Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Fun set of conflict resolutions here...

For the mac80211 stuff, these were fortunately just parallel
adds.  Trivially resolved.

In drivers/net/phy/phy.c we had a bug fix in 'net' that moved the
function phy_disable_interrupts() earlier in the file, whilst in
'net-next' the phy_error() call from this function was removed.

In net/ipv4/xfrm4_policy.c, David Ahern's changes to remove the
'rt_table_id' member of rtable collided with a bug fix in 'net' that
added a new struct member "rt_mtu_locked" which needs to be copied
over here.

The mlxsw driver conflict consisted of net-next separating
the span code and definitions into separate files, whilst
a 'net' bug fix made some changes to that moved code.

The mlx5 infiniband conflict resolution was quite non-trivial,
the RDMA tree's merge commit was used as a guide here, and
here are their notes:

====================

    Due to bug fixes found by the syzkaller bot and taken into the for-rc
    branch after development for the 4.17 merge window had already started
    being taken into the for-next branch, there were fairly non-trivial
    merge issues that would need to be resolved between the for-rc branch
    and the for-next branch.  This merge resolves those conflicts and
    provides a unified base upon which ongoing development for 4.17 can
    be based.

    Conflicts:
            drivers/infiniband/hw/mlx5/main.c - Commit 42cea83f9524
            (IB/mlx5: Fix cleanup order on unload) added to for-rc and
            commit b5ca15ad7e61 (IB/mlx5: Add proper representors support)
            add as part of the devel cycle both needed to modify the
            init/de-init functions used by mlx5.  To support the new
            representors, the new functions added by the cleanup patch
            needed to be made non-static, and the init/de-init list
            added by the representors patch needed to be modified to
            match the init/de-init list changes made by the cleanup
            patch.
    Updates:
            drivers/infiniband/hw/mlx5/mlx5_ib.h - Update function
            prototypes added by representors patch to reflect new function
            names as changed by cleanup patch
            drivers/infiniband/hw/mlx5/ib_rep.c - Update init/de-init
            stage list to match new order from cleanup patch
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

69 files changed, 489 insertions, 267 deletions

diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 64aa9f755e1d..45c9bf5ff3a0 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -48,8 +48,8 @@ bool vlan_do_receive(struct sk_buff **skbp)
                  * original position later
                  */
                 skb_push(skb, offset);
-                skb = *skbp = vlan_insert_tag(skb, skb->vlan_proto,
-                                              skb->vlan_tci);
+                skb = *skbp = vlan_insert_inner_tag(skb, skb->vlan_proto,
+                                                    skb->vlan_tci, skb->mac_len);
                 if (!skb)
                         return false;
                 skb_pull(skb, offset + VLAN_HLEN);
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 75dda9454ccf..a60bacf7120b 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -400,7 +400,7 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
                    batadv_arp_hw_src(skb, hdr_size), &ip_src,
                    batadv_arp_hw_dst(skb, hdr_size), &ip_dst);
 
-        if (hdr_size == 0)
+        if (hdr_size < sizeof(struct batadv_unicast_packet))
                 return;
 
         unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c
index 7d5e9abb7a65..55c358ad3331 100644
--- a/net/batman-adv/icmp_socket.c
+++ b/net/batman-adv/icmp_socket.c
@@ -24,6 +24,7 @@
 #include <linux/debugfs.h>
 #include <linux/errno.h>
 #include <linux/etherdevice.h>
+#include <linux/eventpoll.h>
 #include <linux/export.h>
 #include <linux/fcntl.h>
 #include <linux/fs.h>
diff --git a/net/batman-adv/log.c b/net/batman-adv/log.c
index 52d8a4b848c0..853773e45f79 100644
--- a/net/batman-adv/log.c
+++ b/net/batman-adv/log.c
@@ -22,6 +22,7 @@
 #include <linux/compiler.h>
 #include <linux/debugfs.h>
 #include <linux/errno.h>
+#include <linux/eventpoll.h>
 #include <linux/export.h>
 #include <linux/fcntl.h>
 #include <linux/fs.h>
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index 5615b6abea6f..de3a055f7dd8 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -598,8 +598,8 @@ update:
                 bat_priv->mcast.enabled = true;
         }
 
-        return !(mcast_data.flags &
-                 (BATADV_MCAST_WANT_ALL_IPV4 | BATADV_MCAST_WANT_ALL_IPV6));
+        return !(mcast_data.flags & BATADV_MCAST_WANT_ALL_IPV4 &&
+                 mcast_data.flags & BATADV_MCAST_WANT_ALL_IPV6);
 }
 
 /**
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 289df027ecdd..cc3ed93a6d51 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -759,6 +759,7 @@ free_skb:
 /**
  * batadv_reroute_unicast_packet() - update the unicast header for re-routing
  * @bat_priv: the bat priv with all the soft interface information
+ * @skb: unicast packet to process
  * @unicast_packet: the unicast header to be updated
  * @dst_addr: the payload destination
  * @vid: VLAN identifier
@@ -770,7 +771,7 @@ free_skb:
  * Return: true if the packet header has been updated, false otherwise
  */
 static bool
-batadv_reroute_unicast_packet(struct batadv_priv *bat_priv,
+batadv_reroute_unicast_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
                               struct batadv_unicast_packet *unicast_packet,
                               u8 *dst_addr, unsigned short vid)
 {
@@ -799,8 +800,10 @@ batadv_reroute_unicast_packet(struct batadv_priv *bat_priv,
         }
 
         /* update the packet header */
+        skb_postpull_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
         ether_addr_copy(unicast_packet->dest, orig_addr);
         unicast_packet->ttvn = orig_ttvn;
+        skb_postpush_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
 
         ret = true;
 out:
@@ -841,7 +844,7 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
          * the packet to
          */
         if (batadv_tt_local_client_is_roaming(bat_priv, ethhdr->h_dest, vid)) {
-                if (batadv_reroute_unicast_packet(bat_priv, unicast_packet,
+                if (batadv_reroute_unicast_packet(bat_priv, skb, unicast_packet,
                                                   ethhdr->h_dest, vid))
                         batadv_dbg_ratelimited(BATADV_DBG_TT,
                                                bat_priv,
@@ -887,7 +890,7 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
          * destination can possibly be updated and forwarded towards the new
          * target host
          */
-        if (batadv_reroute_unicast_packet(bat_priv, unicast_packet,
+        if (batadv_reroute_unicast_packet(bat_priv, skb, unicast_packet,
                                           ethhdr->h_dest, vid)) {
                 batadv_dbg_ratelimited(BATADV_DBG_TT, bat_priv,
                                        "Rerouting unicast packet to %pM (dst=%pM): TTVN mismatch old_ttvn=%u new_ttvn=%u\n",
@@ -910,12 +913,14 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
         if (!primary_if)
                 return false;
 
+        /* update the packet header */
+        skb_postpull_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
         ether_addr_copy(unicast_packet->dest, primary_if->net_dev->dev_addr);
+        unicast_packet->ttvn = curr_ttvn;
+        skb_postpush_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
 
         batadv_hardif_put(primary_if);
 
-        unicast_packet->ttvn = curr_ttvn;
-
         return true;
 }
 
@@ -968,14 +973,10 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
         struct batadv_orig_node *orig_node = NULL, *orig_node_gw = NULL;
         int check, hdr_size = sizeof(*unicast_packet);
         enum batadv_subtype subtype;
-        struct ethhdr *ethhdr;
         int ret = NET_RX_DROP;
         bool is4addr, is_gw;
 
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
-        unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
-        ethhdr = eth_hdr(skb);
-
         is4addr = unicast_packet->packet_type == BATADV_UNICAST_4ADDR;
         /* the caller function should have already pulled 2 bytes */
         if (is4addr)
@@ -995,12 +996,14 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
         if (!batadv_check_unicast_ttvn(bat_priv, skb, hdr_size))
                 goto free_skb;
 
+        unicast_packet = (struct batadv_unicast_packet *)skb->data;
+
         /* packet for me */
         if (batadv_is_my_mac(bat_priv, unicast_packet->dest)) {
                 /* If this is a unicast packet from another backgone gw,
                  * drop it.
                  */
-                orig_addr_gw = ethhdr->h_source;
+                orig_addr_gw = eth_hdr(skb)->h_source;
                 orig_node_gw = batadv_orig_hash_find(bat_priv, orig_addr_gw);
                 if (orig_node_gw) {
                         is_gw = batadv_bla_is_backbone_gw(skb, orig_node_gw,
@@ -1015,6 +1018,8 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
                 }
 
                 if (is4addr) {
+                        unicast_4addr_packet =
+                                (struct batadv_unicast_4addr_packet *)skb->data;
                         subtype = unicast_4addr_packet->subtype;
                         batadv_dat_inc_counter(bat_priv, subtype);
 
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 01117ae84f1d..a2ddae2f37d7 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2296,8 +2296,14 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
         else
                 sec_level = authreq_to_seclevel(auth);
 
-        if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
+        if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) {
+                /* If link is already encrypted with sufficient security we
+                 * still need refresh encryption as per Core Spec 5.0 Vol 3,
+                 * Part H 2.4.6
+                 */
+                smp_ltk_encrypt(conn, hcon->sec_level);
                 return 0;
+        }
 
         if (sec_level > hcon->pending_sec_level)
                 hcon->pending_sec_level = sec_level;
diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index c5afb4232ecb..620e54f08296 100644
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -177,6 +177,28 @@ static bool poolsize_invalid(const struct ebt_mac_wormhash *w)
         return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple));
 }
 
+static bool wormhash_offset_invalid(int off, unsigned int len)
+{
+        if (off == 0) /* not present */
+                return false;
+
+        if (off < (int)sizeof(struct ebt_among_info) ||
+            off % __alignof__(struct ebt_mac_wormhash))
+                return true;
+
+        off += sizeof(struct ebt_mac_wormhash);
+
+        return off > len;
+}
+
+static bool wormhash_sizes_valid(const struct ebt_mac_wormhash *wh, int a, int b)
+{
+        if (a == 0)
+                a = sizeof(struct ebt_among_info);
+
+        return ebt_mac_wormhash_size(wh) + a == b;
+}
+
 static int ebt_among_mt_check(const struct xt_mtchk_param *par)
 {
         const struct ebt_among_info *info = par->matchinfo;
@@ -189,6 +211,10 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par)
         if (expected_length > em->match_size)
                 return -EINVAL;
 
+        if (wormhash_offset_invalid(info->wh_dst_ofs, em->match_size) ||
+            wormhash_offset_invalid(info->wh_src_ofs, em->match_size))
+                return -EINVAL;
+
         wh_dst = ebt_among_wh_dst(info);
         if (poolsize_invalid(wh_dst))
                 return -EINVAL;
@@ -201,6 +227,14 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par)
         if (poolsize_invalid(wh_src))
                 return -EINVAL;
 
+        if (info->wh_src_ofs < info->wh_dst_ofs) {
+                if (!wormhash_sizes_valid(wh_src, info->wh_src_ofs, info->wh_dst_ofs))
+                        return -EINVAL;
+        } else {
+                if (!wormhash_sizes_valid(wh_dst, info->wh_dst_ofs, info->wh_src_ofs))
+                        return -EINVAL;
+        }
+
         expected_length += ebt_mac_wormhash_size(wh_src);
 
         if (em->match_size != EBT_ALIGN(expected_length)) {
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 254ef9f49567..a94d23b0a9af 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2119,8 +2119,12 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
          * offsets are relative to beginning of struct ebt_entry (i.e., 0).
          */
         for (i = 0; i < 4 ; ++i) {
-                if (offsets[i] >= *total)
+                if (offsets[i] > *total)
                         return -EINVAL;
+
+                if (i < 3 && offsets[i] == *total)
+                        return -EINVAL;
+
                 if (i == 0)
                         continue;
                 if (offsets[i-1] > offsets[i])
diff --git a/net/core/dev.c b/net/core/dev.c
index d8887cc38e7b..f9c28f44286c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3278,15 +3278,23 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q,
 #if IS_ENABLED(CONFIG_CGROUP_NET_PRIO)
 static void skb_update_prio(struct sk_buff *skb)
 {
-        struct netprio_map *map = rcu_dereference_bh(skb->dev->priomap);
+        const struct netprio_map *map;
+        const struct sock *sk;
+        unsigned int prioidx;
 
-        if (!skb->priority && skb->sk && map) {
-                unsigned int prioidx =
-                        sock_cgroup_prioidx(&skb->sk->sk_cgrp_data);
+        if (skb->priority)
+                return;
+        map = rcu_dereference_bh(skb->dev->priomap);
+        if (!map)
+                return;
+        sk = skb_to_full_sk(skb);
+        if (!sk)
+                return;
 
-                if (prioidx < map->priomap_len)
-                        skb->priority = map->priomap[prioidx];
-        }
+        prioidx = sock_cgroup_prioidx(&sk->sk_cgrp_data);
+
+        if (prioidx < map->priomap_len)
+                skb->priority = map->priomap[prioidx];
 }
 #else
 #define skb_update_prio(skb)
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 0ab1af04296c..a04e1e88bf3a 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -402,8 +402,6 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
         if (colon)
                 *colon = 0;
 
-        dev_load(net, ifr->ifr_name);
-
         /*
          *      See which interface the caller is talking about.
          */
@@ -423,6 +421,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
         case SIOCGIFMAP:
         case SIOCGIFINDEX:
         case SIOCGIFTXQLEN:
+                dev_load(net, ifr->ifr_name);
                 rcu_read_lock();
                 ret = dev_ifsioc_locked(net, ifr, cmd);
                 rcu_read_unlock();
@@ -431,6 +430,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
                 return ret;
 
         case SIOCETHTOOL:
+                dev_load(net, ifr->ifr_name);
                 rtnl_lock();
                 ret = dev_ethtool(net, ifr);
                 rtnl_unlock();
@@ -447,6 +447,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
         case SIOCGMIIPHY:
         case SIOCGMIIREG:
         case SIOCSIFNAME:
+                dev_load(net, ifr->ifr_name);
                 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
                         return -EPERM;
                 rtnl_lock();
@@ -494,6 +495,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
                 /* fall through */
         case SIOCBONDSLAVEINFOQUERY:
         case SIOCBONDINFOQUERY:
+                dev_load(net, ifr->ifr_name);
                 rtnl_lock();
                 ret = dev_ifsioc(net, ifr, cmd);
                 rtnl_unlock();
@@ -518,6 +520,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
                     cmd == SIOCGHWTSTAMP ||
                     (cmd >= SIOCDEVPRIVATE &&
                      cmd <= SIOCDEVPRIVATE + 15)) {
+                        dev_load(net, ifr->ifr_name);
                         rtnl_lock();
                         ret = dev_ifsioc(net, ifr, cmd);
                         rtnl_unlock();
diff --git a/net/core/devlink.c b/net/core/devlink.c
index d03b96f87c25..9236e421bd62 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1798,7 +1798,7 @@ send_done:
         if (!nlh) {
                 err = devlink_dpipe_send_and_alloc_skb(&skb, info);
                 if (err)
-                        goto err_skb_send_alloc;
+                        return err;
                 goto send_done;
         }
 
@@ -1807,7 +1807,6 @@ send_done:
 nla_put_failure:
         err = -EMSGSIZE;
 err_table_put:
-err_skb_send_alloc:
         genlmsg_cancel(skb, hdr);
         nlmsg_free(skb);
         return err;
@@ -2073,7 +2072,7 @@ static int devlink_dpipe_entries_fill(struct genl_info *info,
                                              table->counters_enabled,
                                              &dump_ctx);
         if (err)
-                goto err_entries_dump;
+                return err;
 
 send_done:
         nlh = nlmsg_put(dump_ctx.skb, info->snd_portid, info->snd_seq,
@@ -2081,16 +2080,10 @@ send_done:
         if (!nlh) {
                 err = devlink_dpipe_send_and_alloc_skb(&dump_ctx.skb, info);
                 if (err)
-                        goto err_skb_send_alloc;
+                        return err;
                 goto send_done;
         }
         return genlmsg_reply(dump_ctx.skb, info);
-
-err_entries_dump:
-err_skb_send_alloc:
-        genlmsg_cancel(dump_ctx.skb, dump_ctx.hdr);
-        nlmsg_free(dump_ctx.skb);
-        return err;
 }
 
 static int devlink_nl_cmd_dpipe_entries_get(struct sk_buff *skb,
@@ -2229,7 +2222,7 @@ send_done:
         if (!nlh) {
                 err = devlink_dpipe_send_and_alloc_skb(&skb, info);
                 if (err)
-                        goto err_skb_send_alloc;
+                        return err;
                 goto send_done;
         }
         return genlmsg_reply(skb, info);
@@ -2237,7 +2230,6 @@ send_done:
 nla_put_failure:
         err = -EMSGSIZE;
 err_table_put:
-err_skb_send_alloc:
         genlmsg_cancel(skb, hdr);
         nlmsg_free(skb);
         return err;
diff --git a/net/core/filter.c b/net/core/filter.c
index c86f03fd9ea5..00c711c5f1a2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2283,6 +2283,10 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
         u32 off = skb_mac_header_len(skb);
         int ret;
 
+        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+                return -ENOTSUPP;
+
         ret = skb_cow(skb, len_diff);
         if (unlikely(ret < 0))
                 return ret;
@@ -2292,19 +2296,21 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
                 return ret;
 
         if (skb_is_gso(skb)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
+
                 /* SKB_GSO_TCPV4 needs to be changed into
                  * SKB_GSO_TCPV6.
                  */
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) {
-                        skb_shinfo(skb)->gso_type &= ~SKB_GSO_TCPV4;
-                        skb_shinfo(skb)->gso_type |=  SKB_GSO_TCPV6;
+                if (shinfo->gso_type & SKB_GSO_TCPV4) {
+                        shinfo->gso_type &= ~SKB_GSO_TCPV4;
+                        shinfo->gso_type |=  SKB_GSO_TCPV6;
                 }
 
                 /* Due to IPv6 header, MSS needs to be downgraded. */
-                skb_shinfo(skb)->gso_size -= len_diff;
+                skb_decrease_gso_size(shinfo, len_diff);
                 /* Header must be checked, and gso_segs recomputed. */
-                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
-                skb_shinfo(skb)->gso_segs = 0;
+                shinfo->gso_type |= SKB_GSO_DODGY;
+                shinfo->gso_segs = 0;
         }
 
         skb->protocol = htons(ETH_P_IPV6);
@@ -2319,6 +2325,10 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
         u32 off = skb_mac_header_len(skb);
         int ret;
 
+        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+                return -ENOTSUPP;
+
         ret = skb_unclone(skb, GFP_ATOMIC);
         if (unlikely(ret < 0))
                 return ret;
@@ -2328,19 +2338,21 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
                 return ret;
 
         if (skb_is_gso(skb)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
+
                 /* SKB_GSO_TCPV6 needs to be changed into
                  * SKB_GSO_TCPV4.
                  */
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
-                        skb_shinfo(skb)->gso_type &= ~SKB_GSO_TCPV6;
-                        skb_shinfo(skb)->gso_type |=  SKB_GSO_TCPV4;
+                if (shinfo->gso_type & SKB_GSO_TCPV6) {
+                        shinfo->gso_type &= ~SKB_GSO_TCPV6;
+                        shinfo->gso_type |=  SKB_GSO_TCPV4;
                 }
 
                 /* Due to IPv4 header, MSS can be upgraded. */
-                skb_shinfo(skb)->gso_size += len_diff;
+                skb_increase_gso_size(shinfo, len_diff);
                 /* Header must be checked, and gso_segs recomputed. */
-                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
-                skb_shinfo(skb)->gso_segs = 0;
+                shinfo->gso_type |= SKB_GSO_DODGY;
+                shinfo->gso_segs = 0;
         }
 
         skb->protocol = htons(ETH_P_IP);
@@ -2439,6 +2451,10 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff)
         u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
         int ret;
 
+        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+                return -ENOTSUPP;
+
         ret = skb_cow(skb, len_diff);
         if (unlikely(ret < 0))
                 return ret;
@@ -2448,11 +2464,13 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff)
                 return ret;
 
         if (skb_is_gso(skb)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
+
                 /* Due to header grow, MSS needs to be downgraded. */
-                skb_shinfo(skb)->gso_size -= len_diff;
+                skb_decrease_gso_size(shinfo, len_diff);
                 /* Header must be checked, and gso_segs recomputed. */
-                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
-                skb_shinfo(skb)->gso_segs = 0;
+                shinfo->gso_type |= SKB_GSO_DODGY;
+                shinfo->gso_segs = 0;
         }
 
         return 0;
@@ -2463,6 +2481,10 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
         u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
         int ret;
 
+        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+                return -ENOTSUPP;
+
         ret = skb_unclone(skb, GFP_ATOMIC);
         if (unlikely(ret < 0))
                 return ret;
@@ -2472,11 +2494,13 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
                 return ret;
 
         if (skb_is_gso(skb)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
+
                 /* Due to header shrink, MSS can be upgraded. */
-                skb_shinfo(skb)->gso_size += len_diff;
+                skb_increase_gso_size(shinfo, len_diff);
                 /* Header must be checked, and gso_segs recomputed. */
-                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
-                skb_shinfo(skb)->gso_segs = 0;
+                shinfo->gso_type |= SKB_GSO_DODGY;
+                shinfo->gso_segs = 0;
         }
 
         return 0;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 715c13495ba6..46cb22215ff4 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4181,7 +4181,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
 
         skb_queue_tail(&sk->sk_error_queue, skb);
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk);
+                sk->sk_error_report(sk);
         return 0;
 }
 EXPORT_SYMBOL(sock_queue_err_skb);
@@ -4906,7 +4906,7 @@ static unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
                         thlen += inner_tcp_hdrlen(skb);
         } else if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) {
                 thlen = tcp_hdrlen(skb);
-        } else if (unlikely(shinfo->gso_type & SKB_GSO_SCTP)) {
+        } else if (unlikely(skb_is_gso_sctp(skb))) {
                 thlen = sizeof(struct sctphdr);
         }
         /* UFO sets gso_size to the size of the fragmentation
@@ -5022,13 +5022,16 @@ EXPORT_SYMBOL_GPL(skb_gso_validate_mac_len);
 
 static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
 {
+        int mac_len;
+
         if (skb_cow(skb, skb_headroom(skb)) < 0) {
                 kfree_skb(skb);
                 return NULL;
         }
 
-        memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len - VLAN_HLEN,
-                2 * ETH_ALEN);
+        mac_len = skb->data - skb_mac_header(skb);
+        memmove(skb_mac_header(skb) + VLAN_HLEN, skb_mac_header(skb),
+                mac_len - VLAN_HLEN - ETH_TLEN);
         skb->mac_header += VLAN_HLEN;
         return skb;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index f704324d1219..e689496dfd8a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3326,6 +3326,27 @@ void proto_unregister(struct proto *prot)
 }
 EXPORT_SYMBOL(proto_unregister);
 
+int sock_load_diag_module(int family, int protocol)
+{
+        if (!protocol) {
+                if (!sock_is_registered(family))
+                        return -ENOENT;
+
+                return request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+                                      NETLINK_SOCK_DIAG, family);
+        }
+
+#ifdef CONFIG_INET
+        if (family == AF_INET &&
+            !rcu_access_pointer(inet_protos[protocol]))
+                return -ENOENT;
+#endif
+
+        return request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
+                              NETLINK_SOCK_DIAG, family, protocol);
+}
+EXPORT_SYMBOL(sock_load_diag_module);
+
 #ifdef CONFIG_PROC_FS
 static void *proto_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(proto_list_mutex)
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index aee5642affd9..a3392a8f9276 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -220,8 +220,7 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh)
                 return -EINVAL;
 
         if (sock_diag_handlers[req->sdiag_family] == NULL)
-                request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-                                NETLINK_SOCK_DIAG, req->sdiag_family);
+                sock_load_diag_module(req->sdiag_family, 0);
 
         mutex_lock(&sock_diag_table_mutex);
         hndl = sock_diag_handlers[req->sdiag_family];
@@ -247,8 +246,7 @@ static int sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
         case TCPDIAG_GETSOCK:
         case DCCPDIAG_GETSOCK:
                 if (inet_rcv_compat == NULL)
-                        request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-                                        NETLINK_SOCK_DIAG, AF_INET);
+                        sock_load_diag_module(AF_INET, 0);
 
                 mutex_lock(&sock_diag_table_mutex);
                 if (inet_rcv_compat != NULL)
@@ -281,14 +279,12 @@ static int sock_diag_bind(struct net *net, int group)
         case SKNLGRP_INET_TCP_DESTROY:
         case SKNLGRP_INET_UDP_DESTROY:
                 if (!sock_diag_handlers[AF_INET])
-                        request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-                                       NETLINK_SOCK_DIAG, AF_INET);
+                        sock_load_diag_module(AF_INET, 0);
                 break;
         case SKNLGRP_INET6_TCP_DESTROY:
         case SKNLGRP_INET6_UDP_DESTROY:
                 if (!sock_diag_handlers[AF_INET6])
-                        request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-                                       NETLINK_SOCK_DIAG, AF_INET6);
+                        sock_load_diag_module(AF_INET6, 0);
                 break;
         }
         return 0;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 15bdc002d90c..84cd4e3fd01b 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -794,6 +794,11 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         if (skb == NULL)
                 goto out_release;
 
+        if (sk->sk_state == DCCP_CLOSED) {
+                rc = -ENOTCONN;
+                goto out_discard;
+        }
+
         skb_reserve(skb, sk->sk_prot->max_header);
         rc = memcpy_from_msg(skb_put(skb, len), msg, len);
         if (rc != 0)
diff --git a/net/dsa/legacy.c b/net/dsa/legacy.c
index cb54b81d0bd9..42a7b85b84e1 100644
--- a/net/dsa/legacy.c
+++ b/net/dsa/legacy.c
@@ -194,7 +194,7 @@ static int dsa_switch_setup_one(struct dsa_switch *ds,
                 ds->ports[i].dn = cd->port_dn[i];
                 ds->ports[i].cpu_dp = dst->cpu_dp;
 
-                if (dsa_is_user_port(ds, i))
+                if (!dsa_is_user_port(ds, i))
                         continue;
 
                 ret = dsa_slave_create(&ds->ports[i]);
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index e4f305320519..275449b0d633 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -207,9 +207,13 @@ static inline void lowpan_netlink_fini(void)
 static int lowpan_device_event(struct notifier_block *unused,
                                unsigned long event, void *ptr)
 {
-        struct net_device *wdev = netdev_notifier_info_to_dev(ptr);
+        struct net_device *ndev = netdev_notifier_info_to_dev(ptr);
+        struct wpan_dev *wpan_dev;
 
-        if (wdev->type != ARPHRD_IEEE802154)
+        if (ndev->type != ARPHRD_IEEE802154)
+                return NOTIFY_DONE;
+        wpan_dev = ndev->ieee802154_ptr;
+        if (!wpan_dev)
                 return NOTIFY_DONE;
 
         switch (event) {
@@ -218,8 +222,8 @@ static int lowpan_device_event(struct notifier_block *unused,
                  * also delete possible lowpan interfaces which belongs
                  * to the wpan interface.
                  */
-                if (wdev->ieee802154_ptr->lowpan_dev)
-                        lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL);
+                if (wpan_dev->lowpan_dev)
+                        lowpan_dellink(wpan_dev->lowpan_dev, NULL);
                 break;
         default:
                 return NOTIFY_DONE;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index a383f299ce24..4e5bc4b2f14e 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -53,8 +53,7 @@ static DEFINE_MUTEX(inet_diag_table_mutex);
 static const struct inet_diag_handler *inet_diag_lock_handler(int proto)
 {
         if (!inet_diag_table[proto])
-                request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
-                               NETLINK_SOCK_DIAG, AF_INET, proto);
+                sock_load_diag_module(AF_INET, proto);
 
         mutex_lock(&inet_diag_table_mutex);
         if (!inet_diag_table[proto])
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 26a3d0315728..e8ec28999f5c 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -119,6 +119,9 @@ out:
 
 static bool inet_fragq_should_evict(const struct inet_frag_queue *q)
 {
+        if (!hlist_unhashed(&q->list_evictor))
+                return false;
+
         return q->net->low_thresh == 0 ||
                frag_mem_limit(q->net) >= q->net->low_thresh;
 }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index e74ee837b300..4ac5728689f5 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -635,6 +635,7 @@ static inline u32 fnhe_hashfun(__be32 daddr)
 static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
 {
         rt->rt_pmtu = fnhe->fnhe_pmtu;
+        rt->rt_mtu_locked = fnhe->fnhe_mtu_locked;
         rt->dst.expires = fnhe->fnhe_expires;
 
         if (fnhe->fnhe_gw) {
@@ -645,7 +646,7 @@ static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnh
 }
 
 static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
-                                  u32 pmtu, unsigned long expires)
+                                  u32 pmtu, bool lock, unsigned long expires)
 {
         struct fnhe_hash_bucket *hash;
         struct fib_nh_exception *fnhe;
@@ -682,8 +683,10 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                         fnhe->fnhe_genid = genid;
                 if (gw)
                         fnhe->fnhe_gw = gw;
-                if (pmtu)
+                if (pmtu) {
                         fnhe->fnhe_pmtu = pmtu;
+                        fnhe->fnhe_mtu_locked = lock;
+                }
                 fnhe->fnhe_expires = max(1UL, expires);
                 /* Update all cached dsts too */
                 rt = rcu_dereference(fnhe->fnhe_rth_input);
@@ -707,6 +710,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                 fnhe->fnhe_daddr = daddr;
                 fnhe->fnhe_gw = gw;
                 fnhe->fnhe_pmtu = pmtu;
+                fnhe->fnhe_mtu_locked = lock;
                 fnhe->fnhe_expires = expires;
 
                 /* Exception created; mark the cached routes for the nexthop
@@ -788,7 +792,8 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow
                                 struct fib_nh *nh = &FIB_RES_NH(res);
 
                                 update_or_create_fnhe(nh, fl4->daddr, new_gw,
-                                                0, jiffies + ip_rt_gc_timeout);
+                                                0, false,
+                                                jiffies + ip_rt_gc_timeout);
                         }
                         if (kill_route)
                                 rt->dst.obsolete = DST_OBSOLETE_KILL;
@@ -1010,15 +1015,18 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
 {
         struct dst_entry *dst = &rt->dst;
         struct fib_result res;
+        bool lock = false;
 
-        if (dst_metric_locked(dst, RTAX_MTU))
+        if (ip_mtu_locked(dst))
                 return;
 
         if (ipv4_mtu(dst) < mtu)
                 return;
 
-        if (mtu < ip_rt_min_pmtu)
+        if (mtu < ip_rt_min_pmtu) {
+                lock = true;
                 mtu = ip_rt_min_pmtu;
+        }
 
         if (rt->rt_pmtu == mtu &&
             time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2))
@@ -1028,7 +1036,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
         if (fib_lookup(dev_net(dst->dev), fl4, &res, 0) == 0) {
                 struct fib_nh *nh = &FIB_RES_NH(res);
 
-                update_or_create_fnhe(nh, fl4->daddr, 0, mtu,
+                update_or_create_fnhe(nh, fl4->daddr, 0, mtu, lock,
                                       jiffies + ip_rt_mtu_expires);
         }
         rcu_read_unlock();
@@ -1281,7 +1289,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
 
         mtu = READ_ONCE(dst->dev->mtu);
 
-        if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
+        if (unlikely(ip_mtu_locked(dst))) {
                 if (rt->rt_uses_gateway && mtu > 576)
                         mtu = 576;
         }
@@ -1394,7 +1402,7 @@ struct uncached_list {
 
 static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt_uncached_list);
 
-static void rt_add_uncached_list(struct rtable *rt)
+void rt_add_uncached_list(struct rtable *rt)
 {
         struct uncached_list *ul = raw_cpu_ptr(&rt_uncached_list);
 
@@ -1405,14 +1413,8 @@ static void rt_add_uncached_list(struct rtable *rt)
         spin_unlock_bh(&ul->lock);
 }
 
-static void ipv4_dst_destroy(struct dst_entry *dst)
+void rt_del_uncached_list(struct rtable *rt)
 {
-        struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);
-        struct rtable *rt = (struct rtable *) dst;
-
-        if (p != &dst_default_metrics && refcount_dec_and_test(&p->refcnt))
-                kfree(p);
-
         if (!list_empty(&rt->rt_uncached)) {
                 struct uncached_list *ul = rt->rt_uncached_list;
 
@@ -1422,6 +1424,17 @@ static void ipv4_dst_destroy(struct dst_entry *dst)
         }
 }
 
+static void ipv4_dst_destroy(struct dst_entry *dst)
+{
+        struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);
+        struct rtable *rt = (struct rtable *)dst;
+
+        if (p != &dst_default_metrics && refcount_dec_and_test(&p->refcnt))
+                kfree(p);
+
+        rt_del_uncached_list(rt);
+}
+
 void rt_flush_dev(struct net_device *dev)
 {
         struct net *net = dev_net(dev);
@@ -1517,6 +1530,7 @@ struct rtable *rt_dst_alloc(struct net_device *dev,
                 rt->rt_is_input = 0;
                 rt->rt_iif = 0;
                 rt->rt_pmtu = 0;
+                rt->rt_mtu_locked = 0;
                 rt->rt_gateway = 0;
                 rt->rt_uses_gateway = 0;
                 INIT_LIST_HEAD(&rt->rt_uncached);
@@ -2533,6 +2547,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
                 rt->rt_is_input = ort->rt_is_input;
                 rt->rt_iif = ort->rt_iif;
                 rt->rt_pmtu = ort->rt_pmtu;
+                rt->rt_mtu_locked = ort->rt_mtu_locked;
 
                 rt->rt_genid = rt_genid_ipv4(net);
                 rt->rt_flags = ort->rt_flags;
@@ -2635,6 +2650,8 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src, u32 table_id,
         memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
         if (rt->rt_pmtu && expires)
                 metrics[RTAX_MTU - 1] = rt->rt_pmtu;
+        if (rt->rt_mtu_locked && expires)
+                metrics[RTAX_LOCK - 1] |= BIT(RTAX_MTU);
         if (rtnetlink_put_metrics(skb, metrics) < 0)
                 goto nla_put_failure;
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index d763fae1b574..0c31be306572 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3545,6 +3545,7 @@ int tcp_abort(struct sock *sk, int err)
 
         bh_unlock_sock(sk);
         local_bh_enable();
+        tcp_write_queue_purge(sk);
         release_sock(sk);
         return 0;
 }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 71fc60f1b326..f7d944855f8e 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -34,6 +34,7 @@ static void tcp_write_err(struct sock *sk)
         sk->sk_err = sk->sk_err_soft ? : ETIMEDOUT;
         sk->sk_error_report(sk);
 
+        tcp_write_queue_purge(sk);
         tcp_done(sk);
         __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONTIMEOUT);
 }
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 63faeee989a9..2a9764bd1719 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -92,7 +92,8 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_reset_network_header(skb);
         skb_mac_header_rebuild(skb);
-        eth_hdr(skb)->h_proto = skb->protocol;
+        if (skb->mac_len)
+                eth_hdr(skb)->h_proto = skb->protocol;
 
         err = 0;
 
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 0c752dc3f93b..6c76a757fa4a 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -100,7 +100,9 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         xdst->u.rt.rt_gateway = rt->rt_gateway;
         xdst->u.rt.rt_uses_gateway = rt->rt_uses_gateway;
         xdst->u.rt.rt_pmtu = rt->rt_pmtu;
+        xdst->u.rt.rt_mtu_locked = rt->rt_mtu_locked;
         INIT_LIST_HEAD(&xdst->u.rt.rt_uncached);
+        rt_add_uncached_list(&xdst->u.rt);
 
         return 0;
 }
@@ -240,7 +242,8 @@ static void xfrm4_dst_destroy(struct dst_entry *dst)
         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
 
         dst_destroy_metrics_generic(dst);
-
+        if (xdst->u.rt.rt_uncached_list)
+                rt_del_uncached_list(&xdst->u.rt);
         xfrm_dst_destroy(xdst);
 }
 
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index b27333d7b099..88bc2ef7c7a8 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -146,10 +146,12 @@ int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr,
         struct sockaddr_in6     *usin = (struct sockaddr_in6 *) uaddr;
         struct inet_sock        *inet = inet_sk(sk);
         struct ipv6_pinfo       *np = inet6_sk(sk);
-        struct in6_addr         *daddr;
+        struct in6_addr         *daddr, old_daddr;
+        __be32                  fl6_flowlabel = 0;
+        __be32                  old_fl6_flowlabel;
+        __be16                  old_dport;
         int                     addr_type;
         int                     err;
-        __be32                  fl6_flowlabel = 0;
 
         if (usin->sin6_family == AF_INET) {
                 if (__ipv6_only_sock(sk))
@@ -238,9 +240,13 @@ ipv4_connected:
                 }
         }
 
+        /* save the current peer information before updating it */
+        old_daddr = sk->sk_v6_daddr;
+        old_fl6_flowlabel = np->flow_label;
+        old_dport = inet->inet_dport;
+
         sk->sk_v6_daddr = *daddr;
         np->flow_label = fl6_flowlabel;
-
         inet->inet_dport = usin->sin6_port;
 
         /*
@@ -250,11 +256,12 @@ ipv4_connected:
 
         err = ip6_datagram_dst_update(sk, true);
         if (err) {
-                /* Reset daddr and dport so that udp_v6_early_demux()
-                 * fails to find this socket
+                /* Restore the socket peer info, to keep it consistent with
+                 * the old socket state
                  */
-                memset(&sk->sk_v6_daddr, 0, sizeof(sk->sk_v6_daddr));
-                inet->inet_dport = 0;
+                sk->sk_v6_daddr = old_daddr;
+                np->flow_label = old_fl6_flowlabel;
+                inet->inet_dport = old_dport;
                 goto out;
         }
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 6adbcf40cf8c..3a98c694da5f 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -126,7 +126,8 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
         struct ip6_tnl *t, *cand = NULL;
         struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
         int dev_type = (gre_proto == htons(ETH_P_TEB) ||
-                        gre_proto == htons(ETH_P_ERSPAN)) ?
+                        gre_proto == htons(ETH_P_ERSPAN) ||
+                        gre_proto == htons(ETH_P_ERSPAN2)) ?
                        ARPHRD_ETHER : ARPHRD_IP6GRE;
         int score, cand_score = 4;
 
@@ -905,6 +906,9 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                 truncate = true;
         }
 
+        if (skb_cow_head(skb, dev->needed_headroom))
+                goto tx_err;
+
         t->parms.o_flags &= ~TUNNEL_KEY;
         IPCB(skb)->flags = 0;
 
@@ -947,6 +951,8 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                                                md->u.md2.dir,
                                                get_hwid(&md->u.md2),
                                                truncate, false);
+                } else {
+                        goto tx_err;
                 }
         } else {
                 switch (skb->protocol) {
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 10024eb0c521..d1d0b2fa7a07 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1554,7 +1554,8 @@ static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
         *(opt++) = (rd_len >> 3);
         opt += 6;
 
-        memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
+        skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
+                      rd_len - 8);
 }
 
 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 939d122e71b4..a2ed9fdd58d4 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -128,7 +128,7 @@ struct uncached_list {
 
 static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt6_uncached_list);
 
-static void rt6_uncached_list_add(struct rt6_info *rt)
+void rt6_uncached_list_add(struct rt6_info *rt)
 {
         struct uncached_list *ul = raw_cpu_ptr(&rt6_uncached_list);
 
@@ -139,7 +139,7 @@ static void rt6_uncached_list_add(struct rt6_info *rt)
         spin_unlock_bh(&ul->lock);
 }
 
-static void rt6_uncached_list_del(struct rt6_info *rt)
+void rt6_uncached_list_del(struct rt6_info *rt)
 {
         if (!list_empty(&rt->rt6i_uncached)) {
                 struct uncached_list *ul = rt->rt6i_uncached_list;
@@ -1514,7 +1514,30 @@ static void rt6_exceptions_remove_prefsrc(struct rt6_info *rt)
         }
 }
 
-static void rt6_exceptions_update_pmtu(struct rt6_info *rt, int mtu)
+static bool rt6_mtu_change_route_allowed(struct inet6_dev *idev,
+                                         struct rt6_info *rt, int mtu)
+{
+        /* If the new MTU is lower than the route PMTU, this new MTU will be the
+         * lowest MTU in the path: always allow updating the route PMTU to
+         * reflect PMTU decreases.
+         *
+         * If the new MTU is higher, and the route PMTU is equal to the local
+         * MTU, this means the old MTU is the lowest in the path, so allow
+         * updating it: if other nodes now have lower MTUs, PMTU discovery will
+         * handle this.
+         */
+
+        if (dst_mtu(&rt->dst) >= mtu)
+                return true;
+
+        if (dst_mtu(&rt->dst) == idev->cnf.mtu6)
+                return true;
+
+        return false;
+}
+
+static void rt6_exceptions_update_pmtu(struct inet6_dev *idev,
+                                       struct rt6_info *rt, int mtu)
 {
         struct rt6_exception_bucket *bucket;
         struct rt6_exception *rt6_ex;
@@ -1523,20 +1546,22 @@ static void rt6_exceptions_update_pmtu(struct rt6_info *rt, int mtu)
         bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
                                         lockdep_is_held(&rt6_exception_lock));
 
-        if (bucket) {
-                for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
-                        hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
-                                struct rt6_info *entry = rt6_ex->rt6i;
-                                /* For RTF_CACHE with rt6i_pmtu == 0
-                                 * (i.e. a redirected route),
-                                 * the metrics of its rt->dst.from has already
-                                 * been updated.
-                                 */
-                                if (entry->rt6i_pmtu && entry->rt6i_pmtu > mtu)
-                                        entry->rt6i_pmtu = mtu;
-                        }
-                        bucket++;
+        if (!bucket)
+                return;
+
+        for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
+                hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
+                        struct rt6_info *entry = rt6_ex->rt6i;
+
+                        /* For RTF_CACHE with rt6i_pmtu == 0 (i.e. a redirected
+                         * route), the metrics of its rt->dst.from have already
+                         * been updated.
+                         */
+                        if (entry->rt6i_pmtu &&
+                            rt6_mtu_change_route_allowed(idev, entry, mtu))
+                                entry->rt6i_pmtu = mtu;
                 }
+                bucket++;
         }
 }
 
@@ -3899,25 +3924,13 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
            Since RFC 1981 doesn't include administrative MTU increase
            update PMTU increase is a MUST. (i.e. jumbo frame)
          */
-        /*
-           If new MTU is less than route PMTU, this new MTU will be the
-           lowest MTU in the path, update the route PMTU to reflect PMTU
-           decreases; if new MTU is greater than route PMTU, and the
-           old MTU is the lowest MTU in the path, update the route PMTU
-           to reflect the increase. In this case if the other nodes' MTU
-           also have the lowest MTU, TOO BIG MESSAGE will be lead to
-           PMTU discovery.
-         */
         if (rt->dst.dev == arg->dev &&
-            dst_metric_raw(&rt->dst, RTAX_MTU) &&
             !dst_metric_locked(&rt->dst, RTAX_MTU)) {
                 spin_lock_bh(&rt6_exception_lock);
-                if (dst_mtu(&rt->dst) >= arg->mtu ||
-                    (dst_mtu(&rt->dst) < arg->mtu &&
-                     dst_mtu(&rt->dst) == idev->cnf.mtu6)) {
+                if (dst_metric_raw(&rt->dst, RTAX_MTU) &&
+                    rt6_mtu_change_route_allowed(idev, rt, arg->mtu))
                         dst_metric_set(&rt->dst, RTAX_MTU, arg->mtu);
-                }
-                rt6_exceptions_update_pmtu(rt, arg->mtu);
+                rt6_exceptions_update_pmtu(idev, rt, arg->mtu);
                 spin_unlock_bh(&rt6_exception_lock);
         }
         return 0;
@@ -4189,6 +4202,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
                                 r_cfg.fc_encap_type = nla_get_u16(nla);
                 }
 
+                r_cfg.fc_flags |= (rtnh->rtnh_flags & RTNH_F_ONLINK);
                 rt = ip6_route_info_create(&r_cfg, extack);
                 if (IS_ERR(rt)) {
                         err = PTR_ERR(rt);
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index bd6cc688bd19..7a78dcfda68a 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -93,7 +93,8 @@ static void set_tun_src(struct net *net, struct net_device *dev,
 /* encapsulate an IPv6 packet within an outer IPv6 header with a given SRH */
 int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
 {
-        struct net *net = dev_net(skb_dst(skb)->dev);
+        struct dst_entry *dst = skb_dst(skb);
+        struct net *net = dev_net(dst->dev);
         struct ipv6hdr *hdr, *inner_hdr;
         struct ipv6_sr_hdr *isrh;
         int hdrlen, tot_len, err;
@@ -134,7 +135,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
         isrh->nexthdr = proto;
 
         hdr->daddr = isrh->segments[isrh->first_segment];
-        set_tun_src(net, skb->dev, &hdr->daddr, &hdr->saddr);
+        set_tun_src(net, ip6_dst_idev(dst)->dev, &hdr->daddr, &hdr->saddr);
 
 #ifdef CONFIG_IPV6_SEG6_HMAC
         if (sr_has_hmac(isrh)) {
@@ -418,7 +419,7 @@ static int seg6_build_state(struct nlattr *nla,
 
         slwt = seg6_lwt_lwtunnel(newts);
 
-        err = dst_cache_init(&slwt->cache, GFP_KERNEL);
+        err = dst_cache_init(&slwt->cache, GFP_ATOMIC);
         if (err) {
                 kfree(newts);
                 return err;
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index bb935a3b7fea..de1b0b8c53b0 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -92,7 +92,8 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_reset_network_header(skb);
         skb_mac_header_rebuild(skb);
-        eth_hdr(skb)->h_proto = skb->protocol;
+        if (skb->mac_len)
+                eth_hdr(skb)->h_proto = skb->protocol;
 
         err = 0;
 
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 88cd0c90fa81..cbb270bd81b0 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -113,6 +113,9 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway;
         xdst->u.rt6.rt6i_dst = rt->rt6i_dst;
         xdst->u.rt6.rt6i_src = rt->rt6i_src;
+        INIT_LIST_HEAD(&xdst->u.rt6.rt6i_uncached);
+        rt6_uncached_list_add(&xdst->u.rt6);
+        atomic_inc(&dev_net(dev)->ipv6.rt6_stats->fib_rt_uncache);
 
         return 0;
 }
@@ -244,6 +247,8 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
         if (likely(xdst->u.rt6.rt6i_idev))
                 in6_dev_put(xdst->u.rt6.rt6i_idev);
         dst_destroy_metrics_generic(dst);
+        if (xdst->u.rt6.rt6i_uncached_list)
+                rt6_uncached_list_del(&xdst->u.rt6);
         xfrm_dst_destroy(xdst);
 }
 
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 81ce15ffb878..893a022f9620 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -2432,9 +2432,11 @@ static int afiucv_iucv_init(void)
         af_iucv_dev->driver = &af_iucv_driver;
         err = device_register(af_iucv_dev);
         if (err)
-                goto out_driver;
+                goto out_iucv_dev;
         return 0;
 
+out_iucv_dev:
+        put_device(af_iucv_dev);
 out_driver:
         driver_unregister(&af_iucv_driver);
 out_iucv:
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index a6cd0712e063..516cfad71b85 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1381,24 +1381,32 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
                 .parse_msg = kcm_parse_func_strparser,
                 .read_sock_done = kcm_read_sock_done,
         };
-        int err;
+        int err = 0;
 
         csk = csock->sk;
         if (!csk)
                 return -EINVAL;
 
+        lock_sock(csk);
+
         /* Only allow TCP sockets to be attached for now */
         if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) ||
-            csk->sk_protocol != IPPROTO_TCP)
-                return -EOPNOTSUPP;
+            csk->sk_protocol != IPPROTO_TCP) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
 
         /* Don't allow listeners or closed sockets */
-        if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE)
-                return -EOPNOTSUPP;
+        if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
 
         psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL);
-        if (!psock)
-                return -ENOMEM;
+        if (!psock) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         psock->mux = mux;
         psock->sk = csk;
@@ -1407,7 +1415,7 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
         err = strp_init(&psock->strp, csk, &cb);
         if (err) {
                 kmem_cache_free(kcm_psockp, psock);
-                return err;
+                goto out;
         }
 
         write_lock_bh(&csk->sk_callback_lock);
@@ -1420,7 +1428,8 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
                 strp_stop(&psock->strp);
                 strp_done(&psock->strp);
                 kmem_cache_free(kcm_psockp, psock);
-                return -EALREADY;
+                err = -EALREADY;
+                goto out;
         }
 
         psock->save_data_ready = csk->sk_data_ready;
@@ -1456,7 +1465,10 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
         /* Schedule RX work in case there are already bytes queued */
         strp_check_rcv(&psock->strp);
 
-        return 0;
+out:
+        release_sock(csk);
+
+        return err;
 }
 
 static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info)
@@ -1508,6 +1520,7 @@ static void kcm_unattach(struct kcm_psock *psock)
 
         if (WARN_ON(psock->rx_kcm)) {
                 write_unlock_bh(&csk->sk_callback_lock);
+                release_sock(csk);
                 return;
         }
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 189a12a5e4ac..b86868da50d4 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -111,6 +111,13 @@ struct l2tp_net {
         spinlock_t l2tp_session_hlist_lock;
 };
 
+#if IS_ENABLED(CONFIG_IPV6)
+static bool l2tp_sk_is_v6(struct sock *sk)
+{
+        return sk->sk_family == PF_INET6 &&
+               !ipv6_addr_v4mapped(&sk->sk_v6_daddr);
+}
+#endif
 
 static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
 {
@@ -1049,7 +1056,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
         /* Queue the packet to IP for output */
         skb->ignore_df = 1;
 #if IS_ENABLED(CONFIG_IPV6)
-        if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped)
+        if (l2tp_sk_is_v6(tunnel->sock))
                 error = inet6_csk_xmit(tunnel->sock, skb, NULL);
         else
 #endif
@@ -1112,6 +1119,15 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
                 goto out_unlock;
         }
 
+        /* The user-space may change the connection status for the user-space
+         * provided socket at run time: we must check it under the socket lock
+         */
+        if (tunnel->fd >= 0 && sk->sk_state != TCP_ESTABLISHED) {
+                kfree_skb(skb);
+                ret = NET_XMIT_DROP;
+                goto out_unlock;
+        }
+
         /* Get routing info from the tunnel socket */
         skb_dst_drop(skb);
         skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
@@ -1131,7 +1147,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
 
                 /* Calculate UDP checksum if configured to do so */
 #if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
+                if (l2tp_sk_is_v6(sk))
                         udp6_set_csum(udp_get_no_check6_tx(sk),
                                       skb, &inet6_sk(sk)->saddr,
                                       &sk->sk_v6_daddr, udp_len);
@@ -1457,9 +1473,14 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                 encap = cfg->encap;
 
         /* Quick sanity checks */
+        err = -EPROTONOSUPPORT;
+        if (sk->sk_type != SOCK_DGRAM) {
+                pr_debug("tunl %hu: fd %d wrong socket type\n",
+                         tunnel_id, fd);
+                goto err;
+        }
         switch (encap) {
         case L2TP_ENCAPTYPE_UDP:
-                err = -EPROTONOSUPPORT;
                 if (sk->sk_protocol != IPPROTO_UDP) {
                         pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
                                tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
@@ -1467,7 +1488,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                 }
                 break;
         case L2TP_ENCAPTYPE_IP:
-                err = -EPROTONOSUPPORT;
                 if (sk->sk_protocol != IPPROTO_L2TP) {
                         pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
                                tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
@@ -1507,24 +1527,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         if (cfg != NULL)
                 tunnel->debug = cfg->debug;
 
-#if IS_ENABLED(CONFIG_IPV6)
-        if (sk->sk_family == PF_INET6) {
-                struct ipv6_pinfo *np = inet6_sk(sk);
-
-                if (ipv6_addr_v4mapped(&np->saddr) &&
-                    ipv6_addr_v4mapped(&sk->sk_v6_daddr)) {
-                        struct inet_sock *inet = inet_sk(sk);
-
-                        tunnel->v4mapped = true;
-                        inet->inet_saddr = np->saddr.s6_addr32[3];
-                        inet->inet_rcv_saddr = sk->sk_v6_rcv_saddr.s6_addr32[3];
-                        inet->inet_daddr = sk->sk_v6_daddr.s6_addr32[3];
-                } else {
-                        tunnel->v4mapped = false;
-                }
-        }
-#endif
-
         /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
         tunnel->encap = encap;
         if (encap == L2TP_ENCAPTYPE_UDP) {
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index a1aa9550f04e..2718d0b284d0 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -188,9 +188,6 @@ struct l2tp_tunnel {
         struct sock             *sock;          /* Parent socket */
         int                     fd;             /* Parent fd, if tunnel socket
                                                  * was created by userspace */
-#if IS_ENABLED(CONFIG_IPV6)
-        bool                    v4mapped;
-#endif
 
         struct work_struct      del_work;
 
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index a75653affbf7..b5adf3625d16 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -213,6 +213,7 @@ static const char *hw_flag_names[] = {
         FLAG(SUPPORTS_TX_FRAG),
         FLAG(SUPPORTS_TDLS_BUFFER_STA),
         FLAG(DEAUTH_NEED_MGD_TX_PREP),
+        FLAG(DOESNT_SUPPORT_QOS_NDP),
 #undef FLAG
 };
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0024eff9bb84..fe4aefb06d9f 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -897,7 +897,8 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
         struct ieee80211_hdr_3addr *nullfunc;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif, true);
+        skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
+                !ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
         if (!skb)
                 return;
 
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 8e19c86d1aa6..fd13d28e4ca7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5423,6 +5423,7 @@ err:
 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
 {
         cancel_delayed_work_sync(&flowtable->data.gc_work);
+        kfree(flowtable->ops);
         kfree(flowtable->name);
         flowtable->data.type->free(&flowtable->data);
         rhashtable_destroy(&flowtable->data.rhashtable);
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 3f1624ee056f..d40591fe1b2f 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -674,7 +674,7 @@ static const struct nft_set_ops *
 nft_hash_select_ops(const struct nft_ctx *ctx, const struct nft_set_desc *desc,
                     u32 flags)
 {
-        if (desc->size) {
+        if (desc->size && !(flags & NFT_SET_TIMEOUT)) {
                 switch (desc->klen) {
                 case 4:
                         return &nft_hash_fast_ops;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index d9deebe599ec..6de1f6a4cb80 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -423,6 +423,36 @@ textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto)
         return buf;
 }
 
+/**
+ * xt_check_proc_name - check that name is suitable for /proc file creation
+ *
+ * @name: file name candidate
+ * @size: length of buffer
+ *
+ * some x_tables modules wish to create a file in /proc.
+ * This function makes sure that the name is suitable for this
+ * purpose, it checks that name is NUL terminated and isn't a 'special'
+ * name, like "..".
+ *
+ * returns negative number on error or 0 if name is useable.
+ */
+int xt_check_proc_name(const char *name, unsigned int size)
+{
+        if (name[0] == '\0')
+                return -EINVAL;
+
+        if (strnlen(name, size) == size)
+                return -ENAMETOOLONG;
+
+        if (strcmp(name, ".") == 0 ||
+            strcmp(name, "..") == 0 ||
+            strchr(name, '/'))
+                return -EINVAL;
+
+        return 0;
+}
+EXPORT_SYMBOL(xt_check_proc_name);
+
 int xt_check_match(struct xt_mtchk_param *par,
                    unsigned int size, u_int8_t proto, bool inv_proto)
 {
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index db2fe0911740..ef65b7a9173e 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -917,8 +917,9 @@ static int hashlimit_mt_check_v1(const struct xt_mtchk_param *par)
         struct hashlimit_cfg3 cfg = {};
         int ret;
 
-        if (info->name[sizeof(info->name) - 1] != '\0')
-                return -EINVAL;
+        ret = xt_check_proc_name(info->name, sizeof(info->name));
+        if (ret)
+                return ret;
 
         ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
 
@@ -935,8 +936,9 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
         struct hashlimit_cfg3 cfg = {};
         int ret;
 
-        if (info->name[sizeof(info->name) - 1] != '\0')
-                return -EINVAL;
+        ret = xt_check_proc_name(info->name, sizeof(info->name));
+        if (ret)
+                return ret;
 
         ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
 
@@ -950,9 +952,11 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
 static int hashlimit_mt_check(const struct xt_mtchk_param *par)
 {
         struct xt_hashlimit_mtinfo3 *info = par->matchinfo;
+        int ret;
 
-        if (info->name[sizeof(info->name) - 1] != '\0')
-                return -EINVAL;
+        ret = xt_check_proc_name(info->name, sizeof(info->name));
+        if (ret)
+                return ret;
 
         return hashlimit_mt_check_common(par, &info->hinfo, &info->cfg,
                                          info->name, 3);
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 19efdb757944..486dd24da78b 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -361,9 +361,9 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
                                     info->hit_count, XT_RECENT_MAX_NSTAMPS - 1);
                 return -EINVAL;
         }
-        if (info->name[0] == '\0' ||
-            strnlen(info->name, XT_RECENT_NAME_LEN) == XT_RECENT_NAME_LEN)
-                return -EINVAL;
+        ret = xt_check_proc_name(info->name, sizeof(info->name));
+        if (ret)
+                return ret;
 
         if (ip_pkt_list_tot && info->hit_count < ip_pkt_list_tot)
                 nstamp_mask = roundup_pow_of_two(ip_pkt_list_tot) - 1;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index a6f63a5faee7..af51b8c0a2cb 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1107,7 +1107,7 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
         if (!err)
                 delivered = true;
         else if (err != -ESRCH)
-                goto error;
+                return err;
         return delivered ? 0 : -ESRCH;
  error:
         kfree_skb(skb);
diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c
index 04b94281a30b..b891a91577f8 100644
--- a/net/openvswitch/meter.c
+++ b/net/openvswitch/meter.c
@@ -242,14 +242,20 @@ static struct dp_meter *dp_meter_create(struct nlattr **a)
 
                 band->type = nla_get_u32(attr[OVS_BAND_ATTR_TYPE]);
                 band->rate = nla_get_u32(attr[OVS_BAND_ATTR_RATE]);
+                if (band->rate == 0) {
+                        err = -EINVAL;
+                        goto exit_free_meter;
+                }
+
                 band->burst_size = nla_get_u32(attr[OVS_BAND_ATTR_BURST]);
                 /* Figure out max delta_t that is enough to fill any bucket.
                  * Keep max_delta_t size to the bucket units:
                  * pkts => 1/1000 packets, kilobits => bits.
+                 *
+                 * Start with a full bucket.
                  */
-                band_max_delta_t = (band->burst_size + band->rate) * 1000;
-                /* Start with a full bucket. */
-                band->bucket = band_max_delta_t;
+                band->bucket = (band->burst_size + band->rate) * 1000;
+                band_max_delta_t = band->bucket / band->rate;
                 if (band_max_delta_t > meter->max_delta_t)
                         meter->max_delta_t = band_max_delta_t;
                 band++;
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index da72e0cf2b1f..5cb9b268e8ff 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -352,7 +352,7 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
         return res;
 out:
         if (res == ACT_P_CREATED)
-                tcf_idr_cleanup(*act, est);
+                tcf_idr_release(*act, bind);
 
         return ret;
 }
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 1fb1f1f6a555..a527e287c086 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -350,7 +350,7 @@ static int tcf_csum_sctp(struct sk_buff *skb, unsigned int ihl,
 {
         struct sctphdr *sctph;
 
-        if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_SCTP)
+        if (skb_is_gso(skb) && skb_is_gso_sctp(skb))
                 return 1;
 
         sctph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*sctph));
@@ -626,7 +626,8 @@ static void tcf_csum_cleanup(struct tc_action *a)
         struct tcf_csum_params *params;
 
         params = rcu_dereference_protected(p->params, 1);
-        kfree_rcu(params, rcu);
+        if (params)
+                kfree_rcu(params, rcu);
 }
 
 static int tcf_csum_walker(struct net *net, struct sk_buff *skb,
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 10866717f88e..b5e8565b89c7 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -80,9 +80,12 @@ static void ipt_destroy_target(struct xt_entry_target *t)
 static void tcf_ipt_release(struct tc_action *a)
 {
         struct tcf_ipt *ipt = to_ipt(a);
-        ipt_destroy_target(ipt->tcfi_t);
+
+        if (ipt->tcfi_t) {
+                ipt_destroy_target(ipt->tcfi_t);
+                kfree(ipt->tcfi_t);
+        }
         kfree(ipt->tcfi_tname);
-        kfree(ipt->tcfi_t);
 }
 
 static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = {
@@ -187,7 +190,7 @@ err2:
         kfree(tname);
 err1:
         if (ret == ACT_P_CREATED)
-                tcf_idr_cleanup(*a, est);
+                tcf_idr_release(*a, bind);
         return err;
 }
 
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 5e8cc8f63acd..f392ccaaa0d8 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -176,7 +176,7 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
                 p = to_pedit(*a);
                 keys = kmalloc(ksize, GFP_KERNEL);
                 if (keys == NULL) {
-                        tcf_idr_cleanup(*a, est);
+                        tcf_idr_release(*a, bind);
                         kfree(keys_ex);
                         return -ENOMEM;
                 }
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 51fe4fe343f7..7081ec75e696 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -196,7 +196,7 @@ failure:
         qdisc_put_rtab(P_tab);
         qdisc_put_rtab(R_tab);
         if (ret == ACT_P_CREATED)
-                tcf_idr_cleanup(*a, est);
+                tcf_idr_release(*a, bind);
         return err;
 }
 
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 238dfd27e995..3a89f98f17e6 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -103,7 +103,8 @@ static void tcf_sample_cleanup(struct tc_action *a)
 
         psample_group = rtnl_dereference(s->psample_group);
         RCU_INIT_POINTER(s->psample_group, NULL);
-        psample_group_put(psample_group);
+        if (psample_group)
+                psample_group_put(psample_group);
 }
 
 static bool tcf_sample_dev_ok_push(struct net_device *dev)
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 91816d73f3f3..e84768ae610a 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -121,7 +121,7 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
                 d = to_defact(*a);
                 ret = alloc_defdata(d, defdata);
                 if (ret < 0) {
-                        tcf_idr_cleanup(*a, est);
+                        tcf_idr_release(*a, bind);
                         return ret;
                 }
                 d->tcf_action = parm->action;
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index febec75f4f7a..142a996ac776 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -152,7 +152,7 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
         ASSERT_RTNL();
         p = kzalloc(sizeof(struct tcf_skbmod_params), GFP_KERNEL);
         if (unlikely(!p)) {
-                if (ovr)
+                if (ret == ACT_P_CREATED)
                         tcf_idr_release(*a, bind);
                 return -ENOMEM;
         }
@@ -190,7 +190,8 @@ static void tcf_skbmod_cleanup(struct tc_action *a)
         struct tcf_skbmod_params  *p;
 
         p = rcu_dereference_protected(d->skbmod_p, 1);
-        kfree_rcu(p, rcu);
+        if (p)
+                kfree_rcu(p, rcu);
 }
 
 static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a,
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 9169b7e78ada..a1c8dd406a04 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -153,6 +153,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
                 metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX;
                 break;
         default:
+                ret = -EINVAL;
                 goto err_out;
         }
 
@@ -207,11 +208,12 @@ static void tunnel_key_release(struct tc_action *a)
         struct tcf_tunnel_key_params *params;
 
         params = rcu_dereference_protected(t->params, 1);
+        if (params) {
+                if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
+                        dst_release(&params->tcft_enc_metadata->dst);
 
-        if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
-                dst_release(&params->tcft_enc_metadata->dst);
-
-        kfree_rcu(params, rcu);
+                kfree_rcu(params, rcu);
+        }
 }
 
 static int tunnel_key_dump_addresses(struct sk_buff *skb,
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index c2ee7fd51cc9..4595391c2129 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -195,7 +195,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
         ASSERT_RTNL();
         p = kzalloc(sizeof(*p), GFP_KERNEL);
         if (!p) {
-                if (ovr)
+                if (ret == ACT_P_CREATED)
                         tcf_idr_release(*a, bind);
                 return -ENOMEM;
         }
@@ -225,7 +225,8 @@ static void tcf_vlan_cleanup(struct tc_action *a)
         struct tcf_vlan_params *p;
 
         p = rcu_dereference_protected(v->vlan_p, 1);
-        kfree_rcu(p, rcu);
+        if (p)
+                kfree_rcu(p, rcu);
 }
 
 static int tcf_vlan_dump(struct sk_buff *skb, struct tc_action *a,
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 190570f21b20..7e3fbe9cc936 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -106,6 +106,14 @@ static inline void qdisc_enqueue_skb_bad_txq(struct Qdisc *q,
 
         __skb_queue_tail(&q->skb_bad_txq, skb);
 
+        if (qdisc_is_percpu_stats(q)) {
+                qdisc_qstats_cpu_backlog_inc(q, skb);
+                qdisc_qstats_cpu_qlen_inc(q);
+        } else {
+                qdisc_qstats_backlog_inc(q, skb);
+                q->q.qlen++;
+        }
+
         if (lock)
                 spin_unlock(lock);
 }
@@ -196,14 +204,6 @@ static void try_bulk_dequeue_skb_slow(struct Qdisc *q,
                         break;
                 if (unlikely(skb_get_queue_mapping(nskb) != mapping)) {
                         qdisc_enqueue_skb_bad_txq(q, nskb);
-
-                        if (qdisc_is_percpu_stats(q)) {
-                                qdisc_qstats_cpu_backlog_inc(q, nskb);
-                                qdisc_qstats_cpu_qlen_inc(q);
-                        } else {
-                                qdisc_qstats_backlog_inc(q, nskb);
-                                q->q.qlen++;
-                        }
                         break;
                 }
                 skb->next = nskb;
@@ -628,6 +628,7 @@ static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc *qdisc,
         int band = prio2band[skb->priority & TC_PRIO_MAX];
         struct pfifo_fast_priv *priv = qdisc_priv(qdisc);
         struct skb_array *q = band2list(priv, band);
+        unsigned int pkt_len = qdisc_pkt_len(skb);
         int err;
 
         err = skb_array_produce(q, skb);
@@ -636,7 +637,10 @@ static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc *qdisc,
                 return qdisc_drop_cpu(skb, qdisc, to_free);
 
         qdisc_qstats_cpu_qlen_inc(qdisc);
-        qdisc_qstats_cpu_backlog_inc(qdisc, skb);
+        /* Note: skb can not be used after skb_array_produce(),
+         * so we better not use qdisc_qstats_cpu_backlog_inc()
+         */
+        this_cpu_add(qdisc->cpu_qstats->backlog, pkt_len);
         return NET_XMIT_SUCCESS;
 }
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 7c179addebcd..7d6801fc5340 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -509,7 +509,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
         }
 
         if (unlikely(sch->q.qlen >= sch->limit))
-                return qdisc_drop(skb, sch, to_free);
+                return qdisc_drop_all(skb, sch, to_free);
 
         qdisc_qstats_backlog_inc(sch, skb);
 
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 0247cc432e02..b381d78548ac 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -106,6 +106,7 @@ int sctp_rcv(struct sk_buff *skb)
         int family;
         struct sctp_af *af;
         struct net *net = dev_net(skb->dev);
+        bool is_gso = skb_is_gso(skb) && skb_is_gso_sctp(skb);
 
         if (skb->pkt_type != PACKET_HOST)
                 goto discard_it;
@@ -123,8 +124,7 @@ int sctp_rcv(struct sk_buff *skb)
          * it's better to just linearize it otherwise crc computing
          * takes longer.
          */
-        if ((!(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) &&
-             skb_linearize(skb)) ||
+        if ((!is_gso && skb_linearize(skb)) ||
             !pskb_may_pull(skb, sizeof(struct sctphdr)))
                 goto discard_it;
 
@@ -135,7 +135,7 @@ int sctp_rcv(struct sk_buff *skb)
         if (skb_csum_unnecessary(skb))
                 __skb_decr_checksum_unnecessary(skb);
         else if (!sctp_checksum_disable &&
-                 !(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) &&
+                 !is_gso &&
                  sctp_rcv_checksum(net, skb) < 0)
                 goto discard_it;
         skb->csum_valid = 1;
@@ -1218,7 +1218,7 @@ static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net,
          * issue as packets hitting this are mostly INIT or INIT-ACK and
          * those cannot be on GSO-style anyway.
          */
-        if ((skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) == SKB_GSO_SCTP)
+        if (skb_is_gso(skb) && skb_is_gso_sctp(skb))
                 return NULL;
 
         ch = (struct sctp_chunkhdr *)skb->data;
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 48392552ee7c..23ebc5318edc 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -170,7 +170,7 @@ next_chunk:
 
                 chunk = list_entry(entry, struct sctp_chunk, list);
 
-                if ((skb_shinfo(chunk->skb)->gso_type & SKB_GSO_SCTP) == SKB_GSO_SCTP) {
+                if (skb_is_gso(chunk->skb) && skb_is_gso_sctp(chunk->skb)) {
                         /* GSO-marked skbs but without frags, handle
                          * them normally
                          */
diff --git a/net/sctp/offload.c b/net/sctp/offload.c
index 35bc7106d182..123e9f2dc226 100644
--- a/net/sctp/offload.c
+++ b/net/sctp/offload.c
@@ -45,7 +45,7 @@ static struct sk_buff *sctp_gso_segment(struct sk_buff *skb,
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         struct sctphdr *sh;
 
-        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP))
+        if (!skb_is_gso_sctp(skb))
                 goto out;
 
         sh = sctp_hdr(skb);
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 86913eb5cfa0..5f8046c62d90 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -983,10 +983,6 @@ out:
                 lsmc->clcsock = NULL;
         }
         release_sock(lsk);
-        /* no more listening, wake up smc_close_wait_listen_clcsock and
-         * accept
-         */
-        lsk->sk_state_change(lsk);
         sock_put(&lsmc->sk); /* sock_hold in smc_listen */
 }
 
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index e339c0186dcf..fa41d9881741 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -30,27 +30,6 @@ static void smc_close_cleanup_listen(struct sock *parent)
                 smc_close_non_accepted(sk);
 }
 
-static void smc_close_wait_listen_clcsock(struct smc_sock *smc)
-{
-        DEFINE_WAIT_FUNC(wait, woken_wake_function);
-        struct sock *sk = &smc->sk;
-        signed long timeout;
-
-        timeout = SMC_CLOSE_WAIT_LISTEN_CLCSOCK_TIME;
-        add_wait_queue(sk_sleep(sk), &wait);
-        do {
-                release_sock(sk);
-                if (smc->clcsock)
-                        timeout = wait_woken(&wait, TASK_UNINTERRUPTIBLE,
-                                             timeout);
-                sched_annotate_sleep();
-                lock_sock(sk);
-                if (!smc->clcsock)
-                        break;
-        } while (timeout);
-        remove_wait_queue(sk_sleep(sk), &wait);
-}
-
 /* wait for sndbuf data being transmitted */
 static void smc_close_stream_wait(struct smc_sock *smc, long timeout)
 {
@@ -204,9 +183,11 @@ again:
                         rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR);
                         /* wake up kernel_accept of smc_tcp_listen_worker */
                         smc->clcsock->sk->sk_data_ready(smc->clcsock->sk);
-                        smc_close_wait_listen_clcsock(smc);
                 }
                 smc_close_cleanup_listen(sk);
+                release_sock(sk);
+                flush_work(&smc->tcp_listen_work);
+                lock_sock(sk);
                 break;
         case SMC_ACTIVE:
                 smc_close_stream_wait(smc, timeout);
diff --git a/net/socket.c b/net/socket.c
index d9a1ac233b35..3d1948d27a25 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2590,6 +2590,11 @@ void sock_unregister(int family)
 }
 EXPORT_SYMBOL(sock_unregister);
 
+bool sock_is_registered(int family)
+{
+        return family < NPROTO && rcu_access_pointer(net_families[family]);
+}
+
 static int __init sock_init(void)
 {
         int err;
diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
index ccfdc7115a83..a00ec715aa46 100644
--- a/net/xfrm/xfrm_ipcomp.c
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -283,7 +283,7 @@ static struct crypto_comp * __percpu *ipcomp_alloc_tfms(const char *alg_name)
                 struct crypto_comp *tfm;
 
                 /* This can be any valid CPU ID so we don't need locking. */
-                tfm = __this_cpu_read(*pos->tfms);
+                tfm = this_cpu_read(*pos->tfms);
 
                 if (!strcmp(crypto_comp_name(tfm), alg_name)) {
                         pos->users++;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 77d9d1ab05ce..cb3bb9ae4407 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1458,10 +1458,13 @@ xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, const struct flowi *fl,
 static int xfrm_get_tos(const struct flowi *fl, int family)
 {
         const struct xfrm_policy_afinfo *afinfo;
-        int tos = 0;
+        int tos;
 
         afinfo = xfrm_policy_get_afinfo(family);
-        tos = afinfo ? afinfo->get_tos(fl) : 0;
+        if (!afinfo)
+                return 0;
+
+        tos = afinfo->get_tos(fl);
 
         rcu_read_unlock();
 
@@ -1891,7 +1894,7 @@ static void xfrm_policy_queue_process(struct timer_list *t)
         spin_unlock(&pq->hold_queue.lock);
 
         dst_hold(xfrm_dst_path(dst));
-        dst = xfrm_lookup(net, xfrm_dst_path(dst), &fl, sk, 0);
+        dst = xfrm_lookup(net, xfrm_dst_path(dst), &fl, sk, XFRM_LOOKUP_QUEUE);
         if (IS_ERR(dst))
                 goto purge_queue;
 
@@ -2729,14 +2732,14 @@ static const void *xfrm_get_dst_nexthop(const struct dst_entry *dst,
         while (dst->xfrm) {
                 const struct xfrm_state *xfrm = dst->xfrm;
 
+                dst = xfrm_dst_child(dst);
+
                 if (xfrm->props.mode == XFRM_MODE_TRANSPORT)
                         continue;
                 if (xfrm->type->flags & XFRM_TYPE_REMOTE_COADDR)
                         daddr = xfrm->coaddr;
                 else if (!(xfrm->type->flags & XFRM_TYPE_LOCAL_COADDR))
                         daddr = &xfrm->id.daddr;
-
-                dst = xfrm_dst_child(dst);
         }
         return daddr;
 }
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 1d38c6acf8af..9e3a5e85f828 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -660,7 +660,7 @@ static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff
                 } else {
                         XFRM_SKB_CB(skb)->seq.output.low = oseq + 1;
                         XFRM_SKB_CB(skb)->seq.output.hi = oseq_hi;
-                        xo->seq.low = oseq = oseq + 1;
+                        xo->seq.low = oseq + 1;
                         xo->seq.hi = oseq_hi;
                         oseq += skb_shinfo(skb)->gso_segs;
                 }
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 54e21f19d722..f9d2f2233f09 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2056,6 +2056,11 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen
         struct xfrm_mgr *km;
         struct xfrm_policy *pol = NULL;
 
+#ifdef CONFIG_COMPAT
+        if (in_compat_syscall())
+                return -EOPNOTSUPP;
+#endif
+
         if (!optval && !optlen) {
                 xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL);
                 xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index aff2e84ec761..e92b8c019c88 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -121,22 +121,17 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
         struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
         struct xfrm_replay_state_esn *rs;
 
-        if (p->flags & XFRM_STATE_ESN) {
-                if (!rt)
-                        return -EINVAL;
+        if (!rt)
+                return (p->flags & XFRM_STATE_ESN) ? -EINVAL : 0;
 
-                rs = nla_data(rt);
+        rs = nla_data(rt);
 
-                if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
-                        return -EINVAL;
-
-                if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
-                    nla_len(rt) != sizeof(*rs))
-                        return -EINVAL;
-        }
+        if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
+                return -EINVAL;
 
-        if (!rt)
-                return 0;
+        if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
+            nla_len(rt) != sizeof(*rs))
+                return -EINVAL;
 
         /* As only ESP and AH support ESN feature. */
         if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH))