Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
 "Some straggler bug fixes here:

   1) Netlink_sendmsg() doesn't check iterator type properly in mmap
      case, from Ken-ichirou MATSUZAWA.

   2) Don't sleep in atomic context in bcmgenet driver, from Florian
      Fainelli.

   3) The pfkey_broadcast() code patch can't actually ever use anything
      other than GFP_ATOMIC.  And the cases that right now pass
      GFP_KERNEL or similar will currently trigger an RCU splat.  Just
      use GFP_ATOMIC unconditionally.  From David Ahern.

   4) Fix FD bit timings handling in pcan_usb driver, from Marc
      Kleine-Budde.

   5) Cache dst leaked in ip6_gre tunnel removal, fix from Huaibin Wang.

   6) Traversal into drivers/net/ethernet/renesas should be triggered by
      CONFIG_NET_VENDOR_RENESAS, not a particular driver's config
      option.  From Kazuya Mizuguchi.

   7) Fix regression in handling of igmp_join errors in vxlan, from
      Marcelo Ricardo Leitner.

   8) Make phy_{read,write}_mmd_indirect() properly take the mdio_lock
      mutex when programming the registers.  From Russell King.

   9) Fix non-forced handling in u32_destroy(), from WANG Cong.

  10) Test the EVENT_NO_RUNTIME_PM flag before it is cleared in
      usbnet_stop(), from Eugene Shatokhin.

  11) In sfc driver, don't fetch statistics firmware isn't capable of,
      from Bert Kenward.

  12) Verify ASCONF address parameter location in SCTP, from Xin Long"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  sctp: donot reset the overall_error_count in SHUTDOWN_RECEIVE state
  sctp: asconf's process should verify address parameter is in the beginning
  sfc: only use vadaptor stats if firmware is capable
  net: phy: fixed: propagate fixed link values to struct
  usbnet: Get EVENT_NO_RUNTIME_PM bit before it is cleared
  drivers: net: xgene: fix: Oops in linkwatch_fire_event
  cls_u32: complete the check for non-forced case in u32_destroy()
  net: fec: use reinit_completion() in mdio accessor functions
  net: phy: add locking to phy_read_mmd_indirect()/phy_write_mmd_indirect()
  vxlan: re-ignore EADDRINUSE from igmp_join
  net: compile renesas directory if NET_VENDOR_RENESAS is configured
  ip6_gre: release cached dst on tunnel removal
  phylib: Make PHYs children of their MDIO bus, not the bus' parent.
  can: pcan_usb: don't provide CAN FD bittimings by non-FD adapters
  net: Fix RCU splat in af_key
  net: bcmgenet: fix uncleaned dma flags
  net: bcmgenet: Avoid sleeping in bcmgenet_timeout
  netlink: mmap: fix tx type check

22 files changed, 207 insertions, 113 deletions

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
index 6b94007ae052..838545ce468d 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
@@ -854,6 +854,18 @@ static int pcan_usb_probe(struct usb_interface *intf)
 /*
  * describe the PCAN-USB adapter
  */
+static const struct can_bittiming_const pcan_usb_const = {
+        .name = "pcan_usb",
+        .tseg1_min = 1,
+        .tseg1_max = 16,
+        .tseg2_min = 1,
+        .tseg2_max = 8,
+        .sjw_max = 4,
+        .brp_min = 1,
+        .brp_max = 64,
+        .brp_inc = 1,
+};
+
 const struct peak_usb_adapter pcan_usb = {
         .name = "PCAN-USB",
         .device_id = PCAN_USB_PRODUCT_ID,
@@ -862,17 +874,7 @@ const struct peak_usb_adapter pcan_usb = {
         .clock = {
                 .freq = PCAN_USB_CRYSTAL_HZ / 2 ,
         },
-        .bittiming_const = {
-                .name = "pcan_usb",
-                .tseg1_min = 1,
-                .tseg1_max = 16,
-                .tseg2_min = 1,
-                .tseg2_max = 8,
-                .sjw_max = 4,
-                .brp_min = 1,
-                .brp_max = 64,
-                .brp_inc = 1,
-        },
+        .bittiming_const = &pcan_usb_const,
 
         /* size of device private data */
         .sizeof_dev_private = sizeof(struct pcan_usb),
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 7921cff93a63..5a2e341a6d1e 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -792,9 +792,9 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter,
         dev->ep_msg_out = peak_usb_adapter->ep_msg_out[ctrl_idx];
 
         dev->can.clock = peak_usb_adapter->clock;
-        dev->can.bittiming_const = &peak_usb_adapter->bittiming_const;
+        dev->can.bittiming_const = peak_usb_adapter->bittiming_const;
         dev->can.do_set_bittiming = peak_usb_set_bittiming;
-        dev->can.data_bittiming_const = &peak_usb_adapter->data_bittiming_const;
+        dev->can.data_bittiming_const = peak_usb_adapter->data_bittiming_const;
         dev->can.do_set_data_bittiming = peak_usb_set_data_bittiming;
         dev->can.do_set_mode = peak_usb_set_mode;
         dev->can.do_get_berr_counter = peak_usb_adapter->do_get_berr_counter;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.h b/drivers/net/can/usb/peak_usb/pcan_usb_core.h
index 9e624f05ad4d..506fe506c9d3 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.h
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.h
@@ -48,8 +48,8 @@ struct peak_usb_adapter {
         u32 device_id;
         u32 ctrlmode_supported;
         struct can_clock clock;
-        const struct can_bittiming_const bittiming_const;
-        const struct can_bittiming_const data_bittiming_const;
+        const struct can_bittiming_const * const bittiming_const;
+        const struct can_bittiming_const * const data_bittiming_const;
         unsigned int ctrl_count;
 
         int (*intf_probe)(struct usb_interface *intf);
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index 09d14e70abd7..ce44a033f63b 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -990,6 +990,30 @@ static void pcan_usb_fd_free(struct peak_usb_device *dev)
 }
 
 /* describes the PCAN-USB FD adapter */
+static const struct can_bittiming_const pcan_usb_fd_const = {
+        .name = "pcan_usb_fd",
+        .tseg1_min = 1,
+        .tseg1_max = 64,
+        .tseg2_min = 1,
+        .tseg2_max = 16,
+        .sjw_max = 16,
+        .brp_min = 1,
+        .brp_max = 1024,
+        .brp_inc = 1,
+};
+
+static const struct can_bittiming_const pcan_usb_fd_data_const = {
+        .name = "pcan_usb_fd",
+        .tseg1_min = 1,
+        .tseg1_max = 16,
+        .tseg2_min = 1,
+        .tseg2_max = 8,
+        .sjw_max = 4,
+        .brp_min = 1,
+        .brp_max = 1024,
+        .brp_inc = 1,
+};
+
 const struct peak_usb_adapter pcan_usb_fd = {
         .name = "PCAN-USB FD",
         .device_id = PCAN_USBFD_PRODUCT_ID,
@@ -999,28 +1023,8 @@ const struct peak_usb_adapter pcan_usb_fd = {
         .clock = {
                 .freq = PCAN_UFD_CRYSTAL_HZ,
         },
-        .bittiming_const = {
-                .name = "pcan_usb_fd",
-                .tseg1_min = 1,
-                .tseg1_max = 64,
-                .tseg2_min = 1,
-                .tseg2_max = 16,
-                .sjw_max = 16,
-                .brp_min = 1,
-                .brp_max = 1024,
-                .brp_inc = 1,
-        },
-        .data_bittiming_const = {
-                .name = "pcan_usb_fd",
-                .tseg1_min = 1,
-                .tseg1_max = 16,
-                .tseg2_min = 1,
-                .tseg2_max = 8,
-                .sjw_max = 4,
-                .brp_min = 1,
-                .brp_max = 1024,
-                .brp_inc = 1,
-        },
+        .bittiming_const = &pcan_usb_fd_const,
+        .data_bittiming_const = &pcan_usb_fd_data_const,
 
         /* size of device private data */
         .sizeof_dev_private = sizeof(struct pcan_usb_fd_device),
@@ -1058,6 +1062,30 @@ const struct peak_usb_adapter pcan_usb_fd = {
 };
 
 /* describes the PCAN-USB Pro FD adapter */
+static const struct can_bittiming_const pcan_usb_pro_fd_const = {
+        .name = "pcan_usb_pro_fd",
+        .tseg1_min = 1,
+        .tseg1_max = 64,
+        .tseg2_min = 1,
+        .tseg2_max = 16,
+        .sjw_max = 16,
+        .brp_min = 1,
+        .brp_max = 1024,
+        .brp_inc = 1,
+};
+
+static const struct can_bittiming_const pcan_usb_pro_fd_data_const = {
+        .name = "pcan_usb_pro_fd",
+        .tseg1_min = 1,
+        .tseg1_max = 16,
+        .tseg2_min = 1,
+        .tseg2_max = 8,
+        .sjw_max = 4,
+        .brp_min = 1,
+        .brp_max = 1024,
+        .brp_inc = 1,
+};
+
 const struct peak_usb_adapter pcan_usb_pro_fd = {
         .name = "PCAN-USB Pro FD",
         .device_id = PCAN_USBPROFD_PRODUCT_ID,
@@ -1067,28 +1095,8 @@ const struct peak_usb_adapter pcan_usb_pro_fd = {
         .clock = {
                 .freq = PCAN_UFD_CRYSTAL_HZ,
         },
-        .bittiming_const = {
-                .name = "pcan_usb_pro_fd",
-                .tseg1_min = 1,
-                .tseg1_max = 64,
-                .tseg2_min = 1,
-                .tseg2_max = 16,
-                .sjw_max = 16,
-                .brp_min = 1,
-                .brp_max = 1024,
-                .brp_inc = 1,
-        },
-        .data_bittiming_const = {
-                .name = "pcan_usb_pro_fd",
-                .tseg1_min = 1,
-                .tseg1_max = 16,
-                .tseg2_min = 1,
-                .tseg2_max = 8,
-                .sjw_max = 4,
-                .brp_min = 1,
-                .brp_max = 1024,
-                .brp_inc = 1,
-        },
+        .bittiming_const = &pcan_usb_pro_fd_const,
+        .data_bittiming_const = &pcan_usb_pro_fd_data_const,
 
         /* size of device private data */
         .sizeof_dev_private = sizeof(struct pcan_usb_fd_device),
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index 7d61b3279798..bbdd6058cd2f 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -1004,6 +1004,18 @@ int pcan_usb_pro_probe(struct usb_interface *intf)
 /*
  * describe the PCAN-USB Pro adapter
  */
+static const struct can_bittiming_const pcan_usb_pro_const = {
+        .name = "pcan_usb_pro",
+        .tseg1_min = 1,
+        .tseg1_max = 16,
+        .tseg2_min = 1,
+        .tseg2_max = 8,
+        .sjw_max = 4,
+        .brp_min = 1,
+        .brp_max = 1024,
+        .brp_inc = 1,
+};
+
 const struct peak_usb_adapter pcan_usb_pro = {
         .name = "PCAN-USB Pro",
         .device_id = PCAN_USBPRO_PRODUCT_ID,
@@ -1012,17 +1024,7 @@ const struct peak_usb_adapter pcan_usb_pro = {
         .clock = {
                 .freq = PCAN_USBPRO_CRYSTAL_HZ,
         },
-        .bittiming_const = {
-                .name = "pcan_usb_pro",
-                .tseg1_min = 1,
-                .tseg1_max = 16,
-                .tseg2_min = 1,
-                .tseg2_max = 8,
-                .sjw_max = 4,
-                .brp_min = 1,
-                .brp_max = 1024,
-                .brp_inc = 1,
-        },
+        .bittiming_const = &pcan_usb_pro_const,
 
         /* size of device private data */
         .sizeof_dev_private = sizeof(struct pcan_usb_pro_device),
diff --git a/drivers/net/ethernet/Makefile b/drivers/net/ethernet/Makefile
index c51014b0464f..b52e0f63f9a3 100644
--- a/drivers/net/ethernet/Makefile
+++ b/drivers/net/ethernet/Makefile
@@ -65,7 +65,7 @@ obj-$(CONFIG_NET_VENDOR_PASEMI) += pasemi/
 obj-$(CONFIG_NET_VENDOR_QLOGIC) += qlogic/
 obj-$(CONFIG_NET_VENDOR_QUALCOMM) += qualcomm/
 obj-$(CONFIG_NET_VENDOR_REALTEK) += realtek/
-obj-$(CONFIG_SH_ETH) += renesas/
+obj-$(CONFIG_NET_VENDOR_RENESAS) += renesas/
 obj-$(CONFIG_NET_VENDOR_RDC) += rdc/
 obj-$(CONFIG_NET_VENDOR_ROCKER) += rocker/
 obj-$(CONFIG_NET_VENDOR_SAMSUNG) += samsung/
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index a626c4315a89..cfa37041ab71 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -801,6 +801,9 @@ int xgene_enet_mdio_config(struct xgene_enet_pdata *pdata)
 
 void xgene_enet_mdio_remove(struct xgene_enet_pdata *pdata)
 {
+        if (pdata->phy_dev)
+                phy_disconnect(pdata->phy_dev);
+
         mdiobus_unregister(pdata->mdio_bus);
         mdiobus_free(pdata->mdio_bus);
         pdata->mdio_bus = NULL;
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 299eb4315fe6..a02ea7f8fdae 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -1277,9 +1277,10 @@ static int xgene_enet_remove(struct platform_device *pdev)
         mac_ops->tx_disable(pdata);
 
         xgene_enet_napi_del(pdata);
-        xgene_enet_mdio_remove(pdata);
-        xgene_enet_delete_desc_rings(pdata);
+        if (pdata->phy_mode == PHY_INTERFACE_MODE_RGMII)
+                xgene_enet_mdio_remove(pdata);
         unregister_netdev(ndev);
+        xgene_enet_delete_desc_rings(pdata);
         pdata->port_ops->shutdown(pdata);
         free_netdev(ndev);
 
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 64c1e9db6b0b..09ff09f828d0 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -2126,6 +2126,8 @@ static int bcmgenet_dma_teardown(struct bcmgenet_priv *priv)
         int ret = 0;
         int timeout = 0;
         u32 reg;
+        u32 dma_ctrl;
+        int i;
 
         /* Disable TDMA to stop add more frames in TX DMA */
         reg = bcmgenet_tdma_readl(priv, DMA_CTRL);
@@ -2169,6 +2171,20 @@ static int bcmgenet_dma_teardown(struct bcmgenet_priv *priv)
                 ret = -ETIMEDOUT;
         }
 
+        dma_ctrl = 0;
+        for (i = 0; i < priv->hw_params->rx_queues; i++)
+                dma_ctrl |= (1 << (i + DMA_RING_BUF_EN_SHIFT));
+        reg = bcmgenet_rdma_readl(priv, DMA_CTRL);
+        reg &= ~dma_ctrl;
+        bcmgenet_rdma_writel(priv, reg, DMA_CTRL);
+
+        dma_ctrl = 0;
+        for (i = 0; i < priv->hw_params->tx_queues; i++)
+                dma_ctrl |= (1 << (i + DMA_RING_BUF_EN_SHIFT));
+        reg = bcmgenet_tdma_readl(priv, DMA_CTRL);
+        reg &= ~dma_ctrl;
+        bcmgenet_tdma_writel(priv, reg, DMA_CTRL);
+
         return ret;
 }
 
@@ -2820,8 +2836,6 @@ static void bcmgenet_timeout(struct net_device *dev)
 
         netif_dbg(priv, tx_err, dev, "bcmgenet_timeout\n");
 
-        bcmgenet_disable_tx_napi(priv);
-
         for (q = 0; q < priv->hw_params->tx_queues; q++)
                 bcmgenet_dump_tx_queue(&priv->tx_rings[q]);
         bcmgenet_dump_tx_queue(&priv->tx_rings[DESC_INDEX]);
@@ -2837,8 +2851,6 @@ static void bcmgenet_timeout(struct net_device *dev)
         bcmgenet_intrl2_0_writel(priv, int0_enable, INTRL2_CPU_MASK_CLEAR);
         bcmgenet_intrl2_1_writel(priv, int1_enable, INTRL2_CPU_MASK_CLEAR);
 
-        bcmgenet_enable_tx_napi(priv);
-
         dev->trans_start = jiffies;
 
         dev->stats.tx_errors++;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 271bb5862346..b349e6f36ea7 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1778,7 +1778,7 @@ static int fec_enet_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
                 return ret;
 
         fep->mii_timeout = 0;
-        init_completion(&fep->mdio_done);
+        reinit_completion(&fep->mdio_done);
 
         /* start a read op */
         writel(FEC_MMFR_ST | FEC_MMFR_OP_READ |
@@ -1817,7 +1817,7 @@ static int fec_enet_mdio_write(struct mii_bus *bus, int mii_id, int regnum,
                 return ret;
 
         fep->mii_timeout = 0;
-        init_completion(&fep->mdio_done);
+        reinit_completion(&fep->mdio_done);
 
         /* start a write op */
         writel(FEC_MMFR_ST | FEC_MMFR_OP_WRITE |
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 605cc8948594..b1a4ea21c91c 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -1282,7 +1282,12 @@ static size_t efx_ef10_update_stats_common(struct efx_nic *efx, u64 *full_stats,
                 }
         }
 
-        if (core_stats) {
+        if (!core_stats)
+                return stats_count;
+
+        if (nic_data->datapath_caps &
+                        1 << MC_CMD_GET_CAPABILITIES_OUT_EVB_LBN) {
+                /* Use vadaptor stats. */
                 core_stats->rx_packets = stats[EF10_STAT_rx_unicast] +
                                          stats[EF10_STAT_rx_multicast] +
                                          stats[EF10_STAT_rx_broadcast];
@@ -1302,6 +1307,26 @@ static size_t efx_ef10_update_stats_common(struct efx_nic *efx, u64 *full_stats,
                 core_stats->rx_fifo_errors = stats[EF10_STAT_rx_overflow];
                 core_stats->rx_errors = core_stats->rx_crc_errors;
                 core_stats->tx_errors = stats[EF10_STAT_tx_bad];
+        } else {
+                /* Use port stats. */
+                core_stats->rx_packets = stats[EF10_STAT_port_rx_packets];
+                core_stats->tx_packets = stats[EF10_STAT_port_tx_packets];
+                core_stats->rx_bytes = stats[EF10_STAT_port_rx_bytes];
+                core_stats->tx_bytes = stats[EF10_STAT_port_tx_bytes];
+                core_stats->rx_dropped = stats[EF10_STAT_port_rx_nodesc_drops] +
+                                         stats[GENERIC_STAT_rx_nodesc_trunc] +
+                                         stats[GENERIC_STAT_rx_noskb_drops];
+                core_stats->multicast = stats[EF10_STAT_port_rx_multicast];
+                core_stats->rx_length_errors =
+                                stats[EF10_STAT_port_rx_gtjumbo] +
+                                stats[EF10_STAT_port_rx_length_error];
+                core_stats->rx_crc_errors = stats[EF10_STAT_port_rx_bad];
+                core_stats->rx_frame_errors =
+                                stats[EF10_STAT_port_rx_align_error];
+                core_stats->rx_fifo_errors = stats[EF10_STAT_port_rx_overflow];
+                core_stats->rx_errors = (core_stats->rx_length_errors +
+                                         core_stats->rx_crc_errors +
+                                         core_stats->rx_frame_errors);
         }
 
         return stats_count;
diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index 1960b46add65..d7a65247f952 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -290,6 +290,15 @@ struct phy_device *fixed_phy_register(unsigned int irq,
                 return ERR_PTR(-EINVAL);
         }
 
+        /* propagate the fixed link values to struct phy_device */
+        phy->link = status->link;
+        if (status->link) {
+                phy->speed = status->speed;
+                phy->duplex = status->duplex;
+                phy->pause = status->pause;
+                phy->asym_pause = status->asym_pause;
+        }
+
         of_node_get(np);
         phy->dev.of_node = np;
 
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 1e1fbb049ec6..34fe339f4e80 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -1038,10 +1038,14 @@ int phy_read_mmd_indirect(struct phy_device *phydev, int prtad,
         int value = -1;
 
         if (phydrv->read_mmd_indirect == NULL) {
-                mmd_phy_indirect(phydev->bus, prtad, devad, addr);
+                struct mii_bus *bus = phydev->bus;
+
+                mutex_lock(&bus->mdio_lock);
+                mmd_phy_indirect(bus, prtad, devad, addr);
 
                 /* Read the content of the MMD's selected register */
-                value = phydev->bus->read(phydev->bus, addr, MII_MMD_DATA);
+                value = bus->read(bus, addr, MII_MMD_DATA);
+                mutex_unlock(&bus->mdio_lock);
         } else {
                 value = phydrv->read_mmd_indirect(phydev, prtad, devad, addr);
         }
@@ -1071,10 +1075,14 @@ void phy_write_mmd_indirect(struct phy_device *phydev, int prtad,
         struct phy_driver *phydrv = phydev->drv;
 
         if (phydrv->write_mmd_indirect == NULL) {
-                mmd_phy_indirect(phydev->bus, prtad, devad, addr);
+                struct mii_bus *bus = phydev->bus;
+
+                mutex_lock(&bus->mdio_lock);
+                mmd_phy_indirect(bus, prtad, devad, addr);
 
                 /* Write the data into MMD's selected register */
-                phydev->bus->write(phydev->bus, addr, MII_MMD_DATA, data);
+                bus->write(bus, addr, MII_MMD_DATA, data);
+                mutex_unlock(&bus->mdio_lock);
         } else {
                 phydrv->write_mmd_indirect(phydev, prtad, devad, addr, data);
         }
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 0302483de240..55f01788df5e 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -176,7 +176,7 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
         if (c45_ids)
                 dev->c45_ids = *c45_ids;
         dev->bus = bus;
-        dev->dev.parent = bus->parent;
+        dev->dev.parent = &bus->dev;
         dev->dev.bus = &mdio_bus_type;
         dev->irq = bus->irq != NULL ? bus->irq[addr] : PHY_POLL;
         dev_set_name(&dev->dev, PHY_ID_FMT, bus->id, addr);
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 3c86b107275a..e0498571ae26 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -778,7 +778,7 @@ int usbnet_stop (struct net_device *net)
 {
         struct usbnet           *dev = netdev_priv(net);
         struct driver_info      *info = dev->driver_info;
-        int                     retval, pm;
+        int                     retval, pm, mpn;
 
         clear_bit(EVENT_DEV_OPEN, &dev->flags);
         netif_stop_queue (net);
@@ -809,6 +809,8 @@ int usbnet_stop (struct net_device *net)
 
         usbnet_purge_paused_rxq(dev);
 
+        mpn = !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags);
+
         /* deferred work (task, timer, softirq) must also stop.
          * can't flush_scheduled_work() until we drop rtnl (later),
          * else workers could deadlock; so make workers a NOP.
@@ -819,8 +821,7 @@ int usbnet_stop (struct net_device *net)
         if (!pm)
                 usb_autopm_put_interface(dev->intf);
 
-        if (info->manage_power &&
-            !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags))
+        if (info->manage_power && mpn)
                 info->manage_power(dev, 0);
         else
                 usb_autopm_put_interface(dev->intf);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 34c519eb1db5..5bc4b1ed67b3 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2216,6 +2216,8 @@ static int vxlan_open(struct net_device *dev)
 
         if (vxlan_addr_multicast(&vxlan->default_dst.remote_ip)) {
                 ret = vxlan_igmp_join(vxlan);
+                if (ret == -EADDRINUSE)
+                        ret = 0;
                 if (ret) {
                         vxlan_sock_release(vs);
                         return ret;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index a38d3ac0f18f..69f4f689f06a 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -361,6 +361,7 @@ static void ip6gre_tunnel_uninit(struct net_device *dev)
         struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
 
         ip6gre_tunnel_unlink(ign, t);
+        ip6_tnl_dst_reset(t);
         dev_put(dev);
 }
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index b397f0aa9005..83a70688784b 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -219,7 +219,7 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
 #define BROADCAST_ONE           1
 #define BROADCAST_REGISTERED    2
 #define BROADCAST_PROMISC_ONLY  4
-static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
+static int pfkey_broadcast(struct sk_buff *skb,
                            int broadcast_flags, struct sock *one_sk,
                            struct net *net)
 {
@@ -244,7 +244,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
                  * socket.
                  */
                 if (pfk->promisc)
-                        pfkey_broadcast_one(skb, &skb2, allocation, sk);
+                        pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk);
 
                 /* the exact target will be processed later */
                 if (sk == one_sk)
@@ -259,7 +259,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
                                 continue;
                 }
 
-                err2 = pfkey_broadcast_one(skb, &skb2, allocation, sk);
+                err2 = pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk);
 
                 /* Error is cleare after succecful sending to at least one
                  * registered KM */
@@ -269,7 +269,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
         rcu_read_unlock();
 
         if (one_sk != NULL)
-                err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
+                err = pfkey_broadcast_one(skb, &skb2, GFP_KERNEL, one_sk);
 
         kfree_skb(skb2);
         kfree_skb(skb);
@@ -292,7 +292,7 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
                 hdr = (struct sadb_msg *) pfk->dump.skb->data;
                 hdr->sadb_msg_seq = 0;
                 hdr->sadb_msg_errno = rc;
-                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
                                 &pfk->sk, sock_net(&pfk->sk));
                 pfk->dump.skb = NULL;
         }
@@ -333,7 +333,7 @@ static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk)
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
                              sizeof(uint64_t));
 
-        pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk, sock_net(sk));
+        pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
 
         return 0;
 }
@@ -1365,7 +1365,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
 
         xfrm_state_put(x);
 
-        pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk, net);
+        pfkey_broadcast(resp_skb, BROADCAST_ONE, sk, net);
 
         return 0;
 }
@@ -1452,7 +1452,7 @@ static int key_notify_sa(struct xfrm_state *x, const struct km_event *c)
         hdr->sadb_msg_seq = c->seq;
         hdr->sadb_msg_pid = c->portid;
 
-        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xs_net(x));
+        pfkey_broadcast(skb, BROADCAST_ALL, NULL, xs_net(x));
 
         return 0;
 }
@@ -1565,7 +1565,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, const struct sadb_msg
         out_hdr->sadb_msg_reserved = 0;
         out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
         out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
+        pfkey_broadcast(out_skb, BROADCAST_ONE, sk, sock_net(sk));
 
         return 0;
 }
@@ -1670,7 +1670,7 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad
                 return -ENOBUFS;
         }
 
-        pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk, sock_net(sk));
+        pfkey_broadcast(supp_skb, BROADCAST_REGISTERED, sk, sock_net(sk));
 
         return 0;
 }
@@ -1689,7 +1689,7 @@ static int unicast_flush_resp(struct sock *sk, const struct sadb_msg *ihdr)
         hdr->sadb_msg_errno = (uint8_t) 0;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
 
-        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
+        return pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
 }
 
 static int key_notify_sa_flush(const struct km_event *c)
@@ -1710,7 +1710,7 @@ static int key_notify_sa_flush(const struct km_event *c)
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
         hdr->sadb_msg_reserved = 0;
 
-        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
+        pfkey_broadcast(skb, BROADCAST_ALL, NULL, c->net);
 
         return 0;
 }
@@ -1767,7 +1767,7 @@ static int dump_sa(struct xfrm_state *x, int count, void *ptr)
         out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
 
         if (pfk->dump.skb)
-                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
                                 &pfk->sk, sock_net(&pfk->sk));
         pfk->dump.skb = out_skb;
 
@@ -1847,7 +1847,7 @@ static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, const struct sadb
                 new_hdr->sadb_msg_errno = 0;
         }
 
-        pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, sock_net(sk));
+        pfkey_broadcast(skb, BROADCAST_ALL, NULL, sock_net(sk));
         return 0;
 }
 
@@ -2181,7 +2181,7 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_ev
         out_hdr->sadb_msg_errno = 0;
         out_hdr->sadb_msg_seq = c->seq;
         out_hdr->sadb_msg_pid = c->portid;
-        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp));
+        pfkey_broadcast(out_skb, BROADCAST_ALL, NULL, xp_net(xp));
         return 0;
 
 }
@@ -2401,7 +2401,7 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
         out_hdr->sadb_msg_errno = 0;
         out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
         out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, xp_net(xp));
+        pfkey_broadcast(out_skb, BROADCAST_ONE, sk, xp_net(xp));
         err = 0;
 
 out:
@@ -2655,7 +2655,7 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
         out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
 
         if (pfk->dump.skb)
-                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
                                 &pfk->sk, sock_net(&pfk->sk));
         pfk->dump.skb = out_skb;
 
@@ -2708,7 +2708,7 @@ static int key_notify_policy_flush(const struct km_event *c)
         hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
         hdr->sadb_msg_reserved = 0;
-        pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
+        pfkey_broadcast(skb_out, BROADCAST_ALL, NULL, c->net);
         return 0;
 
 }
@@ -2770,7 +2770,7 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
         void *ext_hdrs[SADB_EXT_MAX];
         int err;
 
-        pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
+        pfkey_broadcast(skb_clone(skb, GFP_KERNEL),
                         BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
 
         memset(ext_hdrs, 0, sizeof(ext_hdrs));
@@ -2992,7 +2992,7 @@ static int key_notify_sa_expire(struct xfrm_state *x, const struct km_event *c)
         out_hdr->sadb_msg_seq = 0;
         out_hdr->sadb_msg_pid = 0;
 
-        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, xs_net(x));
+        pfkey_broadcast(out_skb, BROADCAST_REGISTERED, NULL, xs_net(x));
         return 0;
 }
 
@@ -3182,7 +3182,7 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
                        xfrm_ctx->ctx_len);
         }
 
-        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, xs_net(x));
+        return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
 }
 
 static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
@@ -3380,7 +3380,7 @@ static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
         n_port->sadb_x_nat_t_port_port = sport;
         n_port->sadb_x_nat_t_port_reserved = 0;
 
-        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, xs_net(x));
+        return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
 }
 
 #ifdef CONFIG_NET_KEY_MIGRATE
@@ -3572,7 +3572,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
         }
 
         /* broadcast migrate message to sockets */
-        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, &init_net);
+        pfkey_broadcast(skb, BROADCAST_ALL, NULL, &init_net);
 
         return 0;
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 67d210477863..a774985489e2 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2401,7 +2401,7 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
          * sendmsg(), but that's what we've got...
          */
         if (netlink_tx_is_mmaped(sk) &&
-            msg->msg_iter.type == ITER_IOVEC &&
+            iter_is_iovec(&msg->msg_iter) &&
             msg->msg_iter.nr_segs == 1 &&
             msg->msg_iter.iov->iov_base == NULL) {
                 err = netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group,
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index cab9e9b43967..4fbb67430ce4 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -490,6 +490,19 @@ static bool u32_destroy(struct tcf_proto *tp, bool force)
                                         return false;
                         }
                 }
+
+                if (tp_c->refcnt > 1)
+                        return false;
+
+                if (tp_c->refcnt == 1) {
+                        struct tc_u_hnode *ht;
+
+                        for (ht = rtnl_dereference(tp_c->hlist);
+                             ht;
+                             ht = rtnl_dereference(ht->next))
+                                if (!ht_empty(ht))
+                                        return false;
+                }
         }
 
         if (root_ht && --root_ht->refcnt == 0)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 06320c8c1c86..a655ddc3f353 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3132,11 +3132,18 @@ bool sctp_verify_asconf(const struct sctp_association *asoc,
                 case SCTP_PARAM_IPV4_ADDRESS:
                         if (length != sizeof(sctp_ipv4addr_param_t))
                                 return false;
+                        /* ensure there is only one addr param and it's in the
+                         * beginning of addip_hdr params, or we reject it.
+                         */
+                        if (param.v != addip->addip_hdr.params)
+                                return false;
                         addr_param_seen = true;
                         break;
                 case SCTP_PARAM_IPV6_ADDRESS:
                         if (length != sizeof(sctp_ipv6addr_param_t))
                                 return false;
+                        if (param.v != addip->addip_hdr.params)
+                                return false;
                         addr_param_seen = true;
                         break;
                 case SCTP_PARAM_ADD_IP:
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index fef2acdf4a2e..85e6f03aeb70 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -702,7 +702,7 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
          * outstanding data and rely on the retransmission limit be reached
          * to shutdown the association.
          */
-        if (t->asoc->state != SCTP_STATE_SHUTDOWN_PENDING)
+        if (t->asoc->state < SCTP_STATE_SHUTDOWN_PENDING)
                 t->asoc->overall_error_count = 0;
 
         /* Clear the hb_sent flag to signal that we had a good