Merge branch 'linus' into locking/core, to pick up fixes

Signed-off-by: Ingo Molnar <mingo@kernel.org>

35 files changed, 192 insertions, 105 deletions

diff --git a/net/core/datagram.c b/net/core/datagram.c
index ee5647bd91b3..a21ca8dee5ea 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -169,14 +169,20 @@ struct sk_buff *__skb_try_recv_from_queue(struct sock *sk,
                                           int *peeked, int *off, int *err,
                                           struct sk_buff **last)
 {
+        bool peek_at_off = false;
         struct sk_buff *skb;
-        int _off = *off;
+        int _off = 0;
+
+        if (unlikely(flags & MSG_PEEK && *off >= 0)) {
+                peek_at_off = true;
+                _off = *off;
+        }
 
         *last = queue->prev;
         skb_queue_walk(queue, skb) {
                 if (flags & MSG_PEEK) {
-                        if (_off >= skb->len && (skb->len || _off ||
-                                                 skb->peeked)) {
+                        if (peek_at_off && _off >= skb->len &&
+                            (_off || skb->peeked)) {
                                 _off -= skb->len;
                                 continue;
                         }
diff --git a/net/core/filter.c b/net/core/filter.c
index f44fc22fd45a..6280a602604c 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3505,6 +3505,7 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
                                               bpf_target_off(struct sk_buff, tc_index, 2,
                                                              target_size));
 #else
+                *target_size = 2;
                 if (type == BPF_WRITE)
                         *insn++ = BPF_MOV64_REG(si->dst_reg, si->dst_reg);
                 else
@@ -3520,6 +3521,7 @@ static u32 bpf_convert_ctx_access(enum bpf_access_type type,
                 *insn++ = BPF_JMP_IMM(BPF_JGE, si->dst_reg, MIN_NAPI_ID, 1);
                 *insn++ = BPF_MOV64_IMM(si->dst_reg, 0);
 #else
+                *target_size = 4;
                 *insn++ = BPF_MOV64_IMM(si->dst_reg, 0);
 #endif
                 break;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 9fe25bf63296..b68168fcc06a 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -24,6 +24,7 @@
 #include <net/checksum.h>
 
 #include <net/inet_sock.h>
+#include <net/inet_common.h>
 #include <net/sock.h>
 #include <net/xfrm.h>
 
@@ -170,6 +171,15 @@ const char *dccp_packet_name(const int type)
 
 EXPORT_SYMBOL_GPL(dccp_packet_name);
 
+static void dccp_sk_destruct(struct sock *sk)
+{
+        struct dccp_sock *dp = dccp_sk(sk);
+
+        ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+        dp->dccps_hc_tx_ccid = NULL;
+        inet_sock_destruct(sk);
+}
+
 int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
 {
         struct dccp_sock *dp = dccp_sk(sk);
@@ -179,6 +189,7 @@ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
         icsk->icsk_syn_retries  = sysctl_dccp_request_retries;
         sk->sk_state            = DCCP_CLOSED;
         sk->sk_write_space      = dccp_write_space;
+        sk->sk_destruct         = dccp_sk_destruct;
         icsk->icsk_sync_mss     = dccp_sync_mss;
         dp->dccps_mss_cache     = 536;
         dp->dccps_rate_last     = jiffies;
@@ -201,10 +212,7 @@ void dccp_destroy_sock(struct sock *sk)
 {
         struct dccp_sock *dp = dccp_sk(sk);
 
-        /*
-         * DCCP doesn't use sk_write_queue, just sk_send_head
-         * for retransmissions
-         */
+        __skb_queue_purge(&sk->sk_write_queue);
         if (sk->sk_send_head != NULL) {
                 kfree_skb(sk->sk_send_head);
                 sk->sk_send_head = NULL;
@@ -222,8 +230,7 @@ void dccp_destroy_sock(struct sock *sk)
                 dp->dccps_hc_rx_ackvec = NULL;
         }
         ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
-        ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
-        dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
+        dp->dccps_hc_rx_ccid = NULL;
 
         /* clean up feature negotiation state */
         dccp_feat_list_purge(&dp->dccps_featneg);
diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c
index fab41de8e983..de66ca8e6201 100644
--- a/net/dsa/tag_ksz.c
+++ b/net/dsa/tag_ksz.c
@@ -42,6 +42,9 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
         padlen = (skb->len >= ETH_ZLEN) ? 0 : ETH_ZLEN - skb->len;
 
         if (skb_tailroom(skb) >= padlen + KSZ_INGRESS_TAG_LEN) {
+                if (skb_put_padto(skb, skb->len + padlen))
+                        return NULL;
+
                 nskb = skb;
         } else {
                 nskb = alloc_skb(NET_IP_ALIGN + skb->len +
@@ -56,13 +59,15 @@ static struct sk_buff *ksz_xmit(struct sk_buff *skb, struct net_device *dev)
                 skb_set_transport_header(nskb,
                                          skb_transport_header(skb) - skb->head);
                 skb_copy_and_csum_dev(skb, skb_put(nskb, skb->len));
+
+                if (skb_put_padto(nskb, nskb->len + padlen)) {
+                        kfree_skb(nskb);
+                        return NULL;
+                }
+
                 kfree_skb(skb);
         }
 
-        /* skb is freed when it fails */
-        if (skb_put_padto(nskb, nskb->len + padlen))
-                return NULL;
-
         tag = skb_put(nskb, KSZ_INGRESS_TAG_LEN);
         tag[0] = 0;
         tag[1] = 1 << p->dp->index; /* destination port */
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index b8d18171cca3..ec3a9ce281a6 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1083,15 +1083,17 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
         fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
         if (!fi)
                 goto failure;
-        fib_info_cnt++;
         if (cfg->fc_mx) {
                 fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
-                if (!fi->fib_metrics)
-                        goto failure;
+                if (unlikely(!fi->fib_metrics)) {
+                        kfree(fi);
+                        return ERR_PTR(err);
+                }
                 atomic_set(&fi->fib_metrics->refcnt, 1);
-        } else
+        } else {
                 fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
-
+        }
+        fib_info_cnt++;
         fi->fib_net = net;
         fi->fib_protocol = cfg->fc_protocol;
         fi->fib_scope = cfg->fc_scope;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 498706b072fb..caf2f1101d02 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1007,10 +1007,18 @@ int igmp_rcv(struct sk_buff *skb)
 {
         /* This basically follows the spec line by line -- see RFC1112 */
         struct igmphdr *ih;
-        struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+        struct net_device *dev = skb->dev;
+        struct in_device *in_dev;
         int len = skb->len;
         bool dropped = true;
 
+        if (netif_is_l3_master(dev)) {
+                dev = dev_get_by_index_rcu(dev_net(dev), IPCB(skb)->iif);
+                if (!dev)
+                        goto drop;
+        }
+
+        in_dev = __in_dev_get_rcu(dev);
         if (!in_dev)
                 goto drop;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 0383e66f59bc..2331de20ca50 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1267,7 +1267,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
         if (mtu)
                 return mtu;
 
-        mtu = dst->dev->mtu;
+        mtu = READ_ONCE(dst->dev->mtu);
 
         if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
                 if (rt->rt_uses_gateway && mtu > 576)
@@ -2750,26 +2750,34 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                 err = 0;
                 if (IS_ERR(rt))
                         err = PTR_ERR(rt);
+                else
+                        skb_dst_set(skb, &rt->dst);
         }
 
         if (err)
                 goto errout_free;
 
-        skb_dst_set(skb, &rt->dst);
         if (rtm->rtm_flags & RTM_F_NOTIFY)
                 rt->rt_flags |= RTCF_NOTIFY;
 
         if (rtm->rtm_flags & RTM_F_LOOKUP_TABLE)
                 table_id = rt->rt_table_id;
 
-        if (rtm->rtm_flags & RTM_F_FIB_MATCH)
+        if (rtm->rtm_flags & RTM_F_FIB_MATCH) {
+                if (!res.fi) {
+                        err = fib_props[res.type].error;
+                        if (!err)
+                                err = -EHOSTUNREACH;
+                        goto errout_free;
+                }
                 err = fib_dump_info(skb, NETLINK_CB(in_skb).portid,
                                     nlh->nlmsg_seq, RTM_NEWROUTE, table_id,
                                     rt->rt_type, res.prefix, res.prefixlen,
                                     fl4.flowi4_tos, res.fi, 0);
-        else
+        } else {
                 err = rt_fill_info(net, dst, src, table_id, &fl4, skb,
                                    NETLINK_CB(in_skb).portid, nlh->nlmsg_seq);
+        }
         if (err < 0)
                 goto errout_free;
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 53de1424c13c..bab7f0493098 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3009,8 +3009,7 @@ void tcp_rearm_rto(struct sock *sk)
                         /* delta_us may not be positive if the socket is locked
                          * when the retrans timer fires and is rescheduled.
                          */
-                        if (delta_us > 0)
-                                rto = usecs_to_jiffies(delta_us);
+                        rto = usecs_to_jiffies(max_t(int, delta_us, 1));
                 }
                 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, rto,
                                           TCP_RTO_MAX);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a20e7f03d5f7..e9252c7df809 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1722,6 +1722,8 @@ process:
                  */
                 sock_hold(sk);
                 refcounted = true;
+                if (tcp_filter(sk, skb))
+                        goto discard_and_relse;
                 nsk = tcp_check_req(sk, skb, req, false);
                 if (!nsk) {
                         reqsk_put(req);
@@ -1729,8 +1731,6 @@ process:
                 }
                 if (nsk == sk) {
                         reqsk_put(req);
-                } else if (tcp_filter(sk, skb)) {
-                        goto discard_and_relse;
                 } else if (tcp_child_process(sk, nsk, skb)) {
                         tcp_v4_send_reset(nsk, skb);
                         goto discard_and_relse;
diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c
index 2417f55374c5..6bb9e14c710a 100644
--- a/net/ipv4/tcp_ulp.c
+++ b/net/ipv4/tcp_ulp.c
@@ -122,14 +122,14 @@ int tcp_set_ulp(struct sock *sk, const char *name)
 
         ulp_ops = __tcp_ulp_find_autoload(name);
         if (!ulp_ops)
-                err = -ENOENT;
-        else
-                err = ulp_ops->init(sk);
+                return -ENOENT;
 
-        if (err)
-                goto out;
+        err = ulp_ops->init(sk);
+        if (err) {
+                module_put(ulp_ops->owner);
+                return err;
+        }
 
         icsk->icsk_ulp_ops = ulp_ops;
- out:
-        return err;
+        return 0;
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index b34f09b20fef..ebe46ed997cb 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1574,7 +1574,8 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
                 return ip_recv_error(sk, msg, len, addr_len);
 
 try_again:
-        peeking = off = sk_peek_offset(sk, flags);
+        peeking = flags & MSG_PEEK;
+        off = sk_peek_offset(sk, flags);
         skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
         if (!skb)
                 return err;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index ebb299cf72b7..5cc0ea038198 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -914,6 +914,8 @@ add:
                 }
                 nsiblings = iter->rt6i_nsiblings;
                 fib6_purge_rt(iter, fn, info->nl_net);
+                if (fn->rr_ptr == iter)
+                        fn->rr_ptr = NULL;
                 rt6_release(iter);
 
                 if (nsiblings) {
@@ -926,6 +928,8 @@ add:
                                 if (rt6_qualify_for_ecmp(iter)) {
                                         *ins = iter->dst.rt6_next;
                                         fib6_purge_rt(iter, fn, info->nl_net);
+                                        if (fn->rr_ptr == iter)
+                                                fn->rr_ptr = NULL;
                                         rt6_release(iter);
                                         nsiblings--;
                                 } else {
@@ -1014,7 +1018,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
                         /* Create subtree root node */
                         sfn = node_alloc();
                         if (!sfn)
-                                goto st_failure;
+                                goto failure;
 
                         sfn->leaf = info->nl_net->ipv6.ip6_null_entry;
                         atomic_inc(&info->nl_net->ipv6.ip6_null_entry->rt6i_ref);
@@ -1031,12 +1035,12 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
 
                         if (IS_ERR(sn)) {
                                 /* If it is failed, discard just allocated
-                                   root, and then (in st_failure) stale node
+                                   root, and then (in failure) stale node
                                    in main tree.
                                  */
                                 node_free(sfn);
                                 err = PTR_ERR(sn);
-                                goto st_failure;
+                                goto failure;
                         }
 
                         /* Now link new subtree to main tree */
@@ -1051,7 +1055,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
 
                         if (IS_ERR(sn)) {
                                 err = PTR_ERR(sn);
-                                goto st_failure;
+                                goto failure;
                         }
                 }
 
@@ -1092,18 +1096,17 @@ out:
                         atomic_inc(&pn->leaf->rt6i_ref);
                 }
 #endif
-                /* Always release dst as dst->__refcnt is guaranteed
-                 * to be taken before entering this function
-                 */
-                dst_release_immediate(&rt->dst);
+                goto failure;
         }
         return err;
 
-#ifdef CONFIG_IPV6_SUBTREES
-        /* Subtree creation failed, probably main tree node
-           is orphan. If it is, shoot it.
+failure:
+        /* fn->leaf could be NULL if fn is an intermediate node and we
+         * failed to add the new route to it in both subtree creation
+         * failure and fib6_add_rt2node() failure case.
+         * In both cases, fib6_repair_tree() should be called to fix
+         * fn->leaf.
          */
-st_failure:
         if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
                 fib6_repair_tree(info->nl_net, fn);
         /* Always release dst as dst->__refcnt is guaranteed
@@ -1111,7 +1114,6 @@ st_failure:
          */
         dst_release_immediate(&rt->dst);
         return err;
-#endif
 }
 
 /*
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a640fbcba15d..94d6a13d47f0 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -417,14 +417,11 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
         struct net_device *loopback_dev =
                 dev_net(dev)->loopback_dev;
 
-        if (dev != loopback_dev) {
-                if (idev && idev->dev == dev) {
-                        struct inet6_dev *loopback_idev =
-                                in6_dev_get(loopback_dev);
-                        if (loopback_idev) {
-                                rt->rt6i_idev = loopback_idev;
-                                in6_dev_put(idev);
-                        }
+        if (idev && idev->dev != loopback_dev) {
+                struct inet6_dev *loopback_idev = in6_dev_get(loopback_dev);
+                if (loopback_idev) {
+                        rt->rt6i_idev = loopback_idev;
+                        in6_dev_put(idev);
                 }
         }
 }
@@ -3724,10 +3721,10 @@ static int ip6_route_dev_notify(struct notifier_block *this,
                 /* NETDEV_UNREGISTER could be fired for multiple times by
                  * netdev_wait_allrefs(). Make sure we only call this once.
                  */
-                in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
-                in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
-                in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
+                in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
 #endif
         }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2521690d62d6..206210125fd7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1456,6 +1456,8 @@ process:
                 }
                 sock_hold(sk);
                 refcounted = true;
+                if (tcp_filter(sk, skb))
+                        goto discard_and_relse;
                 nsk = tcp_check_req(sk, skb, req, false);
                 if (!nsk) {
                         reqsk_put(req);
@@ -1464,8 +1466,6 @@ process:
                 if (nsk == sk) {
                         reqsk_put(req);
                         tcp_v6_restore_cb(skb);
-                } else if (tcp_filter(sk, skb)) {
-                        goto discard_and_relse;
                 } else if (tcp_child_process(sk, nsk, skb)) {
                         tcp_v6_send_reset(nsk, skb);
                         goto discard_and_relse;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 96d240798c38..8cd9b628cdc7 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -362,7 +362,8 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                 return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 
 try_again:
-        peeking = off = sk_peek_offset(sk, flags);
+        peeking = flags & MSG_PEEK;
+        off = sk_peek_offset(sk, flags);
         skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
         if (!skb)
                 return err;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 2e6990f8b80b..23fa7c8b09a5 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -2213,7 +2213,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 {
         struct sock *sk = sock->sk;
         struct irda_sock *self = irda_sk(sk);
-        struct irda_device_list list;
+        struct irda_device_list list = { 0 };
         struct irda_device_info *discoveries;
         struct irda_ias_set *   ias_opt;        /* IAS get/query params */
         struct ias_object *     ias_obj;        /* Object in IAS */
diff --git a/net/key/af_key.c b/net/key/af_key.c
index ca9d3ae665e7..98f4d8211b9a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -228,7 +228,7 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
 #define BROADCAST_ONE           1
 #define BROADCAST_REGISTERED    2
 #define BROADCAST_PROMISC_ONLY  4
-static int pfkey_broadcast(struct sk_buff *skb,
+static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
                            int broadcast_flags, struct sock *one_sk,
                            struct net *net)
 {
@@ -278,7 +278,7 @@ static int pfkey_broadcast(struct sk_buff *skb,
         rcu_read_unlock();
 
         if (one_sk != NULL)
-                err = pfkey_broadcast_one(skb, &skb2, GFP_KERNEL, one_sk);
+                err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
 
         kfree_skb(skb2);
         kfree_skb(skb);
@@ -311,7 +311,7 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
                 hdr = (struct sadb_msg *) pfk->dump.skb->data;
                 hdr->sadb_msg_seq = 0;
                 hdr->sadb_msg_errno = rc;
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                 &pfk->sk, sock_net(&pfk->sk));
                 pfk->dump.skb = NULL;
         }
@@ -355,7 +355,7 @@ static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk)
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
                              sizeof(uint64_t));
 
-        pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+        pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk, sock_net(sk));
 
         return 0;
 }
@@ -1389,7 +1389,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
 
         xfrm_state_put(x);
 
-        pfkey_broadcast(resp_skb, BROADCAST_ONE, sk, net);
+        pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk, net);
 
         return 0;
 }
@@ -1476,7 +1476,7 @@ static int key_notify_sa(struct xfrm_state *x, const struct km_event *c)
         hdr->sadb_msg_seq = c->seq;
         hdr->sadb_msg_pid = c->portid;
 
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, xs_net(x));
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xs_net(x));
 
         return 0;
 }
@@ -1589,7 +1589,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, const struct sadb_msg
         out_hdr->sadb_msg_reserved = 0;
         out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
         out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, BROADCAST_ONE, sk, sock_net(sk));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
 
         return 0;
 }
@@ -1694,8 +1694,8 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad
                 return -ENOBUFS;
         }
 
-        pfkey_broadcast(supp_skb, BROADCAST_REGISTERED, sk, sock_net(sk));
-
+        pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk,
+                        sock_net(sk));
         return 0;
 }
 
@@ -1712,7 +1712,8 @@ static int unicast_flush_resp(struct sock *sk, const struct sadb_msg *ihdr)
         hdr->sadb_msg_errno = (uint8_t) 0;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
 
-        return pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk,
+                               sock_net(sk));
 }
 
 static int key_notify_sa_flush(const struct km_event *c)
@@ -1733,7 +1734,7 @@ static int key_notify_sa_flush(const struct km_event *c)
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
         hdr->sadb_msg_reserved = 0;
 
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, c->net);
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
 
         return 0;
 }
@@ -1790,7 +1791,7 @@ static int dump_sa(struct xfrm_state *x, int count, void *ptr)
         out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
 
         if (pfk->dump.skb)
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                 &pfk->sk, sock_net(&pfk->sk));
         pfk->dump.skb = out_skb;
 
@@ -1878,7 +1879,7 @@ static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, const struct sadb
                 new_hdr->sadb_msg_errno = 0;
         }
 
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, sock_net(sk));
+        pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, sock_net(sk));
         return 0;
 }
 
@@ -2206,7 +2207,7 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_ev
         out_hdr->sadb_msg_errno = 0;
         out_hdr->sadb_msg_seq = c->seq;
         out_hdr->sadb_msg_pid = c->portid;
-        pfkey_broadcast(out_skb, BROADCAST_ALL, NULL, xp_net(xp));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp));
         return 0;
 
 }
@@ -2426,7 +2427,7 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
         out_hdr->sadb_msg_errno = 0;
         out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
         out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
-        pfkey_broadcast(out_skb, BROADCAST_ONE, sk, xp_net(xp));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, xp_net(xp));
         err = 0;
 
 out:
@@ -2682,7 +2683,7 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
         out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
 
         if (pfk->dump.skb)
-                pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+                pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
                                 &pfk->sk, sock_net(&pfk->sk));
         pfk->dump.skb = out_skb;
 
@@ -2739,7 +2740,7 @@ static int key_notify_policy_flush(const struct km_event *c)
         hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
         hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
         hdr->sadb_msg_reserved = 0;
-        pfkey_broadcast(skb_out, BROADCAST_ALL, NULL, c->net);
+        pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
         return 0;
 
 }
@@ -2803,7 +2804,7 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
         void *ext_hdrs[SADB_EXT_MAX];
         int err;
 
-        pfkey_broadcast(skb_clone(skb, GFP_KERNEL),
+        pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
                         BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
 
         memset(ext_hdrs, 0, sizeof(ext_hdrs));
@@ -3024,7 +3025,8 @@ static int key_notify_sa_expire(struct xfrm_state *x, const struct km_event *c)
         out_hdr->sadb_msg_seq = 0;
         out_hdr->sadb_msg_pid = 0;
 
-        pfkey_broadcast(out_skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                        xs_net(x));
         return 0;
 }
 
@@ -3212,7 +3214,8 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
                        xfrm_ctx->ctx_len);
         }
 
-        return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                               xs_net(x));
 }
 
 static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
@@ -3408,7 +3411,8 @@ static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
         n_port->sadb_x_nat_t_port_port = sport;
         n_port->sadb_x_nat_t_port_reserved = 0;
 
-        return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+        return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+                               xs_net(x));
 }
 
 #ifdef CONFIG_NET_KEY_MIGRATE
@@ -3599,7 +3603,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
         }
 
         /* broadcast migrate message to sockets */
-        pfkey_broadcast(skb, BROADCAST_ALL, NULL, &init_net);
+        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, &init_net);
 
         return 0;
 
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 8708cbe8af5b..2b36eff5d97e 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -7,7 +7,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -466,3 +466,23 @@ void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
         rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_manage_rx_ba_offl);
+
+void ieee80211_rx_ba_timer_expired(struct ieee80211_vif *vif,
+                                   const u8 *addr, unsigned int tid)
+{
+        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        rcu_read_lock();
+        sta = sta_info_get_bss(sdata, addr);
+        if (!sta)
+                goto unlock;
+
+        set_bit(tid, sta->ampdu_mlme.tid_rx_timer_expired);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+
+ unlock:
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(ieee80211_rx_ba_timer_expired);
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index e4610676299b..a54a556fcdb5 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -1337,6 +1337,7 @@ int ovs_execute_actions(struct datapath *dp, struct sk_buff *skb,
                 goto out;
         }
 
+        OVS_CB(skb)->acts_origlen = acts->orig_len;
         err = do_execute_actions(dp, skb, key,
                                  acts->actions, acts->actions_len);
 
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 45fe8c8a884d..6b44fe405282 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -381,7 +381,7 @@ static int queue_gso_packets(struct datapath *dp, struct sk_buff *skb,
 }
 
 static size_t upcall_msg_size(const struct dp_upcall_info *upcall_info,
-                              unsigned int hdrlen)
+                              unsigned int hdrlen, int actions_attrlen)
 {
         size_t size = NLMSG_ALIGN(sizeof(struct ovs_header))
                 + nla_total_size(hdrlen) /* OVS_PACKET_ATTR_PACKET */
@@ -398,7 +398,7 @@ static size_t upcall_msg_size(const struct dp_upcall_info *upcall_info,
 
         /* OVS_PACKET_ATTR_ACTIONS */
         if (upcall_info->actions_len)
-                size += nla_total_size(upcall_info->actions_len);
+                size += nla_total_size(actions_attrlen);
 
         /* OVS_PACKET_ATTR_MRU */
         if (upcall_info->mru)
@@ -465,7 +465,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
         else
                 hlen = skb->len;
 
-        len = upcall_msg_size(upcall_info, hlen - cutlen);
+        len = upcall_msg_size(upcall_info, hlen - cutlen,
+                              OVS_CB(skb)->acts_origlen);
         user_skb = genlmsg_new(len, GFP_ATOMIC);
         if (!user_skb) {
                 err = -ENOMEM;
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index 5d8dcd88815f..480600649d0b 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -99,11 +99,13 @@ struct datapath {
  * when a packet is received by OVS.
  * @mru: The maximum received fragement size; 0 if the packet is not
  * fragmented.
+ * @acts_origlen: The netlink size of the flow actions applied to this skb.
  * @cutlen: The number of bytes from the packet end to be removed.
  */
 struct ovs_skb_cb {
         struct vport            *input_vport;
         u16                     mru;
+        u16                     acts_origlen;
         u32                     cutlen;
 };
 #define OVS_CB(skb) ((struct ovs_skb_cb *)(skb)->cb)
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index dd30d74824b0..ec3383f97d4c 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -223,6 +223,7 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx)
         tail = b->call_backlog_tail;
         while (CIRC_CNT(head, tail, size) > 0) {
                 struct rxrpc_call *call = b->call_backlog[tail];
+                call->socket = rx;
                 if (rx->discard_new_call) {
                         _debug("discard %lx", call->user_call_ID);
                         rx->discard_new_call(call, call->user_call_ID);
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index d516ba8178b8..541707802a23 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -41,6 +41,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
 {
         struct xt_tgchk_param par;
         struct xt_target *target;
+        struct ipt_entry e = {};
         int ret = 0;
 
         target = xt_request_find_target(AF_INET, t->u.user.name,
@@ -52,6 +53,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
         memset(&par, 0, sizeof(par));
         par.net       = net;
         par.table     = table;
+        par.entryinfo = &e;
         par.target    = target;
         par.targinfo  = t->data;
         par.hook_mask = hook;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 39da0c5801c9..9fd44c221347 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -205,7 +205,7 @@ static void tcf_chain_flush(struct tcf_chain *chain)
 {
         struct tcf_proto *tp;
 
-        if (*chain->p_filter_chain)
+        if (chain->p_filter_chain)
                 RCU_INIT_POINTER(*chain->p_filter_chain, NULL);
         while ((tp = rtnl_dereference(chain->filter_chain)) != NULL) {
                 RCU_INIT_POINTER(chain->filter_chain, tp->next);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index bd24a550e0f9..a3fa144b8648 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -286,9 +286,6 @@ static struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
 void qdisc_hash_add(struct Qdisc *q, bool invisible)
 {
         if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
-                struct Qdisc *root = qdisc_dev(q)->qdisc;
-
-                WARN_ON_ONCE(root == &noop_qdisc);
                 ASSERT_RTNL();
                 hash_add_rcu(qdisc_dev(q)->qdisc_hash, &q->hash, q->handle);
                 if (invisible)
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 572fe2584e48..c403c87aff7a 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -572,8 +572,10 @@ static void atm_tc_destroy(struct Qdisc *sch)
         struct atm_flow_data *flow, *tmp;
 
         pr_debug("atm_tc_destroy(sch %p,[qdisc %p])\n", sch, p);
-        list_for_each_entry(flow, &p->flows, list)
+        list_for_each_entry(flow, &p->flows, list) {
                 tcf_block_put(flow->block);
+                flow->block = NULL;
+        }
 
         list_for_each_entry_safe(flow, tmp, &p->flows, list) {
                 if (flow->ref > 1)
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 481036f6b54e..780db43300b1 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1431,8 +1431,10 @@ static void cbq_destroy(struct Qdisc *sch)
          * be bound to classes which have been destroyed already. --TGR '04
          */
         for (h = 0; h < q->clhash.hashsize; h++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[h], common.hnode) {
                         tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
         }
         for (h = 0; h < q->clhash.hashsize; h++) {
                 hlist_for_each_entry_safe(cl, next, &q->clhash.hash[h],
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index b52f74610dc7..fd15200f8627 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1428,6 +1428,10 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
                 return err;
         q->eligible = RB_ROOT;
 
+        err = tcf_block_get(&q->root.block, &q->root.filter_list);
+        if (err)
+                goto err_tcf;
+
         q->root.cl_common.classid = sch->handle;
         q->root.refcnt  = 1;
         q->root.sched   = q;
@@ -1447,6 +1451,10 @@ hfsc_init_qdisc(struct Qdisc *sch, struct nlattr *opt)
         qdisc_watchdog_init(&q->watchdog, sch);
 
         return 0;
+
+err_tcf:
+        qdisc_class_hash_destroy(&q->clhash);
+        return err;
 }
 
 static int
@@ -1522,8 +1530,10 @@ hfsc_destroy_qdisc(struct Qdisc *sch)
         unsigned int i;
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode) {
                         tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
         }
         for (i = 0; i < q->clhash.hashsize; i++) {
                 hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 203286ab4427..5d65ec5207e9 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1258,8 +1258,10 @@ static void htb_destroy(struct Qdisc *sch)
         tcf_block_put(q->block);
 
         for (i = 0; i < q->clhash.hashsize; i++) {
-                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode)
+                hlist_for_each_entry(cl, &q->clhash.hash[i], common.hnode) {
                         tcf_block_put(cl->block);
+                        cl->block = NULL;
+                }
         }
         for (i = 0; i < q->clhash.hashsize; i++) {
                 hlist_for_each_entry_safe(cl, next, &q->clhash.hash[i],
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index f80ea2cc5f1f..82469ef9655e 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -437,6 +437,7 @@ congestion_drop:
                 qdisc_drop(head, sch, to_free);
 
                 slot_queue_add(slot, skb);
+                qdisc_tree_reduce_backlog(sch, 0, delta);
                 return NET_XMIT_CN;
         }
 
@@ -468,8 +469,10 @@ enqueue:
         /* Return Congestion Notification only if we dropped a packet
          * from this flow.
          */
-        if (qlen != slot->qlen)
+        if (qlen != slot->qlen) {
+                qdisc_tree_reduce_backlog(sch, 0, dropped - qdisc_pkt_len(skb));
                 return NET_XMIT_CN;
+        }
 
         /* As we dropped a packet, better let upper stack know this */
         qdisc_tree_reduce_backlog(sch, 1, dropped);
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 2a186b201ad2..a4b6ffb61495 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -512,7 +512,9 @@ static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
 {
         addr->sa.sa_family = AF_INET6;
         addr->v6.sin6_port = port;
+        addr->v6.sin6_flowinfo = 0;
         addr->v6.sin6_addr = *saddr;
+        addr->v6.sin6_scope_id = 0;
 }
 
 /* Compare addresses exactly.
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index d174ee3254ee..767e0537dde5 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -596,7 +596,7 @@ static int tipc_l2_rcv_msg(struct sk_buff *skb, struct net_device *dev,
         rcu_read_lock();
         b = rcu_dereference_rtnl(dev->tipc_ptr);
         if (likely(b && test_bit(0, &b->up) &&
-                   (skb->pkt_type <= PACKET_BROADCAST))) {
+                   (skb->pkt_type <= PACKET_MULTICAST))) {
                 skb->next = NULL;
                 tipc_rcv(dev_net(dev), skb, b);
                 rcu_read_unlock();
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index ab3087687a32..dcd90e6fa7c3 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -513,6 +513,7 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
 
         /* Now reverse the concerned fields */
         msg_set_errcode(hdr, err);
+        msg_set_non_seq(hdr, 0);
         msg_set_origport(hdr, msg_destport(&ohdr));
         msg_set_destport(hdr, msg_origport(&ohdr));
         msg_set_destnode(hdr, msg_prevnode(&ohdr));
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 9bfe886ab330..750949dfc1d7 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -258,13 +258,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
         arg = nlmsg_new(0, GFP_KERNEL);
         if (!arg) {
                 kfree_skb(msg->rep);
+                msg->rep = NULL;
                 return -ENOMEM;
         }
 
         err = __tipc_nl_compat_dumpit(cmd, msg, arg);
-        if (err)
+        if (err) {
                 kfree_skb(msg->rep);
-
+                msg->rep = NULL;
+        }
         kfree_skb(arg);
 
         return err;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 7b52a380d710..be8982b4f8c0 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2304,10 +2304,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,
          */
         mutex_lock(&u->iolock);
 
-        if (flags & MSG_PEEK)
-                skip = sk_peek_offset(sk, flags);
-        else
-                skip = 0;
+        skip = max(sk_peek_offset(sk, flags), 0);
 
         do {
                 int chunk;