUBPACKET 0x3f            /* Subpacket number in jumbogram */
-#define RXRPC_RX_ANNO_JLAST     0x40            /* Set if last element of a jumbo packet */
 #define RXRPC_RX_ANNO_VERIFIED  0x80            /* Set if verified and decrypted */
        rxrpc_seq_t             tx_hard_ack;    /* Dead slot in buffer; the first transmitted but
                                                 * not hard-ACK'd packet follows this.
@@ -649,7 +655,6 @@ struct rxrpc_call {
        /* receive-phase ACK management */
        u8                      ackr_reason;    /* reason to ACK */
-        u16                     ackr_skew;      /* skew on packet being ACK'd */
        rxrpc_serial_t          ackr_serial;    /* serial of packet being ACK'd */
        rxrpc_serial_t          ackr_first_seq; /* first sequence number received */
        rxrpc_seq_t             ackr_prev_seq;  /* previous sequence number received */
@@ -743,7 +748,7 @@ int rxrpc_reject_call(struct rxrpc_sock *);
 /*
 * call_event.c
 */
-void rxrpc_propose_ACK(struct rxrpc_call *, u8, u16, u32, bool, bool,
+void rxrpc_propose_ACK(struct rxrpc_call *, u8, u32, bool, bool,
                       enum rxrpc_propose_ack_trace);
 void rxrpc_process_call(struct work_struct *);
@@ -905,6 +910,7 @@ void rxrpc_disconnect_client_call(struct rxrpc_call *);
 void rxrpc_put_client_conn(struct rxrpc_connection *);
 void rxrpc_discard_expired_client_conns(struct work_struct *);
 void rxrpc_destroy_all_client_connections(struct rxrpc_net *);
+void rxrpc_clean_up_local_conns(struct rxrpc_local *);
 /*
 * conn_event.c
@@ -1002,6 +1008,8 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *, const struct sockaddr_rxrpc
 struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *);
 struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *);
 void rxrpc_put_local(struct rxrpc_local *);
+struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *);
+void rxrpc_unuse_local(struct rxrpc_local *);
 void rxrpc_queue_local(struct rxrpc_local *);
 void rxrpc_destroy_all_locals(struct rxrpc_net *);
@@ -1061,6 +1069,7 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *);
 struct rxrpc_peer *rxrpc_get_peer(struct rxrpc_peer *);
 struct rxrpc_peer *rxrpc_get_peer_maybe(struct rxrpc_peer *);
 void rxrpc_put_peer(struct rxrpc_peer *);
+void rxrpc_put_peer_locked(struct rxrpc_peer *);
 /*
 * proc.c
@@ -1102,6 +1111,7 @@ void rxrpc_kernel_data_consumed(struct rxrpc_call *, struct sk_buff *);
 void rxrpc_packet_destructor(struct sk_buff *);
 void rxrpc_new_skb(struct sk_buff *, enum rxrpc_skb_trace);
 void rxrpc_see_skb(struct sk_buff *, enum rxrpc_skb_trace);
+void rxrpc_eaten_skb(struct sk_buff *, enum rxrpc_skb_trace);
 void rxrpc_get_skb(struct sk_buff *, enum rxrpc_skb_trace);
 void rxrpc_free_skb(struct sk_buff *, enum rxrpc_skb_trace);
 void rxrpc_purge_queue(struct sk_buff_head *);
diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index bc2adeb3acb9..cedbbb3a7c2e 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -43,8 +43,7 @@ static void rxrpc_propose_ping(struct rxrpc_call *call,
 * propose an ACK be sent
 */
 static void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
-                                u16 skew, u32 serial, bool immediate,
+                                u32 serial, bool immediate, bool background,
-                                bool background,
                                enum rxrpc_propose_ack_trace why)
 {
        enum rxrpc_propose_ack_outcome outcome = rxrpc_propose_ack_use;
@@ -69,14 +68,12 @@ static void __rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
                if (RXRPC_ACK_UPDATEABLE & (1 << ack_reason)) {
                        outcome = rxrpc_propose_ack_update;
                        call->ackr_serial = serial;
-                        call->ackr_skew = skew;
                }
                if (!immediate)
                        goto trace;
        } else if (prior > rxrpc_ack_priority[call->ackr_reason]) {
                call->ackr_reason = ack_reason;
                call->ackr_serial = serial;
-                call->ackr_skew = skew;
        } else {
                outcome = rxrpc_propose_ack_subsume;
        }
@@ -137,11 +134,11 @@ trace:
 * propose an ACK be sent, locking the call structure
 */
 void rxrpc_propose_ACK(struct rxrpc_call *call, u8 ack_reason,
-                       u16 skew, u32 serial, bool immediate, bool background,
+                       u32 serial, bool immediate, bool background,
                       enum rxrpc_propose_ack_trace why)
 {
        spin_lock_bh(&call->lock);
-        __rxrpc_propose_ACK(call, ack_reason, skew, serial,
+        __rxrpc_propose_ACK(call, ack_reason, serial,
                            immediate, background, why);
        spin_unlock_bh(&call->lock);
 }
@@ -202,7 +199,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
                        continue;
                skb = call->rxtx_buffer[ix];
-                rxrpc_see_skb(skb, rxrpc_skb_tx_seen);
+                rxrpc_see_skb(skb, rxrpc_skb_seen);
                if (anno_type == RXRPC_TX_ANNO_UNACK) {
                        if (ktime_after(skb->tstamp, max_age)) {
@@ -239,7 +236,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
                ack_ts = ktime_sub(now, call->acks_latest_ts);
                if (ktime_to_ns(ack_ts) < call->peer->rtt)
                        goto out;
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, false,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, false,
                                  rxrpc_propose_ack_ping_for_lost_ack);
                rxrpc_send_ack_packet(call, true, NULL);
                goto out;
@@ -258,18 +255,18 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
                        continue;
                skb = call->rxtx_buffer[ix];
-                rxrpc_get_skb(skb, rxrpc_skb_tx_got);
+                rxrpc_get_skb(skb, rxrpc_skb_got);
                spin_unlock_bh(&call->lock);
                if (rxrpc_send_data_packet(call, skb, true) < 0) {
-                        rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
+                        rxrpc_free_skb(skb, rxrpc_skb_freed);
                        return;
                }
                if (rxrpc_is_client_call(call))
                        rxrpc_expose_client_call(call);
-                rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
                spin_lock_bh(&call->lock);
                /* We need to clear the retransmit state, but there are two
@@ -372,7 +369,7 @@ recheck_state:
        if (time_after_eq(now, t)) {
                trace_rxrpc_timer(call, rxrpc_timer_exp_keepalive, now);
                cmpxchg(&call->keepalive_at, t, now + MAX_JIFFY_OFFSET);
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, true,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, true,
                                  rxrpc_propose_ack_ping_for_keepalive);
                set_bit(RXRPC_CALL_EV_PING, &call->events);
        }
@@ -407,7 +404,7 @@ recheck_state:
        send_ack = NULL;
        if (test_and_clear_bit(RXRPC_CALL_EV_ACK_LOST, &call->events)) {
                call->acks_lost_top = call->tx_top;
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, 0, true, false,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, 0, true, false,
                                  rxrpc_propose_ack_ping_for_lost_ack);
                send_ack = &call->acks_lost_ping;
        }
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index 217b12be9e08..014548c259ce 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -422,6 +422,19 @@ void rxrpc_get_call(struct rxrpc_call *call, enum rxrpc_call_trace op)
 }
 /*
+ * Clean up the RxTx skb ring.
+ */
+static void rxrpc_cleanup_ring(struct rxrpc_call *call)
+{
+        int i;
+        for (i = 0; i < RXRPC_RXTX_BUFF_SIZE; i++) {
+                rxrpc_free_skb(call->rxtx_buffer[i], rxrpc_skb_cleaned);
+                call->rxtx_buffer[i] = NULL;
+        }
+}
+/*
 * Detach a call from its owning socket.
 */
 void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call)
@@ -429,7 +442,6 @@ void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call)
        const void *here = __builtin_return_address(0);
        struct rxrpc_connection *conn = call->conn;
        bool put = false;
-        int i;
        _enter("{%d,%d}", call->debug_id, atomic_read(&call->usage));
@@ -479,13 +491,7 @@ void rxrpc_release_call(struct rxrpc_sock *rx, struct rxrpc_call *call)
        if (conn)
                rxrpc_disconnect_call(call);
-        for (i = 0; i < RXRPC_RXTX_BUFF_SIZE; i++) {
+        rxrpc_cleanup_ring(call);
-                rxrpc_free_skb(call->rxtx_buffer[i],
-                               (call->tx_phase ? rxrpc_skb_tx_cleaned :
-                                rxrpc_skb_rx_cleaned));
-                call->rxtx_buffer[i] = NULL;
-        }
        _leave("");
 }
@@ -568,8 +574,6 @@ static void rxrpc_rcu_destroy_call(struct rcu_head *rcu)
 */
 void rxrpc_cleanup_call(struct rxrpc_call *call)
 {
-        int i;
        _net("DESTROY CALL %d", call->debug_id);
        memset(&call->sock_node, 0xcd, sizeof(call->sock_node));
@@ -580,13 +584,8 @@ void rxrpc_cleanup_call(struct rxrpc_call *call)
        ASSERT(test_bit(RXRPC_CALL_RELEASED, &call->flags));
        ASSERTCMP(call->conn, ==, NULL);
-        /* Clean up the Rx/Tx buffer */
+        rxrpc_cleanup_ring(call);
-        for (i = 0; i < RXRPC_RXTX_BUFF_SIZE; i++)
+        rxrpc_free_skb(call->tx_pending, rxrpc_skb_cleaned);
-                rxrpc_free_skb(call->rxtx_buffer[i],
-                               (call->tx_phase ? rxrpc_skb_tx_cleaned :
-                                rxrpc_skb_rx_cleaned));
-        rxrpc_free_skb(call->tx_pending, rxrpc_skb_tx_cleaned);
        call_rcu(&call->rcu, rxrpc_rcu_destroy_call);
 }
diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
index aea82f909c60..3f1da1b49f69 100644
--- a/net/rxrpc/conn_client.c
+++ b/net/rxrpc/conn_client.c
@@ -1162,3 +1162,47 @@ void rxrpc_destroy_all_client_connections(struct rxrpc_net *rxnet)
        _leave("");
 }
+/*
+ * Clean up the client connections on a local endpoint.
+ */
+void rxrpc_clean_up_local_conns(struct rxrpc_local *local)
+{
+        struct rxrpc_connection *conn, *tmp;
+        struct rxrpc_net *rxnet = local->rxnet;
+        unsigned int nr_active;
+        LIST_HEAD(graveyard);
+        _enter("");
+        spin_lock(&rxnet->client_conn_cache_lock);
+        nr_active = rxnet->nr_active_client_conns;
+        list_for_each_entry_safe(conn, tmp, &rxnet->idle_client_conns,
+                                 cache_link) {
+                if (conn->params.local == local) {
+                        ASSERTCMP(conn->cache_state, ==, RXRPC_CONN_CLIENT_IDLE);
+                        trace_rxrpc_client(conn, -1, rxrpc_client_discard);
+                        if (!test_and_clear_bit(RXRPC_CONN_EXPOSED, &conn->flags))
+                                BUG();
+                        conn->cache_state = RXRPC_CONN_CLIENT_INACTIVE;
+                        list_move(&conn->cache_link, &graveyard);
+                        nr_active--;
+                }
+        }
+        rxnet->nr_active_client_conns = nr_active;
+        spin_unlock(&rxnet->client_conn_cache_lock);
+        ASSERTCMP(nr_active, >=, 0);
+        while (!list_empty(&graveyard)) {
+                conn = list_entry(graveyard.next,
+                                  struct rxrpc_connection, cache_link);
+                list_del_init(&conn->cache_link);
+                rxrpc_put_connection(conn);
+        }
+        _leave(" [culled]");
+}
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index df6624c140be..a1ceef4f5cd0 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -472,7 +472,7 @@ void rxrpc_process_connection(struct work_struct *work)
        /* go through the conn-level event packets, releasing the ref on this
         * connection that each one has when we've finished with it */
        while ((skb = skb_dequeue(&conn->rx_queue))) {
-                rxrpc_see_skb(skb, rxrpc_skb_rx_seen);
+                rxrpc_see_skb(skb, rxrpc_skb_seen);
                ret = rxrpc_process_event(conn, skb, &abort_code);
                switch (ret) {
                case -EPROTO:
@@ -484,7 +484,7 @@ void rxrpc_process_connection(struct work_struct *work)
                        goto requeue_and_leave;
                case -ECONNABORTED:
                default:
-                        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                        rxrpc_free_skb(skb, rxrpc_skb_freed);
                        break;
                }
        }
@@ -501,6 +501,6 @@ requeue_and_leave:
 protocol_error:
        if (rxrpc_abort_connection(conn, ret, abort_code) < 0)
                goto requeue_and_leave;
-        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
        goto out;
 }
diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
index 434ef392212b..ed05b6922132 100644
--- a/net/rxrpc/conn_object.c
+++ b/net/rxrpc/conn_object.c
@@ -398,7 +398,7 @@ void rxrpc_service_connection_reaper(struct work_struct *work)
                if (conn->state == RXRPC_CONN_SERVICE_PREALLOC)
                        continue;
-                if (rxnet->live) {
+                if (rxnet->live && !conn->params.local->dead) {
                        idle_timestamp = READ_ONCE(conn->idle_timestamp);
                        expire_at = idle_timestamp + rxrpc_connection_expiry * HZ;
                        if (conn->params.local->service_closed)
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 5bd6f1546e5c..d122c53c8697 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -196,15 +196,14 @@ send_extra_data:
 * Ping the other end to fill our RTT cache and to retrieve the rwind
 * and MTU parameters.
 */
-static void rxrpc_send_ping(struct rxrpc_call *call, struct sk_buff *skb,
+static void rxrpc_send_ping(struct rxrpc_call *call, struct sk_buff *skb)
-                            int skew)
 {
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        ktime_t now = skb->tstamp;
        if (call->peer->rtt_usage < 3 ||
            ktime_before(ktime_add_ms(call->peer->rtt_last_req, 1000), now))
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, skew, sp->hdr.serial,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, sp->hdr.serial,
                                  true, true,
                                  rxrpc_propose_ack_ping_for_params);
 }
@@ -234,7 +233,7 @@ static bool rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to,
                ix = call->tx_hard_ack & RXRPC_RXTX_BUFF_MASK;
                skb = call->rxtx_buffer[ix];
                annotation = call->rxtx_annotations[ix];
-                rxrpc_see_skb(skb, rxrpc_skb_tx_rotated);
+                rxrpc_see_skb(skb, rxrpc_skb_rotated);
                call->rxtx_buffer[ix] = NULL;
                call->rxtx_annotations[ix] = 0;
                skb->next = list;
@@ -259,7 +258,7 @@ static bool rxrpc_rotate_tx_window(struct rxrpc_call *call, rxrpc_seq_t to,
                skb = list;
                list = skb->next;
                skb_mark_not_on_list(skb);
-                rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
        }
        return rot_last;
@@ -348,7 +347,7 @@ static bool rxrpc_receiving_reply(struct rxrpc_call *call)
 }
 /*
- * Scan a jumbo packet to validate its structure and to work out how many
+ * Scan a data packet to validate its structure and to work out how many
 * subpackets it contains.
 *
 * A jumbo packet is a collection of consecutive packets glued together with
@@ -359,16 +358,21 @@ static bool rxrpc_receiving_reply(struct rxrpc_call *call)
 * the last are RXRPC_JUMBO_DATALEN in size.  The last subpacket may be of any
 * size.
 */
-static bool rxrpc_validate_jumbo(struct sk_buff *skb)
+static bool rxrpc_validate_data(struct sk_buff *skb)
 {
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        unsigned int offset = sizeof(struct rxrpc_wire_header);
        unsigned int len = skb->len;
-        int nr_jumbo = 1;
        u8 flags = sp->hdr.flags;
-        do {
+        for (;;) {
-                nr_jumbo++;
+                if (flags & RXRPC_REQUEST_ACK)
+                        __set_bit(sp->nr_subpackets, sp->rx_req_ack);
+                sp->nr_subpackets++;
+                if (!(flags & RXRPC_JUMBO_PACKET))
+                        break;
                if (len - offset < RXRPC_JUMBO_SUBPKTLEN)
                        goto protocol_error;
                if (flags & RXRPC_LAST_PACKET)
@@ -377,9 +381,10 @@ static bool rxrpc_validate_jumbo(struct sk_buff *skb)
                if (skb_copy_bits(skb, offset, &flags, 1) < 0)
                        goto protocol_error;
                offset += sizeof(struct rxrpc_jumbo_header);
-        } while (flags & RXRPC_JUMBO_PACKET);
+        }
-        sp->nr_jumbo = nr_jumbo;
+        if (flags & RXRPC_LAST_PACKET)
+                sp->rx_flags |= RXRPC_SKB_INCL_LAST;
        return true;
 protocol_error:
@@ -400,10 +405,10 @@ protocol_error:
 * (that information is encoded in the ACK packet).
 */
 static void rxrpc_input_dup_data(struct rxrpc_call *call, rxrpc_seq_t seq,
-                                 u8 annotation, bool *_jumbo_bad)
+                                 bool is_jumbo, bool *_jumbo_bad)
 {
        /* Discard normal packets that are duplicates. */
-        if (annotation == 0)
+        if (is_jumbo)
                return;
        /* Skip jumbo subpackets that are duplicates.  When we've had three or
@@ -417,30 +422,30 @@ static void rxrpc_input_dup_data(struct rxrpc_call *call, rxrpc_seq_t seq,
 }
 /*
- * Process a DATA packet, adding the packet to the Rx ring.
+ * Process a DATA packet, adding the packet to the Rx ring.  The caller's
+ * packet ref must be passed on or discarded.
 */
-static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
+static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb)
-                             u16 skew)
 {
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        enum rxrpc_call_state state;
-        unsigned int offset = sizeof(struct rxrpc_wire_header);
+        unsigned int j;
-        unsigned int ix;
        rxrpc_serial_t serial = sp->hdr.serial, ack_serial = 0;
-        rxrpc_seq_t seq = sp->hdr.seq, hard_ack;
+        rxrpc_seq_t seq0 = sp->hdr.seq, hard_ack;
-        bool immediate_ack = false, jumbo_bad = false, queued;
+        bool immediate_ack = false, jumbo_bad = false;
-        u16 len;
+        u8 ack = 0;
-        u8 ack = 0, flags, annotation = 0;
        _enter("{%u,%u},{%u,%u}",
-               call->rx_hard_ack, call->rx_top, skb->len, seq);
+               call->rx_hard_ack, call->rx_top, skb->len, seq0);
-        _proto("Rx DATA %%%u { #%u f=%02x }",
+        _proto("Rx DATA %%%u { #%u f=%02x n=%u }",
-               sp->hdr.serial, seq, sp->hdr.flags);
+               sp->hdr.serial, seq0, sp->hdr.flags, sp->nr_subpackets);
        state = READ_ONCE(call->state);
-        if (state >= RXRPC_CALL_COMPLETE)
+        if (state >= RXRPC_CALL_COMPLETE) {
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
                return;
+        }
        if (call->state == RXRPC_CALL_SERVER_RECV_REQUEST) {
                unsigned long timo = READ_ONCE(call->next_req_timo);
@@ -465,156 +470,157 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb,
            !rxrpc_receiving_reply(call))
                goto unlock;
-        call->ackr_prev_seq = seq;
+        call->ackr_prev_seq = seq0;
        hard_ack = READ_ONCE(call->rx_hard_ack);
-        if (after(seq, hard_ack + call->rx_winsize)) {
-                ack = RXRPC_ACK_EXCEEDS_WINDOW;
-                ack_serial = serial;
-                goto ack;
-        }
-        flags = sp->hdr.flags;
+        if (sp->nr_subpackets > 1) {
-        if (flags & RXRPC_JUMBO_PACKET) {
                if (call->nr_jumbo_bad > 3) {
                        ack = RXRPC_ACK_NOSPACE;
                        ack_serial = serial;
                        goto ack;
                }
-                annotation = 1;
        }
-next_subpacket:
+        for (j = 0; j < sp->nr_subpackets; j++) {
-        queued = false;
+                rxrpc_serial_t serial = sp->hdr.serial + j;
-        ix = seq & RXRPC_RXTX_BUFF_MASK;
+                rxrpc_seq_t seq = seq0 + j;
-        len = skb->len;
+                unsigned int ix = seq & RXRPC_RXTX_BUFF_MASK;
-        if (flags & RXRPC_JUMBO_PACKET)
+                bool terminal = (j == sp->nr_subpackets - 1);
-                len = RXRPC_JUMBO_DATALEN;
+                bool last = terminal && (sp->rx_flags & RXRPC_SKB_INCL_LAST);
+                u8 flags, annotation = j;
-        if (flags & RXRPC_LAST_PACKET) {
-                if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
+                _proto("Rx DATA+%u %%%u { #%x t=%u l=%u }",
-                    seq != call->rx_top) {
+                     j, serial, seq, terminal, last);
-                        rxrpc_proto_abort("LSN", call, seq);
-                        goto unlock;
+                if (last) {
-                }
+                        if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
-        } else {
+                            seq != call->rx_top) {
-                if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
+                                rxrpc_proto_abort("LSN", call, seq);
-                    after_eq(seq, call->rx_top)) {
+                                goto unlock;
-                        rxrpc_proto_abort("LSA", call, seq);
+                        }
-                        goto unlock;
+                } else {
+                        if (test_bit(RXRPC_CALL_RX_LAST, &call->flags) &&
+                            after_eq(seq, call->rx_top)) {
+                                rxrpc_proto_abort("LSA", call, seq);
+                                goto unlock;
+                        }
                }
-        }
-        trace_rxrpc_rx_data(call->debug_id, seq, serial, flags, annotation);
-        if (before_eq(seq, hard_ack)) {
-                ack = RXRPC_ACK_DUPLICATE;
-                ack_serial = serial;
-                goto skip;
-        }
-        if (flags & RXRPC_REQUEST_ACK && !ack) {
+                flags = 0;
-                ack = RXRPC_ACK_REQUESTED;
+                if (last)
-                ack_serial = serial;
+                        flags |= RXRPC_LAST_PACKET;
-        }
+                if (!terminal)
+                        flags |= RXRPC_JUMBO_PACKET;
+                if (test_bit(j, sp->rx_req_ack))
+                        flags |= RXRPC_REQUEST_ACK;
+                trace_rxrpc_rx_data(call->debug_id, seq, serial, flags, annotation);
-        if (call->rxtx_buffer[ix]) {
+                if (before_eq(seq, hard_ack)) {
-                rxrpc_input_dup_data(call, seq, annotation, &jumbo_bad);
-                if (ack != RXRPC_ACK_DUPLICATE) {
                        ack = RXRPC_ACK_DUPLICATE;
                        ack_serial = serial;
+                        continue;
                }
-                immediate_ack = true;
-                goto skip;
-        }
-        /* Queue the packet.  We use a couple of memory barriers here as need
-         * to make sure that rx_top is perceived to be set after the buffer
-         * pointer and that the buffer pointer is set after the annotation and
-         * the skb data.
-         *
-         * Barriers against rxrpc_recvmsg_data() and rxrpc_rotate_rx_window()
-         * and also rxrpc_fill_out_ack().
-         */
-        rxrpc_get_skb(skb, rxrpc_skb_rx_got);
-        call->rxtx_annotations[ix] = annotation;
-        smp_wmb();
-        call->rxtx_buffer[ix] = skb;
-        if (after(seq, call->rx_top)) {
-                smp_store_release(&call->rx_top, seq);
-        } else if (before(seq, call->rx_top)) {
-                /* Send an immediate ACK if we fill in a hole */
-                if (!ack) {
-                        ack = RXRPC_ACK_DELAY;
-                        ack_serial = serial;
-                }
-                immediate_ack = true;
-        }
-        if (flags & RXRPC_LAST_PACKET) {
-                set_bit(RXRPC_CALL_RX_LAST, &call->flags);
-                trace_rxrpc_receive(call, rxrpc_receive_queue_last, serial, seq);
-        } else {
-                trace_rxrpc_receive(call, rxrpc_receive_queue, serial, seq);
-        }
-        queued = true;
-        if (after_eq(seq, call->rx_expect_next)) {
+                if (call->rxtx_buffer[ix]) {
-                if (after(seq, call->rx_expect_next)) {
+                        rxrpc_input_dup_data(call, seq, sp->nr_subpackets > 1,
-                        _net("OOS %u > %u", seq, call->rx_expect_next);
+                                             &jumbo_bad);
-                        ack = RXRPC_ACK_OUT_OF_SEQUENCE;
+                        if (ack != RXRPC_ACK_DUPLICATE) {
-                        ack_serial = serial;
+                                ack = RXRPC_ACK_DUPLICATE;
+                                ack_serial = serial;
+                        }
+                        immediate_ack = true;
+                        continue;
                }
-                call->rx_expect_next = seq + 1;
-        }
-skip:
-        offset += len;
-        if (flags & RXRPC_JUMBO_PACKET) {
-                if (skb_copy_bits(skb, offset, &flags, 1) < 0) {
-                        rxrpc_proto_abort("XJF", call, seq);
-                        goto unlock;
-                }
-                offset += sizeof(struct rxrpc_jumbo_header);
-                seq++;
-                serial++;
-                annotation++;
-                if (flags & RXRPC_JUMBO_PACKET)
-                        annotation |= RXRPC_RX_ANNO_JLAST;
                if (after(seq, hard_ack + call->rx_winsize)) {
                        ack = RXRPC_ACK_EXCEEDS_WINDOW;
                        ack_serial = serial;
-                        if (!jumbo_bad) {
+                        if (flags & RXRPC_JUMBO_PACKET) {
-                                call->nr_jumbo_bad++;
+                                if (!jumbo_bad) {
-                                jumbo_bad = true;
+                                        call->nr_jumbo_bad++;
+                                        jumbo_bad = true;
+                                }
                        }
                        goto ack;
                }
-                _proto("Rx DATA Jumbo %%%u", serial);
+                if (flags & RXRPC_REQUEST_ACK && !ack) {
-                goto next_subpacket;
+                        ack = RXRPC_ACK_REQUESTED;
-        }
+                        ack_serial = serial;
+                }
+                /* Queue the packet.  We use a couple of memory barriers here as need
+                 * to make sure that rx_top is perceived to be set after the buffer
+                 * pointer and that the buffer pointer is set after the annotation and
+                 * the skb data.
+                 *
+                 * Barriers against rxrpc_recvmsg_data() and rxrpc_rotate_rx_window()
+                 * and also rxrpc_fill_out_ack().
+                 */
+                if (!terminal)
+                        rxrpc_get_skb(skb, rxrpc_skb_got);
+                call->rxtx_annotations[ix] = annotation;
+                smp_wmb();
+                call->rxtx_buffer[ix] = skb;
+                if (after(seq, call->rx_top)) {
+                        smp_store_release(&call->rx_top, seq);
+                } else if (before(seq, call->rx_top)) {
+                        /* Send an immediate ACK if we fill in a hole */
+                        if (!ack) {
+                                ack = RXRPC_ACK_DELAY;
+                                ack_serial = serial;
+                        }
+                        immediate_ack = true;
+                }
-        if (queued && flags & RXRPC_LAST_PACKET && !ack) {
+                if (terminal) {
-                ack = RXRPC_ACK_DELAY;
+                        /* From this point on, we're not allowed to touch the
-                ack_serial = serial;
+                         * packet any longer as its ref now belongs to the Rx
+                         * ring.
+                         */
+                        skb = NULL;
+                }
+                if (last) {
+                        set_bit(RXRPC_CALL_RX_LAST, &call->flags);
+                        if (!ack) {
+                                ack = RXRPC_ACK_DELAY;
+                                ack_serial = serial;
+                        }
+                        trace_rxrpc_receive(call, rxrpc_receive_queue_last, serial, seq);
+                } else {
+                        trace_rxrpc_receive(call, rxrpc_receive_queue, serial, seq);
+                }
+                if (after_eq(seq, call->rx_expect_next)) {
+                        if (after(seq, call->rx_expect_next)) {
+                                _net("OOS %u > %u", seq, call->rx_expect_next);
+                                ack = RXRPC_ACK_OUT_OF_SEQUENCE;
+                                ack_serial = serial;
+                        }
+                        call->rx_expect_next = seq + 1;
+                }
        }
 ack:
        if (ack)
-                rxrpc_propose_ACK(call, ack, skew, ack_serial,
+                rxrpc_propose_ACK(call, ack, ack_serial,
                                  immediate_ack, true,
                                  rxrpc_propose_ack_input_data);
        else
-                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, skew, serial,
+                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, serial,
                                  false, true,
                                  rxrpc_propose_ack_input_data);
-        if (sp->hdr.seq == READ_ONCE(call->rx_hard_ack) + 1) {
+        if (seq0 == READ_ONCE(call->rx_hard_ack) + 1) {
                trace_rxrpc_notify_socket(call->debug_id, serial);
                rxrpc_notify_socket(call);
        }
 unlock:
        spin_unlock(&call->input_lock);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
        _leave(" [queued]");
 }
@@ -822,8 +828,7 @@ static void rxrpc_input_soft_acks(struct rxrpc_call *call, u8 *acks,
 * soft-ACK means that the packet may be discarded and retransmission
 * requested.  A phase is complete when all packets are hard-ACK'd.
 */
-static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
+static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb)
-                            u16 skew)
 {
        struct rxrpc_ack_summary summary = { 0 };
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
@@ -867,11 +872,11 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
        if (buf.ack.reason == RXRPC_ACK_PING) {
                _proto("Rx ACK %%%u PING Request", sp->hdr.serial);
                rxrpc_propose_ACK(call, RXRPC_ACK_PING_RESPONSE,
-                                  skew, sp->hdr.serial, true, true,
+                                  sp->hdr.serial, true, true,
                                  rxrpc_propose_ack_respond_to_ping);
        } else if (sp->hdr.flags & RXRPC_REQUEST_ACK) {
                rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED,
-                                  skew, sp->hdr.serial, true, true,
+                                  sp->hdr.serial, true, true,
                                  rxrpc_propose_ack_respond_to_ack);
        }
@@ -948,7 +953,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
            RXRPC_TX_ANNO_LAST &&
            summary.nr_acks == call->tx_top - hard_ack &&
            rxrpc_is_client_call(call))
-                rxrpc_propose_ACK(call, RXRPC_ACK_PING, skew, sp->hdr.serial,
+                rxrpc_propose_ACK(call, RXRPC_ACK_PING, sp->hdr.serial,
                                  false, true,
                                  rxrpc_propose_ack_ping_for_lost_reply);
@@ -1004,7 +1009,7 @@ static void rxrpc_input_abort(struct rxrpc_call *call, struct sk_buff *skb)
 * Process an incoming call packet.
 */
 static void rxrpc_input_call_packet(struct rxrpc_call *call,
-                                    struct sk_buff *skb, u16 skew)
+                                    struct sk_buff *skb)
 {
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        unsigned long timo;
@@ -1023,11 +1028,11 @@ static void rxrpc_input_call_packet(struct rxrpc_call *call,
        switch (sp->hdr.type) {
        case RXRPC_PACKET_TYPE_DATA:
-                rxrpc_input_data(call, skb, skew);
+                rxrpc_input_data(call, skb);
-                break;
+                goto no_free;
        case RXRPC_PACKET_TYPE_ACK:
-                rxrpc_input_ack(call, skb, skew);
+                rxrpc_input_ack(call, skb);
                break;
        case RXRPC_PACKET_TYPE_BUSY:
@@ -1051,6 +1056,8 @@ static void rxrpc_input_call_packet(struct rxrpc_call *call,
                break;
        }
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
+no_free:
        _leave("");
 }
@@ -1108,8 +1115,12 @@ static void rxrpc_post_packet_to_local(struct rxrpc_local *local,
 {
        _enter("%p,%p", local, skb);
-        skb_queue_tail(&local->event_queue, skb);
+        if (rxrpc_get_local_maybe(local)) {
-        rxrpc_queue_local(local);
+                skb_queue_tail(&local->event_queue, skb);
+                rxrpc_queue_local(local);
+        } else {
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
+        }
 }
 /*
@@ -1119,8 +1130,12 @@ static void rxrpc_reject_packet(struct rxrpc_local *local, struct sk_buff *skb)
 {
        CHECK_SLAB_OKAY(&local->usage);
-        skb_queue_tail(&local->reject_queue, skb);
+        if (rxrpc_get_local_maybe(local)) {
-        rxrpc_queue_local(local);
+                skb_queue_tail(&local->reject_queue, skb);
+                rxrpc_queue_local(local);
+        } else {
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
+        }
 }
 /*
@@ -1173,7 +1188,6 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
        struct rxrpc_peer *peer = NULL;
        struct rxrpc_sock *rx = NULL;
        unsigned int channel;
-        int skew = 0;
        _enter("%p", udp_sk);
@@ -1184,7 +1198,7 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
        if (skb->tstamp == 0)
                skb->tstamp = ktime_get_real();
-        rxrpc_new_skb(skb, rxrpc_skb_rx_received);
+        rxrpc_new_skb(skb, rxrpc_skb_received);
        skb_pull(skb, sizeof(struct udphdr));
@@ -1201,7 +1215,7 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                static int lose;
                if ((lose++ & 7) == 7) {
                        trace_rxrpc_rx_lose(sp);
-                        rxrpc_free_skb(skb, rxrpc_skb_rx_lost);
+                        rxrpc_free_skb(skb, rxrpc_skb_lost);
                        return 0;
                }
        }
@@ -1233,9 +1247,26 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                if (sp->hdr.callNumber == 0 ||
                    sp->hdr.seq == 0)
                        goto bad_message;
-                if (sp->hdr.flags & RXRPC_JUMBO_PACKET &&
+                if (!rxrpc_validate_data(skb))
-                    !rxrpc_validate_jumbo(skb))
                        goto bad_message;
+                /* Unshare the packet so that it can be modified for in-place
+                 * decryption.
+                 */
+                if (sp->hdr.securityIndex != 0) {
+                        struct sk_buff *nskb = skb_unshare(skb, GFP_ATOMIC);
+                        if (!nskb) {
+                                rxrpc_eaten_skb(skb, rxrpc_skb_unshared_nomem);
+                                goto out;
+                        }
+                        if (nskb != skb) {
+                                rxrpc_eaten_skb(skb, rxrpc_skb_received);
+                                rxrpc_new_skb(skb, rxrpc_skb_unshared);
+                                skb = nskb;
+                                sp = rxrpc_skb(skb);
+                        }
+                }
                break;
        case RXRPC_PACKET_TYPE_CHALLENGE:
@@ -1301,15 +1332,8 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                        goto out;
                }
-                /* Note the serial number skew here */
+                if ((int)sp->hdr.serial - (int)conn->hi_serial > 0)
-                skew = (int)sp->hdr.serial - (int)conn->hi_serial;
+                        conn->hi_serial = sp->hdr.serial;
-                if (skew >= 0) {
-                        if (skew > 0)
-                                conn->hi_serial = sp->hdr.serial;
-                } else {
-                        skew = -skew;
-                        skew = min(skew, 65535);
-                }
                /* Call-bound packets are routed by connection channel. */
                channel = sp->hdr.cid & RXRPC_CHANNELMASK;
@@ -1372,15 +1396,18 @@ int rxrpc_input_packet(struct sock *udp_sk, struct sk_buff *skb)
                call = rxrpc_new_incoming_call(local, rx, skb);
                if (!call)
                        goto reject_packet;
-                rxrpc_send_ping(call, skb, skew);
+                rxrpc_send_ping(call, skb);
                mutex_unlock(&call->user_mutex);
        }
-        rxrpc_input_call_packet(call, skb, skew);
+        /* Process a call packet; this either discards or passes on the ref
-        goto discard;
+         * elsewhere.
+         */
+        rxrpc_input_call_packet(call, skb);
+        goto out;
 discard:
-        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
 out:
        trace_rxrpc_rx_done(0, 0);
        return 0;
diff --git a/net/rxrpc/local_event.c b/net/rxrpc/local_event.c
index e93a78f7c05e..3ce6d628cd75 100644
--- a/net/rxrpc/local_event.c
+++ b/net/rxrpc/local_event.c
@@ -90,7 +90,7 @@ void rxrpc_process_local_events(struct rxrpc_local *local)
        if (skb) {
                struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
-                rxrpc_see_skb(skb, rxrpc_skb_rx_seen);
+                rxrpc_see_skb(skb, rxrpc_skb_seen);
                _debug("{%d},{%u}", local->debug_id, sp->hdr.type);
                switch (sp->hdr.type) {
@@ -108,7 +108,7 @@ void rxrpc_process_local_events(struct rxrpc_local *local)
                        break;
                }
-                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
        }
        _leave("");
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index b1c71bad510b..36587260cabd 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -79,6 +79,7 @@ static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
        local = kzalloc(sizeof(struct rxrpc_local), GFP_KERNEL);
        if (local) {
                atomic_set(&local->usage, 1);
+                atomic_set(&local->active_users, 1);
                local->rxnet = rxnet;
                INIT_LIST_HEAD(&local->link);
                INIT_WORK(&local->processor, rxrpc_local_processor);
@@ -92,7 +93,7 @@ static struct rxrpc_local *rxrpc_alloc_local(struct rxrpc_net *rxnet,
                local->debug_id = atomic_inc_return(&rxrpc_debug_id);
                memcpy(&local->srx, srx, sizeof(*srx));
                local->srx.srx_service = 0;
-                trace_rxrpc_local(local, rxrpc_local_new, 1, NULL);
+                trace_rxrpc_local(local->debug_id, rxrpc_local_new, 1, NULL);
        }
        _leave(" = %p", local);
@@ -266,11 +267,8 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
                 * bind the transport socket may still fail if we're attempting
                 * to use a local address that the dying object is still using.
                 */
-                if (!rxrpc_get_local_maybe(local)) {
+                if (!rxrpc_use_local(local))
-                        cursor = cursor->next;
-                        list_del_init(&local->link);
                        break;
-                }
                age = "old";
                goto found;
@@ -284,7 +282,10 @@ struct rxrpc_local *rxrpc_lookup_local(struct net *net,
        if (ret < 0)
                goto sock_error;
-        list_add_tail(&local->link, cursor);
+        if (cursor != &rxnet->local_endpoints)
+                list_replace_init(cursor, &local->link);
+        else
+                list_add_tail(&local->link, cursor);
        age = "new";
 found:
@@ -320,7 +321,7 @@ struct rxrpc_local *rxrpc_get_local(struct rxrpc_local *local)
        int n;
        n = atomic_inc_return(&local->usage);
-        trace_rxrpc_local(local, rxrpc_local_got, n, here);
+        trace_rxrpc_local(local->debug_id, rxrpc_local_got, n, here);
        return local;
 }
@@ -334,7 +335,8 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
        if (local) {
                int n = atomic_fetch_add_unless(&local->usage, 1, 0);
                if (n > 0)
-                        trace_rxrpc_local(local, rxrpc_local_got, n + 1, here);
+                        trace_rxrpc_local(local->debug_id, rxrpc_local_got,
+                                          n + 1, here);
                else
                        local = NULL;
        }
@@ -342,24 +344,18 @@ struct rxrpc_local *rxrpc_get_local_maybe(struct rxrpc_local *local)
 }
 /*
- * Queue a local endpoint.
+ * Queue a local endpoint and pass the caller's reference to the work item.
 */
 void rxrpc_queue_local(struct rxrpc_local *local)
 {
        const void *here = __builtin_return_address(0);
+        unsigned int debug_id = local->debug_id;
+        int n = atomic_read(&local->usage);
        if (rxrpc_queue_work(&local->processor))
-                trace_rxrpc_local(local, rxrpc_local_queued,
+                trace_rxrpc_local(debug_id, rxrpc_local_queued, n, here);
-                                  atomic_read(&local->usage), here);
+        else
-}
+                rxrpc_put_local(local);
-/*
- * A local endpoint reached its end of life.
- */
-static void __rxrpc_put_local(struct rxrpc_local *local)
-{
-        _enter("%d", local->debug_id);
-        rxrpc_queue_work(&local->processor);
 }
 /*
@@ -372,10 +368,47 @@ void rxrpc_put_local(struct rxrpc_local *local)
        if (local) {
                n = atomic_dec_return(&local->usage);
-                trace_rxrpc_local(local, rxrpc_local_put, n, here);
+                trace_rxrpc_local(local->debug_id, rxrpc_local_put, n, here);
                if (n == 0)
-                        __rxrpc_put_local(local);
+                        call_rcu(&local->rcu, rxrpc_local_rcu);
+        }
+}
+/*
+ * Start using a local endpoint.
+ */
+struct rxrpc_local *rxrpc_use_local(struct rxrpc_local *local)
+{
+        unsigned int au;
+        local = rxrpc_get_local_maybe(local);
+        if (!local)
+                return NULL;
+        au = atomic_fetch_add_unless(&local->active_users, 1, 0);
+        if (au == 0) {
+                rxrpc_put_local(local);
+                return NULL;
+        }
+        return local;
+}
+/*
+ * Cease using a local endpoint.  Once the number of active users reaches 0, we
+ * start the closure of the transport in the work processor.
+ */
+void rxrpc_unuse_local(struct rxrpc_local *local)
+{
+        unsigned int au;
+        if (local) {
+                au = atomic_dec_return(&local->active_users);
+                if (au == 0)
+                        rxrpc_queue_local(local);
+                else
+                        rxrpc_put_local(local);
        }
 }
@@ -393,21 +426,14 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
        _enter("%d", local->debug_id);
-        /* We can get a race between an incoming call packet queueing the
-         * processor again and the work processor starting the destruction
-         * process which will shut down the UDP socket.
-         */
-        if (local->dead) {
-                _leave(" [already dead]");
-                return;
-        }
        local->dead = true;
        mutex_lock(&rxnet->local_mutex);
        list_del_init(&local->link);
        mutex_unlock(&rxnet->local_mutex);
-        ASSERT(RB_EMPTY_ROOT(&local->client_conns));
+        rxrpc_clean_up_local_conns(local);
+        rxrpc_service_connection_reaper(&rxnet->service_conn_reaper);
        ASSERT(!local->service);
        if (socket) {
@@ -422,13 +448,11 @@ static void rxrpc_local_destroyer(struct rxrpc_local *local)
         */
        rxrpc_purge_queue(&local->reject_queue);
        rxrpc_purge_queue(&local->event_queue);
-        _debug("rcu local %d", local->debug_id);
-        call_rcu(&local->rcu, rxrpc_local_rcu);
 }
 /*
- * Process events on an endpoint
+ * Process events on an endpoint.  The work item carries a ref which
+ * we must release.
 */
 static void rxrpc_local_processor(struct work_struct *work)
 {
@@ -436,13 +460,15 @@ static void rxrpc_local_processor(struct work_struct *work)
                container_of(work, struct rxrpc_local, processor);
        bool again;
-        trace_rxrpc_local(local, rxrpc_local_processing,
+        trace_rxrpc_local(local->debug_id, rxrpc_local_processing,
                          atomic_read(&local->usage), NULL);
        do {
                again = false;
-                if (atomic_read(&local->usage) == 0)
+                if (atomic_read(&local->active_users) == 0) {
-                        return rxrpc_local_destroyer(local);
+                        rxrpc_local_destroyer(local);
+                        break;
+                }
                if (!skb_queue_empty(&local->reject_queue)) {
                        rxrpc_reject_packets(local);
@@ -454,6 +480,8 @@ static void rxrpc_local_processor(struct work_struct *work)
                        again = true;
                }
        } while (again);
+        rxrpc_put_local(local);
 }
 /*
diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
index 948e3fe249ec..935bb60fff56 100644
--- a/net/rxrpc/output.c
+++ b/net/rxrpc/output.c
@@ -87,7 +87,7 @@ static size_t rxrpc_fill_out_ack(struct rxrpc_connection *conn,
        *_top = top;
        pkt->ack.bufferSpace    = htons(8);
-        pkt->ack.maxSkew        = htons(call->ackr_skew);
+        pkt->ack.maxSkew        = htons(0);
        pkt->ack.firstPacket    = htonl(hard_ack + 1);
        pkt->ack.previousPacket = htonl(call->ackr_prev_seq);
        pkt->ack.serial         = htonl(serial);
@@ -228,7 +228,6 @@ int rxrpc_send_ack_packet(struct rxrpc_call *call, bool ping,
                        if (ping)
                                clear_bit(RXRPC_CALL_PINGING, &call->flags);
                        rxrpc_propose_ACK(call, pkt->ack.reason,
-                                          ntohs(pkt->ack.maxSkew),
                                          ntohl(pkt->ack.serial),
                                          false, true,
                                          rxrpc_propose_ack_retry_tx);
@@ -566,7 +565,7 @@ void rxrpc_reject_packets(struct rxrpc_local *local)
        memset(&whdr, 0, sizeof(whdr));
        while ((skb = skb_dequeue(&local->reject_queue))) {
-                rxrpc_see_skb(skb, rxrpc_skb_rx_seen);
+                rxrpc_see_skb(skb, rxrpc_skb_seen);
                sp = rxrpc_skb(skb);
                switch (skb->mark) {
@@ -582,7 +581,7 @@ void rxrpc_reject_packets(struct rxrpc_local *local)
                        ioc = 2;
                        break;
                default:
-                        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                        rxrpc_free_skb(skb, rxrpc_skb_freed);
                        continue;
                }
@@ -607,7 +606,7 @@ void rxrpc_reject_packets(struct rxrpc_local *local)
                                                      rxrpc_tx_point_reject);
                }
-                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
        }
        _leave("");
diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
index 9f2f45c09e58..c97ebdc043e4 100644
--- a/net/rxrpc/peer_event.c
+++ b/net/rxrpc/peer_event.c
@@ -163,11 +163,11 @@ void rxrpc_error_report(struct sock *sk)
                _leave("UDP socket errqueue empty");
                return;
        }
-        rxrpc_new_skb(skb, rxrpc_skb_rx_received);
+        rxrpc_new_skb(skb, rxrpc_skb_received);
        serr = SKB_EXT_ERR(skb);
        if (!skb->len && serr->ee.ee_origin == SO_EE_ORIGIN_TIMESTAMPING) {
                _leave("UDP empty message");
-                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
                return;
        }
@@ -177,7 +177,7 @@ void rxrpc_error_report(struct sock *sk)
                peer = NULL;
        if (!peer) {
                rcu_read_unlock();
-                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
                _leave(" [no peer]");
                return;
        }
@@ -189,7 +189,7 @@ void rxrpc_error_report(struct sock *sk)
             serr->ee.ee_code == ICMP_FRAG_NEEDED)) {
                rxrpc_adjust_mtu(peer, serr);
                rcu_read_unlock();
-                rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+                rxrpc_free_skb(skb, rxrpc_skb_freed);
                rxrpc_put_peer(peer);
                _leave(" [MTU update]");
                return;
@@ -197,7 +197,7 @@ void rxrpc_error_report(struct sock *sk)
        rxrpc_store_error(peer, serr);
        rcu_read_unlock();
-        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
        rxrpc_put_peer(peer);
        _leave("");
@@ -378,7 +378,7 @@ static void rxrpc_peer_keepalive_dispatch(struct rxrpc_net *rxnet,
                spin_lock_bh(&rxnet->peer_hash_lock);
                list_add_tail(&peer->keepalive_link,
                              &rxnet->peer_keepalive[slot & mask]);
-                rxrpc_put_peer(peer);
+                rxrpc_put_peer_locked(peer);
        }
        spin_unlock_bh(&rxnet->peer_hash_lock);
diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
index 9d3ce81cf8ae..9c3ac96f71cb 100644
--- a/net/rxrpc/peer_object.c
+++ b/net/rxrpc/peer_object.c
@@ -437,6 +437,24 @@ void rxrpc_put_peer(struct rxrpc_peer *peer)
 }
 /*
+ * Drop a ref on a peer record where the caller already holds the
+ * peer_hash_lock.
+ */
+void rxrpc_put_peer_locked(struct rxrpc_peer *peer)
+{
+        const void *here = __builtin_return_address(0);
+        int n;
+        n = atomic_dec_return(&peer->usage);
+        trace_rxrpc_peer(peer, rxrpc_peer_put, n, here);
+        if (n == 0) {
+                hash_del_rcu(&peer->hash_link);
+                list_del_init(&peer->keepalive_link);
+                kfree_rcu(peer, rcu);
+        }
+}
+/*
 * Make sure all peer records have been discarded.
 */
 void rxrpc_destroy_all_peers(struct rxrpc_net *rxnet)
diff --git a/net/rxrpc/protocol.h b/net/rxrpc/protocol.h
index 99ce322d7caa..49bb972539aa 100644
--- a/net/rxrpc/protocol.h
+++ b/net/rxrpc/protocol.h
@@ -89,6 +89,15 @@ struct rxrpc_jumbo_header {
 #define RXRPC_JUMBO_DATALEN     1412    /* non-terminal jumbo packet data length */
 #define RXRPC_JUMBO_SUBPKTLEN   (RXRPC_JUMBO_DATALEN + sizeof(struct rxrpc_jumbo_header))
+/*
+ * The maximum number of subpackets that can possibly fit in a UDP packet is:
+ *
+ *      ((max_IP - IP_hdr - UDP_hdr) / RXRPC_JUMBO_SUBPKTLEN) + 1
+ *      = ((65535 - 28 - 28) / 1416) + 1
+ *      = 46 non-terminal packets and 1 terminal packet.
+ */
+#define RXRPC_MAX_NR_JUMBO      47
 /*****************************************************************************/
 /*
 * on-the-wire Rx ACK packet data payload
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index 5abf46cf9e6c..3b0becb12041 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -141,7 +141,7 @@ static void rxrpc_end_rx_phase(struct rxrpc_call *call, rxrpc_serial_t serial)
        ASSERTCMP(call->rx_hard_ack, ==, call->rx_top);
        if (call->state == RXRPC_CALL_CLIENT_RECV_REPLY) {
-                rxrpc_propose_ACK(call, RXRPC_ACK_IDLE, 0, serial, false, true,
+                rxrpc_propose_ACK(call, RXRPC_ACK_IDLE, serial, false, true,
                                  rxrpc_propose_ack_terminal_ack);
                //rxrpc_send_ack_packet(call, false, NULL);
        }
@@ -159,7 +159,7 @@ static void rxrpc_end_rx_phase(struct rxrpc_call *call, rxrpc_serial_t serial)
                call->state = RXRPC_CALL_SERVER_ACK_REQUEST;
                call->expect_req_by = jiffies + MAX_JIFFY_OFFSET;
                write_unlock_bh(&call->state_lock);
-                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, 0, serial, false, true,
+                rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, serial, false, true,
                                  rxrpc_propose_ack_processing_op);
                break;
        default:
@@ -177,7 +177,8 @@ static void rxrpc_rotate_rx_window(struct rxrpc_call *call)
        struct sk_buff *skb;
        rxrpc_serial_t serial;
        rxrpc_seq_t hard_ack, top;
-        u8 flags;
+        bool last = false;
+        u8 subpacket;
        int ix;
        _enter("%d", call->debug_id);
@@ -189,30 +190,32 @@ static void rxrpc_rotate_rx_window(struct rxrpc_call *call)
        hard_ack++;
        ix = hard_ack & RXRPC_RXTX_BUFF_MASK;
        skb = call->rxtx_buffer[ix];
-        rxrpc_see_skb(skb, rxrpc_skb_rx_rotated);
+        rxrpc_see_skb(skb, rxrpc_skb_rotated);
        sp = rxrpc_skb(skb);
-        flags = sp->hdr.flags;
-        serial = sp->hdr.serial;
+        subpacket = call->rxtx_annotations[ix] & RXRPC_RX_ANNO_SUBPACKET;
-        if (call->rxtx_annotations[ix] & RXRPC_RX_ANNO_JUMBO)
+        serial = sp->hdr.serial + subpacket;
-                serial += (call->rxtx_annotations[ix] & RXRPC_RX_ANNO_JUMBO) - 1;
+        if (subpacket == sp->nr_subpackets - 1 &&
+            sp->rx_flags & RXRPC_SKB_INCL_LAST)
+                last = true;
        call->rxtx_buffer[ix] = NULL;
        call->rxtx_annotations[ix] = 0;
        /* Barrier against rxrpc_input_data(). */
        smp_store_release(&call->rx_hard_ack, hard_ack);
-        rxrpc_free_skb(skb, rxrpc_skb_rx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
-        _debug("%u,%u,%02x", hard_ack, top, flags);
        trace_rxrpc_receive(call, rxrpc_receive_rotate, serial, hard_ack);
-        if (flags & RXRPC_LAST_PACKET) {
+        if (last) {
                rxrpc_end_rx_phase(call, serial);
        } else {
                /* Check to see if there's an ACK that needs sending. */
                if (after_eq(hard_ack, call->ackr_consumed + 2) ||
                    after_eq(top, call->ackr_seen + 2) ||
                    (hard_ack == top && after(hard_ack, call->ackr_consumed)))
-                        rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, 0, serial,
+                        rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, serial,
                                          true, true,
                                          rxrpc_propose_ack_rotate_rx);
                if (call->ackr_reason && call->ackr_reason != RXRPC_ACK_DELAY)
@@ -233,18 +236,19 @@ static int rxrpc_verify_packet(struct rxrpc_call *call, struct sk_buff *skb,
        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        rxrpc_seq_t seq = sp->hdr.seq;
        u16 cksum = sp->hdr.cksum;
+        u8 subpacket = annotation & RXRPC_RX_ANNO_SUBPACKET;
        _enter("");
        /* For all but the head jumbo subpacket, the security checksum is in a
         * jumbo header immediately prior to the data.
         */
-        if ((annotation & RXRPC_RX_ANNO_JUMBO) > 1) {
+        if (subpacket > 0) {
                __be16 tmp;
                if (skb_copy_bits(skb, offset - 2, &tmp, 2) < 0)
                        BUG();
                cksum = ntohs(tmp);
-                seq += (annotation & RXRPC_RX_ANNO_JUMBO) - 1;
+                seq += subpacket;
        }
        return call->conn->security->verify_packet(call, skb, offset, len,
@@ -265,19 +269,18 @@ static int rxrpc_locate_data(struct rxrpc_call *call, struct sk_buff *skb,
                             u8 *_annotation,
                             unsigned int *_offset, unsigned int *_len)
 {
+        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
        unsigned int offset = sizeof(struct rxrpc_wire_header);
        unsigned int len;
        int ret;
        u8 annotation = *_annotation;
+        u8 subpacket = annotation & RXRPC_RX_ANNO_SUBPACKET;
        /* Locate the subpacket */
+        offset += subpacket * RXRPC_JUMBO_SUBPKTLEN;
        len = skb->len - offset;
-        if ((annotation & RXRPC_RX_ANNO_JUMBO) > 0) {
+        if (subpacket < sp->nr_subpackets - 1)
-                offset += (((annotation & RXRPC_RX_ANNO_JUMBO) - 1) *
+                len = RXRPC_JUMBO_DATALEN;
-                           RXRPC_JUMBO_SUBPKTLEN);
-                len = (annotation & RXRPC_RX_ANNO_JLAST) ?
-                        skb->len - offset : RXRPC_JUMBO_SUBPKTLEN;
-        }
        if (!(annotation & RXRPC_RX_ANNO_VERIFIED)) {
                ret = rxrpc_verify_packet(call, skb, annotation, offset, len);
@@ -303,6 +306,7 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
 {
        struct rxrpc_skb_priv *sp;
        struct sk_buff *skb;
+        rxrpc_serial_t serial;
        rxrpc_seq_t hard_ack, top, seq;
        size_t remain;
        bool last;
@@ -336,12 +340,15 @@ static int rxrpc_recvmsg_data(struct socket *sock, struct rxrpc_call *call,
                        break;
                }
                smp_rmb();
-                rxrpc_see_skb(skb, rxrpc_skb_rx_seen);
+                rxrpc_see_skb(skb, rxrpc_skb_seen);
                sp = rxrpc_skb(skb);
-                if (!(flags & MSG_PEEK))
+                if (!(flags & MSG_PEEK)) {
+                        serial = sp->hdr.serial;
+                        serial += call->rxtx_annotations[ix] & RXRPC_RX_ANNO_SUBPACKET;
                        trace_rxrpc_receive(call, rxrpc_receive_front,
-                                            sp->hdr.serial, seq);
+                                            serial, seq);
+                }
                if (msg)
                        sock_recv_timestamp(msg, sock->sk, skb);
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index ae8cd8926456..c60c520fde7c 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -187,10 +187,8 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
        struct rxrpc_skb_priv *sp;
        struct rxrpc_crypt iv;
        struct scatterlist sg[16];
-        struct sk_buff *trailer;
        unsigned int len;
        u16 check;
-        int nsg;
        int err;
        sp = rxrpc_skb(skb);
@@ -214,15 +212,14 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
        crypto_skcipher_encrypt(req);
        /* we want to encrypt the skbuff in-place */
-        nsg = skb_cow_data(skb, 0, &trailer);
+        err = -EMSGSIZE;
-        err = -ENOMEM;
+        if (skb_shinfo(skb)->nr_frags > 16)
-        if (nsg < 0 || nsg > 16)
                goto out;
        len = data_size + call->conn->size_align - 1;
        len &= ~(call->conn->size_align - 1);
-        sg_init_table(sg, nsg);
+        sg_init_table(sg, ARRAY_SIZE(sg));
        err = skb_to_sgvec(skb, sg, 0, len);
        if (unlikely(err < 0))
                goto out;
@@ -319,11 +316,10 @@ static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
        struct rxkad_level1_hdr sechdr;
        struct rxrpc_crypt iv;
        struct scatterlist sg[16];
-        struct sk_buff *trailer;
        bool aborted;
        u32 data_size, buf;
        u16 check;
-        int nsg, ret;
+        int ret;
        _enter("");
@@ -336,11 +332,7 @@ static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
        /* Decrypt the skbuff in-place.  TODO: We really want to decrypt
         * directly into the target buffer.
         */
-        nsg = skb_cow_data(skb, 0, &trailer);
+        sg_init_table(sg, ARRAY_SIZE(sg));
-        if (nsg < 0 || nsg > 16)
-                goto nomem;
-        sg_init_table(sg, nsg);
        ret = skb_to_sgvec(skb, sg, offset, 8);
        if (unlikely(ret < 0))
                return ret;
@@ -388,10 +380,6 @@ protocol_error:
        if (aborted)
                rxrpc_send_abort_packet(call);
        return -EPROTO;
-nomem:
-        _leave(" = -ENOMEM");
-        return -ENOMEM;
 }
 /*
@@ -406,7 +394,6 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
        struct rxkad_level2_hdr sechdr;
        struct rxrpc_crypt iv;
        struct scatterlist _sg[4], *sg;
-        struct sk_buff *trailer;
        bool aborted;
        u32 data_size, buf;
        u16 check;
@@ -423,12 +410,11 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
        /* Decrypt the skbuff in-place.  TODO: We really want to decrypt
         * directly into the target buffer.
         */
-        nsg = skb_cow_data(skb, 0, &trailer);
-        if (nsg < 0)
-                goto nomem;
        sg = _sg;
-        if (unlikely(nsg > 4)) {
+        nsg = skb_shinfo(skb)->nr_frags;
+        if (nsg <= 4) {
+                nsg = 4;
+        } else {
                sg = kmalloc_array(nsg, sizeof(*sg), GFP_NOIO);
                if (!sg)
                        goto nomem;
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 5d3f33ce6d41..6a1547b270fe 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -176,7 +176,7 @@ static int rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
        skb->tstamp = ktime_get_real();
        ix = seq & RXRPC_RXTX_BUFF_MASK;
-        rxrpc_get_skb(skb, rxrpc_skb_tx_got);
+        rxrpc_get_skb(skb, rxrpc_skb_got);
        call->rxtx_annotations[ix] = annotation;
        smp_wmb();
        call->rxtx_buffer[ix] = skb;
@@ -226,6 +226,7 @@ static int rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
                        rxrpc_set_call_completion(call,
                                                  RXRPC_CALL_LOCAL_ERROR,
                                                  0, ret);
+                        rxrpc_notify_socket(call);
                        goto out;
                }
                _debug("need instant resend %d", ret);
@@ -247,7 +248,7 @@ static int rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
        }
 out:
-        rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
        _leave(" = %d", ret);
        return ret;
 }
@@ -288,7 +289,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
        skb = call->tx_pending;
        call->tx_pending = NULL;
-        rxrpc_see_skb(skb, rxrpc_skb_tx_seen);
+        rxrpc_see_skb(skb, rxrpc_skb_seen);
        copied = 0;
        do {
@@ -335,7 +336,9 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
                        if (!skb)
                                goto maybe_error;
-                        rxrpc_new_skb(skb, rxrpc_skb_tx_new);
+                        sp = rxrpc_skb(skb);
+                        sp->rx_flags |= RXRPC_SKB_TX_BUFFER;
+                        rxrpc_new_skb(skb, rxrpc_skb_new);
                        _debug("ALLOC SEND %p", skb);
@@ -345,7 +348,6 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
                        skb_reserve(skb, call->conn->security_size);
                        skb->len += call->conn->security_size;
-                        sp = rxrpc_skb(skb);
                        sp->remain = chunk;
                        if (sp->remain > skb_tailroom(skb))
                                sp->remain = skb_tailroom(skb);
@@ -438,7 +440,7 @@ out:
        return ret;
 call_terminated:
-        rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
+        rxrpc_free_skb(skb, rxrpc_skb_freed);
        _leave(" = %d", call->error);
        return call->error;
diff --git a/net/rxrpc/skbuff.c b/net/rxrpc/skbuff.c
index 9ad5045b7c2f..0348d2bf6f7d 100644
--- a/net/rxrpc/skbuff.c
+++ b/net/rxrpc/skbuff.c
@@ -14,7 +14,8 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
-#define select_skb_count(op) (op >= rxrpc_skb_tx_cleaned ? &rxrpc_n_tx_skbs : &rxrpc_n_rx_skbs)
+#define is_tx_skb(skb) (rxrpc_skb(skb)->rx_flags & RXRPC_SKB_TX_BUFFER)
+#define select_skb_count(skb) (is_tx_skb(skb) ? &rxrpc_n_tx_skbs : &rxrpc_n_rx_skbs)
 /*
 * Note the allocation or reception of a socket buffer.
@@ -22,8 +23,9 @@
 void rxrpc_new_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
 {
        const void *here = __builtin_return_address(0);
-        int n = atomic_inc_return(select_skb_count(op));
+        int n = atomic_inc_return(select_skb_count(skb));
-        trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n, here);
+        trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n,
+                        rxrpc_skb(skb)->rx_flags, here);
 }
 /*
@@ -33,8 +35,9 @@ void rxrpc_see_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
 {
        const void *here = __builtin_return_address(0);
        if (skb) {
-                int n = atomic_read(select_skb_count(op));
+                int n = atomic_read(select_skb_count(skb));
-                trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n, here);
+                trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n,
+                                rxrpc_skb(skb)->rx_flags, here);
        }
 }
@@ -44,12 +47,23 @@ void rxrpc_see_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
 void rxrpc_get_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
 {
        const void *here = __builtin_return_address(0);
-        int n = atomic_inc_return(select_skb_count(op));
+        int n = atomic_inc_return(select_skb_count(skb));
-        trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n, here);
+        trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n,
+                        rxrpc_skb(skb)->rx_flags, here);
        skb_get(skb);
 }
 /*
+ * Note the dropping of a ref on a socket buffer by the core.
+ */
+void rxrpc_eaten_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
+{
+        const void *here = __builtin_return_address(0);
+        int n = atomic_inc_return(&rxrpc_n_rx_skbs);
+        trace_rxrpc_skb(skb, op, 0, n, 0, here);
+}
+/*
 * Note the destruction of a socket buffer.
 */
 void rxrpc_free_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
@@ -58,8 +72,9 @@ void rxrpc_free_skb(struct sk_buff *skb, enum rxrpc_skb_trace op)
        if (skb) {
                int n;
                CHECK_SLAB_OKAY(&skb->users);
-                n = atomic_dec_return(select_skb_count(op));
+                n = atomic_dec_return(select_skb_count(skb));
-                trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n, here);
+                trace_rxrpc_skb(skb, op, refcount_read(&skb->users), n,
+                                rxrpc_skb(skb)->rx_flags, here);
                kfree_skb(skb);
        }
 }
@@ -72,9 +87,10 @@ void rxrpc_purge_queue(struct sk_buff_head *list)
        const void *here = __builtin_return_address(0);
        struct sk_buff *skb;
        while ((skb = skb_dequeue((list))) != NULL) {
-                int n = atomic_dec_return(select_skb_count(rxrpc_skb_rx_purged));
+                int n = atomic_dec_return(select_skb_count(skb));
-                trace_rxrpc_skb(skb, rxrpc_skb_rx_purged,
+                trace_rxrpc_skb(skb, rxrpc_skb_purged,
-                                refcount_read(&skb->users), n, here);
+                                refcount_read(&skb->users), n,
+                                rxrpc_skb(skb)->rx_flags, here);
                kfree_skb(skb);
        }
 }
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 8126b26f125e..04b7bd4ec751 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -285,6 +285,7 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
        struct tcf_bpf *prog;
        bool is_bpf, is_ebpf;
        int ret, res = 0;
+        u32 index;
        if (!nla)
                return -EINVAL;
@@ -298,13 +299,13 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
                return -EINVAL;
        parm = nla_data(tb[TCA_ACT_BPF_PARMS]);
+        index = parm->index;
-        ret = tcf_idr_check_alloc(tn, &parm->index, act, bind);
+        ret = tcf_idr_check_alloc(tn, &index, act, bind);
        if (!ret) {
-                ret = tcf_idr_create(tn, parm->index, est, act,
+                ret = tcf_idr_create(tn, index, est, act,
                                     &act_bpf_ops, bind, true);
                if (ret < 0) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
@@ -421,7 +422,7 @@ static __net_init int bpf_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, bpf_net_id);
-        return tc_action_net_init(tn, &act_bpf_ops);
+        return tc_action_net_init(net, tn, &act_bpf_ops);
 }
 static void __net_exit bpf_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index ce36b0f7e1dc..2b43cacf82af 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -103,6 +103,7 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
        struct tcf_connmark_info *ci;
        struct tc_connmark *parm;
        int ret = 0, err;
+        u32 index;
        if (!nla)
                return -EINVAL;
@@ -116,13 +117,13 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla,
                return -EINVAL;
        parm = nla_data(tb[TCA_CONNMARK_PARMS]);
+        index = parm->index;
-        ret = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        ret = tcf_idr_check_alloc(tn, &index, a, bind);
        if (!ret) {
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_connmark_ops, bind, false);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
@@ -230,7 +231,7 @@ static __net_init int connmark_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, connmark_net_id);
-        return tc_action_net_init(tn, &act_connmark_ops);
+        return tc_action_net_init(net, tn, &act_connmark_ops);
 }
 static void __net_exit connmark_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 621fb22ce2a9..d3cfad88dc3a 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -52,6 +52,7 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla,
        struct tc_csum *parm;
        struct tcf_csum *p;
        int ret = 0, err;
+        u32 index;
        if (nla == NULL)
                return -EINVAL;
@@ -64,13 +65,13 @@ static int tcf_csum_init(struct net *net, struct nlattr *nla,
        if (tb[TCA_CSUM_PARMS] == NULL)
                return -EINVAL;
        parm = nla_data(tb[TCA_CSUM_PARMS]);
+        index = parm->index;
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (!err) {
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_csum_ops, bind, true);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
                ret = ACT_P_CREATED;
@@ -713,7 +714,7 @@ static __net_init int csum_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, csum_net_id);
-        return tc_action_net_init(tn, &act_csum_ops);
+        return tc_action_net_init(net, tn, &act_csum_ops);
 }
 static void __net_exit csum_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index b501ce0cf116..cdd6f3818097 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -666,6 +666,7 @@ static int tcf_ct_init(struct net *net, struct nlattr *nla,
        struct tc_ct *parm;
        struct tcf_ct *c;
        int err, res = 0;
+        u32 index;
        if (!nla) {
                NL_SET_ERR_MSG_MOD(extack, "Ct requires attributes to be passed");
@@ -681,16 +682,16 @@ static int tcf_ct_init(struct net *net, struct nlattr *nla,
                return -EINVAL;
        }
        parm = nla_data(tb[TCA_CT_PARMS]);
+        index = parm->index;
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (err < 0)
                return err;
        if (!err) {
-                err = tcf_idr_create(tn, parm->index, est, a,
+                err = tcf_idr_create(tn, index, est, a,
                                     &act_ct_ops, bind, true);
                if (err) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return err;
                }
                res = ACT_P_CREATED;
@@ -938,7 +939,7 @@ static __net_init int ct_init_net(struct net *net)
                tn->labels = true;
        }
-        return tc_action_net_init(&tn->tn, &act_ct_ops);
+        return tc_action_net_init(net, &tn->tn, &act_ct_ops);
 }
 static void __net_exit ct_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_ctinfo.c b/net/sched/act_ctinfo.c
index 10eb2bb99861..0dbcfd1dca7b 100644
--- a/net/sched/act_ctinfo.c
+++ b/net/sched/act_ctinfo.c
@@ -157,10 +157,10 @@ static int tcf_ctinfo_init(struct net *net, struct nlattr *nla,
                           struct netlink_ext_ack *extack)
 {
        struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
+        u32 dscpmask = 0, dscpstatemask, index;
        struct nlattr *tb[TCA_CTINFO_MAX + 1];
        struct tcf_ctinfo_params *cp_new;
        struct tcf_chain *goto_ch = NULL;
-        u32 dscpmask = 0, dscpstatemask;
        struct tc_ctinfo *actparm;
        struct tcf_ctinfo *ci;
        u8 dscpmaskshift;
@@ -206,12 +206,13 @@ static int tcf_ctinfo_init(struct net *net, struct nlattr *nla,
        }
        /* done the validation:now to the actual action allocation */
-        err = tcf_idr_check_alloc(tn, &actparm->index, a, bind);
+        index = actparm->index;
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (!err) {
-                ret = tcf_idr_create(tn, actparm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_ctinfo_ops, bind, false);
                if (ret) {
-                        tcf_idr_cleanup(tn, actparm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
                ret = ACT_P_CREATED;
@@ -375,7 +376,7 @@ static __net_init int ctinfo_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, ctinfo_net_id);
-        return tc_action_net_init(tn, &act_ctinfo_ops);
+        return tc_action_net_init(net, tn, &act_ctinfo_ops);
 }
 static void __net_exit ctinfo_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index b2380c5284e6..324f1d1f6d47 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -61,6 +61,7 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
        struct tc_gact *parm;
        struct tcf_gact *gact;
        int ret = 0;
+        u32 index;
        int err;
 #ifdef CONFIG_GACT_PROB
        struct tc_gact_p *p_parm = NULL;
@@ -77,6 +78,7 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
        if (tb[TCA_GACT_PARMS] == NULL)
                return -EINVAL;
        parm = nla_data(tb[TCA_GACT_PARMS]);
+        index = parm->index;
 #ifndef CONFIG_GACT_PROB
        if (tb[TCA_GACT_PROB] != NULL)
@@ -94,12 +96,12 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
        }
 #endif
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (!err) {
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_gact_ops, bind, true);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
                ret = ACT_P_CREATED;
@@ -276,7 +278,7 @@ static __net_init int gact_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, gact_net_id);
-        return tc_action_net_init(tn, &act_gact_ops);
+        return tc_action_net_init(net, tn, &act_gact_ops);
 }
 static void __net_exit gact_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 41d5398dd2f2..3a31e241c647 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -479,8 +479,14 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
        u8 *saddr = NULL;
        bool exists = false;
        int ret = 0;
+        u32 index;
        int err;
+        if (!nla) {
+                NL_SET_ERR_MSG_MOD(extack, "IFE requires attributes to be passed");
+                return -EINVAL;
+        }
        err = nla_parse_nested_deprecated(tb, TCA_IFE_MAX, nla, ife_policy,
                                          NULL);
        if (err < 0)
@@ -502,7 +508,8 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
        if (!p)
                return -ENOMEM;
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        index = parm->index;
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (err < 0) {
                kfree(p);
                return err;
@@ -514,10 +521,10 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
        }
        if (!exists) {
-                ret = tcf_idr_create(tn, parm->index, est, a, &act_ife_ops,
+                ret = tcf_idr_create(tn, index, est, a, &act_ife_ops,
                                     bind, true);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        kfree(p);
                        return ret;
                }
@@ -883,7 +890,7 @@ static __net_init int ife_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, ife_net_id);
-        return tc_action_net_init(tn, &act_ife_ops);
+        return tc_action_net_init(net, tn, &act_ife_ops);
 }
 static void __net_exit ife_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index ce2c30a591d2..214a03d405cf 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -61,12 +61,13 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
        return 0;
 }
-static void ipt_destroy_target(struct xt_entry_target *t)
+static void ipt_destroy_target(struct xt_entry_target *t, struct net *net)
 {
        struct xt_tgdtor_param par = {
                .target   = t->u.kernel.target,
                .targinfo = t->data,
                .family   = NFPROTO_IPV4,
+                .net      = net,
        };
        if (par.target->destroy != NULL)
                par.target->destroy(&par);
@@ -78,7 +79,7 @@ static void tcf_ipt_release(struct tc_action *a)
        struct tcf_ipt *ipt = to_ipt(a);
        if (ipt->tcfi_t) {
-                ipt_destroy_target(ipt->tcfi_t);
+                ipt_destroy_target(ipt->tcfi_t, a->idrinfo->net);
                kfree(ipt->tcfi_t);
        }
        kfree(ipt->tcfi_tname);
@@ -180,7 +181,7 @@ static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla,
        spin_lock_bh(&ipt->tcf_lock);
        if (ret != ACT_P_CREATED) {
-                ipt_destroy_target(ipt->tcfi_t);
+                ipt_destroy_target(ipt->tcfi_t, net);
                kfree(ipt->tcfi_tname);
                kfree(ipt->tcfi_t);
        }
@@ -350,7 +351,7 @@ static __net_init int ipt_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, ipt_net_id);
-        return tc_action_net_init(tn, &act_ipt_ops);
+        return tc_action_net_init(net, tn, &act_ipt_ops);
 }
 static void __net_exit ipt_exit_net(struct list_head *net_list)
@@ -399,7 +400,7 @@ static __net_init int xt_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, xt_net_id);
-        return tc_action_net_init(tn, &act_xt_ops);
+        return tc_action_net_init(net, tn, &act_xt_ops);
 }
 static void __net_exit xt_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 055faa298c8e..9d1bf508075a 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -104,6 +104,7 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
        struct net_device *dev;
        bool exists = false;
        int ret, err;
+        u32 index;
        if (!nla) {
                NL_SET_ERR_MSG_MOD(extack, "Mirred requires attributes to be passed");
@@ -118,8 +119,8 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
                return -EINVAL;
        }
        parm = nla_data(tb[TCA_MIRRED_PARMS]);
+        index = parm->index;
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (err < 0)
                return err;
        exists = err;
@@ -136,21 +137,21 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
                if (exists)
                        tcf_idr_release(*a, bind);
                else
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                NL_SET_ERR_MSG_MOD(extack, "Unknown mirred option");
                return -EINVAL;
        }
        if (!exists) {
                if (!parm->ifindex) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        NL_SET_ERR_MSG_MOD(extack, "Specified device does not exist");
                        return -EINVAL;
                }
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_mirred_ops, bind, true);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
                ret = ACT_P_CREATED;
@@ -452,7 +453,7 @@ static __net_init int mirred_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, mirred_net_id);
-        return tc_action_net_init(tn, &act_mirred_ops);
+        return tc_action_net_init(net, tn, &act_mirred_ops);
 }
 static void __net_exit mirred_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_mpls.c b/net/sched/act_mpls.c
index ca2597ce4ac9..e168df0e008a 100644
--- a/net/sched/act_mpls.c
+++ b/net/sched/act_mpls.c
@@ -138,6 +138,7 @@ static int tcf_mpls_init(struct net *net, struct nlattr *nla,
        struct tcf_mpls *m;
        int ret = 0, err;
        u8 mpls_ttl = 0;
+        u32 index;
        if (!nla) {
                NL_SET_ERR_MSG_MOD(extack, "Missing netlink attributes");
@@ -153,6 +154,7 @@ static int tcf_mpls_init(struct net *net, struct nlattr *nla,
                return -EINVAL;
        }
        parm = nla_data(tb[TCA_MPLS_PARMS]);
+        index = parm->index;
        /* Verify parameters against action type. */
        switch (parm->m_action) {
@@ -209,7 +211,7 @@ static int tcf_mpls_init(struct net *net, struct nlattr *nla,
                return -EINVAL;
        }
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (err < 0)
                return err;
        exists = err;
@@ -217,10 +219,10 @@ static int tcf_mpls_init(struct net *net, struct nlattr *nla,
                return 0;
        if (!exists) {
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_mpls_ops, bind, true);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
@@ -373,7 +375,7 @@ static __net_init int mpls_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, mpls_net_id);
-        return tc_action_net_init(tn, &act_mpls_ops);
+        return tc_action_net_init(net, tn, &act_mpls_ops);
 }
 static void __net_exit mpls_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 45923ebb7a4f..ea4c5359e7df 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -44,6 +44,7 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
        struct tc_nat *parm;
        int ret = 0, err;
        struct tcf_nat *p;
+        u32 index;
        if (nla == NULL)
                return -EINVAL;
@@ -56,13 +57,13 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
        if (tb[TCA_NAT_PARMS] == NULL)
                return -EINVAL;
        parm = nla_data(tb[TCA_NAT_PARMS]);
+        index = parm->index;
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (!err) {
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_nat_ops, bind, false);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
                ret = ACT_P_CREATED;
@@ -326,7 +327,7 @@ static __net_init int nat_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, nat_net_id);
-        return tc_action_net_init(tn, &act_nat_ops);
+        return tc_action_net_init(net, tn, &act_nat_ops);
 }
 static void __net_exit nat_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 45e9d6bfddb3..cdfaa79382a2 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -149,6 +149,7 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
        struct tcf_pedit *p;
        int ret = 0, err;
        int ksize;
+        u32 index;
        if (!nla) {
                NL_SET_ERR_MSG_MOD(extack, "Pedit requires attributes to be passed");
@@ -179,18 +180,19 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
        if (IS_ERR(keys_ex))
                return PTR_ERR(keys_ex);
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        index = parm->index;
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (!err) {
                if (!parm->nkeys) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        NL_SET_ERR_MSG_MOD(extack, "Pedit requires keys to be passed");
                        ret = -EINVAL;
                        goto out_free;
                }
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_pedit_ops, bind, false);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        goto out_free;
                }
                ret = ACT_P_CREATED;
@@ -496,7 +498,7 @@ static __net_init int pedit_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, pedit_net_id);
-        return tc_action_net_init(tn, &act_pedit_ops);
+        return tc_action_net_init(net, tn, &act_pedit_ops);
 }
 static void __net_exit pedit_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index a065f62fa79c..6315e0f8d26e 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -57,6 +57,7 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
        struct tc_action_net *tn = net_generic(net, police_net_id);
        struct tcf_police_params *new;
        bool exists = false;
+        u32 index;
        if (nla == NULL)
                return -EINVAL;
@@ -73,7 +74,8 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
                return -EINVAL;
        parm = nla_data(tb[TCA_POLICE_TBF]);
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        index = parm->index;
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (err < 0)
                return err;
        exists = err;
@@ -81,10 +83,10 @@ static int tcf_police_init(struct net *net, struct nlattr *nla,
                return 0;
        if (!exists) {
-                ret = tcf_idr_create(tn, parm->index, NULL, a,
+                ret = tcf_idr_create(tn, index, NULL, a,
                                     &act_police_ops, bind, true);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
                ret = ACT_P_CREATED;
@@ -369,7 +371,7 @@ static __net_init int police_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, police_net_id);
-        return tc_action_net_init(tn, &act_police_ops);
+        return tc_action_net_init(net, tn, &act_police_ops);
 }
 static void __net_exit police_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 274d7a0c0e25..10229124a992 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -41,8 +41,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
        struct tc_action_net *tn = net_generic(net, sample_net_id);
        struct nlattr *tb[TCA_SAMPLE_MAX + 1];
        struct psample_group *psample_group;
+        u32 psample_group_num, rate, index;
        struct tcf_chain *goto_ch = NULL;
-        u32 psample_group_num, rate;
        struct tc_sample *parm;
        struct tcf_sample *s;
        bool exists = false;
@@ -59,8 +59,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
                return -EINVAL;
        parm = nla_data(tb[TCA_SAMPLE_PARMS]);
+        index = parm->index;
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (err < 0)
                return err;
        exists = err;
@@ -68,10 +68,10 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
                return 0;
        if (!exists) {
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_sample_ops, bind, true);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
                ret = ACT_P_CREATED;
@@ -102,13 +102,17 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
        goto_ch = tcf_action_set_ctrlact(*a, parm->action, goto_ch);
        s->rate = rate;
        s->psample_group_num = psample_group_num;
-        RCU_INIT_POINTER(s->psample_group, psample_group);
+        rcu_swap_protected(s->psample_group, psample_group,
+                           lockdep_is_held(&s->tcf_lock));
        if (tb[TCA_SAMPLE_TRUNC_SIZE]) {
                s->truncate = true;
                s->trunc_size = nla_get_u32(tb[TCA_SAMPLE_TRUNC_SIZE]);
        }
        spin_unlock_bh(&s->tcf_lock);
+        if (psample_group)
+                psample_group_put(psample_group);
        if (goto_ch)
                tcf_chain_put_by_act(goto_ch);
@@ -265,7 +269,7 @@ static __net_init int sample_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, sample_net_id);
-        return tc_action_net_init(tn, &act_sample_ops);
+        return tc_action_net_init(net, tn, &act_sample_ops);
 }
 static void __net_exit sample_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index f28ddbabff76..6120e56117ca 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -95,6 +95,7 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
        struct tcf_defact *d;
        bool exists = false;
        int ret = 0, err;
+        u32 index;
        if (nla == NULL)
                return -EINVAL;
@@ -108,7 +109,8 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
                return -EINVAL;
        parm = nla_data(tb[TCA_DEF_PARMS]);
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        index = parm->index;
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (err < 0)
                return err;
        exists = err;
@@ -119,15 +121,15 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
                if (exists)
                        tcf_idr_release(*a, bind);
                else
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                return -EINVAL;
        }
        if (!exists) {
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_simp_ops, bind, false);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
@@ -230,7 +232,7 @@ static __net_init int simp_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, simp_net_id);
-        return tc_action_net_init(tn, &act_simp_ops);
+        return tc_action_net_init(net, tn, &act_simp_ops);
 }
 static void __net_exit simp_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 215a06705cef..6a8d3337c577 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -99,6 +99,7 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
        u16 *queue_mapping = NULL, *ptype = NULL;
        bool exists = false;
        int ret = 0, err;
+        u32 index;
        if (nla == NULL)
                return -EINVAL;
@@ -146,8 +147,8 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
        }
        parm = nla_data(tb[TCA_SKBEDIT_PARMS]);
+        index = parm->index;
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (err < 0)
                return err;
        exists = err;
@@ -158,15 +159,15 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
                if (exists)
                        tcf_idr_release(*a, bind);
                else
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                return -EINVAL;
        }
        if (!exists) {
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_skbedit_ops, bind, true);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
@@ -306,6 +307,17 @@ static int tcf_skbedit_search(struct net *net, struct tc_action **a, u32 index)
        return tcf_idr_search(tn, a, index);
 }
+static size_t tcf_skbedit_get_fill_size(const struct tc_action *act)
+{
+        return nla_total_size(sizeof(struct tc_skbedit))
+                + nla_total_size(sizeof(u32)) /* TCA_SKBEDIT_PRIORITY */
+                + nla_total_size(sizeof(u16)) /* TCA_SKBEDIT_QUEUE_MAPPING */
+                + nla_total_size(sizeof(u32)) /* TCA_SKBEDIT_MARK */
+                + nla_total_size(sizeof(u16)) /* TCA_SKBEDIT_PTYPE */
+                + nla_total_size(sizeof(u32)) /* TCA_SKBEDIT_MASK */
+                + nla_total_size_64bit(sizeof(u64)); /* TCA_SKBEDIT_FLAGS */
+}
 static struct tc_action_ops act_skbedit_ops = {
        .kind           =       "skbedit",
        .id             =       TCA_ID_SKBEDIT,
@@ -315,6 +327,7 @@ static struct tc_action_ops act_skbedit_ops = {
        .init           =       tcf_skbedit_init,
        .cleanup        =       tcf_skbedit_cleanup,
        .walk           =       tcf_skbedit_walker,
+        .get_fill_size  =       tcf_skbedit_get_fill_size,
        .lookup         =       tcf_skbedit_search,
        .size           =       sizeof(struct tcf_skbedit),
 };
@@ -323,7 +336,7 @@ static __net_init int skbedit_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, skbedit_net_id);
-        return tc_action_net_init(tn, &act_skbedit_ops);
+        return tc_action_net_init(net, tn, &act_skbedit_ops);
 }
 static void __net_exit skbedit_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index 4f07706eff07..888437f97ba6 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -87,12 +87,12 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
        struct tcf_skbmod_params *p, *p_old;
        struct tcf_chain *goto_ch = NULL;
        struct tc_skbmod *parm;
+        u32 lflags = 0, index;
        struct tcf_skbmod *d;
        bool exists = false;
        u8 *daddr = NULL;
        u8 *saddr = NULL;
        u16 eth_type = 0;
-        u32 lflags = 0;
        int ret = 0, err;
        if (!nla)
@@ -122,10 +122,11 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
        }
        parm = nla_data(tb[TCA_SKBMOD_PARMS]);
+        index = parm->index;
        if (parm->flags & SKBMOD_F_SWAPMAC)
                lflags = SKBMOD_F_SWAPMAC;
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (err < 0)
                return err;
        exists = err;
@@ -136,15 +137,15 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
                if (exists)
                        tcf_idr_release(*a, bind);
                else
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                return -EINVAL;
        }
        if (!exists) {
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_skbmod_ops, bind, true);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
@@ -286,7 +287,7 @@ static __net_init int skbmod_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, skbmod_net_id);
-        return tc_action_net_init(tn, &act_skbmod_ops);
+        return tc_action_net_init(net, tn, &act_skbmod_ops);
 }
 static void __net_exit skbmod_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 10dffda1d5cc..2f83a79f76aa 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -225,6 +225,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
        __be16 flags = 0;
        u8 tos, ttl;
        int ret = 0;
+        u32 index;
        int err;
        if (!nla) {
@@ -245,7 +246,8 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
        }
        parm = nla_data(tb[TCA_TUNNEL_KEY_PARMS]);
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        index = parm->index;
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (err < 0)
                return err;
        exists = err;
@@ -345,7 +347,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
        }
        if (!exists) {
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_tunnel_key_ops, bind, true);
                if (ret) {
                        NL_SET_ERR_MSG(extack, "Cannot create TC IDR");
@@ -403,7 +405,7 @@ err_out:
        if (exists)
                tcf_idr_release(*a, bind);
        else
-                tcf_idr_cleanup(tn, parm->index);
+                tcf_idr_cleanup(tn, index);
        return ret;
 }
@@ -598,7 +600,7 @@ static __net_init int tunnel_key_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
-        return tc_action_net_init(tn, &act_tunnel_key_ops);
+        return tc_action_net_init(net, tn, &act_tunnel_key_ops);
 }
 static void __net_exit tunnel_key_exit_net(struct list_head *net_list)
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index 9269d350fb8a..287a30bf8930 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -116,6 +116,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
        u8 push_prio = 0;
        bool exists = false;
        int ret = 0, err;
+        u32 index;
        if (!nla)
                return -EINVAL;
@@ -128,7 +129,8 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
        if (!tb[TCA_VLAN_PARMS])
                return -EINVAL;
        parm = nla_data(tb[TCA_VLAN_PARMS]);
-        err = tcf_idr_check_alloc(tn, &parm->index, a, bind);
+        index = parm->index;
+        err = tcf_idr_check_alloc(tn, &index, a, bind);
        if (err < 0)
                return err;
        exists = err;
@@ -144,7 +146,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
                        if (exists)
                                tcf_idr_release(*a, bind);
                        else
-                                tcf_idr_cleanup(tn, parm->index);
+                                tcf_idr_cleanup(tn, index);
                        return -EINVAL;
                }
                push_vid = nla_get_u16(tb[TCA_VLAN_PUSH_VLAN_ID]);
@@ -152,7 +154,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
                        if (exists)
                                tcf_idr_release(*a, bind);
                        else
-                                tcf_idr_cleanup(tn, parm->index);
+                                tcf_idr_cleanup(tn, index);
                        return -ERANGE;
                }
@@ -166,7 +168,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
                                if (exists)
                                        tcf_idr_release(*a, bind);
                                else
-                                        tcf_idr_cleanup(tn, parm->index);
+                                        tcf_idr_cleanup(tn, index);
                                return -EPROTONOSUPPORT;
                        }
                } else {
@@ -180,16 +182,16 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
                if (exists)
                        tcf_idr_release(*a, bind);
                else
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                return -EINVAL;
        }
        action = parm->v_action;
        if (!exists) {
-                ret = tcf_idr_create(tn, parm->index, est, a,
+                ret = tcf_idr_create(tn, index, est, a,
                                     &act_vlan_ops, bind, true);
                if (ret) {
-                        tcf_idr_cleanup(tn, parm->index);
+                        tcf_idr_cleanup(tn, index);
                        return ret;
                }
@@ -306,6 +308,14 @@ static int tcf_vlan_search(struct net *net, struct tc_action **a, u32 index)
        return tcf_idr_search(tn, a, index);
 }
+static size_t tcf_vlan_get_fill_size(const struct tc_action *act)
+{
+        return nla_total_size(sizeof(struct tc_vlan))
+                + nla_total_size(sizeof(u16)) /* TCA_VLAN_PUSH_VLAN_ID */
+                + nla_total_size(sizeof(u16)) /* TCA_VLAN_PUSH_VLAN_PROTOCOL */
+                + nla_total_size(sizeof(u8)); /* TCA_VLAN_PUSH_VLAN_PRIORITY */
+}
 static struct tc_action_ops act_vlan_ops = {
        .kind           =       "vlan",
        .id             =       TCA_ID_VLAN,
@@ -315,6 +325,7 @@ static struct tc_action_ops act_vlan_ops = {
        .init           =       tcf_vlan_init,
        .cleanup        =       tcf_vlan_cleanup,
        .walk           =       tcf_vlan_walker,
+        .get_fill_size  =       tcf_vlan_get_fill_size,
        .lookup         =       tcf_vlan_search,
        .size           =       sizeof(struct tcf_vlan),
 };
@@ -323,7 +334,7 @@ static __net_init int vlan_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, vlan_net_id);
-        return tc_action_net_init(tn, &act_vlan_ops);
+        return tc_action_net_init(net, tn, &act_vlan_ops);
 }
 static void __net_exit vlan_exit_net(struct list_head *net_list)
diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
index 732e109c3055..810645b5c086 100644
--- a/net/sched/sch_cbs.c
+++ b/net/sched/sch_cbs.c
@@ -181,11 +181,6 @@ static struct sk_buff *cbs_dequeue_soft(struct Qdisc *sch)
        s64 credits;
        int len;
-        if (atomic64_read(&q->port_rate) == -1) {
-                WARN_ONCE(1, "cbs: dequeue() called with unknown port rate.");
-                return NULL;
-        }
        if (q->credits < 0) {
                credits = timediff_to_credits(now - q->last, q->idleslope);
@@ -303,11 +298,19 @@ static int cbs_enable_offload(struct net_device *dev, struct cbs_sched_data *q,
 static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
 {
        struct ethtool_link_ksettings ecmd;
+        int speed = SPEED_10;
        int port_rate = -1;
+        int err;
+        err = __ethtool_get_link_ksettings(dev, &ecmd);
+        if (err < 0)
+                goto skip;
+        if (ecmd.base.speed != SPEED_UNKNOWN)
+                speed = ecmd.base.speed;
-        if (!__ethtool_get_link_ksettings(dev, &ecmd) &&
+skip:
-            ecmd.base.speed != SPEED_UNKNOWN)
+        port_rate = speed * 1000 * BYTES_PER_KBIT;
-                port_rate = ecmd.base.speed * 1000 * BYTES_PER_KBIT;
        atomic64_set(&q->port_rate, port_rate);
        netdev_dbg(dev, "cbs: set %s's port_rate to: %lld, linkspeed: %d\n",
diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c
index 25ef172c23df..30169b3adbbb 100644
--- a/net/sched/sch_codel.c
+++ b/net/sched/sch_codel.c
@@ -71,10 +71,10 @@ static struct sk_buff *dequeue_func(struct codel_vars *vars, void *ctx)
        struct Qdisc *sch = ctx;
        struct sk_buff *skb = __qdisc_dequeue_head(&sch->q);
-        if (skb)
+        if (skb) {
                sch->qstats.backlog -= qdisc_pkt_len(skb);
+                prefetch(&skb->end); /* we'll need skb_shinfo() */
-        prefetch(&skb->end); /* we'll need skb_shinfo() */
+        }
        return skb;
 }
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 11c03cf4aa74..137db1cbde85 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -624,8 +624,12 @@ static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc *qdisc,
        err = skb_array_produce(q, skb);
-        if (unlikely(err))
+        if (unlikely(err)) {
-                return qdisc_drop_cpu(skb, qdisc, to_free);
+                if (qdisc_is_percpu_stats(qdisc))
+                        return qdisc_drop_cpu(skb, qdisc, to_free);
+                else
+                        return qdisc_drop(skb, qdisc, to_free);
+        }
        qdisc_update_stats_at_enqueue(qdisc, pkt_len);
        return NET_XMIT_SUCCESS;
@@ -688,11 +692,14 @@ static void pfifo_fast_reset(struct Qdisc *qdisc)
                        kfree_skb(skb);
        }
-        for_each_possible_cpu(i) {
+        if (qdisc_is_percpu_stats(qdisc)) {
-                struct gnet_stats_queue *q = per_cpu_ptr(qdisc->cpu_qstats, i);
+                for_each_possible_cpu(i) {
+                        struct gnet_stats_queue *q;
-                q->backlog = 0;
+                        q = per_cpu_ptr(qdisc->cpu_qstats, i);
-                q->qlen = 0;
+                        q->backlog = 0;
+                        q->qlen = 0;
+                }
        }
 }
diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index c39db507ba3f..8d8bc2ec5cd6 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -477,11 +477,6 @@ static struct sk_buff *taprio_dequeue(struct Qdisc *sch)
        u32 gate_mask;
        int i;
-        if (atomic64_read(&q->picos_per_byte) == -1) {
-                WARN_ONCE(1, "taprio: dequeue() called with unknown picos per byte.");
-                return NULL;
-        }
        rcu_read_lock();
        entry = rcu_dereference(q->current_entry);
        /* if there's no entry, it means that the schedule didn't
@@ -958,12 +953,20 @@ static void taprio_set_picos_per_byte(struct net_device *dev,
                                      struct taprio_sched *q)
 {
        struct ethtool_link_ksettings ecmd;
-        int picos_per_byte = -1;
+        int speed = SPEED_10;
+        int picos_per_byte;
+        int err;
-        if (!__ethtool_get_link_ksettings(dev, &ecmd) &&
+        err = __ethtool_get_link_ksettings(dev, &ecmd);
-            ecmd.base.speed != SPEED_UNKNOWN)
+        if (err < 0)
-                picos_per_byte = div64_s64(NSEC_PER_SEC * 1000LL * 8,
+                goto skip;
-                                           ecmd.base.speed * 1000 * 1000);
+        if (ecmd.base.speed != SPEED_UNKNOWN)
+                speed = ecmd.base.speed;
+skip:
+        picos_per_byte = div64_s64(NSEC_PER_SEC * 1000LL * 8,
+                                   speed * 1000 * 1000);
        atomic64_set(&q->picos_per_byte, picos_per_byte);
        netdev_dbg(dev, "taprio: set %s's picos_per_byte to: %lld, linkspeed: %d\n",
@@ -1195,7 +1198,8 @@ unlock:
        spin_unlock_bh(qdisc_lock(sch));
 free_sched:
-        kfree(new_admin);
+        if (new_admin)
+                call_rcu(&new_admin->rcu, taprio_free_sched_cb);
        return err;
 }
@@ -1248,6 +1252,10 @@ static int taprio_init(struct Qdisc *sch, struct nlattr *opt,
         */
        q->clockid = -1;
+        spin_lock(&taprio_list_lock);
+        list_add(&q->taprio_list, &taprio_list);
+        spin_unlock(&taprio_list_lock);
        if (sch->parent != TC_H_ROOT)
                return -EOPNOTSUPP;
@@ -1265,10 +1273,6 @@ static int taprio_init(struct Qdisc *sch, struct nlattr *opt,
        if (!opt)
                return -EINVAL;
-        spin_lock(&taprio_list_lock);
-        list_add(&q->taprio_list, &taprio_list);
-        spin_unlock(&taprio_list_lock);
        for (i = 0; i < dev->num_tx_queues; i++) {
                struct netdev_queue *dev_queue;
                struct Qdisc *qdisc;
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index a554d6d15d1b..1cf5bb5b73c4 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -546,7 +546,7 @@ static void sctp_do_8_2_transport_strike(struct sctp_cmd_seq *commands,
         */
        if (net->sctp.pf_enable &&
           (transport->state == SCTP_ACTIVE) &&
-           (asoc->pf_retrans < transport->pathmaxrxt) &&
+           (transport->error_count < transport->pathmaxrxt) &&
           (transport->error_count > asoc->pf_retrans)) {
                sctp_assoc_control_transport(asoc, transport,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index aa80cda36581..9d1f83b10c0a 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -985,7 +985,7 @@ static int sctp_setsockopt_bindx(struct sock *sk,
                return -EINVAL;
        kaddrs = memdup_user(addrs, addrs_size);
-        if (unlikely(IS_ERR(kaddrs)))
+        if (IS_ERR(kaddrs))
                return PTR_ERR(kaddrs);
        /* Walk through the addrs buffer and count the number of addresses. */
@@ -1315,7 +1315,7 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
                return -EINVAL;
        kaddrs = memdup_user(addrs, addrs_size);
-        if (unlikely(IS_ERR(kaddrs)))
+        if (IS_ERR(kaddrs))
                return PTR_ERR(kaddrs);
        /* Allow security module to validate connectx addresses. */
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 25946604af85..e83cdaa2ab76 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -316,6 +316,7 @@ int sctp_send_reset_streams(struct sctp_association *asoc,
                nstr_list[i] = htons(str_list[i]);
        if (out && !sctp_stream_outq_is_empty(stream, str_nums, nstr_list)) {
+                kfree(nstr_list);
                retval = -EAGAIN;
                goto out;
        }
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 302e355f2ebc..5b932583e407 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -263,7 +263,7 @@ static int smc_bind(struct socket *sock, struct sockaddr *uaddr,
        /* Check if socket is already active */
        rc = -EINVAL;
-        if (sk->sk_state != SMC_INIT)
+        if (sk->sk_state != SMC_INIT || smc->connect_nonblock)
                goto out_rel;
        smc->clcsock->sk->sk_reuse = sk->sk_reuse;
@@ -1390,7 +1390,8 @@ static int smc_listen(struct socket *sock, int backlog)
        lock_sock(sk);
        rc = -EINVAL;
-        if ((sk->sk_state != SMC_INIT) && (sk->sk_state != SMC_LISTEN))
+        if ((sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) ||
+            smc->connect_nonblock)
                goto out;
        rc = 0;
@@ -1518,7 +1519,7 @@ static int smc_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
                goto out;
        if (msg->msg_flags & MSG_FASTOPEN) {
-                if (sk->sk_state == SMC_INIT) {
+                if (sk->sk_state == SMC_INIT && !smc->connect_nonblock) {
                        smc_switch_to_fallback(smc);
                        smc->fallback_rsn = SMC_CLC_DECL_OPTUNSUPP;
                } else {
@@ -1732,14 +1733,18 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
                }
                break;
        case TCP_NODELAY:
-                if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) {
+                if (sk->sk_state != SMC_INIT &&
+                    sk->sk_state != SMC_LISTEN &&
+                    sk->sk_state != SMC_CLOSED) {
                        if (val && !smc->use_fallback)
                                mod_delayed_work(system_wq, &smc->conn.tx_work,
                                                 0);
                }
                break;
        case TCP_CORK:
-                if (sk->sk_state != SMC_INIT && sk->sk_state != SMC_LISTEN) {
+                if (sk->sk_state != SMC_INIT &&
+                    sk->sk_state != SMC_LISTEN &&
+                    sk->sk_state != SMC_CLOSED) {
                        if (!val && !smc->use_fallback)
                                mod_delayed_work(system_wq, &smc->conn.tx_work,
                                                 0);
diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
index f0de323d15d6..6c8f09c1ce51 100644
--- a/net/smc/smc_tx.c
+++ b/net/smc/smc_tx.c
@@ -76,13 +76,11 @@ static int smc_tx_wait(struct smc_sock *smc, int flags)
        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        struct smc_connection *conn = &smc->conn;
        struct sock *sk = &smc->sk;
-        bool noblock;
        long timeo;
        int rc = 0;
        /* similar to sk_stream_wait_memory */
        timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
-        noblock = timeo ? false : true;
        add_wait_queue(sk_sleep(sk), &wait);
        while (1) {
                sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
@@ -97,8 +95,8 @@ static int smc_tx_wait(struct smc_sock *smc, int flags)
                        break;
                }
                if (!timeo) {
-                        if (noblock)
+                        /* ensure EPOLLOUT is subsequently generated */
-                                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+                        set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
                        rc = -EAGAIN;
                        break;
                }
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index d8679b6027e9..a07b516e503a 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1970,6 +1970,7 @@ call_bind(struct rpc_task *task)
 static void
 call_bind_status(struct rpc_task *task)
 {
+        struct rpc_xprt *xprt = task->tk_rqstp->rq_xprt;
        int status = -EIO;
        if (rpc_task_transmitted(task)) {
@@ -1977,14 +1978,15 @@ call_bind_status(struct rpc_task *task)
                return;
        }
-        if (task->tk_status >= 0) {
+        dprint_status(task);
-                dprint_status(task);
+        trace_rpc_bind_status(task);
+        if (task->tk_status >= 0)
+                goto out_next;
+        if (xprt_bound(xprt)) {
                task->tk_status = 0;
-                task->tk_action = call_connect;
+                goto out_next;
-                return;
        }
-        trace_rpc_bind_status(task);
        switch (task->tk_status) {
        case -ENOMEM:
                dprintk("RPC: %5u rpcbind out of memory\n", task->tk_pid);
@@ -2003,6 +2005,9 @@ call_bind_status(struct rpc_task *task)
                task->tk_rebind_retry--;
                rpc_delay(task, 3*HZ);
                goto retry_timeout;
+        case -ENOBUFS:
+                rpc_delay(task, HZ >> 2);
+                goto retry_timeout;
        case -EAGAIN:
                goto retry_timeout;
        case -ETIMEDOUT:
@@ -2026,7 +2031,6 @@ call_bind_status(struct rpc_task *task)
        case -ENETDOWN:
        case -EHOSTUNREACH:
        case -ENETUNREACH:
-        case -ENOBUFS:
        case -EPIPE:
                dprintk("RPC: %5u remote rpcbind unreachable: %d\n",
                                task->tk_pid, task->tk_status);
@@ -2043,7 +2047,9 @@ call_bind_status(struct rpc_task *task)
        rpc_call_rpcerror(task, status);
        return;
+out_next:
+        task->tk_action = call_connect;
+        return;
 retry_timeout:
        task->tk_status = 0;
        task->tk_action = call_bind;
@@ -2090,6 +2096,7 @@ call_connect(struct rpc_task *task)
 static void
 call_connect_status(struct rpc_task *task)
 {
+        struct rpc_xprt *xprt = task->tk_rqstp->rq_xprt;
        struct rpc_clnt *clnt = task->tk_client;
        int status = task->tk_status;
@@ -2099,8 +2106,17 @@ call_connect_status(struct rpc_task *task)
        }
        dprint_status(task);
        trace_rpc_connect_status(task);
+        if (task->tk_status == 0) {
+                clnt->cl_stats->netreconn++;
+                goto out_next;
+        }
+        if (xprt_connected(xprt)) {
+                task->tk_status = 0;
+                goto out_next;
+        }
        task->tk_status = 0;
        switch (status) {
        case -ECONNREFUSED:
@@ -2117,8 +2133,6 @@ call_connect_status(struct rpc_task *task)
        case -ENETDOWN:
        case -ENETUNREACH:
        case -EHOSTUNREACH:
-        case -EADDRINUSE:
-        case -ENOBUFS:
        case -EPIPE:
                xprt_conditional_disconnect(task->tk_rqstp->rq_xprt,
                                            task->tk_rqstp->rq_connect_cookie);
@@ -2127,17 +2141,20 @@ call_connect_status(struct rpc_task *task)
                /* retry with existing socket, after a delay */
                rpc_delay(task, 3*HZ);
                /* fall through */
+        case -EADDRINUSE:
        case -ENOTCONN:
        case -EAGAIN:
        case -ETIMEDOUT:
                goto out_retry;
-        case 0:
+        case -ENOBUFS:
-                clnt->cl_stats->netreconn++;
+                rpc_delay(task, HZ >> 2);
-                task->tk_action = call_transmit;
+                goto out_retry;
-                return;
        }
        rpc_call_rpcerror(task, status);
        return;
+out_next:
+        task->tk_action = call_transmit;
+        return;
 out_retry:
        /* Check for timeouts before looping back to call_bind */
        task->tk_action = call_bind;
@@ -2365,7 +2382,7 @@ call_status(struct rpc_task *task)
        case -ECONNABORTED:
        case -ENOTCONN:
                rpc_force_rebind(clnt);
-                /* fall through */
+                break;
        case -EADDRINUSE:
                rpc_delay(task, 3*HZ);
                /* fall through */
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 783748dc5e6f..2e71f5455c6c 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1408,13 +1408,6 @@ xprt_request_transmit(struct rpc_rqst *req, struct rpc_task *snd_task)
                        status = -EBADMSG;
                        goto out_dequeue;
                }
-                if (task->tk_ops->rpc_call_prepare_transmit) {
-                        task->tk_ops->rpc_call_prepare_transmit(task,
-                                        task->tk_calldata);
-                        status = task->tk_status;
-                        if (status < 0)
-                                goto out_dequeue;
-                }
                if (RPC_SIGNALLED(task)) {
                        status = -ERESTARTSYS;
                        goto out_dequeue;
diff --git a/net/tipc/addr.c b/net/tipc/addr.c
index b88d48d00913..0f1eaed1bd1b 100644
--- a/net/tipc/addr.c
+++ b/net/tipc/addr.c
@@ -75,6 +75,7 @@ void tipc_set_node_addr(struct net *net, u32 addr)
                tipc_set_node_id(net, node_id);
        }
        tn->trial_addr = addr;
+        tn->addr_trial_end = jiffies;
        pr_info("32-bit node address hash set to %x\n", addr);
 }
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 66d3a07bc571..c2c5c53cad22 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -106,8 +106,6 @@ struct tipc_stats {
 * @transmitq: queue for sent, non-acked messages
 * @backlogq: queue for messages waiting to be sent
 * @snt_nxt: next sequence number to use for outbound messages
- * @prev_from: sequence number of most previous retransmission request
- * @stale_limit: time when repeated identical retransmits must force link reset
 * @ackers: # of peers that needs to ack each packet before it can be released
 * @acked: # last packet acked by a certain peer. Used for broadcast.
 * @rcv_nxt: next sequence number to expect for inbound messages
@@ -164,9 +162,7 @@ struct tipc_link {
                u16 limit;
        } backlog[5];
        u16 snd_nxt;
-        u16 prev_from;
        u16 window;
-        unsigned long stale_limit;
        /* Reception */
        u16 rcv_nxt;
@@ -1044,47 +1040,53 @@ static void tipc_link_advance_backlog(struct tipc_link *l,
 * link_retransmit_failure() - Detect repeated retransmit failures
 * @l: tipc link sender
 * @r: tipc link receiver (= l in case of unicast)
- * @from: seqno of the 1st packet in retransmit request
 * @rc: returned code
 *
 * Return: true if the repeated retransmit failures happens, otherwise
 * false
 */
 static bool link_retransmit_failure(struct tipc_link *l, struct tipc_link *r,
-                                    u16 from, int *rc)
+                                    int *rc)
 {
        struct sk_buff *skb = skb_peek(&l->transmq);
        struct tipc_msg *hdr;
        if (!skb)
                return false;
-        hdr = buf_msg(skb);
-        /* Detect repeated retransmit failures on same packet */
+        if (!TIPC_SKB_CB(skb)->retr_cnt)
-        if (r->prev_from != from) {
+                return false;
-                r->prev_from = from;
-                r->stale_limit = jiffies + msecs_to_jiffies(r->tolerance);
-        } else if (time_after(jiffies, r->stale_limit)) {
-                pr_warn("Retransmission failure on link <%s>\n", l->name);
-                link_print(l, "State of link ");
-                pr_info("Failed msg: usr %u, typ %u, len %u, err %u\n",
-                        msg_user(hdr), msg_type(hdr), msg_size(hdr),
-                        msg_errcode(hdr));
-                pr_info("sqno %u, prev: %x, src: %x\n",
-                        msg_seqno(hdr), msg_prevnode(hdr), msg_orignode(hdr));
-                trace_tipc_list_dump(&l->transmq, true, "retrans failure!");
-                trace_tipc_link_dump(l, TIPC_DUMP_NONE, "retrans failure!");
-                trace_tipc_link_dump(r, TIPC_DUMP_NONE, "retrans failure!");
-                if (link_is_bc_sndlink(l))
+        if (!time_after(jiffies, TIPC_SKB_CB(skb)->retr_stamp +
-                        *rc = TIPC_LINK_DOWN_EVT;
+                        msecs_to_jiffies(r->tolerance)))
+                return false;
+        hdr = buf_msg(skb);
+        if (link_is_bc_sndlink(l) && !less(r->acked, msg_seqno(hdr)))
+                return false;
+        pr_warn("Retransmission failure on link <%s>\n", l->name);
+        link_print(l, "State of link ");
+        pr_info("Failed msg: usr %u, typ %u, len %u, err %u\n",
+                msg_user(hdr), msg_type(hdr), msg_size(hdr), msg_errcode(hdr));
+        pr_info("sqno %u, prev: %x, dest: %x\n",
+                msg_seqno(hdr), msg_prevnode(hdr), msg_destnode(hdr));
+        pr_info("retr_stamp %d, retr_cnt %d\n",
+                jiffies_to_msecs(TIPC_SKB_CB(skb)->retr_stamp),
+                TIPC_SKB_CB(skb)->retr_cnt);
+        trace_tipc_list_dump(&l->transmq, true, "retrans failure!");
+        trace_tipc_link_dump(l, TIPC_DUMP_NONE, "retrans failure!");
+        trace_tipc_link_dump(r, TIPC_DUMP_NONE, "retrans failure!");
+        if (link_is_bc_sndlink(l)) {
+                r->state = LINK_RESET;
+                *rc = TIPC_LINK_DOWN_EVT;
+        } else {
                *rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
-                return true;
        }
-        return false;
+        return true;
 }
 /* tipc_link_bc_retrans() - retransmit zero or more packets
@@ -1110,7 +1112,7 @@ static int tipc_link_bc_retrans(struct tipc_link *l, struct tipc_link *r,
        trace_tipc_link_retrans(r, from, to, &l->transmq);
-        if (link_retransmit_failure(l, r, from, &rc))
+        if (link_retransmit_failure(l, r, &rc))
                return rc;
        skb_queue_walk(&l->transmq, skb) {
@@ -1119,11 +1121,10 @@ static int tipc_link_bc_retrans(struct tipc_link *l, struct tipc_link *r,
                        continue;
                if (more(msg_seqno(hdr), to))
                        break;
-                if (link_is_bc_sndlink(l)) {
-                        if (time_before(jiffies, TIPC_SKB_CB(skb)->nxt_retr))
+                if (time_before(jiffies, TIPC_SKB_CB(skb)->nxt_retr))
-                                continue;
+                        continue;
-                        TIPC_SKB_CB(skb)->nxt_retr = TIPC_BC_RETR_LIM;
+                TIPC_SKB_CB(skb)->nxt_retr = TIPC_BC_RETR_LIM;
-                }
                _skb = __pskb_copy(skb, LL_MAX_HEADER + MIN_H_SIZE, GFP_ATOMIC);
                if (!_skb)
                        return 0;
@@ -1133,6 +1134,10 @@ static int tipc_link_bc_retrans(struct tipc_link *l, struct tipc_link *r,
                _skb->priority = TC_PRIO_CONTROL;
                __skb_queue_tail(xmitq, _skb);
                l->stats.retransmitted++;
+                /* Increase actual retrans counter & mark first time */
+                if (!TIPC_SKB_CB(skb)->retr_cnt++)
+                        TIPC_SKB_CB(skb)->retr_stamp = jiffies;
        }
        return 0;
 }
@@ -1357,12 +1362,10 @@ static int tipc_link_advance_transmq(struct tipc_link *l, u16 acked, u16 gap,
        struct tipc_msg *hdr;
        u16 bc_ack = l->bc_rcvlink->rcv_nxt - 1;
        u16 ack = l->rcv_nxt - 1;
+        bool passed = false;
        u16 seqno, n = 0;
        int rc = 0;
-        if (gap && link_retransmit_failure(l, l, acked + 1, &rc))
-                return rc;
        skb_queue_walk_safe(&l->transmq, skb, tmp) {
                seqno = buf_seqno(skb);
@@ -1372,12 +1375,17 @@ next_gap_ack:
                        __skb_unlink(skb, &l->transmq);
                        kfree_skb(skb);
                } else if (less_eq(seqno, acked + gap)) {
-                        /* retransmit skb */
+                        /* First, check if repeated retrans failures occurs? */
+                        if (!passed && link_retransmit_failure(l, l, &rc))
+                                return rc;
+                        passed = true;
+                        /* retransmit skb if unrestricted*/
                        if (time_before(jiffies, TIPC_SKB_CB(skb)->nxt_retr))
                                continue;
                        TIPC_SKB_CB(skb)->nxt_retr = TIPC_UC_RETR_TIME;
+                        _skb = __pskb_copy(skb, LL_MAX_HEADER + MIN_H_SIZE,
-                        _skb = __pskb_copy(skb, MIN_H_SIZE, GFP_ATOMIC);
+                                           GFP_ATOMIC);
                        if (!_skb)
                                continue;
                        hdr = buf_msg(_skb);
@@ -1386,6 +1394,10 @@ next_gap_ack:
                        _skb->priority = TC_PRIO_CONTROL;
                        __skb_queue_tail(xmitq, _skb);
                        l->stats.retransmitted++;
+                        /* Increase actual retrans counter & mark first time */
+                        if (!TIPC_SKB_CB(skb)->retr_cnt++)
+                                TIPC_SKB_CB(skb)->retr_stamp = jiffies;
                } else {
                        /* retry with Gap ACK blocks if any */
                        if (!ga || n >= ga->gack_cnt)
@@ -2577,7 +2589,7 @@ int tipc_link_dump(struct tipc_link *l, u16 dqueues, char *buf)
        i += scnprintf(buf + i, sz - i, " %x", l->peer_caps);
        i += scnprintf(buf + i, sz - i, " %u", l->silent_intv_cnt);
        i += scnprintf(buf + i, sz - i, " %u", l->rst_cnt);
-        i += scnprintf(buf + i, sz - i, " %u", l->prev_from);
+        i += scnprintf(buf + i, sz - i, " %u", 0);
        i += scnprintf(buf + i, sz - i, " %u", 0);
        i += scnprintf(buf + i, sz - i, " %u", l->acked);
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index da509f0eb9ca..d7ebc9e955f6 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -102,13 +102,15 @@ struct plist;
 #define TIPC_MEDIA_INFO_OFFSET  5
 struct tipc_skb_cb {
-        u32 bytes_read;
-        u32 orig_member;
        struct sk_buff *tail;
        unsigned long nxt_retr;
-        bool validated;
+        unsigned long retr_stamp;
+        u32 bytes_read;
+        u32 orig_member;
        u16 chain_imp;
        u16 ackers;
+        u16 retr_cnt;
+        bool validated;
 };
 #define TIPC_SKB_CB(__skb) ((struct tipc_skb_cb *)&((__skb)->cb[0]))
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index d86030ef1232..e135d4e11231 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -55,6 +55,7 @@ struct tipc_nl_compat_msg {
        int rep_type;
        int rep_size;
        int req_type;
+        int req_size;
        struct net *net;
        struct sk_buff *rep;
        struct tlv_desc *req;
@@ -257,7 +258,8 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
        int err;
        struct sk_buff *arg;
-        if (msg->req_type && !TLV_CHECK_TYPE(msg->req, msg->req_type))
+        if (msg->req_type && (!msg->req_size ||
+                              !TLV_CHECK_TYPE(msg->req, msg->req_type)))
                return -EINVAL;
        msg->rep = tipc_tlv_alloc(msg->rep_size);
@@ -354,7 +356,8 @@ static int tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
 {
        int err;
-        if (msg->req_type && !TLV_CHECK_TYPE(msg->req, msg->req_type))
+        if (msg->req_type && (!msg->req_size ||
+                              !TLV_CHECK_TYPE(msg->req, msg->req_type)))
                return -EINVAL;
        err = __tipc_nl_compat_doit(cmd, msg);
@@ -1278,8 +1281,8 @@ static int tipc_nl_compat_recv(struct sk_buff *skb, struct genl_info *info)
                goto send;
        }
-        len = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN);
+        msg.req_size = nlmsg_attrlen(req_nlh, GENL_HDRLEN + TIPC_GENL_HDRLEN);
-        if (!len || !TLV_OK(msg.req, len)) {
+        if (msg.req_size && !TLV_OK(msg.req, msg.req_size)) {
                msg.rep = tipc_get_err_tlv(TIPC_CFG_NOT_SUPPORTED);
                err = -EOPNOTSUPP;
                goto send;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index dd8537f988c4..83ae41d7e554 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -485,9 +485,8 @@ static int tipc_sk_create(struct net *net, struct socket *sock,
                tsk_set_unreturnable(tsk, true);
                if (sock->type == SOCK_DGRAM)
                        tsk_set_unreliable(tsk, true);
-                __skb_queue_head_init(&tsk->mc_method.deferredq);
        }
+        __skb_queue_head_init(&tsk->mc_method.deferredq);
        trace_tipc_sk_create(sk, NULL, TIPC_DUMP_NONE, " ");
        return 0;
 }
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index 7c0b2b778703..43922d86e510 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -373,9 +373,9 @@ static int tls_push_data(struct sock *sk,
        struct tls_context *tls_ctx = tls_get_ctx(sk);
        struct tls_prot_info *prot = &tls_ctx->prot_info;
        struct tls_offload_context_tx *ctx = tls_offload_ctx_tx(tls_ctx);
-        int tls_push_record_flags = flags | MSG_SENDPAGE_NOTLAST;
        int more = flags & (MSG_SENDPAGE_NOTLAST | MSG_MORE);
        struct tls_record_info *record = ctx->open_record;
+        int tls_push_record_flags;
        struct page_frag *pfrag;
        size_t orig_size = size;
        u32 max_open_record_len;
@@ -390,6 +390,9 @@ static int tls_push_data(struct sock *sk,
        if (sk->sk_err)
                return -sk->sk_err;
+        flags |= MSG_SENDPAGE_DECRYPTED;
+        tls_push_record_flags = flags | MSG_SENDPAGE_NOTLAST;
        timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
        if (tls_is_partially_sent_record(tls_ctx)) {
                rc = tls_push_partial_record(sk, tls_ctx, flags);
@@ -576,7 +579,9 @@ void tls_device_write_space(struct sock *sk, struct tls_context *ctx)
                gfp_t sk_allocation = sk->sk_allocation;
                sk->sk_allocation = GFP_ATOMIC;
-                tls_push_partial_record(sk, ctx, MSG_DONTWAIT | MSG_NOSIGNAL);
+                tls_push_partial_record(sk, ctx,
+                                        MSG_DONTWAIT | MSG_NOSIGNAL |
+                                        MSG_SENDPAGE_DECRYPTED);
                sk->sk_allocation = sk_allocation;
        }
 }
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 4674e57e66b0..43252a801c3f 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -261,24 +261,9 @@ void tls_ctx_free(struct tls_context *ctx)
        kfree(ctx);
 }
-static void tls_sk_proto_close(struct sock *sk, long timeout)
+static void tls_sk_proto_cleanup(struct sock *sk,
+                                 struct tls_context *ctx, long timeo)
 {
-        struct tls_context *ctx = tls_get_ctx(sk);
-        long timeo = sock_sndtimeo(sk, 0);
-        void (*sk_proto_close)(struct sock *sk, long timeout);
-        bool free_ctx = false;
-        lock_sock(sk);
-        sk_proto_close = ctx->sk_proto_close;
-        if (ctx->tx_conf == TLS_HW_RECORD && ctx->rx_conf == TLS_HW_RECORD)
-                goto skip_tx_cleanup;
-        if (ctx->tx_conf == TLS_BASE && ctx->rx_conf == TLS_BASE) {
-                free_ctx = true;
-                goto skip_tx_cleanup;
-        }
        if (unlikely(sk->sk_write_pending) &&
            !wait_on_pending_writer(sk, &timeo))
                tls_handle_open_record(sk, 0);
@@ -287,7 +272,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
        if (ctx->tx_conf == TLS_SW) {
                kfree(ctx->tx.rec_seq);
                kfree(ctx->tx.iv);
-                tls_sw_free_resources_tx(sk);
+                tls_sw_release_resources_tx(sk);
 #ifdef CONFIG_TLS_DEVICE
        } else if (ctx->tx_conf == TLS_HW) {
                tls_device_free_resources_tx(sk);
@@ -295,26 +280,46 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
        }
        if (ctx->rx_conf == TLS_SW)
-                tls_sw_free_resources_rx(sk);
+                tls_sw_release_resources_rx(sk);
 #ifdef CONFIG_TLS_DEVICE
        if (ctx->rx_conf == TLS_HW)
                tls_device_offload_cleanup_rx(sk);
-        if (ctx->tx_conf != TLS_HW && ctx->rx_conf != TLS_HW) {
-#else
-        {
 #endif
-                tls_ctx_free(ctx);
+}
-                ctx = NULL;
-        }
-skip_tx_cleanup:
+static void tls_sk_proto_close(struct sock *sk, long timeout)
+{
+        struct inet_connection_sock *icsk = inet_csk(sk);
+        struct tls_context *ctx = tls_get_ctx(sk);
+        long timeo = sock_sndtimeo(sk, 0);
+        bool free_ctx;
+        if (ctx->tx_conf == TLS_SW)
+                tls_sw_cancel_work_tx(ctx);
+        lock_sock(sk);
+        free_ctx = ctx->tx_conf != TLS_HW && ctx->rx_conf != TLS_HW;
+        if (ctx->tx_conf != TLS_BASE || ctx->rx_conf != TLS_BASE)
+                tls_sk_proto_cleanup(sk, ctx, timeo);
+        write_lock_bh(&sk->sk_callback_lock);
+        if (free_ctx)
+                icsk->icsk_ulp_data = NULL;
+        sk->sk_prot = ctx->sk_proto;
+        if (sk->sk_write_space == tls_write_space)
+                sk->sk_write_space = ctx->sk_write_space;
+        write_unlock_bh(&sk->sk_callback_lock);
        release_sock(sk);
-        sk_proto_close(sk, timeout);
+        if (ctx->tx_conf == TLS_SW)
-        /* free ctx for TLS_HW_RECORD, used by tcp_set_state
+                tls_sw_free_ctx_tx(ctx);
-         * for sk->sk_prot->unhash [tls_hw_unhash]
+        if (ctx->rx_conf == TLS_SW || ctx->rx_conf == TLS_HW)
-         */
+                tls_sw_strparser_done(ctx);
+        if (ctx->rx_conf == TLS_SW)
+                tls_sw_free_ctx_rx(ctx);
+        ctx->sk_proto_close(sk, timeout);
        if (free_ctx)
                tls_ctx_free(ctx);
 }
@@ -526,6 +531,8 @@ static int do_tls_setsockopt_conf(struct sock *sk, char __user *optval,
                {
 #endif
                        rc = tls_set_sw_offload(sk, ctx, 1);
+                        if (rc)
+                                goto err_crypto_info;
                        conf = TLS_SW;
                }
        } else {
@@ -537,13 +544,13 @@ static int do_tls_setsockopt_conf(struct sock *sk, char __user *optval,
                {
 #endif
                        rc = tls_set_sw_offload(sk, ctx, 0);
+                        if (rc)
+                                goto err_crypto_info;
                        conf = TLS_SW;
                }
+                tls_sw_strparser_arm(sk, ctx);
        }
-        if (rc)
-                goto err_crypto_info;
        if (tx)
                ctx->tx_conf = conf;
        else
@@ -607,6 +614,7 @@ static struct tls_context *create_ctx(struct sock *sk)
        ctx->setsockopt = sk->sk_prot->setsockopt;
        ctx->getsockopt = sk->sk_prot->getsockopt;
        ctx->sk_proto_close = sk->sk_prot->close;
+        ctx->unhash = sk->sk_prot->unhash;
        return ctx;
 }
@@ -764,7 +772,6 @@ static void build_protos(struct proto prot[TLS_NUM_CONFIG][TLS_NUM_CONFIG],
        prot[TLS_HW_RECORD][TLS_HW_RECORD] = *base;
        prot[TLS_HW_RECORD][TLS_HW_RECORD].hash         = tls_hw_hash;
        prot[TLS_HW_RECORD][TLS_HW_RECORD].unhash       = tls_hw_unhash;
-        prot[TLS_HW_RECORD][TLS_HW_RECORD].close        = tls_sk_proto_close;
 }
 static int tls_init(struct sock *sk)
@@ -773,7 +780,7 @@ static int tls_init(struct sock *sk)
        int rc = 0;
        if (tls_hw_prot(sk))
-                goto out;
+                return 0;
        /* The TLS ulp is currently supported only for TCP sockets
         * in ESTABLISHED state.
@@ -784,21 +791,38 @@ static int tls_init(struct sock *sk)
        if (sk->sk_state != TCP_ESTABLISHED)
                return -ENOTSUPP;
+        tls_build_proto(sk);
        /* allocate tls context */
+        write_lock_bh(&sk->sk_callback_lock);
        ctx = create_ctx(sk);
        if (!ctx) {
                rc = -ENOMEM;
                goto out;
        }
-        tls_build_proto(sk);
        ctx->tx_conf = TLS_BASE;
        ctx->rx_conf = TLS_BASE;
+        ctx->sk_proto = sk->sk_prot;
        update_sk_prot(sk, ctx);
 out:
+        write_unlock_bh(&sk->sk_callback_lock);
        return rc;
 }
+static void tls_update(struct sock *sk, struct proto *p)
+{
+        struct tls_context *ctx;
+        ctx = tls_get_ctx(sk);
+        if (likely(ctx)) {
+                ctx->sk_proto_close = p->close;
+                ctx->sk_proto = p;
+        } else {
+                sk->sk_prot = p;
+        }
+}
 void tls_register_device(struct tls_device *device)
 {
        spin_lock_bh(&device_spinlock);
@@ -819,6 +843,7 @@ static struct tcp_ulp_ops tcp_tls_ulp_ops __read_mostly = {
        .name                   = "tls",
        .owner                  = THIS_MODULE,
        .init                   = tls_init,
+        .update                 = tls_update,
 };
 static int __init tls_register(void)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 53b4ad94e74a..91d21b048a9b 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -2054,7 +2054,16 @@ static void tls_data_ready(struct sock *sk)
        }
 }
-void tls_sw_free_resources_tx(struct sock *sk)
+void tls_sw_cancel_work_tx(struct tls_context *tls_ctx)
+{
+        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
+        set_bit(BIT_TX_CLOSING, &ctx->tx_bitmask);
+        set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
+        cancel_delayed_work_sync(&ctx->tx_work.work);
+}
+void tls_sw_release_resources_tx(struct sock *sk)
 {
        struct tls_context *tls_ctx = tls_get_ctx(sk);
        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
@@ -2065,11 +2074,6 @@ void tls_sw_free_resources_tx(struct sock *sk)
        if (atomic_read(&ctx->encrypt_pending))
                crypto_wait_req(-EINPROGRESS, &ctx->async_wait);
-        release_sock(sk);
-        cancel_delayed_work_sync(&ctx->tx_work.work);
-        lock_sock(sk);
-        /* Tx whatever records we can transmit and abandon the rest */
        tls_tx_records(sk, -1);
        /* Free up un-sent records in tx_list. First, free
@@ -2092,6 +2096,11 @@ void tls_sw_free_resources_tx(struct sock *sk)
        crypto_free_aead(ctx->aead_send);
        tls_free_open_rec(sk);
+}
+void tls_sw_free_ctx_tx(struct tls_context *tls_ctx)
+{
+        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
        kfree(ctx);
 }
@@ -2110,25 +2119,40 @@ void tls_sw_release_resources_rx(struct sock *sk)
                skb_queue_purge(&ctx->rx_list);
                crypto_free_aead(ctx->aead_recv);
                strp_stop(&ctx->strp);
-                write_lock_bh(&sk->sk_callback_lock);
+                /* If tls_sw_strparser_arm() was not called (cleanup paths)
-                sk->sk_data_ready = ctx->saved_data_ready;
+                 * we still want to strp_stop(), but sk->sk_data_ready was
-                write_unlock_bh(&sk->sk_callback_lock);
+                 * never swapped.
-                release_sock(sk);
+                 */
-                strp_done(&ctx->strp);
+                if (ctx->saved_data_ready) {
-                lock_sock(sk);
+                        write_lock_bh(&sk->sk_callback_lock);
+                        sk->sk_data_ready = ctx->saved_data_ready;
+                        write_unlock_bh(&sk->sk_callback_lock);
+                }
        }
 }
-void tls_sw_free_resources_rx(struct sock *sk)
+void tls_sw_strparser_done(struct tls_context *tls_ctx)
 {
-        struct tls_context *tls_ctx = tls_get_ctx(sk);
        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
-        tls_sw_release_resources_rx(sk);
+        strp_done(&ctx->strp);
+}
+void tls_sw_free_ctx_rx(struct tls_context *tls_ctx)
+{
+        struct tls_sw_context_rx *ctx = tls_sw_ctx_rx(tls_ctx);
        kfree(ctx);
 }
+void tls_sw_free_resources_rx(struct sock *sk)
+{
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
+        tls_sw_release_resources_rx(sk);
+        tls_sw_free_ctx_rx(tls_ctx);
+}
 /* The work handler to transmitt the encrypted records in tx_list */
 static void tx_work_handler(struct work_struct *work)
 {
@@ -2137,11 +2161,17 @@ static void tx_work_handler(struct work_struct *work)
                                               struct tx_work, work);
        struct sock *sk = tx_work->sk;
        struct tls_context *tls_ctx = tls_get_ctx(sk);
-        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
+        struct tls_sw_context_tx *ctx;
-        if (!test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask))
+        if (unlikely(!tls_ctx))
                return;
+        ctx = tls_sw_ctx_tx(tls_ctx);
+        if (test_bit(BIT_TX_CLOSING, &ctx->tx_bitmask))
+                return;
+        if (!test_and_clear_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask))
+                return;
        lock_sock(sk);
        tls_tx_records(sk, -1);
        release_sock(sk);
@@ -2160,6 +2190,18 @@ void tls_sw_write_space(struct sock *sk, struct tls_context *ctx)
        }
 }
+void tls_sw_strparser_arm(struct sock *sk, struct tls_context *tls_ctx)
+{
+        struct tls_sw_context_rx *rx_ctx = tls_sw_ctx_rx(tls_ctx);
+        write_lock_bh(&sk->sk_callback_lock);
+        rx_ctx->saved_data_ready = sk->sk_data_ready;
+        sk->sk_data_ready = tls_data_ready;
+        write_unlock_bh(&sk->sk_callback_lock);
+        strp_check_rcv(&rx_ctx->strp);
+}
 int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
 {
        struct tls_context *tls_ctx = tls_get_ctx(sk);
@@ -2357,13 +2399,6 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
                cb.parse_msg = tls_read_size;
                strp_init(&sw_ctx_rx->strp, sk, &cb);
-                write_lock_bh(&sk->sk_callback_lock);
-                sw_ctx_rx->saved_data_ready = sk->sk_data_ready;
-                sk->sk_data_ready = tls_data_ready;
-                write_unlock_bh(&sk->sk_callback_lock);
-                strp_check_rcv(&sw_ctx_rx->strp);
        }
        goto out;
diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
index f2084e3f7aa4..9d864ebeb7b3 100644
--- a/net/vmw_vsock/hyperv_transport.c
+++ b/net/vmw_vsock/hyperv_transport.c
@@ -312,6 +312,11 @@ static void hvs_close_connection(struct vmbus_channel *chan)
        lock_sock(sk);
        hvs_do_close_lock_held(vsock_sk(sk), true);
        release_sock(sk);
+        /* Release the refcnt for the channel that's opened in
+         * hvs_open_connection().
+         */
+        sock_put(sk);
 }
 static void hvs_open_connection(struct vmbus_channel *chan)
@@ -407,6 +412,9 @@ static void hvs_open_connection(struct vmbus_channel *chan)
        }
        set_per_channel_state(chan, conn_from_host ? new : sk);
+        /* This reference will be dropped by hvs_close_connection(). */
+        sock_hold(conn_from_host ? new : sk);
        vmbus_set_chn_rescind_callback(chan, hvs_close_connection);
        /* Set the pending send size to max packet size to always get
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 45d9afcff6d5..32b3c719fdfc 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1410,10 +1410,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                }
                break;
        case NETDEV_PRE_UP:
-                if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)) &&
+                if (!cfg80211_iftype_allowed(wdev->wiphy, wdev->iftype,
-                    !(wdev->iftype == NL80211_IFTYPE_AP_VLAN &&
+                                             wdev->use_4addr, 0))
-                      rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP &&
-                      wdev->use_4addr))
                        return notifier_from_errno(-EOPNOTSUPP);
                if (rfkill_blocked(rdev->rfkill))
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index fc83dd179c1a..fd05ae1437a9 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3484,9 +3484,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                        return err;
        }
-        if (!(rdev->wiphy.interface_modes & (1 << type)) &&
+        if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
-            !(type == NL80211_IFTYPE_AP_VLAN && params.use_4addr &&
-              rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP))
                return -EOPNOTSUPP;
        err = nl80211_parse_mon_options(rdev, type, info, &params);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 4831ad745f91..327479ce69f5 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2788,7 +2788,7 @@ static void reg_process_pending_hints(void)
        /* When last_request->processed becomes true this will be rescheduled */
        if (lr && !lr->processed) {
-                reg_process_hint(lr);
+                pr_debug("Pending regulatory request, waiting for it to be processed...\n");
                return;
        }
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 1c39d6a2e850..e74837824cea 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -233,25 +233,30 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
        switch (params->cipher) {
        case WLAN_CIPHER_SUITE_TKIP:
+                /* Extended Key ID can only be used with CCMP/GCMP ciphers */
+                if ((pairwise && key_idx) ||
+                    params->mode != NL80211_KEY_RX_TX)
+                        return -EINVAL;
+                break;
        case WLAN_CIPHER_SUITE_CCMP:
        case WLAN_CIPHER_SUITE_CCMP_256:
        case WLAN_CIPHER_SUITE_GCMP:
        case WLAN_CIPHER_SUITE_GCMP_256:
-                /* IEEE802.11-2016 allows only 0 and - when using Extended Key
+                /* IEEE802.11-2016 allows only 0 and - when supporting
-                 * ID - 1 as index for pairwise keys.
+                 * Extended Key ID - 1 as index for pairwise keys.
                 * @NL80211_KEY_NO_TX is only allowed for pairwise keys when
                 * the driver supports Extended Key ID.
                 * @NL80211_KEY_SET_TX can't be set when installing and
                 * validating a key.
                 */
-                if (params->mode == NL80211_KEY_NO_TX) {
+                if ((params->mode == NL80211_KEY_NO_TX && !pairwise) ||
-                        if (!wiphy_ext_feature_isset(&rdev->wiphy,
+                    params->mode == NL80211_KEY_SET_TX)
-                                                     NL80211_EXT_FEATURE_EXT_KEY_ID))
+                        return -EINVAL;
-                                return -EINVAL;
+                if (wiphy_ext_feature_isset(&rdev->wiphy,
-                        else if (!pairwise || key_idx < 0 || key_idx > 1)
+                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
+                        if (pairwise && (key_idx < 0 || key_idx > 1))
                                return -EINVAL;
-                } else if ((pairwise && key_idx) ||
+                } else if (pairwise && key_idx) {
-                           params->mode == NL80211_KEY_SET_TX) {
                        return -EINVAL;
                }
                break;
@@ -1697,7 +1702,7 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
        for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
                num_interfaces += params->iftype_num[iftype];
                if (params->iftype_num[iftype] > 0 &&
-                    !(wiphy->software_iftypes & BIT(iftype)))
+                    !cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
                        used_iftypes |= BIT(iftype);
        }
@@ -1719,7 +1724,7 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
                        return -ENOMEM;
                for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
-                        if (wiphy->software_iftypes & BIT(iftype))
+                        if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
                                continue;
                        for (j = 0; j < c->n_limits; j++) {
                                all_iftypes |= limits[j].types;
@@ -2072,3 +2077,26 @@ int ieee80211_get_vht_max_nss(struct ieee80211_vht_cap *cap,
        return max_vht_nss;
 }
 EXPORT_SYMBOL(ieee80211_get_vht_max_nss);
+bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
+                             bool is_4addr, u8 check_swif)
+{
+        bool is_vlan = iftype == NL80211_IFTYPE_AP_VLAN;
+        switch (check_swif) {
+        case 0:
+                if (is_vlan && is_4addr)
+                        return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
+                return wiphy->interface_modes & BIT(iftype);
+        case 1:
+                if (!(wiphy->software_iftypes & BIT(iftype)) && is_vlan)
+                        return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
+                return wiphy->software_iftypes & BIT(iftype);
+        default:
+                break;
+        }
+        return false;
+}
+EXPORT_SYMBOL(cfg80211_iftype_allowed);
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 83de74ca729a..688aac7a6943 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -365,7 +365,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
        umem->pages = kcalloc(umem->npgs, sizeof(*umem->pages), GFP_KERNEL);
        if (!umem->pages) {
                err = -ENOMEM;
-                goto out_account;
+                goto out_pin;
        }
        for (i = 0; i < umem->npgs; i++)
@@ -373,6 +373,8 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
        return 0;
+out_pin:
+        xdp_umem_unpin_pages(umem);
 out_account:
        xdp_umem_unaccount_pages(umem);
        return err;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 8ca637a72697..ec94f5795ea4 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -3269,7 +3269,7 @@ decode_session4(struct sk_buff *skb, struct flowi *fl, bool reverse)
        struct flowi4 *fl4 = &fl->u.ip4;
        int oif = 0;
-        if (skb_dst(skb))
+        if (skb_dst(skb) && skb_dst(skb)->dev)
                oif = skb_dst(skb)->dev->ifindex;
        memset(fl4, 0, sizeof(struct flowi4));
@@ -3387,7 +3387,7 @@ decode_session6(struct sk_buff *skb, struct flowi *fl, bool reverse)
        nexthdr = nh[nhoff];
-        if (skb_dst(skb))
+        if (skb_dst(skb) && skb_dst(skb)->dev)
                oif = skb_dst(skb)->dev->ifindex;
        memset(fl6, 0, sizeof(struct flowi6));