Merge branch 'for-4.19/cougar' into for-linus

New device support for hid-cougar
author: Jiri Kosina <jkosina@suse.cz> 2018-08-20 12:05:17 -0400
committer: Jiri Kosina <jkosina@suse.cz> 2018-08-20 12:05:17 -0400
commit: 415d2b3392d7a80903e0f97f051201aa02bf20e9 (patch)
tree: 47492d2386a0e7f00ef645313cb44ae4960b7e7e /net
parent: 4f65245f2d178b9cba48350620d76faa4a098841 (diff)
parent: b8e759b8f6dab1c473c30ac12709095d0b81078e (diff)
206 files changed, 2394 insertions, 1935 deletions
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 73a65789271b..8ccee3d01822 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -693,7 +693,7 @@ static struct sk_buff **vlan_gro_receive(struct sk_buff **head,
 out_unlock:
        rcu_read_unlock();
 out:
-        NAPI_GRO_CB(skb)->flush |= flush;
+        skb_gro_flush_final(skb, pp, flush);
        return pp;
 }
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 16e10680518c..931ea00c4fed 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -242,8 +242,9 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                                                "w", nwname);
                                if (!errcode) {
                                        *wnames =
-                                            kmalloc(sizeof(char *) * *nwname,
+                                            kmalloc_array(*nwname,
-                                                    GFP_NOFS);
+                                                          sizeof(char *),
+                                                          GFP_NOFS);
                                        if (!*wnames)
                                                errcode = -ENOMEM;
                                }
@@ -285,9 +286,9 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                                    p9pdu_readf(pdu, proto_version, "w", nwqid);
                                if (!errcode) {
                                        *wqids =
-                                            kmalloc(*nwqid *
+                                            kmalloc_array(*nwqid,
-                                                    sizeof(struct p9_qid),
+                                                          sizeof(struct p9_qid),
-                                                    GFP_NOFS);
+                                                          GFP_NOFS);
                                        if (*wqids == NULL)
                                                errcode = -ENOMEM;
                                }
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 4d0372263e5d..05006cbb3361 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -360,7 +360,8 @@ static int p9_get_mapped_pages(struct virtio_chan *chan,
                nr_pages = DIV_ROUND_UP((unsigned long)p + len, PAGE_SIZE) -
                           (unsigned long)p / PAGE_SIZE;
-                *pages = kmalloc(sizeof(struct page *) * nr_pages, GFP_NOFS);
+                *pages = kmalloc_array(nr_pages, sizeof(struct page *),
+                                       GFP_NOFS);
                if (!*pages)
                        return -ENOMEM;
diff --git a/net/Makefile b/net/Makefile
index 13ec0d5415c7..bdaf53925acd 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -20,11 +20,7 @@ obj-$(CONFIG_TLS)		+= tls/
 obj-$(CONFIG_XFRM)              += xfrm/
 obj-$(CONFIG_UNIX)              += unix/
 obj-$(CONFIG_NET)               += ipv6/
-ifneq ($(CC_CAN_LINK),y)
-$(warning CC cannot link executables. Skipping bpfilter.)
-else
 obj-$(CONFIG_BPFILTER)          += bpfilter/
-endif
 obj-$(CONFIG_PACKET)            += packet/
 obj-$(CONFIG_NET_KEY)           += key/
 obj-$(CONFIG_BRIDGE)            += bridge/
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 55fdba05d7d9..9b6bc5abe946 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1869,7 +1869,7 @@ static const struct proto_ops atalk_dgram_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = atalk_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .ioctl          = atalk_ioctl,
 #ifdef CONFIG_COMPAT
        .compat_ioctl   = atalk_compat_ioctl,
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 36b3adacc0dd..10462de734ea 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -252,8 +252,7 @@ static int br2684_xmit_vcc(struct sk_buff *skb, struct net_device *dev,
        ATM_SKB(skb)->vcc = atmvcc = brvcc->atmvcc;
        pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, atmvcc, atmvcc->dev);
-        refcount_add(skb->truesize, &sk_atm(atmvcc)->sk_wmem_alloc);
+        atm_account_tx(atmvcc, skb);
-        ATM_SKB(skb)->atm_options = atmvcc->atm_options;
        dev->stats.tx_packets++;
        dev->stats.tx_bytes += skb->len;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 66caa48a27c2..d795b9c5aea4 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -381,8 +381,7 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
                memcpy(here, llc_oui, sizeof(llc_oui));
                ((__be16 *) here)[3] = skb->protocol;
        }
-        refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
+        atm_account_tx(vcc, skb);
-        ATM_SKB(skb)->atm_options = vcc->atm_options;
        entry->vccs->last_use = jiffies;
        pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, vcc, vcc->dev);
        old = xchg(&entry->vccs->xoff, 1);      /* assume XOFF ... */
diff --git a/net/atm/common.c b/net/atm/common.c
index 1f2af59935db..a7a68e509628 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -630,10 +630,9 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size)
                goto out;
        }
        pr_debug("%d += %d\n", sk_wmem_alloc_get(sk), skb->truesize);
-        refcount_add(skb->truesize, &sk->sk_wmem_alloc);
+        atm_account_tx(vcc, skb);
        skb->dev = NULL; /* for paths shared with net_device interfaces */
-        ATM_SKB(skb)->atm_options = vcc->atm_options;
        if (!copy_from_iter_full(skb_put(skb, size), size, &m->msg_iter)) {
                kfree_skb(skb);
                error = -EFAULT;
@@ -648,11 +647,16 @@ out:
        return error;
 }
-__poll_t vcc_poll_mask(struct socket *sock, __poll_t events)
+__poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
        struct sock *sk = sock->sk;
-        struct atm_vcc *vcc = ATM_SD(sock);
+        struct atm_vcc *vcc;
-        __poll_t mask = 0;
+        __poll_t mask;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
+        vcc = ATM_SD(sock);
        /* exceptional events */
        if (sk->sk_err)
diff --git a/net/atm/common.h b/net/atm/common.h
index 526796ad230f..5850649068bb 100644
--- a/net/atm/common.h
+++ b/net/atm/common.h
@@ -17,7 +17,7 @@ int vcc_connect(struct socket *sock, int itf, short vpi, int vci);
 int vcc_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
                int flags);
 int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len);
-__poll_t vcc_poll_mask(struct socket *sock, __poll_t events);
+__poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait);
 int vcc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int vcc_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 int vcc_setsockopt(struct socket *sock, int level, int optname,
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 5a95fcf6f9b6..d7f5cf5b7594 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -182,9 +182,8 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb)
        struct net_device *dev = skb->dev;
        ATM_SKB(skb)->vcc = vcc;
-        ATM_SKB(skb)->atm_options = vcc->atm_options;
+        atm_account_tx(vcc, skb);
-        refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
        if (vcc->send(vcc, skb) < 0) {
                dev->stats.tx_dropped++;
                return;
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 31e0dcb970f8..24b53c4c39c6 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -472,7 +472,7 @@ static const uint8_t *copy_macs(struct mpoa_client *mpc,
                if (mpc->number_of_mps_macs != 0)
                        kfree(mpc->mps_macs);
                mpc->number_of_mps_macs = 0;
-                mpc->mps_macs = kmalloc(num_macs * ETH_ALEN, GFP_KERNEL);
+                mpc->mps_macs = kmalloc_array(ETH_ALEN, num_macs, GFP_KERNEL);
                if (mpc->mps_macs == NULL) {
                        pr_info("(%s) out of mem\n", mpc->dev->name);
                        return NULL;
@@ -555,8 +555,7 @@ static int send_via_shortcut(struct sk_buff *skb, struct mpoa_client *mpc)
                                        sizeof(struct llc_snap_hdr));
        }
-        refcount_add(skb->truesize, &sk_atm(entry->shortcut)->sk_wmem_alloc);
+        atm_account_tx(entry->shortcut, skb);
-        ATM_SKB(skb)->atm_options = entry->shortcut->atm_options;
        entry->shortcut->send(entry->shortcut, skb);
        entry->packets_fwded++;
        mpc->in_ops->put(entry);
diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index 21d9d341a619..af8c4b38b746 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -350,8 +350,7 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
                return 1;
        }
-        refcount_add(skb->truesize, &sk_atm(ATM_SKB(skb)->vcc)->sk_wmem_alloc);
+        atm_account_tx(vcc, skb);
-        ATM_SKB(skb)->atm_options = ATM_SKB(skb)->vcc->atm_options;
        pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n",
                 skb, ATM_SKB(skb)->vcc, ATM_SKB(skb)->vcc->dev);
        ret = ATM_SKB(skb)->vcc->send(ATM_SKB(skb)->vcc, skb)
diff --git a/net/atm/pvc.c b/net/atm/pvc.c
index 9f75092fe778..2cb10af16afc 100644
--- a/net/atm/pvc.c
+++ b/net/atm/pvc.c
@@ -113,7 +113,7 @@ static const struct proto_ops pvc_proto_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      pvc_getname,
-        .poll_mask =    vcc_poll_mask,
+        .poll =         vcc_poll,
        .ioctl =        vcc_ioctl,
 #ifdef CONFIG_COMPAT
        .compat_ioctl = vcc_compat_ioctl,
diff --git a/net/atm/raw.c b/net/atm/raw.c
index ee10e8d46185..b3ba44aab0ee 100644
--- a/net/atm/raw.c
+++ b/net/atm/raw.c
@@ -35,8 +35,8 @@ static void atm_pop_raw(struct atm_vcc *vcc, struct sk_buff *skb)
        struct sock *sk = sk_atm(vcc);
        pr_debug("(%d) %d -= %d\n",
-                 vcc->vci, sk_wmem_alloc_get(sk), skb->truesize);
+                 vcc->vci, sk_wmem_alloc_get(sk), ATM_SKB(skb)->acct_truesize);
-        WARN_ON(refcount_sub_and_test(skb->truesize, &sk->sk_wmem_alloc));
+        WARN_ON(refcount_sub_and_test(ATM_SKB(skb)->acct_truesize, &sk->sk_wmem_alloc));
        dev_kfree_skb_any(skb);
        sk->sk_write_space(sk);
 }
diff --git a/net/atm/svc.c b/net/atm/svc.c
index 53f4ad7087b1..2f91b766ac42 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -636,7 +636,7 @@ static const struct proto_ops svc_proto_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       svc_accept,
        .getname =      svc_getname,
-        .poll_mask =    vcc_poll_mask,
+        .poll =         vcc_poll,
        .ioctl =        svc_ioctl,
 #ifdef CONFIG_COMPAT
        .compat_ioctl = svc_compat_ioctl,
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index d1d2442ce573..c603d33d5410 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1941,7 +1941,7 @@ static const struct proto_ops ax25_proto_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = ax25_accept,
        .getname        = ax25_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .ioctl          = ax25_ioctl,
        .listen         = ax25_listen,
        .shutdown       = ax25_shutdown,
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 510ab4f55df5..3264e1873219 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -437,13 +437,16 @@ static inline __poll_t bt_accept_poll(struct sock *parent)
        return 0;
 }
-__poll_t bt_sock_poll_mask(struct socket *sock, __poll_t events)
+__poll_t bt_sock_poll(struct file *file, struct socket *sock,
+                          poll_table *wait)
 {
        struct sock *sk = sock->sk;
        __poll_t mask = 0;
        BT_DBG("sock %p, sk %p", sock, sk);
+        poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_state == BT_LISTEN)
                return bt_accept_poll(sk);
@@ -475,7 +478,7 @@ __poll_t bt_sock_poll_mask(struct socket *sock, __poll_t events)
        return mask;
 }
-EXPORT_SYMBOL(bt_sock_poll_mask);
+EXPORT_SYMBOL(bt_sock_poll);
 int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 1dec33790198..ee8ef1228263 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1281,7 +1281,7 @@ int hci_inquiry(void __user *arg)
        /* cache_dump can't sleep. Therefore we allocate temp buffer and then
         * copy it to the user space.
         */
-        buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
+        buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
        if (!buf) {
                err = -ENOMEM;
                goto done;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index d6c099861538..1506e1632394 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1975,7 +1975,7 @@ static const struct proto_ops hci_sock_ops = {
        .sendmsg        = hci_sock_sendmsg,
        .recvmsg        = hci_sock_recvmsg,
        .ioctl          = hci_sock_ioctl,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
        .setsockopt     = hci_sock_setsockopt,
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9b7907ebfa01..d17a4736e47c 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -331,7 +331,7 @@ static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
         */
        alloc_size = roundup_pow_of_two(size);
-        seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
+        seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
        if (!seq_list->list)
                return -ENOMEM;
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 742a190034e6..686bdc6b35b0 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1653,7 +1653,7 @@ static const struct proto_ops l2cap_sock_ops = {
        .getname        = l2cap_sock_getname,
        .sendmsg        = l2cap_sock_sendmsg,
        .recvmsg        = l2cap_sock_recvmsg,
-        .poll_mask      = bt_sock_poll_mask,
+        .poll           = bt_sock_poll,
        .ioctl          = bt_sock_ioctl,
        .mmap           = sock_no_mmap,
        .socketpair     = sock_no_socketpair,
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 1cf57622473a..d606e9212291 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -1049,7 +1049,7 @@ static const struct proto_ops rfcomm_sock_ops = {
        .setsockopt     = rfcomm_sock_setsockopt,
        .getsockopt     = rfcomm_sock_getsockopt,
        .ioctl          = rfcomm_sock_ioctl,
-        .poll_mask      = bt_sock_poll_mask,
+        .poll           = bt_sock_poll,
        .socketpair     = sock_no_socketpair,
        .mmap           = sock_no_mmap
 };
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index d60dbc61d170..413b8ee49fec 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -1197,7 +1197,7 @@ static const struct proto_ops sco_sock_ops = {
        .getname        = sco_sock_getname,
        .sendmsg        = sco_sock_sendmsg,
        .recvmsg        = sco_sock_recvmsg,
-        .poll_mask      = bt_sock_poll_mask,
+        .poll           = bt_sock_poll,
        .ioctl          = bt_sock_ioctl,
        .mmap           = sock_no_mmap,
        .socketpair     = sock_no_socketpair,
diff --git a/net/bpfilter/.gitignore b/net/bpfilter/.gitignore
new file mode 100644
index 000000000000..e97084e3eea2
--- /dev/null
+++ b/net/bpfilter/.gitignore
@@ -0,0 +1 @@
+bpfilter_umh
diff --git a/net/bpfilter/Kconfig b/net/bpfilter/Kconfig
index a948b072c28f..76deb6615883 100644
--- a/net/bpfilter/Kconfig
+++ b/net/bpfilter/Kconfig
@@ -1,6 +1,5 @@
 menuconfig BPFILTER
        bool "BPF based packet filtering framework (BPFILTER)"
-        default n
        depends on NET && BPF && INET
        help
          This builds experimental bpfilter framework that is aiming to
@@ -9,6 +8,7 @@ menuconfig BPFILTER
 if BPFILTER
 config BPFILTER_UMH
        tristate "bpfilter kernel module with user mode helper"
+        depends on $(success,$(srctree)/scripts/cc-can-link.sh $(CC))
        default m
        help
          This builds bpfilter kernel module with embedded user mode helper
diff --git a/net/bpfilter/Makefile b/net/bpfilter/Makefile
index aafa72001fcd..39c6980b5d99 100644
--- a/net/bpfilter/Makefile
+++ b/net/bpfilter/Makefile
@@ -15,18 +15,7 @@ ifeq ($(CONFIG_BPFILTER_UMH), y)
 HOSTLDFLAGS += -static
 endif
-# a bit of elf magic to convert bpfilter_umh binary into a binary blob
+$(obj)/bpfilter_umh_blob.o: $(obj)/bpfilter_umh
-# inside bpfilter_umh.o elf file referenced by
-# _binary_net_bpfilter_bpfilter_umh_start symbol
-# which bpfilter_kern.c passes further into umh blob loader at run-time
-quiet_cmd_copy_umh = GEN $@
-      cmd_copy_umh = echo ':' > $(obj)/.bpfilter_umh.o.cmd; \
-      $(OBJCOPY) -I binary -O $(CONFIG_OUTPUT_FORMAT) \
-      -B `$(OBJDUMP) -f $<|grep architecture|cut -d, -f1|cut -d' ' -f2` \
-      --rename-section .data=.init.rodata $< $@
-$(obj)/bpfilter_umh.o: $(obj)/bpfilter_umh
-        $(call cmd,copy_umh)
 obj-$(CONFIG_BPFILTER_UMH) += bpfilter.o
-bpfilter-objs += bpfilter_kern.o bpfilter_umh.o
+bpfilter-objs += bpfilter_kern.o bpfilter_umh_blob.o
diff --git a/net/bpfilter/bpfilter_kern.c b/net/bpfilter/bpfilter_kern.c
index b13d058f8c34..f0fc182d3db7 100644
--- a/net/bpfilter/bpfilter_kern.c
+++ b/net/bpfilter/bpfilter_kern.c
@@ -10,11 +10,8 @@
 #include <linux/file.h>
 #include "msgfmt.h"
-#define UMH_start _binary_net_bpfilter_bpfilter_umh_start
+extern char bpfilter_umh_start;
-#define UMH_end _binary_net_bpfilter_bpfilter_umh_end
+extern char bpfilter_umh_end;
-extern char UMH_start;
-extern char UMH_end;
 static struct umh_info info;
 /* since ip_getsockopt() can run in parallel, serialize access to umh */
@@ -24,17 +21,19 @@ static void shutdown_umh(struct umh_info *info)
 {
        struct task_struct *tsk;
+        if (!info->pid)
+                return;
        tsk = pid_task(find_vpid(info->pid), PIDTYPE_PID);
        if (tsk)
                force_sig(SIGKILL, tsk);
        fput(info->pipe_to_umh);
        fput(info->pipe_from_umh);
+        info->pid = 0;
 }
 static void __stop_umh(void)
 {
-        if (IS_ENABLED(CONFIG_INET) &&
+        if (IS_ENABLED(CONFIG_INET)) {
-            bpfilter_process_sockopt) {
                bpfilter_process_sockopt = NULL;
                shutdown_umh(&info);
        }
@@ -55,7 +54,7 @@ static int __bpfilter_process_sockopt(struct sock *sk, int optname,
        struct mbox_reply reply;
        loff_t pos;
        ssize_t n;
-        int ret;
+        int ret = -EFAULT;
        req.is_set = is_set;
        req.pid = current->pid;
@@ -63,6 +62,8 @@ static int __bpfilter_process_sockopt(struct sock *sk, int optname,
        req.addr = (long)optval;
        req.len = optlen;
        mutex_lock(&bpfilter_lock);
+        if (!info.pid)
+                goto out;
        n = __kernel_write(info.pipe_to_umh, &req, sizeof(req), &pos);
        if (n != sizeof(req)) {
                pr_err("write fail %zd\n", n);
@@ -89,7 +90,9 @@ static int __init load_umh(void)
        int err;
        /* fork usermode process */
-        err = fork_usermode_blob(&UMH_start, &UMH_end - &UMH_start, &info);
+        err = fork_usermode_blob(&bpfilter_umh_start,
+                                 &bpfilter_umh_end - &bpfilter_umh_start,
+                                 &info);
        if (err)
                return err;
        pr_info("Loaded bpfilter_umh pid %d\n", info.pid);
diff --git a/net/bpfilter/bpfilter_umh_blob.S b/net/bpfilter/bpfilter_umh_blob.S
new file mode 100644
index 000000000000..40311d10d2f2
--- /dev/null
+++ b/net/bpfilter/bpfilter_umh_blob.S
@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+        .section .init.rodata, "a"
+        .global bpfilter_umh_start
+bpfilter_umh_start:
+        .incbin "net/bpfilter/bpfilter_umh"
+        .global bpfilter_umh_end
+bpfilter_umh_end:
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index b19e3104afd6..502f66349530 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -135,9 +135,11 @@ struct net_device *br_fdb_find_port(const struct net_device *br_dev,
                return NULL;
        br = netdev_priv(br_dev);
-        f = br_fdb_find(br, addr, vid);
+        rcu_read_lock();
+        f = br_fdb_find_rcu(br, addr, vid);
        if (f && f->dst)
                dev = f->dst->dev;
+        rcu_read_unlock();
        return dev;
 }
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index cb4729539b82..920665dd92db 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -333,7 +333,7 @@ static int br_mdb_rehash(struct net_bridge_mdb_htable __rcu **mdbp, int max,
        mdb->max = max;
        mdb->old = old;
-        mdb->mhash = kzalloc(max * sizeof(*mdb->mhash), GFP_ATOMIC);
+        mdb->mhash = kcalloc(max, sizeof(*mdb->mhash), GFP_ATOMIC);
        if (!mdb->mhash) {
                kfree(mdb);
                return -ENOMEM;
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 28f68a2ec911..491828713e0b 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -411,6 +411,12 @@ ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
        watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0);
        if (IS_ERR(watcher))
                return PTR_ERR(watcher);
+        if (watcher->family != NFPROTO_BRIDGE) {
+                module_put(watcher->me);
+                return -ENOENT;
+        }
        w->u.watcher = watcher;
        par->target   = watcher;
@@ -709,6 +715,8 @@ ebt_check_entry(struct ebt_entry *e, struct net *net,
        }
        i = 0;
+        memset(&mtpar, 0, sizeof(mtpar));
+        memset(&tgpar, 0, sizeof(tgpar));
        mtpar.net       = tgpar.net       = net;
        mtpar.table     = tgpar.table     = name;
        mtpar.entryinfo = tgpar.entryinfo = e;
@@ -730,6 +738,13 @@ ebt_check_entry(struct ebt_entry *e, struct net *net,
                goto cleanup_watchers;
        }
+        /* Reject UNSPEC, xtables verdicts/return values are incompatible */
+        if (target->family != NFPROTO_BRIDGE) {
+                module_put(target->me);
+                ret = -ENOENT;
+                goto cleanup_watchers;
+        }
        t->u.target = target;
        if (t->u.target == &ebt_standard_target) {
                if (gap < sizeof(struct ebt_standard_target)) {
@@ -903,12 +918,13 @@ static int translate_table(struct net *net, const char *name,
                 * if an error occurs
                 */
                newinfo->chainstack =
-                        vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
+                        vmalloc(array_size(nr_cpu_ids,
+                                           sizeof(*(newinfo->chainstack))));
                if (!newinfo->chainstack)
                        return -ENOMEM;
                for_each_possible_cpu(i) {
                        newinfo->chainstack[i] =
-                          vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
+                          vmalloc(array_size(udc_cnt, sizeof(*(newinfo->chainstack[0]))));
                        if (!newinfo->chainstack[i]) {
                                while (i)
                                        vfree(newinfo->chainstack[--i]);
@@ -918,7 +934,7 @@ static int translate_table(struct net *net, const char *name,
                        }
                }
-                cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
+                cl_s = vmalloc(array_size(udc_cnt, sizeof(*cl_s)));
                if (!cl_s)
                        return -ENOMEM;
                i = 0; /* the i'th udc */
@@ -1293,7 +1309,7 @@ static int do_update_counters(struct net *net, const char *name,
        if (num_counters == 0)
                return -EINVAL;
-        tmp = vmalloc(num_counters * sizeof(*tmp));
+        tmp = vmalloc(array_size(num_counters, sizeof(*tmp)));
        if (!tmp)
                return -ENOMEM;
@@ -1434,7 +1450,7 @@ static int copy_counters_to_user(struct ebt_table *t,
                return -EINVAL;
        }
-        counterstmp = vmalloc(nentries * sizeof(*counterstmp));
+        counterstmp = vmalloc(array_size(nentries, sizeof(*counterstmp)));
        if (!counterstmp)
                return -ENOMEM;
@@ -1605,16 +1621,16 @@ struct compat_ebt_entry_mwt {
                compat_uptr_t ptr;
        } u;
        compat_uint_t match_size;
-        compat_uint_t data[0];
+        compat_uint_t data[0] __attribute__ ((aligned (__alignof__(struct compat_ebt_replace))));
 };
 /* account for possible padding between match_size and ->data */
 static int ebt_compat_entry_padsize(void)
 {
-        BUILD_BUG_ON(XT_ALIGN(sizeof(struct ebt_entry_match)) <
+        BUILD_BUG_ON(sizeof(struct ebt_entry_match) <
-                        COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt)));
+                        sizeof(struct compat_ebt_entry_mwt));
-        return (int) XT_ALIGN(sizeof(struct ebt_entry_match)) -
+        return (int) sizeof(struct ebt_entry_match) -
-                        COMPAT_XT_ALIGN(sizeof(struct compat_ebt_entry_mwt));
+                        sizeof(struct compat_ebt_entry_mwt);
 }
 static int ebt_compat_match_offset(const struct xt_match *match,
diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index eaf05de37f75..6de981270566 100644
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -261,7 +261,7 @@ static void nft_reject_br_send_v6_unreach(struct net *net,
        if (!reject6_br_csum_ok(oldskb, hook))
                return;
-        nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct icmp6hdr) +
+        nskb = alloc_skb(sizeof(struct ipv6hdr) + sizeof(struct icmp6hdr) +
                         LL_MAX_HEADER + len, GFP_ATOMIC);
        if (!nskb)
                return;
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index c7991867d622..a6fb1b3bcad9 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -934,11 +934,15 @@ static int caif_release(struct socket *sock)
 }
 /* Copied from af_unix.c:unix_poll(), added CAIF tx_flow handling */
-static __poll_t caif_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t caif_poll(struct file *file,
+                              struct socket *sock, poll_table *wait)
 {
        struct sock *sk = sock->sk;
+        __poll_t mask;
        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
-        __poll_t mask = 0;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        /* exceptional events? */
        if (sk->sk_err)
@@ -972,7 +976,7 @@ static const struct proto_ops caif_seqpacket_ops = {
        .socketpair = sock_no_socketpair,
        .accept = sock_no_accept,
        .getname = sock_no_getname,
-        .poll_mask = caif_poll_mask,
+        .poll = caif_poll,
        .ioctl = sock_no_ioctl,
        .listen = sock_no_listen,
        .shutdown = sock_no_shutdown,
@@ -993,7 +997,7 @@ static const struct proto_ops caif_stream_ops = {
        .socketpair = sock_no_socketpair,
        .accept = sock_no_accept,
        .getname = sock_no_getname,
-        .poll_mask = caif_poll_mask,
+        .poll = caif_poll,
        .ioctl = sock_no_ioctl,
        .listen = sock_no_listen,
        .shutdown = sock_no_shutdown,
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 97fedff3f0c4..0af8f0db892a 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -923,8 +923,9 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                /* create array for CAN frames and copy the data */
                if (msg_head->nframes > 1) {
-                        op->frames = kmalloc(msg_head->nframes * op->cfsiz,
+                        op->frames = kmalloc_array(msg_head->nframes,
-                                             GFP_KERNEL);
+                                                   op->cfsiz,
+                                                   GFP_KERNEL);
                        if (!op->frames) {
                                kfree(op);
                                return -ENOMEM;
@@ -1095,15 +1096,17 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                if (msg_head->nframes > 1) {
                        /* create array for CAN frames and copy the data */
-                        op->frames = kmalloc(msg_head->nframes * op->cfsiz,
+                        op->frames = kmalloc_array(msg_head->nframes,
-                                             GFP_KERNEL);
+                                                   op->cfsiz,
+                                                   GFP_KERNEL);
                        if (!op->frames) {
                                kfree(op);
                                return -ENOMEM;
                        }
                        /* create and init array for received CAN frames */
-                        op->last_frames = kzalloc(msg_head->nframes * op->cfsiz,
+                        op->last_frames = kcalloc(msg_head->nframes,
+                                                  op->cfsiz,
                                                  GFP_KERNEL);
                        if (!op->last_frames) {
                                kfree(op->frames);
@@ -1657,7 +1660,7 @@ static const struct proto_ops bcm_ops = {
        .socketpair    = sock_no_socketpair,
        .accept        = sock_no_accept,
        .getname       = sock_no_getname,
-        .poll_mask     = datagram_poll_mask,
+        .poll          = datagram_poll,
        .ioctl         = can_ioctl,     /* use can_ioctl() from af_can.c */
        .listen        = sock_no_listen,
        .shutdown      = sock_no_shutdown,
diff --git a/net/can/raw.c b/net/can/raw.c
index fd7e2f49ea6a..1051eee82581 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -843,7 +843,7 @@ static const struct proto_ops raw_ops = {
        .socketpair    = sock_no_socketpair,
        .accept        = sock_no_accept,
        .getname       = raw_getname,
-        .poll_mask     = datagram_poll_mask,
+        .poll          = datagram_poll,
        .ioctl         = can_ioctl,     /* use can_ioctl() from af_can.c */
        .listen        = sock_no_listen,
        .shutdown      = sock_no_shutdown,
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 3b3d33ea9ed8..c6413c360771 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -168,12 +168,6 @@ static char tag_keepalive2 = CEPH_MSGR_TAG_KEEPALIVE2;
 static struct lock_class_key socket_class;
 #endif
-/*
- * When skipping (ignoring) a block of input we read it into a "skip
- * buffer," which is this many bytes in size.
- */
-#define SKIP_BUF_SIZE   1024
 static void queue_con(struct ceph_connection *con);
 static void cancel_con(struct ceph_connection *con);
 static void ceph_con_workfn(struct work_struct *);
@@ -520,12 +514,18 @@ static int ceph_tcp_connect(struct ceph_connection *con)
        return 0;
 }
+/*
+ * If @buf is NULL, discard up to @len bytes.
+ */
 static int ceph_tcp_recvmsg(struct socket *sock, void *buf, size_t len)
 {
        struct kvec iov = {buf, len};
        struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL };
        int r;
+        if (!buf)
+                msg.msg_flags |= MSG_TRUNC;
        iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &iov, 1, len);
        r = sock_recvmsg(sock, &msg, msg.msg_flags);
        if (r == -EAGAIN)
@@ -2575,9 +2575,6 @@ static int try_write(struct ceph_connection *con)
            con->state != CON_STATE_OPEN)
                return 0;
-more:
-        dout("try_write out_kvec_bytes %d\n", con->out_kvec_bytes);
        /* open the socket first? */
        if (con->state == CON_STATE_PREOPEN) {
                BUG_ON(con->sock);
@@ -2598,7 +2595,8 @@ more:
                }
        }
-more_kvec:
+more:
+        dout("try_write out_kvec_bytes %d\n", con->out_kvec_bytes);
        BUG_ON(!con->sock);
        /* kvec data queued? */
@@ -2623,7 +2621,7 @@ more_kvec:
                ret = write_partial_message_data(con);
                if (ret == 1)
-                        goto more_kvec;  /* we need to send the footer, too! */
+                        goto more;  /* we need to send the footer, too! */
                if (ret == 0)
                        goto out;
                if (ret < 0) {
@@ -2659,8 +2657,6 @@ out:
        return ret;
 }
 /*
 * Read what we can from the socket.
 */
@@ -2721,16 +2717,11 @@ more:
        if (con->in_base_pos < 0) {
                /*
                 * skipping + discarding content.
-                 *
-                 * FIXME: there must be a better way to do this!
                 */
-                static char buf[SKIP_BUF_SIZE];
+                ret = ceph_tcp_recvmsg(con->sock, NULL, -con->in_base_pos);
-                int skip = min((int) sizeof (buf), -con->in_base_pos);
-                dout("skipping %d / %d bytes\n", skip, -con->in_base_pos);
-                ret = ceph_tcp_recvmsg(con->sock, buf, skip);
                if (ret <= 0)
                        goto out;
+                dout("skipped %d / %d bytes\n", ret, -con->in_base_pos);
                con->in_base_pos += ret;
                if (con->in_base_pos)
                        goto more;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 69a2581ddbba..a00c74f1154e 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -766,7 +766,7 @@ void osd_req_op_extent_dup_last(struct ceph_osd_request *osd_req,
 }
 EXPORT_SYMBOL(osd_req_op_extent_dup_last);
-void osd_req_op_cls_init(struct ceph_osd_request *osd_req, unsigned int which,
+int osd_req_op_cls_init(struct ceph_osd_request *osd_req, unsigned int which,
                        u16 opcode, const char *class, const char *method)
 {
        struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which,
@@ -778,7 +778,9 @@ void osd_req_op_cls_init(struct ceph_osd_request *osd_req, unsigned int which,
        BUG_ON(opcode != CEPH_OSD_OP_CALL);
        pagelist = kmalloc(sizeof (*pagelist), GFP_NOFS);
-        BUG_ON(!pagelist);
+        if (!pagelist)
+                return -ENOMEM;
        ceph_pagelist_init(pagelist);
        op->cls.class_name = class;
@@ -798,6 +800,7 @@ void osd_req_op_cls_init(struct ceph_osd_request *osd_req, unsigned int which,
        osd_req_op_cls_request_info_pagelist(osd_req, which, pagelist);
        op->indata_len = payload_len;
+        return 0;
 }
 EXPORT_SYMBOL(osd_req_op_cls_init);
@@ -1026,7 +1029,6 @@ struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
                                       truncate_size, truncate_seq);
        }
-        req->r_abort_on_full = true;
        req->r_flags = flags;
        req->r_base_oloc.pool = layout->pool_id;
        req->r_base_oloc.pool_ns = ceph_try_get_string(layout->pool_ns);
@@ -1054,6 +1056,38 @@ EXPORT_SYMBOL(ceph_osdc_new_request);
 DEFINE_RB_FUNCS(request, struct ceph_osd_request, r_tid, r_node)
 DEFINE_RB_FUNCS(request_mc, struct ceph_osd_request, r_tid, r_mc_node)
+/*
+ * Call @fn on each OSD request as long as @fn returns 0.
+ */
+static void for_each_request(struct ceph_osd_client *osdc,
+                        int (*fn)(struct ceph_osd_request *req, void *arg),
+                        void *arg)
+{
+        struct rb_node *n, *p;
+        for (n = rb_first(&osdc->osds); n; n = rb_next(n)) {
+                struct ceph_osd *osd = rb_entry(n, struct ceph_osd, o_node);
+                for (p = rb_first(&osd->o_requests); p; ) {
+                        struct ceph_osd_request *req =
+                            rb_entry(p, struct ceph_osd_request, r_node);
+                        p = rb_next(p);
+                        if (fn(req, arg))
+                                return;
+                }
+        }
+        for (p = rb_first(&osdc->homeless_osd.o_requests); p; ) {
+                struct ceph_osd_request *req =
+                    rb_entry(p, struct ceph_osd_request, r_node);
+                p = rb_next(p);
+                if (fn(req, arg))
+                        return;
+        }
+}
 static bool osd_homeless(struct ceph_osd *osd)
 {
        return osd->o_osd == CEPH_HOMELESS_OSD;
@@ -1395,7 +1429,6 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
        bool recovery_deletes = ceph_osdmap_flag(osdc,
                                                 CEPH_OSDMAP_RECOVERY_DELETES);
        enum calc_target_result ct_res;
-        int ret;
        t->epoch = osdc->osdmap->epoch;
        pi = ceph_pg_pool_by_id(osdc->osdmap, t->base_oloc.pool);
@@ -1431,14 +1464,7 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc,
                }
        }
-        ret = __ceph_object_locator_to_pg(pi, &t->target_oid, &t->target_oloc,
+        __ceph_object_locator_to_pg(pi, &t->target_oid, &t->target_oloc, &pgid);
-                                          &pgid);
-        if (ret) {
-                WARN_ON(ret != -ENOENT);
-                t->osd = CEPH_HOMELESS_OSD;
-                ct_res = CALC_TARGET_POOL_DNE;
-                goto out;
-        }
        last_pgid.pool = pgid.pool;
        last_pgid.seed = ceph_stable_mod(pgid.seed, t->pg_num, t->pg_num_mask);
@@ -2161,9 +2187,9 @@ static void __submit_request(struct ceph_osd_request *req, bool wrlocked)
        struct ceph_osd_client *osdc = req->r_osdc;
        struct ceph_osd *osd;
        enum calc_target_result ct_res;
+        int err = 0;
        bool need_send = false;
        bool promoted = false;
-        bool need_abort = false;
        WARN_ON(req->r_tid);
        dout("%s req %p wrlocked %d\n", __func__, req, wrlocked);
@@ -2179,7 +2205,10 @@ again:
                goto promote;
        }
-        if (osdc->osdmap->epoch < osdc->epoch_barrier) {
+        if (osdc->abort_err) {
+                dout("req %p abort_err %d\n", req, osdc->abort_err);
+                err = osdc->abort_err;
+        } else if (osdc->osdmap->epoch < osdc->epoch_barrier) {
                dout("req %p epoch %u barrier %u\n", req, osdc->osdmap->epoch,
                     osdc->epoch_barrier);
                req->r_t.paused = true;
@@ -2200,11 +2229,13 @@ again:
                   (ceph_osdmap_flag(osdc, CEPH_OSDMAP_FULL) ||
                    pool_full(osdc, req->r_t.base_oloc.pool))) {
                dout("req %p full/pool_full\n", req);
-                pr_warn_ratelimited("FULL or reached pool quota\n");
+                if (osdc->abort_on_full) {
-                req->r_t.paused = true;
+                        err = -ENOSPC;
-                maybe_request_map(osdc);
+                } else {
-                if (req->r_abort_on_full)
+                        pr_warn_ratelimited("FULL or reached pool quota\n");
-                        need_abort = true;
+                        req->r_t.paused = true;
+                        maybe_request_map(osdc);
+                }
        } else if (!osd_homeless(osd)) {
                need_send = true;
        } else {
@@ -2221,11 +2252,11 @@ again:
        link_request(osd, req);
        if (need_send)
                send_request(req);
-        else if (need_abort)
+        else if (err)
-                complete_request(req, -ENOSPC);
+                complete_request(req, err);
        mutex_unlock(&osd->lock);
-        if (ct_res == CALC_TARGET_POOL_DNE)
+        if (!err && ct_res == CALC_TARGET_POOL_DNE)
                send_map_check(req);
        if (promoted)
@@ -2281,11 +2312,21 @@ static void finish_request(struct ceph_osd_request *req)
 static void __complete_request(struct ceph_osd_request *req)
 {
-        if (req->r_callback) {
+        dout("%s req %p tid %llu cb %pf result %d\n", __func__, req,
-                dout("%s req %p tid %llu cb %pf result %d\n", __func__, req,
+             req->r_tid, req->r_callback, req->r_result);
-                     req->r_tid, req->r_callback, req->r_result);
+        if (req->r_callback)
                req->r_callback(req);
-        }
+        complete_all(&req->r_completion);
+        ceph_osdc_put_request(req);
+}
+static void complete_request_workfn(struct work_struct *work)
+{
+        struct ceph_osd_request *req =
+            container_of(work, struct ceph_osd_request, r_complete_work);
+        __complete_request(req);
 }
 /*
@@ -2297,9 +2338,9 @@ static void complete_request(struct ceph_osd_request *req, int err)
        req->r_result = err;
        finish_request(req);
-        __complete_request(req);
-        complete_all(&req->r_completion);
+        INIT_WORK(&req->r_complete_work, complete_request_workfn);
-        ceph_osdc_put_request(req);
+        queue_work(req->r_osdc->completion_wq, &req->r_complete_work);
 }
 static void cancel_map_check(struct ceph_osd_request *req)
@@ -2336,6 +2377,28 @@ static void abort_request(struct ceph_osd_request *req, int err)
        complete_request(req, err);
 }
+static int abort_fn(struct ceph_osd_request *req, void *arg)
+{
+        int err = *(int *)arg;
+        abort_request(req, err);
+        return 0; /* continue iteration */
+}
+/*
+ * Abort all in-flight requests with @err and arrange for all future
+ * requests to be failed immediately.
+ */
+void ceph_osdc_abort_requests(struct ceph_osd_client *osdc, int err)
+{
+        dout("%s osdc %p err %d\n", __func__, osdc, err);
+        down_write(&osdc->lock);
+        for_each_request(osdc, abort_fn, &err);
+        osdc->abort_err = err;
+        up_write(&osdc->lock);
+}
+EXPORT_SYMBOL(ceph_osdc_abort_requests);
 static void update_epoch_barrier(struct ceph_osd_client *osdc, u32 eb)
 {
        if (likely(eb > osdc->epoch_barrier)) {
@@ -2363,6 +2426,30 @@ void ceph_osdc_update_epoch_barrier(struct ceph_osd_client *osdc, u32 eb)
 EXPORT_SYMBOL(ceph_osdc_update_epoch_barrier);
 /*
+ * We can end up releasing caps as a result of abort_request().
+ * In that case, we probably want to ensure that the cap release message
+ * has an updated epoch barrier in it, so set the epoch barrier prior to
+ * aborting the first request.
+ */
+static int abort_on_full_fn(struct ceph_osd_request *req, void *arg)
+{
+        struct ceph_osd_client *osdc = req->r_osdc;
+        bool *victims = arg;
+        if ((req->r_flags & CEPH_OSD_FLAG_WRITE) &&
+            (ceph_osdmap_flag(osdc, CEPH_OSDMAP_FULL) ||
+             pool_full(osdc, req->r_t.base_oloc.pool))) {
+                if (!*victims) {
+                        update_epoch_barrier(osdc, osdc->osdmap->epoch);
+                        *victims = true;
+                }
+                abort_request(req, -ENOSPC);
+        }
+        return 0; /* continue iteration */
+}
+/*
 * Drop all pending requests that are stalled waiting on a full condition to
 * clear, and complete them with ENOSPC as the return code. Set the
 * osdc->epoch_barrier to the latest map epoch that we've seen if any were
@@ -2370,61 +2457,11 @@ EXPORT_SYMBOL(ceph_osdc_update_epoch_barrier);
 */
 static void ceph_osdc_abort_on_full(struct ceph_osd_client *osdc)
 {
-        struct rb_node *n;
        bool victims = false;
-        dout("enter abort_on_full\n");
+        if (osdc->abort_on_full &&
+            (ceph_osdmap_flag(osdc, CEPH_OSDMAP_FULL) || have_pool_full(osdc)))
-        if (!ceph_osdmap_flag(osdc, CEPH_OSDMAP_FULL) && !have_pool_full(osdc))
+                for_each_request(osdc, abort_on_full_fn, &victims);
-                goto out;
-        /* Scan list and see if there is anything to abort */
-        for (n = rb_first(&osdc->osds); n; n = rb_next(n)) {
-                struct ceph_osd *osd = rb_entry(n, struct ceph_osd, o_node);
-                struct rb_node *m;
-                m = rb_first(&osd->o_requests);
-                while (m) {
-                        struct ceph_osd_request *req = rb_entry(m,
-                                        struct ceph_osd_request, r_node);
-                        m = rb_next(m);
-                        if (req->r_abort_on_full) {
-                                victims = true;
-                                break;
-                        }
-                }
-                if (victims)
-                        break;
-        }
-        if (!victims)
-                goto out;
-        /*
-         * Update the barrier to current epoch if it's behind that point,
-         * since we know we have some calls to be aborted in the tree.
-         */
-        update_epoch_barrier(osdc, osdc->osdmap->epoch);
-        for (n = rb_first(&osdc->osds); n; n = rb_next(n)) {
-                struct ceph_osd *osd = rb_entry(n, struct ceph_osd, o_node);
-                struct rb_node *m;
-                m = rb_first(&osd->o_requests);
-                while (m) {
-                        struct ceph_osd_request *req = rb_entry(m,
-                                        struct ceph_osd_request, r_node);
-                        m = rb_next(m);
-                        if (req->r_abort_on_full &&
-                            (ceph_osdmap_flag(osdc, CEPH_OSDMAP_FULL) ||
-                             pool_full(osdc, req->r_t.target_oloc.pool)))
-                                abort_request(req, -ENOSPC);
-                }
-        }
-out:
-        dout("return abort_on_full barrier=%u\n", osdc->epoch_barrier);
 }
 static void check_pool_dne(struct ceph_osd_request *req)
@@ -3541,8 +3578,6 @@ static void handle_reply(struct ceph_osd *osd, struct ceph_msg *msg)
        up_read(&osdc->lock);
        __complete_request(req);
-        complete_all(&req->r_completion);
-        ceph_osdc_put_request(req);
        return;
 fail_request:
@@ -4927,7 +4962,10 @@ int ceph_osdc_call(struct ceph_osd_client *osdc,
        if (ret)
                goto out_put_req;
-        osd_req_op_cls_init(req, 0, CEPH_OSD_OP_CALL, class, method);
+        ret = osd_req_op_cls_init(req, 0, CEPH_OSD_OP_CALL, class, method);
+        if (ret)
+                goto out_put_req;
        if (req_page)
                osd_req_op_cls_request_data_pages(req, 0, &req_page, req_len,
                                                  0, false, false);
@@ -4996,6 +5034,10 @@ int ceph_osdc_init(struct ceph_osd_client *osdc, struct ceph_client *client)
        if (!osdc->notify_wq)
                goto out_msgpool_reply;
+        osdc->completion_wq = create_singlethread_workqueue("ceph-completion");
+        if (!osdc->completion_wq)
+                goto out_notify_wq;
        schedule_delayed_work(&osdc->timeout_work,
                              osdc->client->options->osd_keepalive_timeout);
        schedule_delayed_work(&osdc->osds_timeout_work,
@@ -5003,6 +5045,8 @@ int ceph_osdc_init(struct ceph_osd_client *osdc, struct ceph_client *client)
        return 0;
+out_notify_wq:
+        destroy_workqueue(osdc->notify_wq);
 out_msgpool_reply:
        ceph_msgpool_destroy(&osdc->msgpool_op_reply);
 out_msgpool:
@@ -5017,7 +5061,7 @@ out:
 void ceph_osdc_stop(struct ceph_osd_client *osdc)
 {
-        flush_workqueue(osdc->notify_wq);
+        destroy_workqueue(osdc->completion_wq);
        destroy_workqueue(osdc->notify_wq);
        cancel_delayed_work_sync(&osdc->timeout_work);
        cancel_delayed_work_sync(&osdc->osds_timeout_work);
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 9645ffd6acfb..98c0ff3d6441 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -1299,8 +1299,9 @@ static int set_primary_affinity(struct ceph_osdmap *map, int osd, u32 aff)
        if (!map->osd_primary_affinity) {
                int i;
-                map->osd_primary_affinity = kmalloc(map->max_osd*sizeof(u32),
+                map->osd_primary_affinity = kmalloc_array(map->max_osd,
-                                                    GFP_NOFS);
+                                                          sizeof(u32),
+                                                          GFP_NOFS);
                if (!map->osd_primary_affinity)
                        return -ENOMEM;
@@ -2145,10 +2146,10 @@ bool ceph_osds_changed(const struct ceph_osds *old_acting,
 * Should only be called with target_oid and target_oloc (as opposed to
 * base_oid and base_oloc), since tiering isn't taken into account.
 */
-int __ceph_object_locator_to_pg(struct ceph_pg_pool_info *pi,
+void __ceph_object_locator_to_pg(struct ceph_pg_pool_info *pi,
-                                const struct ceph_object_id *oid,
+                                 const struct ceph_object_id *oid,
-                                const struct ceph_object_locator *oloc,
+                                 const struct ceph_object_locator *oloc,
-                                struct ceph_pg *raw_pgid)
+                                 struct ceph_pg *raw_pgid)
 {
        WARN_ON(pi->id != oloc->pool);
@@ -2164,11 +2165,8 @@ int __ceph_object_locator_to_pg(struct ceph_pg_pool_info *pi,
                int nsl = oloc->pool_ns->len;
                size_t total = nsl + 1 + oid->name_len;
-                if (total > sizeof(stack_buf)) {
+                if (total > sizeof(stack_buf))
-                        buf = kmalloc(total, GFP_NOIO);
+                        buf = kmalloc(total, GFP_NOIO | __GFP_NOFAIL);
-                        if (!buf)
-                                return -ENOMEM;
-                }
                memcpy(buf, oloc->pool_ns->str, nsl);
                buf[nsl] = '\037';
                memcpy(buf + nsl + 1, oid->name, oid->name_len);
@@ -2180,7 +2178,6 @@ int __ceph_object_locator_to_pg(struct ceph_pg_pool_info *pi,
                     oid->name, nsl, oloc->pool_ns->str,
                     raw_pgid->pool, raw_pgid->seed);
        }
-        return 0;
 }
 int ceph_object_locator_to_pg(struct ceph_osdmap *osdmap,
@@ -2194,7 +2191,8 @@ int ceph_object_locator_to_pg(struct ceph_osdmap *osdmap,
        if (!pi)
                return -ENOENT;
-        return __ceph_object_locator_to_pg(pi, oid, oloc, raw_pgid);
+        __ceph_object_locator_to_pg(pi, oid, oloc, raw_pgid);
+        return 0;
 }
 EXPORT_SYMBOL(ceph_object_locator_to_pg);
diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c
index a3d0adc828e6..e560d3975f41 100644
--- a/net/ceph/pagevec.c
+++ b/net/ceph/pagevec.c
@@ -20,7 +20,7 @@ struct page **ceph_get_direct_page_vector(const void __user *data,
        int got = 0;
        int rc = 0;
-        pages = kmalloc(sizeof(*pages) * num_pages, GFP_NOFS);
+        pages = kmalloc_array(num_pages, sizeof(*pages), GFP_NOFS);
        if (!pages)
                return ERR_PTR(-ENOMEM);
@@ -74,7 +74,7 @@ struct page **ceph_alloc_page_vector(int num_pages, gfp_t flags)
        struct page **pages;
        int i;
-        pages = kmalloc(sizeof(*pages) * num_pages, flags);
+        pages = kmalloc_array(num_pages, sizeof(*pages), flags);
        if (!pages)
                return ERR_PTR(-ENOMEM);
        for (i = 0; i < num_pages; i++) {
diff --git a/net/core/datagram.c b/net/core/datagram.c
index f19bf3dc2bd6..9938952c5c78 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -819,8 +819,9 @@ EXPORT_SYMBOL(skb_copy_and_csum_datagram_msg);
 /**
 *      datagram_poll - generic datagram poll
+ *      @file: file struct
 *      @sock: socket
- *      @events to wait for
+ *      @wait: poll table
 *
 *      Datagram poll: Again totally generic. This also handles
 *      sequenced packet sockets providing the socket receive queue
@@ -830,10 +831,14 @@ EXPORT_SYMBOL(skb_copy_and_csum_datagram_msg);
 *      and you use a different write policy from sock_writeable()
 *      then please supply your own write_space callback.
 */
-__poll_t datagram_poll_mask(struct socket *sock, __poll_t events)
+__poll_t datagram_poll(struct file *file, struct socket *sock,
+                           poll_table *wait)
 {
        struct sock *sk = sock->sk;
-        __poll_t mask = 0;
+        __poll_t mask;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        /* exceptional events? */
        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
@@ -866,4 +871,4 @@ __poll_t datagram_poll_mask(struct socket *sock, __poll_t events)
        return mask;
 }
-EXPORT_SYMBOL(datagram_poll_mask);
+EXPORT_SYMBOL(datagram_poll);
diff --git a/net/core/dev.c b/net/core/dev.c
index 6e18242a1cae..a5aa1c7444e6 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8643,7 +8643,8 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
                /* We get here if we can't use the current device name */
                if (!pat)
                        goto out;
-                if (dev_get_valid_name(net, dev, pat) < 0)
+                err = dev_get_valid_name(net, dev, pat);
+                if (err < 0)
                        goto out;
        }
@@ -8655,7 +8656,6 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
        dev_close(dev);
        /* And unlink it from device chain */
-        err = -ENODEV;
        unlist_netdevice(dev);
        synchronize_net();
@@ -8823,7 +8823,7 @@ static struct hlist_head * __net_init netdev_create_hash(void)
        int i;
        struct hlist_head *hash;
-        hash = kmalloc(sizeof(*hash) * NETDEV_HASHENTRIES, GFP_KERNEL);
+        hash = kmalloc_array(NETDEV_HASHENTRIES, sizeof(*hash), GFP_KERNEL);
        if (hash != NULL)
                for (i = 0; i < NETDEV_HASHENTRIES; i++)
                        INIT_HLIST_HEAD(&hash[i]);
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index a04e1e88bf3a..50537ff961a7 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -285,16 +285,9 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                if (ifr->ifr_qlen < 0)
                        return -EINVAL;
                if (dev->tx_queue_len ^ ifr->ifr_qlen) {
-                        unsigned int orig_len = dev->tx_queue_len;
+                        err = dev_change_tx_queue_len(dev, ifr->ifr_qlen);
+                        if (err)
-                        dev->tx_queue_len = ifr->ifr_qlen;
-                        err = call_netdevice_notifiers(
-                                        NETDEV_CHANGE_TX_QUEUE_LEN, dev);
-                        err = notifier_to_errno(err);
-                        if (err) {
-                                dev->tx_queue_len = orig_len;
                                return err;
-                        }
                }
                return 0;
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index c15075dc7572..e677a20180cf 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -911,7 +911,7 @@ static noinline_for_stack int ethtool_get_sset_info(struct net_device *dev,
        memset(&info, 0, sizeof(info));
        info.cmd = ETHTOOL_GSSET_INFO;
-        info_buf = kzalloc(n_bits * sizeof(u32), GFP_USER);
+        info_buf = kcalloc(n_bits, sizeof(u32), GFP_USER);
        if (!info_buf)
                return -ENOMEM;
@@ -1017,7 +1017,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
        if (info.cmd == ETHTOOL_GRXCLSRLALL) {
                if (info.rule_cnt > 0) {
                        if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
-                                rule_buf = kzalloc(info.rule_cnt * sizeof(u32),
+                                rule_buf = kcalloc(info.rule_cnt, sizeof(u32),
                                                   GFP_USER);
                        if (!rule_buf)
                                return -ENOMEM;
@@ -1816,7 +1816,7 @@ static int ethtool_self_test(struct net_device *dev, char __user *useraddr)
                return -EFAULT;
        test.len = test_len;
-        data = kmalloc(test_len * sizeof(u64), GFP_USER);
+        data = kmalloc_array(test_len, sizeof(u64), GFP_USER);
        if (!data)
                return -ENOMEM;
@@ -1852,7 +1852,7 @@ static int ethtool_get_strings(struct net_device *dev, void __user *useraddr)
        WARN_ON_ONCE(!ret);
        gstrings.len = ret;
-        data = vzalloc(gstrings.len * ETH_GSTRING_LEN);
+        data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
        if (gstrings.len && !data)
                return -ENOMEM;
@@ -1952,7 +1952,7 @@ static int ethtool_get_stats(struct net_device *dev, void __user *useraddr)
                return -EFAULT;
        stats.n_stats = n_stats;
-        data = vzalloc(n_stats * sizeof(u64));
+        data = vzalloc(array_size(n_stats, sizeof(u64)));
        if (n_stats && !data)
                return -ENOMEM;
@@ -1996,7 +1996,7 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)
                return -EFAULT;
        stats.n_stats = n_stats;
-        data = vzalloc(n_stats * sizeof(u64));
+        data = vzalloc(array_size(n_stats, sizeof(u64)));
        if (n_stats && !data)
                return -ENOMEM;
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 126ffc5bc630..f64aa13811ea 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -416,6 +416,14 @@ static struct fib_rule *rule_find(struct fib_rules_ops *ops,
                if (rule->mark && r->mark != rule->mark)
                        continue;
+                if (rule->suppress_ifgroup != -1 &&
+                    r->suppress_ifgroup != rule->suppress_ifgroup)
+                        continue;
+                if (rule->suppress_prefixlen != -1 &&
+                    r->suppress_prefixlen != rule->suppress_prefixlen)
+                        continue;
                if (rule->mark_mask && r->mark_mask != rule->mark_mask)
                        continue;
@@ -436,6 +444,9 @@ static struct fib_rule *rule_find(struct fib_rules_ops *ops,
                if (rule->ip_proto && r->ip_proto != rule->ip_proto)
                        continue;
+                if (rule->proto && r->proto != rule->proto)
+                        continue;
                if (fib_rule_port_range_set(&rule->sport_range) &&
                    !fib_rule_port_range_compare(&r->sport_range,
                                                 &rule->sport_range))
@@ -645,6 +656,73 @@ errout:
        return err;
 }
+static int rule_exists(struct fib_rules_ops *ops, struct fib_rule_hdr *frh,
+                       struct nlattr **tb, struct fib_rule *rule)
+{
+        struct fib_rule *r;
+        list_for_each_entry(r, &ops->rules_list, list) {
+                if (r->action != rule->action)
+                        continue;
+                if (r->table != rule->table)
+                        continue;
+                if (r->pref != rule->pref)
+                        continue;
+                if (memcmp(r->iifname, rule->iifname, IFNAMSIZ))
+                        continue;
+                if (memcmp(r->oifname, rule->oifname, IFNAMSIZ))
+                        continue;
+                if (r->mark != rule->mark)
+                        continue;
+                if (r->suppress_ifgroup != rule->suppress_ifgroup)
+                        continue;
+                if (r->suppress_prefixlen != rule->suppress_prefixlen)
+                        continue;
+                if (r->mark_mask != rule->mark_mask)
+                        continue;
+                if (r->tun_id != rule->tun_id)
+                        continue;
+                if (r->fr_net != rule->fr_net)
+                        continue;
+                if (r->l3mdev != rule->l3mdev)
+                        continue;
+                if (!uid_eq(r->uid_range.start, rule->uid_range.start) ||
+                    !uid_eq(r->uid_range.end, rule->uid_range.end))
+                        continue;
+                if (r->ip_proto != rule->ip_proto)
+                        continue;
+                if (r->proto != rule->proto)
+                        continue;
+                if (!fib_rule_port_range_compare(&r->sport_range,
+                                                 &rule->sport_range))
+                        continue;
+                if (!fib_rule_port_range_compare(&r->dport_range,
+                                                 &rule->dport_range))
+                        continue;
+                if (!ops->compare(r, frh, tb))
+                        continue;
+                return 1;
+        }
+        return 0;
+}
 int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                   struct netlink_ext_ack *extack)
 {
@@ -679,7 +757,7 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                goto errout;
        if ((nlh->nlmsg_flags & NLM_F_EXCL) &&
-            rule_find(ops, frh, tb, rule, user_priority)) {
+            rule_exists(ops, frh, tb, rule)) {
                err = -EEXIST;
                goto errout_free;
        }
diff --git a/net/core/filter.c b/net/core/filter.c
index 3d9ba7e5965a..0ca6907d7efe 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3214,20 +3214,6 @@ err:
 }
 EXPORT_SYMBOL_GPL(xdp_do_redirect);
-static int __xdp_generic_ok_fwd_dev(struct sk_buff *skb, struct net_device *fwd)
-{
-        unsigned int len;
-        if (unlikely(!(fwd->flags & IFF_UP)))
-                return -ENETDOWN;
-        len = fwd->mtu + fwd->hard_header_len + VLAN_HLEN;
-        if (skb->len > len)
-                return -EMSGSIZE;
-        return 0;
-}
 static int xdp_do_generic_redirect_map(struct net_device *dev,
                                       struct sk_buff *skb,
                                       struct xdp_buff *xdp,
@@ -3256,10 +3242,11 @@ static int xdp_do_generic_redirect_map(struct net_device *dev,
        }
        if (map->map_type == BPF_MAP_TYPE_DEVMAP) {
-                if (unlikely((err = __xdp_generic_ok_fwd_dev(skb, fwd))))
+                struct bpf_dtab_netdev *dst = fwd;
+                err = dev_map_generic_redirect(dst, skb, xdp_prog);
+                if (unlikely(err))
                        goto err;
-                skb->dev = fwd;
-                generic_xdp_tx(skb, xdp_prog);
        } else if (map->map_type == BPF_MAP_TYPE_XSKMAP) {
                struct xdp_sock *xs = fwd;
@@ -4086,8 +4073,9 @@ static int bpf_fib_set_fwd_params(struct bpf_fib_lookup *params,
        memcpy(params->smac, dev->dev_addr, ETH_ALEN);
        params->h_vlan_TCI = 0;
        params->h_vlan_proto = 0;
+        params->ifindex = dev->ifindex;
-        return dev->ifindex;
+        return 0;
 }
 #endif
@@ -4111,7 +4099,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
        /* verify forwarding is enabled on this interface */
        in_dev = __in_dev_get_rcu(dev);
        if (unlikely(!in_dev || !IN_DEV_FORWARD(in_dev)))
-                return 0;
+                return BPF_FIB_LKUP_RET_FWD_DISABLED;
        if (flags & BPF_FIB_LOOKUP_OUTPUT) {
                fl4.flowi4_iif = 1;
@@ -4136,7 +4124,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
                tb = fib_get_table(net, tbid);
                if (unlikely(!tb))
-                        return 0;
+                        return BPF_FIB_LKUP_RET_NOT_FWDED;
                err = fib_table_lookup(tb, &fl4, &res, FIB_LOOKUP_NOREF);
        } else {
@@ -4148,8 +4136,20 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
                err = fib_lookup(net, &fl4, &res, FIB_LOOKUP_NOREF);
        }
-        if (err || res.type != RTN_UNICAST)
+        if (err) {
-                return 0;
+                /* map fib lookup errors to RTN_ type */
+                if (err == -EINVAL)
+                        return BPF_FIB_LKUP_RET_BLACKHOLE;
+                if (err == -EHOSTUNREACH)
+                        return BPF_FIB_LKUP_RET_UNREACHABLE;
+                if (err == -EACCES)
+                        return BPF_FIB_LKUP_RET_PROHIBIT;
+                return BPF_FIB_LKUP_RET_NOT_FWDED;
+        }
+        if (res.type != RTN_UNICAST)
+                return BPF_FIB_LKUP_RET_NOT_FWDED;
        if (res.fi->fib_nhs > 1)
                fib_select_path(net, &res, &fl4, NULL);
@@ -4157,19 +4157,16 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
        if (check_mtu) {
                mtu = ip_mtu_from_fib_result(&res, params->ipv4_dst);
                if (params->tot_len > mtu)
-                        return 0;
+                        return BPF_FIB_LKUP_RET_FRAG_NEEDED;
        }
        nh = &res.fi->fib_nh[res.nh_sel];
        /* do not handle lwt encaps right now */
        if (nh->nh_lwtstate)
-                return 0;
+                return BPF_FIB_LKUP_RET_UNSUPP_LWT;
        dev = nh->nh_dev;
-        if (unlikely(!dev))
-                return 0;
        if (nh->nh_gw)
                params->ipv4_dst = nh->nh_gw;
@@ -4179,10 +4176,10 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
         * rcu_read_lock_bh is not needed here
         */
        neigh = __ipv4_neigh_lookup_noref(dev, (__force u32)params->ipv4_dst);
-        if (neigh)
+        if (!neigh)
-                return bpf_fib_set_fwd_params(params, neigh, dev);
+                return BPF_FIB_LKUP_RET_NO_NEIGH;
-        return 0;
+        return bpf_fib_set_fwd_params(params, neigh, dev);
 }
 #endif
@@ -4203,7 +4200,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
        /* link local addresses are never forwarded */
        if (rt6_need_strict(dst) || rt6_need_strict(src))
-                return 0;
+                return BPF_FIB_LKUP_RET_NOT_FWDED;
        dev = dev_get_by_index_rcu(net, params->ifindex);
        if (unlikely(!dev))
@@ -4211,7 +4208,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
        idev = __in6_dev_get_safely(dev);
        if (unlikely(!idev || !net->ipv6.devconf_all->forwarding))
-                return 0;
+                return BPF_FIB_LKUP_RET_FWD_DISABLED;
        if (flags & BPF_FIB_LOOKUP_OUTPUT) {
                fl6.flowi6_iif = 1;
@@ -4238,7 +4235,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
                tb = ipv6_stub->fib6_get_table(net, tbid);
                if (unlikely(!tb))
-                        return 0;
+                        return BPF_FIB_LKUP_RET_NOT_FWDED;
                f6i = ipv6_stub->fib6_table_lookup(net, tb, oif, &fl6, strict);
        } else {
@@ -4251,11 +4248,23 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
        }
        if (unlikely(IS_ERR_OR_NULL(f6i) || f6i == net->ipv6.fib6_null_entry))
-                return 0;
+                return BPF_FIB_LKUP_RET_NOT_FWDED;
+        if (unlikely(f6i->fib6_flags & RTF_REJECT)) {
+                switch (f6i->fib6_type) {
+                case RTN_BLACKHOLE:
+                        return BPF_FIB_LKUP_RET_BLACKHOLE;
+                case RTN_UNREACHABLE:
+                        return BPF_FIB_LKUP_RET_UNREACHABLE;
+                case RTN_PROHIBIT:
+                        return BPF_FIB_LKUP_RET_PROHIBIT;
+                default:
+                        return BPF_FIB_LKUP_RET_NOT_FWDED;
+                }
+        }
-        if (unlikely(f6i->fib6_flags & RTF_REJECT ||
+        if (f6i->fib6_type != RTN_UNICAST)
-            f6i->fib6_type != RTN_UNICAST))
+                return BPF_FIB_LKUP_RET_NOT_FWDED;
-                return 0;
        if (f6i->fib6_nsiblings && fl6.flowi6_oif == 0)
                f6i = ipv6_stub->fib6_multipath_select(net, f6i, &fl6,
@@ -4265,11 +4274,11 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
        if (check_mtu) {
                mtu = ipv6_stub->ip6_mtu_from_fib6(f6i, dst, src);
                if (params->tot_len > mtu)
-                        return 0;
+                        return BPF_FIB_LKUP_RET_FRAG_NEEDED;
        }
        if (f6i->fib6_nh.nh_lwtstate)
-                return 0;
+                return BPF_FIB_LKUP_RET_UNSUPP_LWT;
        if (f6i->fib6_flags & RTF_GATEWAY)
                *dst = f6i->fib6_nh.nh_gw;
@@ -4283,10 +4292,10 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
         */
        neigh = ___neigh_lookup_noref(ipv6_stub->nd_tbl, neigh_key_eq128,
                                      ndisc_hashfn, dst, dev);
-        if (neigh)
+        if (!neigh)
-                return bpf_fib_set_fwd_params(params, neigh, dev);
+                return BPF_FIB_LKUP_RET_NO_NEIGH;
-        return 0;
+        return bpf_fib_set_fwd_params(params, neigh, dev);
 }
 #endif
@@ -4328,7 +4337,7 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
           struct bpf_fib_lookup *, params, int, plen, u32, flags)
 {
        struct net *net = dev_net(skb->dev);
-        int index = -EAFNOSUPPORT;
+        int rc = -EAFNOSUPPORT;
        if (plen < sizeof(*params))
                return -EINVAL;
@@ -4339,25 +4348,25 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
        switch (params->family) {
 #if IS_ENABLED(CONFIG_INET)
        case AF_INET:
-                index = bpf_ipv4_fib_lookup(net, params, flags, false);
+                rc = bpf_ipv4_fib_lookup(net, params, flags, false);
                break;
 #endif
 #if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
-                index = bpf_ipv6_fib_lookup(net, params, flags, false);
+                rc = bpf_ipv6_fib_lookup(net, params, flags, false);
                break;
 #endif
        }
-        if (index > 0) {
+        if (!rc) {
                struct net_device *dev;
-                dev = dev_get_by_index_rcu(net, index);
+                dev = dev_get_by_index_rcu(net, params->ifindex);
                if (!is_skb_forwardable(dev, skb))
-                        index = 0;
+                        rc = BPF_FIB_LKUP_RET_FRAG_NEEDED;
        }
-        return index;
+        return rc;
 }
 static const struct bpf_func_proto bpf_skb_fib_lookup_proto = {
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index a7a9c3d738ba..8e3fda9e725c 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -119,13 +119,14 @@ unsigned long neigh_rand_reach_time(unsigned long base)
 EXPORT_SYMBOL(neigh_rand_reach_time);
-static bool neigh_del(struct neighbour *n, __u8 state,
+static bool neigh_del(struct neighbour *n, __u8 state, __u8 flags,
                      struct neighbour __rcu **np, struct neigh_table *tbl)
 {
        bool retval = false;
        write_lock(&n->lock);
-        if (refcount_read(&n->refcnt) == 1 && !(n->nud_state & state)) {
+        if (refcount_read(&n->refcnt) == 1 && !(n->nud_state & state) &&
+            !(n->flags & flags)) {
                struct neighbour *neigh;
                neigh = rcu_dereference_protected(n->next,
@@ -157,7 +158,7 @@ bool neigh_remove_one(struct neighbour *ndel, struct neigh_table *tbl)
        while ((n = rcu_dereference_protected(*np,
                                              lockdep_is_held(&tbl->lock)))) {
                if (n == ndel)
-                        return neigh_del(n, 0, np, tbl);
+                        return neigh_del(n, 0, 0, np, tbl);
                np = &n->next;
        }
        return false;
@@ -185,7 +186,8 @@ static int neigh_forced_gc(struct neigh_table *tbl)
                         * - nobody refers to it.
                         * - it is not permanent
                         */
-                        if (neigh_del(n, NUD_PERMANENT, np, tbl)) {
+                        if (neigh_del(n, NUD_PERMANENT, NTF_EXT_LEARNED, np,
+                                      tbl)) {
                                shrunk = 1;
                                continue;
                        }
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 7e4ede34cc52..49368e21d228 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3603,7 +3603,8 @@ static int pktgen_add_device(struct pktgen_thread *t, const char *ifname)
                return -ENOMEM;
        strcpy(pkt_dev->odevname, ifname);
-        pkt_dev->flows = vzalloc_node(MAX_CFLOWS * sizeof(struct flow_state),
+        pkt_dev->flows = vzalloc_node(array_size(MAX_CFLOWS,
+                                                 sizeof(struct flow_state)),
                                      node);
        if (pkt_dev->flows == NULL) {
                kfree(pkt_dev);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index c642304f178c..eba8dae22c25 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5276,8 +5276,7 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len,
                        if (npages >= 1 << order) {
                                page = alloc_pages((gfp_mask & ~__GFP_DIRECT_RECLAIM) |
                                                   __GFP_COMP |
-                                                   __GFP_NOWARN |
+                                                   __GFP_NOWARN,
-                                                   __GFP_NORETRY,
                                                   order);
                                if (page)
                                        goto fill_page;
diff --git a/net/core/sock.c b/net/core/sock.c
index f333d75ef1a9..9e8f65585b81 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -728,22 +728,9 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
                        sock_valbool_flag(sk, SOCK_DBG, valbool);
                break;
        case SO_REUSEADDR:
-                val = (valbool ? SK_CAN_REUSE : SK_NO_REUSE);
+                sk->sk_reuse = (valbool ? SK_CAN_REUSE : SK_NO_REUSE);
-                if ((sk->sk_family == PF_INET || sk->sk_family == PF_INET6) &&
-                    inet_sk(sk)->inet_num &&
-                    (sk->sk_reuse != val)) {
-                        ret = (sk->sk_state == TCP_ESTABLISHED) ? -EISCONN : -EUCLEAN;
-                        break;
-                }
-                sk->sk_reuse = val;
                break;
        case SO_REUSEPORT:
-                if ((sk->sk_family == PF_INET || sk->sk_family == PF_INET6) &&
-                    inet_sk(sk)->inet_num &&
-                    (sk->sk_reuseport != valbool)) {
-                        ret = (sk->sk_state == TCP_ESTABLISHED) ? -EISCONN : -EUCLEAN;
-                        break;
-                }
                sk->sk_reuseport = valbool;
                break;
        case SO_TYPE:
@@ -3256,7 +3243,8 @@ static int req_prot_init(const struct proto *prot)
        rsk_prot->slab = kmem_cache_create(rsk_prot->slab_name,
                                           rsk_prot->obj_size, 0,
-                                           prot->slab_flags, NULL);
+                                           SLAB_ACCOUNT | prot->slab_flags,
+                                           NULL);
        if (!rsk_prot->slab) {
                pr_crit("%s: Can't create request sock SLAB cache!\n",
@@ -3271,7 +3259,8 @@ int proto_register(struct proto *prot, int alloc_slab)
        if (alloc_slab) {
                prot->slab = kmem_cache_create_usercopy(prot->name,
                                        prot->obj_size, 0,
-                                        SLAB_HWCACHE_ALIGN | prot->slab_flags,
+                                        SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT |
+                                        prot->slab_flags,
                                        prot->useroffset, prot->usersize,
                                        NULL);
@@ -3294,6 +3283,7 @@ int proto_register(struct proto *prot, int alloc_slab)
                                kmem_cache_create(prot->twsk_prot->twsk_slab_name,
                                                  prot->twsk_prot->twsk_obj_size,
                                                  0,
+                                                  SLAB_ACCOUNT |
                                                  prot->slab_flags,
                                                  NULL);
                        if (prot->twsk_prot->twsk_slab == NULL)
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index d2f4e0c1faaf..2589a6b78aa1 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -984,7 +984,8 @@ static int dcbnl_build_peer_app(struct net_device *netdev, struct sk_buff* skb,
         */
        err = ops->peer_getappinfo(netdev, &info, &app_count);
        if (!err && app_count) {
-                table = kmalloc(sizeof(struct dcb_app) * app_count, GFP_KERNEL);
+                table = kmalloc_array(app_count, sizeof(struct dcb_app),
+                                      GFP_KERNEL);
                if (!table)
                        return -ENOMEM;
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 385f153fe031..2b75df469220 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -46,7 +46,8 @@ static int ccid2_hc_tx_alloc_seq(struct ccid2_hc_tx_sock *hc)
                return -ENOMEM;
        /* allocate buffer and initialize linked list */
-        seqp = kmalloc(CCID2_SEQBUF_LEN * sizeof(struct ccid2_seq), gfp_any());
+        seqp = kmalloc_array(CCID2_SEQBUF_LEN, sizeof(struct ccid2_seq),
+                             gfp_any());
        if (seqp == NULL)
                return -ENOMEM;
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 8b5ba6dffac7..12877a1514e7 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -600,7 +600,7 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk,
 {
        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
        struct dccp_sock *dp = dccp_sk(sk);
-        ktime_t now = ktime_get_real();
+        ktime_t now = ktime_get();
        s64 delta = 0;
        switch (fbtype) {
@@ -625,15 +625,14 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk,
        case CCID3_FBACK_PERIODIC:
                delta = ktime_us_delta(now, hc->rx_tstamp_last_feedback);
                if (delta <= 0)
-                        DCCP_BUG("delta (%ld) <= 0", (long)delta);
+                        delta = 1;
-                else
+                hc->rx_x_recv = scaled_div32(hc->rx_bytes_recv, delta);
-                        hc->rx_x_recv = scaled_div32(hc->rx_bytes_recv, delta);
                break;
        default:
                return;
        }
-        ccid3_pr_debug("Interval %ldusec, X_recv=%u, 1/p=%u\n", (long)delta,
+        ccid3_pr_debug("Interval %lldusec, X_recv=%u, 1/p=%u\n", delta,
                       hc->rx_x_recv, hc->rx_pinv);
        hc->rx_tstamp_last_feedback = now;
@@ -680,7 +679,8 @@ static int ccid3_hc_rx_insert_options(struct sock *sk, struct sk_buff *skb)
 static u32 ccid3_first_li(struct sock *sk)
 {
        struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk);
-        u32 x_recv, p, delta;
+        u32 x_recv, p;
+        s64 delta;
        u64 fval;
        if (hc->rx_rtt == 0) {
@@ -688,7 +688,9 @@ static u32 ccid3_first_li(struct sock *sk)
                hc->rx_rtt = DCCP_FALLBACK_RTT;
        }
-        delta  = ktime_to_us(net_timedelta(hc->rx_tstamp_last_feedback));
+        delta = ktime_us_delta(ktime_get(), hc->rx_tstamp_last_feedback);
+        if (delta <= 0)
+                delta = 1;
        x_recv = scaled_div32(hc->rx_bytes_recv, delta);
        if (x_recv == 0) {              /* would also trigger divide-by-zero */
                DCCP_WARN("X_recv==0\n");
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index 0ea2ee56ac1b..f91e3816806b 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -316,7 +316,8 @@ int dccp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
                 int flags, int *addr_len);
 void dccp_shutdown(struct sock *sk, int how);
 int inet_dccp_listen(struct socket *sock, int backlog);
-__poll_t dccp_poll_mask(struct socket *sock, __poll_t events);
+__poll_t dccp_poll(struct file *file, struct socket *sock,
+                       poll_table *wait);
 int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len);
 void dccp_req_err(struct sock *sk, u64 seq);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index a9e478cd3787..b08feb219b44 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -984,7 +984,7 @@ static const struct proto_ops inet_dccp_ops = {
        .accept            = inet_accept,
        .getname           = inet_getname,
        /* FIXME: work on tcp_poll to rename it to inet_csk_poll */
-        .poll_mask         = dccp_poll_mask,
+        .poll              = dccp_poll,
        .ioctl             = inet_ioctl,
        /* FIXME: work on inet_listen to rename it to sock_common_listen */
        .listen            = inet_dccp_listen,
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 17fc4e0166ba..6344f1b18a6a 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -1070,7 +1070,7 @@ static const struct proto_ops inet6_dccp_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = inet_accept,
        .getname           = inet6_getname,
-        .poll_mask         = dccp_poll_mask,
+        .poll              = dccp_poll,
        .ioctl             = inet6_ioctl,
        .listen            = inet_dccp_listen,
        .shutdown          = inet_shutdown,
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index ca21c1c76da0..0d56e36a6db7 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -312,11 +312,20 @@ int dccp_disconnect(struct sock *sk, int flags)
 EXPORT_SYMBOL_GPL(dccp_disconnect);
-__poll_t dccp_poll_mask(struct socket *sock, __poll_t events)
+/*
+ *      Wait for a DCCP event.
+ *
+ *      Note that we don't need to lock the socket, as the upper poll layers
+ *      take care of normal races (between the test and the event) and we don't
+ *      go look at any of the socket buffers directly.
+ */
+__poll_t dccp_poll(struct file *file, struct socket *sock,
+                       poll_table *wait)
 {
        __poll_t mask;
        struct sock *sk = sock->sk;
+        sock_poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_state == DCCP_LISTEN)
                return inet_csk_listen_poll(sk);
@@ -358,7 +367,7 @@ __poll_t dccp_poll_mask(struct socket *sock, __poll_t events)
        return mask;
 }
-EXPORT_SYMBOL_GPL(dccp_poll_mask);
+EXPORT_SYMBOL_GPL(dccp_poll);
 int dccp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 {
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 9a686d890bfa..7d6ff983ba2c 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1207,11 +1207,11 @@ static int dn_getname(struct socket *sock, struct sockaddr *uaddr,int peer)
 }
-static __poll_t dn_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t dn_poll(struct file *file, struct socket *sock, poll_table  *wait)
 {
        struct sock *sk = sock->sk;
        struct dn_scp *scp = DN_SK(sk);
-        __poll_t mask = datagram_poll_mask(sock, events);
+        __poll_t mask = datagram_poll(file, sock, wait);
        if (!skb_queue_empty(&scp->other_receive_queue))
                mask |= EPOLLRDBAND;
@@ -2331,7 +2331,7 @@ static const struct proto_ops dn_proto_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       dn_accept,
        .getname =      dn_getname,
-        .poll_mask =    dn_poll_mask,
+        .poll =         dn_poll,
        .ioctl =        dn_ioctl,
        .listen =       dn_listen,
        .shutdown =     dn_shutdown,
diff --git a/net/dsa/tag_trailer.c b/net/dsa/tag_trailer.c
index 7d20e1f3de28..56197f0d9608 100644
--- a/net/dsa/tag_trailer.c
+++ b/net/dsa/tag_trailer.c
@@ -75,7 +75,8 @@ static struct sk_buff *trailer_rcv(struct sk_buff *skb, struct net_device *dev,
        if (!skb->dev)
                return NULL;
-        pskb_trim_rcsum(skb, skb->len - 4);
+        if (pskb_trim_rcsum(skb, skb->len - 4))
+                return NULL;
        return skb;
 }
diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index dc2960be51e0..b231e40f006a 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -38,7 +38,7 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 portid,
 {
        void *hdr;
        int i, pages = 0;
-        uint32_t *buf = kzalloc(32 * sizeof(uint32_t), GFP_KERNEL);
+        uint32_t *buf = kcalloc(32, sizeof(uint32_t), GFP_KERNEL);
        pr_debug("%s\n", __func__);
diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
index a0768d2759b8..a60658c85a9a 100644
--- a/net/ieee802154/socket.c
+++ b/net/ieee802154/socket.c
@@ -423,7 +423,7 @@ static const struct proto_ops ieee802154_raw_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = sock_no_accept,
        .getname           = sock_no_getname,
-        .poll_mask         = datagram_poll_mask,
+        .poll              = datagram_poll,
        .ioctl             = ieee802154_sock_ioctl,
        .listen            = sock_no_listen,
        .shutdown          = sock_no_shutdown,
@@ -969,7 +969,7 @@ static const struct proto_ops ieee802154_dgram_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = sock_no_accept,
        .getname           = sock_no_getname,
-        .poll_mask         = datagram_poll_mask,
+        .poll              = datagram_poll,
        .ioctl             = ieee802154_sock_ioctl,
        .listen            = sock_no_listen,
        .shutdown          = sock_no_shutdown,
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 15e125558c76..b403499fdabe 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -986,7 +986,7 @@ const struct proto_ops inet_stream_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = inet_accept,
        .getname           = inet_getname,
-        .poll_mask         = tcp_poll_mask,
+        .poll              = tcp_poll,
        .ioctl             = inet_ioctl,
        .listen            = inet_listen,
        .shutdown          = inet_shutdown,
@@ -1021,7 +1021,7 @@ const struct proto_ops inet_dgram_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = sock_no_accept,
        .getname           = inet_getname,
-        .poll_mask         = udp_poll_mask,
+        .poll              = udp_poll,
        .ioctl             = inet_ioctl,
        .listen            = sock_no_listen,
        .shutdown          = inet_shutdown,
@@ -1042,7 +1042,7 @@ EXPORT_SYMBOL(inet_dgram_ops);
 /*
 * For SOCK_RAW sockets; should be the same as inet_dgram_ops but without
- * udp_poll_mask
+ * udp_poll
 */
 static const struct proto_ops inet_sockraw_ops = {
        .family            = PF_INET,
@@ -1053,7 +1053,7 @@ static const struct proto_ops inet_sockraw_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = sock_no_accept,
        .getname           = inet_getname,
-        .poll_mask         = datagram_poll_mask,
+        .poll              = datagram_poll,
        .ioctl             = inet_ioctl,
        .listen            = sock_no_listen,
        .shutdown          = inet_shutdown,
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 63aa39b3af03..b21833651394 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -567,7 +567,7 @@ static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt,
                struct nlattr *mx;
                int len = 0;
-                mx = kzalloc(3 * nla_total_size(4), GFP_KERNEL);
+                mx = kcalloc(3, nla_total_size(4), GFP_KERNEL);
                if (!mx)
                        return -ENOMEM;
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index 1540db65241a..c9ec1603666b 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -448,9 +448,7 @@ next_proto:
 out_unlock:
        rcu_read_unlock();
 out:
-        NAPI_GRO_CB(skb)->flush |= flush;
+        skb_gro_flush_final_remcsum(skb, pp, flush, &grc);
-        skb_gro_remcsum_cleanup(skb, &grc);
-        skb->remcsum_offload = 0;
        return pp;
 }
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index 1859c473b21a..6a7d980105f6 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -223,7 +223,7 @@ static struct sk_buff **gre_gro_receive(struct sk_buff **head,
 out_unlock:
        rcu_read_unlock();
 out:
-        NAPI_GRO_CB(skb)->flush |= flush;
+        skb_gro_flush_final(skb, pp, flush);
        return pp;
 }
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 31ff46daae97..3647167c8fa3 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -243,9 +243,9 @@ static inline int compute_score(struct sock *sk, struct net *net,
                        bool dev_match = (sk->sk_bound_dev_if == dif ||
                                          sk->sk_bound_dev_if == sdif);
-                        if (exact_dif && !dev_match)
+                        if (!dev_match)
                                return -1;
-                        if (sk->sk_bound_dev_if && dev_match)
+                        if (sk->sk_bound_dev_if)
                                score += 4;
                }
                if (sk->sk_incoming_cpu == raw_smp_processor_id())
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index af5a830ff6ad..b3308e9d9762 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1145,7 +1145,8 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
        cork->fragsize = ip_sk_use_pmtu(sk) ?
                         dst_mtu(&rt->dst) : rt->dst.dev->mtu;
-        cork->gso_size = sk->sk_type == SOCK_DGRAM ? ipc->gso_size : 0;
+        cork->gso_size = sk->sk_type == SOCK_DGRAM &&
+                         sk->sk_protocol == IPPROTO_UDP ? ipc->gso_size : 0;
        cork->dst = &rt->dst;
        cork->length = 0;
        cork->ttl = ipc->ttl;
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 38d906baf1df..c4f5602308ed 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -261,8 +261,8 @@ static struct net_device *__ip_tunnel_create(struct net *net,
        } else {
                if (strlen(ops->kind) > (IFNAMSIZ - 3))
                        goto failed;
-                strlcpy(name, ops->kind, IFNAMSIZ);
+                strcpy(name, ops->kind);
-                strncat(name, "%d", 2);
+                strcat(name, "%d");
        }
        ASSERT_RTNL();
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 38ab97b0a2ec..ca0dad90803a 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -531,6 +531,7 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
                return -ENOMEM;
        j = 0;
+        memset(&mtpar, 0, sizeof(mtpar));
        mtpar.net       = net;
        mtpar.table     = name;
        mtpar.entryinfo = &e->ip;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index bf4e4adc2d00..1df6e97106d7 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -649,7 +649,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
        hash = rcu_dereference(nh->nh_exceptions);
        if (!hash) {
-                hash = kzalloc(FNHE_HASH_SIZE * sizeof(*hash), GFP_ATOMIC);
+                hash = kcalloc(FNHE_HASH_SIZE, sizeof(*hash), GFP_ATOMIC);
                if (!hash)
                        goto out_unlock;
                rcu_assign_pointer(nh->nh_exceptions, hash);
@@ -3146,7 +3146,8 @@ int __init ip_rt_init(void)
 {
        int cpu;
-        ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
+        ip_idents = kmalloc_array(IP_IDENTS_SZ, sizeof(*ip_idents),
+                                  GFP_KERNEL);
        if (!ip_idents)
                panic("IP: failed to allocate ip_idents\n");
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index d06247ba08b2..af0a857d8352 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -265,8 +265,9 @@ static int proc_tcp_fastopen_key(struct ctl_table *table, int write,
            ipv4.sysctl_tcp_fastopen);
        struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
        struct tcp_fastopen_context *ctxt;
-        int ret;
        u32  user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */
+        __le32 key[4];
+        int ret, i;
        tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL);
        if (!tbl.data)
@@ -275,11 +276,14 @@ static int proc_tcp_fastopen_key(struct ctl_table *table, int write,
        rcu_read_lock();
        ctxt = rcu_dereference(net->ipv4.tcp_fastopen_ctx);
        if (ctxt)
-                memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
+                memcpy(key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
        else
-                memset(user_key, 0, sizeof(user_key));
+                memset(key, 0, sizeof(key));
        rcu_read_unlock();
+        for (i = 0; i < ARRAY_SIZE(key); i++)
+                user_key[i] = le32_to_cpu(key[i]);
        snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x",
                user_key[0], user_key[1], user_key[2], user_key[3]);
        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
@@ -290,13 +294,17 @@ static int proc_tcp_fastopen_key(struct ctl_table *table, int write,
                        ret = -EINVAL;
                        goto bad_key;
                }
-                tcp_fastopen_reset_cipher(net, NULL, user_key,
+                for (i = 0; i < ARRAY_SIZE(user_key); i++)
+                        key[i] = cpu_to_le32(user_key[i]);
+                tcp_fastopen_reset_cipher(net, NULL, key,
                                          TCP_FASTOPEN_KEY_LENGTH);
        }
 bad_key:
        pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n",
-               user_key[0], user_key[1], user_key[2], user_key[3],
+                user_key[0], user_key[1], user_key[2], user_key[3],
               (char *)tbl.data, ret);
        kfree(tbl.data);
        return ret;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2741953adaba..e7b53d2a971f 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -494,21 +494,32 @@ static inline bool tcp_stream_is_readable(const struct tcp_sock *tp,
 }
 /*
- * Socket is not locked. We are protected from async events by poll logic and
+ *      Wait for a TCP event.
- * correct handling of state changes made by other threads is impossible in
+ *
- * any case.
+ *      Note that we don't need to lock the socket, as the upper poll layers
+ *      take care of normal races (between the test and the event) and we don't
+ *      go look at any of the socket buffers directly.
 */
-__poll_t tcp_poll_mask(struct socket *sock, __poll_t events)
+__poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
+        __poll_t mask;
        struct sock *sk = sock->sk;
        const struct tcp_sock *tp = tcp_sk(sk);
-        __poll_t mask = 0;
        int state;
+        sock_poll_wait(file, sk_sleep(sk), wait);
        state = inet_sk_state_load(sk);
        if (state == TCP_LISTEN)
                return inet_csk_listen_poll(sk);
+        /* Socket is not locked. We are protected from async events
+         * by poll logic and correct handling of state changes
+         * made by other threads is impossible in any case.
+         */
+        mask = 0;
        /*
         * EPOLLHUP is certainly not done right. But poll() doesn't
         * have a notion of HUP in just one direction, and for a
@@ -589,7 +600,7 @@ __poll_t tcp_poll_mask(struct socket *sock, __poll_t events)
        return mask;
 }
-EXPORT_SYMBOL(tcp_poll_mask);
+EXPORT_SYMBOL(tcp_poll);
 int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 {
@@ -1694,6 +1705,13 @@ EXPORT_SYMBOL(tcp_peek_len);
 /* Make sure sk_rcvbuf is big enough to satisfy SO_RCVLOWAT hint */
 int tcp_set_rcvlowat(struct sock *sk, int val)
 {
+        int cap;
+        if (sk->sk_userlocks & SOCK_RCVBUF_LOCK)
+                cap = sk->sk_rcvbuf >> 1;
+        else
+                cap = sock_net(sk)->ipv4.sysctl_tcp_rmem[2] >> 1;
+        val = min(val, cap);
        sk->sk_rcvlowat = val ? : 1;
        /* Check if we need to signal EPOLLIN right now */
@@ -1702,12 +1720,7 @@ int tcp_set_rcvlowat(struct sock *sk, int val)
        if (sk->sk_userlocks & SOCK_RCVBUF_LOCK)
                return 0;
-        /* val comes from user space and might be close to INT_MAX */
        val <<= 1;
-        if (val < 0)
-                val = INT_MAX;
-        val = min(val, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
        if (val > sk->sk_rcvbuf) {
                sk->sk_rcvbuf = val;
                tcp_sk(sk)->window_clamp = tcp_win_from_space(sk, val);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 355d3dffd021..8e5522c6833a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -265,7 +265,7 @@ static void __tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb)
                 * it is probably a retransmit.
                 */
                if (tp->ecn_flags & TCP_ECN_SEEN)
-                        tcp_enter_quickack_mode(sk, 1);
+                        tcp_enter_quickack_mode(sk, 2);
                break;
        case INET_ECN_CE:
                if (tcp_ca_needs_ecn(sk))
@@ -273,7 +273,7 @@ static void __tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb)
                if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
                        /* Better not delay acks, sender can have a very low cwnd */
-                        tcp_enter_quickack_mode(sk, 1);
+                        tcp_enter_quickack_mode(sk, 2);
                        tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
                }
                tp->ecn_flags |= TCP_ECN_SEEN;
@@ -3181,6 +3181,15 @@ static int tcp_clean_rtx_queue(struct sock *sk, u32 prior_fack,
                if (tcp_is_reno(tp)) {
                        tcp_remove_reno_sacks(sk, pkts_acked);
+                        /* If any of the cumulatively ACKed segments was
+                         * retransmitted, non-SACK case cannot confirm that
+                         * progress was due to original transmission due to
+                         * lack of TCPCB_SACKED_ACKED bits even if some of
+                         * the packets may have been never retransmitted.
+                         */
+                        if (flag & FLAG_RETRANS_DATA_ACKED)
+                                flag &= ~FLAG_ORIG_SACK_ACKED;
                } else {
                        int delta;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index fed3f1c66167..bea17f1e8302 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1730,6 +1730,10 @@ process:
                        reqsk_put(req);
                        goto discard_it;
                }
+                if (tcp_checksum_complete(skb)) {
+                        reqsk_put(req);
+                        goto csum_error;
+                }
                if (unlikely(sk->sk_state != TCP_LISTEN)) {
                        inet_csk_reqsk_queue_drop_and_put(sk, req);
                        goto lookup;
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index 4d58e2ce0b5b..8cc7c3487330 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -268,8 +268,6 @@ found:
                goto out_check_final;
        }
-        p = *head;
-        th2 = tcp_hdr(p);
        tcp_flag_word(th2) |= flags & (TCP_FLAG_FIN | TCP_FLAG_PSH);
 out_check_final:
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 3365362cac88..24e116ddae79 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2591,7 +2591,7 @@ int compat_udp_getsockopt(struct sock *sk, int level, int optname,
 *      udp_poll - wait for a UDP event.
 *      @file - file struct
 *      @sock - socket
- *      @events - events to wait for
+ *      @wait - poll table
 *
 *      This is same as datagram poll, except for the special case of
 *      blocking sockets. If application is using a blocking fd
@@ -2600,23 +2600,23 @@ int compat_udp_getsockopt(struct sock *sk, int level, int optname,
 *      but then block when reading it. Add special case code
 *      to work around these arguably broken applications.
 */
-__poll_t udp_poll_mask(struct socket *sock, __poll_t events)
+__poll_t udp_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
-        __poll_t mask = datagram_poll_mask(sock, events);
+        __poll_t mask = datagram_poll(file, sock, wait);
        struct sock *sk = sock->sk;
        if (!skb_queue_empty(&udp_sk(sk)->reader_queue))
                mask |= EPOLLIN | EPOLLRDNORM;
        /* Check for false positives due to checksum errors */
-        if ((mask & EPOLLRDNORM) && !(sock->file->f_flags & O_NONBLOCK) &&
+        if ((mask & EPOLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
            !(sk->sk_shutdown & RCV_SHUTDOWN) && first_packet_length(sk) == -1)
                mask &= ~(EPOLLIN | EPOLLRDNORM);
        return mask;
 }
-EXPORT_SYMBOL(udp_poll_mask);
+EXPORT_SYMBOL(udp_poll);
 int udp_abort(struct sock *sk, int err)
 {
@@ -2772,7 +2772,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
                " %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d",
                bucket, src, srcp, dest, destp, sp->sk_state,
                sk_wmem_alloc_get(sp),
-                sk_rmem_alloc_get(sp),
+                udp_rqueue_get(sp),
                0, 0L, 0,
                from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
                0, sock_i_ino(sp),
diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
index d0390d844ac8..d9ad986c7b2c 100644
--- a/net/ipv4/udp_diag.c
+++ b/net/ipv4/udp_diag.c
@@ -163,7 +163,7 @@ static int udp_diag_dump_one(struct sk_buff *in_skb, const struct nlmsghdr *nlh,
 static void udp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
                void *info)
 {
-        r->idiag_rqueue = sk_rmem_alloc_get(sk);
+        r->idiag_rqueue = udp_rqueue_get(sk);
        r->idiag_wqueue = sk_wmem_alloc_get(sk);
 }
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 92dc9e5a7ff3..69c54540d5b4 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -394,7 +394,7 @@ unflush:
 out_unlock:
        rcu_read_unlock();
 out:
-        NAPI_GRO_CB(skb)->flush |= flush;
+        skb_gro_flush_final(skb, pp, flush);
        return pp;
 }
 EXPORT_SYMBOL(udp_gro_receive);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 89019bf59f46..91580c62bb86 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1324,6 +1324,7 @@ retry:
                }
        }
+        memset(&cfg, 0, sizeof(cfg));
        cfg.valid_lft = min_t(__u32, ifp->valid_lft,
                              idev->cnf.temp_valid_lft + age);
        cfg.preferred_lft = cnf_temp_preferred_lft + age - idev->desync_factor;
@@ -1357,7 +1358,6 @@ retry:
        cfg.pfx = &addr;
        cfg.scope = ipv6_addr_scope(cfg.pfx);
-        cfg.rt_priority = 0;
        ift = ipv6_add_addr(idev, &cfg, block, NULL);
        if (IS_ERR(ift)) {
@@ -4528,6 +4528,7 @@ static int modify_prefix_route(struct inet6_ifaddr *ifp,
                               unsigned long expires, u32 flags)
 {
        struct fib6_info *f6i;
+        u32 prio;
        f6i = addrconf_get_prefix_route(&ifp->addr,
                                        ifp->prefix_len,
@@ -4536,13 +4537,15 @@ static int modify_prefix_route(struct inet6_ifaddr *ifp,
        if (!f6i)
                return -ENOENT;
-        if (f6i->fib6_metric != ifp->rt_priority) {
+        prio = ifp->rt_priority ? : IP6_RT_PRIO_ADDRCONF;
+        if (f6i->fib6_metric != prio) {
+                /* delete old one */
+                ip6_del_rt(dev_net(ifp->idev->dev), f6i);
                /* add new one */
                addrconf_prefix_route(&ifp->addr, ifp->prefix_len,
                                      ifp->rt_priority, ifp->idev->dev,
                                      expires, flags, GFP_KERNEL);
-                /* delete old one */
-                ip6_del_rt(dev_net(ifp->idev->dev), f6i);
        } else {
                if (!expires)
                        fib6_clean_expires(f6i);
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 74f2a261e8df..9ed0eae91758 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -570,7 +570,7 @@ const struct proto_ops inet6_stream_ops = {
        .socketpair        = sock_no_socketpair,        /* a do nothing */
        .accept            = inet_accept,               /* ok           */
        .getname           = inet6_getname,
-        .poll_mask         = tcp_poll_mask,             /* ok           */
+        .poll              = tcp_poll,                  /* ok           */
        .ioctl             = inet6_ioctl,               /* must change  */
        .listen            = inet_listen,               /* ok           */
        .shutdown          = inet_shutdown,             /* ok           */
@@ -603,7 +603,7 @@ const struct proto_ops inet6_dgram_ops = {
        .socketpair        = sock_no_socketpair,        /* a do nothing */
        .accept            = sock_no_accept,            /* a do nothing */
        .getname           = inet6_getname,
-        .poll_mask         = udp_poll_mask,             /* ok           */
+        .poll              = udp_poll,                  /* ok           */
        .ioctl             = inet6_ioctl,               /* must change  */
        .listen            = sock_no_listen,            /* ok           */
        .shutdown          = inet_shutdown,             /* ok           */
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index a02ad100f0d7..2ee08b6a86a4 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -1019,8 +1019,8 @@ exit_f:
 }
 EXPORT_SYMBOL_GPL(ip6_datagram_send_ctl);
-void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
+void __ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
-                             __u16 srcp, __u16 destp, int bucket)
+                               __u16 srcp, __u16 destp, int rqueue, int bucket)
 {
        const struct in6_addr *dest, *src;
@@ -1036,7 +1036,7 @@ void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
                   dest->s6_addr32[2], dest->s6_addr32[3], destp,
                   sp->sk_state,
                   sk_wmem_alloc_get(sp),
-                   sk_rmem_alloc_get(sp),
+                   rqueue,
                   0, 0L, 0,
                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
                   0,
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index d8c4b6374377..be491bf6ab6e 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -956,7 +956,7 @@ static int __net_init icmpv6_sk_init(struct net *net)
        int err, i, j;
        net->ipv6.icmp_sk =
-                kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
+                kcalloc(nr_cpu_ids, sizeof(struct sock *), GFP_KERNEL);
        if (!net->ipv6.icmp_sk)
                return -ENOMEM;
diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
index 44c39c5f0638..10ae13560b40 100644
--- a/net/ipv6/ila/ila_xlat.c
+++ b/net/ipv6/ila/ila_xlat.c
@@ -42,7 +42,8 @@ static int alloc_ila_locks(struct ila_net *ilan)
        size = roundup_pow_of_two(nr_pcpus * LOCKS_PER_CPU);
        if (sizeof(spinlock_t) != 0) {
-                ilan->locks = kvmalloc(size * sizeof(spinlock_t), GFP_KERNEL);
+                ilan->locks = kvmalloc_array(size, sizeof(spinlock_t),
+                                             GFP_KERNEL);
                if (!ilan->locks)
                        return -ENOMEM;
                for (i = 0; i < size; i++)
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 2febe26de6a1..595ad408dba0 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -113,9 +113,9 @@ static inline int compute_score(struct sock *sk, struct net *net,
                        bool dev_match = (sk->sk_bound_dev_if == dif ||
                                          sk->sk_bound_dev_if == sdif);
-                        if (exact_dif && !dev_match)
+                        if (!dev_match)
                                return -1;
-                        if (sk->sk_bound_dev_if && dev_match)
+                        if (sk->sk_bound_dev_if)
                                score++;
                }
                if (sk->sk_incoming_cpu == raw_smp_processor_id())
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 7aa4c41a3bd9..1fb2f3118d60 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -167,8 +167,9 @@ struct fib6_info *fib6_info_alloc(gfp_t gfp_flags)
        return f6i;
 }
-void fib6_info_destroy(struct fib6_info *f6i)
+void fib6_info_destroy_rcu(struct rcu_head *head)
 {
+        struct fib6_info *f6i = container_of(head, struct fib6_info, rcu);
        struct rt6_exception_bucket *bucket;
        struct dst_metrics *m;
@@ -206,7 +207,7 @@ void fib6_info_destroy(struct fib6_info *f6i)
        kfree(f6i);
 }
-EXPORT_SYMBOL_GPL(fib6_info_destroy);
+EXPORT_SYMBOL_GPL(fib6_info_destroy_rcu);
 static struct fib6_node *node_alloc(struct net *net)
 {
@@ -934,6 +935,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
 {
        struct fib6_info *leaf = rcu_dereference_protected(fn->leaf,
                                    lockdep_is_held(&rt->fib6_table->tb6_lock));
+        enum fib_event_type event = FIB_EVENT_ENTRY_ADD;
        struct fib6_info *iter = NULL, *match = NULL;
        struct fib6_info __rcu **ins;
        int replace = (info->nlh &&
@@ -1013,6 +1015,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
                                       "Can not append to a REJECT route");
                        return -EINVAL;
                }
+                event = FIB_EVENT_ENTRY_APPEND;
                rt->fib6_nsiblings = match->fib6_nsiblings;
                list_add_tail(&rt->fib6_siblings, &match->fib6_siblings);
                match->fib6_nsiblings++;
@@ -1034,15 +1037,12 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
         *      insert node
         */
        if (!replace) {
-                enum fib_event_type event;
                if (!add)
                        pr_warn("NLM_F_CREATE should be set when creating new route\n");
 add:
                nlflags |= NLM_F_CREATE;
-                event = append ? FIB_EVENT_ENTRY_APPEND : FIB_EVENT_ENTRY_ADD;
                err = call_fib6_entry_notifiers(info->nl_net, event, rt,
                                                extack);
                if (err)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 021e5aef6ba3..a14fb4fcdf18 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1219,7 +1219,8 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
        if (mtu < IPV6_MIN_MTU)
                return -EINVAL;
        cork->base.fragsize = mtu;
-        cork->base.gso_size = sk->sk_type == SOCK_DGRAM ? ipc6->gso_size : 0;
+        cork->base.gso_size = sk->sk_type == SOCK_DGRAM &&
+                              sk->sk_protocol == IPPROTO_UDP ? ipc6->gso_size : 0;
        if (dst_allfrag(xfrm_dst_path(&rt->dst)))
                cork->base.flags |= IPCORK_ALLFRAG;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 975021df7c1c..c0c74088f2af 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2082,7 +2082,8 @@ void ipv6_mc_dad_complete(struct inet6_dev *idev)
                mld_send_initial_cr(idev);
                idev->mc_dad_count--;
                if (idev->mc_dad_count)
-                        mld_dad_start_timer(idev, idev->mc_maxdelay);
+                        mld_dad_start_timer(idev,
+                                            unsolicited_report_interval(idev));
        }
 }
@@ -2094,7 +2095,8 @@ static void mld_dad_timer_expire(struct timer_list *t)
        if (idev->mc_dad_count) {
                idev->mc_dad_count--;
                if (idev->mc_dad_count)
-                        mld_dad_start_timer(idev, idev->mc_maxdelay);
+                        mld_dad_start_timer(idev,
+                                            unsolicited_report_interval(idev));
        }
        in6_dev_put(idev);
 }
@@ -2452,7 +2454,8 @@ static void mld_ifc_timer_expire(struct timer_list *t)
        if (idev->mc_ifc_count) {
                idev->mc_ifc_count--;
                if (idev->mc_ifc_count)
-                        mld_ifc_start_timer(idev, idev->mc_maxdelay);
+                        mld_ifc_start_timer(idev,
+                                            unsolicited_report_interval(idev));
        }
        in6_dev_put(idev);
 }
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 0758b5bcfb29..7eab959734bc 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -550,6 +550,7 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
                return -ENOMEM;
        j = 0;
+        memset(&mtpar, 0, sizeof(mtpar));
        mtpar.net       = net;
        mtpar.table     = name;
        mtpar.entryinfo = &e->ipv6;
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 5e0332014c17..a452d99c9f52 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -107,7 +107,7 @@ static int nf_ct_frag6_sysctl_register(struct net *net)
        if (hdr == NULL)
                goto err_reg;
-        net->nf_frag.sysctl.frags_hdr = hdr;
+        net->nf_frag_frags_hdr = hdr;
        return 0;
 err_reg:
@@ -121,8 +121,8 @@ static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
 {
        struct ctl_table *table;
-        table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg;
+        table = net->nf_frag_frags_hdr->ctl_table_arg;
-        unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr);
+        unregister_net_sysctl_table(net->nf_frag_frags_hdr);
        if (!net_eq(net, &init_net))
                kfree(table);
 }
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index ce6f0d15b5dd..afc307c89d1a 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1334,7 +1334,7 @@ void raw6_proc_exit(void)
 }
 #endif  /* CONFIG_PROC_FS */
-/* Same as inet6_dgram_ops, sans udp_poll_mask.  */
+/* Same as inet6_dgram_ops, sans udp_poll.  */
 const struct proto_ops inet6_sockraw_ops = {
        .family            = PF_INET6,
        .owner             = THIS_MODULE,
@@ -1344,7 +1344,7 @@ const struct proto_ops inet6_sockraw_ops = {
        .socketpair        = sock_no_socketpair,        /* a do nothing */
        .accept            = sock_no_accept,            /* a do nothing */
        .getname           = inet6_getname,
-        .poll_mask         = datagram_poll_mask,        /* ok           */
+        .poll              = datagram_poll,             /* ok           */
        .ioctl             = inet6_ioctl,               /* must change  */
        .listen            = sock_no_listen,            /* ok           */
        .shutdown          = inet_shutdown,             /* ok           */
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index fb956989adaf..86a0e4333d42 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2307,9 +2307,6 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
        const struct in6_addr *daddr, *saddr;
        struct rt6_info *rt6 = (struct rt6_info *)dst;
-        if (rt6->rt6i_flags & RTF_LOCAL)
-                return;
        if (dst_metric_locked(dst, RTAX_MTU))
                return;
diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c
index 33fb35cbfac1..558fe8cc6d43 100644
--- a/net/ipv6/seg6_hmac.c
+++ b/net/ipv6/seg6_hmac.c
@@ -373,7 +373,7 @@ static int seg6_hmac_init_algo(void)
                        return -ENOMEM;
                for_each_possible_cpu(cpu) {
-                        tfm = crypto_alloc_shash(algo->name, 0, GFP_KERNEL);
+                        tfm = crypto_alloc_shash(algo->name, 0, 0);
                        if (IS_ERR(tfm))
                                return PTR_ERR(tfm);
                        p_tfm = per_cpu_ptr(algo->tfms, cpu);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index b620d9b72e59..7efa9fd7e109 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1479,6 +1479,10 @@ process:
                        reqsk_put(req);
                        goto discard_it;
                }
+                if (tcp_checksum_complete(skb)) {
+                        reqsk_put(req);
+                        goto csum_error;
+                }
                if (unlikely(sk->sk_state != TCP_LISTEN)) {
                        inet_csk_reqsk_queue_drop_and_put(sk, req);
                        goto lookup;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 164afd31aebf..e6645cae403e 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1523,7 +1523,8 @@ int udp6_seq_show(struct seq_file *seq, void *v)
                struct inet_sock *inet = inet_sk(v);
                __u16 srcp = ntohs(inet->inet_sport);
                __u16 destp = ntohs(inet->inet_dport);
-                ip6_dgram_sock_seq_show(seq, v, srcp, destp, bucket);
+                __ip6_dgram_sock_seq_show(seq, v, srcp, destp,
+                                          udp_rqueue_get(v), bucket);
        }
        return 0;
 }
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 68e86257a549..893a022f9620 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1488,11 +1488,14 @@ static inline __poll_t iucv_accept_poll(struct sock *parent)
        return 0;
 }
-static __poll_t iucv_sock_poll_mask(struct socket *sock, __poll_t events)
+__poll_t iucv_sock_poll(struct file *file, struct socket *sock,
+                            poll_table *wait)
 {
        struct sock *sk = sock->sk;
        __poll_t mask = 0;
+        sock_poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_state == IUCV_LISTEN)
                return iucv_accept_poll(sk);
@@ -2385,7 +2388,7 @@ static const struct proto_ops iucv_sock_ops = {
        .getname        = iucv_sock_getname,
        .sendmsg        = iucv_sock_sendmsg,
        .recvmsg        = iucv_sock_recvmsg,
-        .poll_mask      = iucv_sock_poll_mask,
+        .poll           = iucv_sock_poll,
        .ioctl          = sock_no_ioctl,
        .mmap           = sock_no_mmap,
        .socketpair     = sock_no_socketpair,
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 84b7d5c6fec8..d3601d421571 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1336,9 +1336,9 @@ static void init_kcm_sock(struct kcm_sock *kcm, struct kcm_mux *mux)
        struct list_head *head;
        int index = 0;
-        /* For SOCK_SEQPACKET sock type, datagram_poll_mask checks the sk_state,
+        /* For SOCK_SEQPACKET sock type, datagram_poll checks the sk_state, so
-         * so  we set sk_state, otherwise epoll_wait always returns right away
+         * we set sk_state, otherwise epoll_wait always returns right away with
-         * with EPOLLHUP
+         * EPOLLHUP
         */
        kcm->sk.sk_state = TCP_ESTABLISHED;
@@ -1903,7 +1903,7 @@ static const struct proto_ops kcm_dgram_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      sock_no_getname,
-        .poll_mask =    datagram_poll_mask,
+        .poll =         datagram_poll,
        .ioctl =        kcm_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     sock_no_shutdown,
@@ -1924,7 +1924,7 @@ static const struct proto_ops kcm_seqpacket_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      sock_no_getname,
-        .poll_mask =    datagram_poll_mask,
+        .poll =         datagram_poll,
        .ioctl =        kcm_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     sock_no_shutdown,
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 8bdc1cbe490a..5e1d2946ffbf 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3751,7 +3751,7 @@ static const struct proto_ops pfkey_ops = {
        /* Now the operations that really occur. */
        .release        =       pfkey_release,
-        .poll_mask      =       datagram_poll_mask,
+        .poll           =       datagram_poll,
        .sendmsg        =       pfkey_sendmsg,
        .recvmsg        =       pfkey_recvmsg,
 };
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 181073bf6925..a9c05b2bc1b0 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -613,7 +613,7 @@ static const struct proto_ops l2tp_ip_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = sock_no_accept,
        .getname           = l2tp_ip_getname,
-        .poll_mask         = datagram_poll_mask,
+        .poll              = datagram_poll,
        .ioctl             = inet_ioctl,
        .listen            = sock_no_listen,
        .shutdown          = inet_shutdown,
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 336e4c00abbc..957369192ca1 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -754,7 +754,7 @@ static const struct proto_ops l2tp_ip6_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = sock_no_accept,
        .getname           = l2tp_ip6_getname,
-        .poll_mask         = datagram_poll_mask,
+        .poll              = datagram_poll,
        .ioctl             = inet6_ioctl,
        .listen            = sock_no_listen,
        .shutdown          = inet_shutdown,
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index 6616c9fd292f..5b9900889e31 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -553,6 +553,12 @@ static int l2tp_nl_cmd_session_create(struct sk_buff *skb, struct genl_info *inf
                goto out_tunnel;
        }
+        /* L2TPv2 only accepts PPP pseudo-wires */
+        if (tunnel->version == 2 && cfg.pw_type != L2TP_PWTYPE_PPP) {
+                ret = -EPROTONOSUPPORT;
+                goto out_tunnel;
+        }
        if (tunnel->version > 2) {
                if (info->attrs[L2TP_ATTR_DATA_SEQ])
                        cfg.data_seq = nla_get_u8(info->attrs[L2TP_ATTR_DATA_SEQ]);
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index b56cb1df4fc0..e398797878a9 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -612,6 +612,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
        u32 session_id, peer_session_id;
        bool drop_refcnt = false;
        bool drop_tunnel = false;
+        bool new_session = false;
+        bool new_tunnel = false;
        int ver = 2;
        int fd;
@@ -701,6 +703,15 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
                                .encap = L2TP_ENCAPTYPE_UDP,
                                .debug = 0,
                        };
+                        /* Prevent l2tp_tunnel_register() from trying to set up
+                         * a kernel socket.
+                         */
+                        if (fd < 0) {
+                                error = -EBADF;
+                                goto end;
+                        }
                        error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel);
                        if (error < 0)
                                goto end;
@@ -713,6 +724,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
                                goto end;
                        }
                        drop_tunnel = true;
+                        new_tunnel = true;
                }
        } else {
                /* Error if we can't find the tunnel */
@@ -734,6 +746,12 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
        session = l2tp_session_get(sock_net(sk), tunnel, session_id);
        if (session) {
                drop_refcnt = true;
+                if (session->pwtype != L2TP_PWTYPE_PPP) {
+                        error = -EPROTOTYPE;
+                        goto end;
+                }
                ps = l2tp_session_priv(session);
                /* Using a pre-existing session is fine as long as it hasn't
@@ -751,6 +769,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
                /* Default MTU must allow space for UDP/L2TP/PPP headers */
                cfg.mtu = 1500 - PPPOL2TP_HEADER_OVERHEAD;
                cfg.mru = cfg.mtu;
+                cfg.pw_type = L2TP_PWTYPE_PPP;
                session = l2tp_session_create(sizeof(struct pppol2tp_session),
                                              tunnel, session_id,
@@ -772,6 +791,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
                        goto end;
                }
                drop_refcnt = true;
+                new_session = true;
        }
        /* Special case: if source & dest session_id == 0x0000, this
@@ -818,6 +838,12 @@ out_no_ppp:
                  session->name);
 end:
+        if (error) {
+                if (new_session)
+                        l2tp_session_delete(session);
+                if (new_tunnel)
+                        l2tp_tunnel_delete(tunnel);
+        }
        if (drop_refcnt)
                l2tp_session_dec_refcount(session);
        if (drop_tunnel)
@@ -1175,7 +1201,7 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
                                l2tp_session_get(sock_net(sk), tunnel,
                                                 stats.session_id);
-                        if (session) {
+                        if (session && session->pwtype == L2TP_PWTYPE_PPP) {
                                err = pppol2tp_session_ioctl(session, cmd,
                                                             arg);
                                l2tp_session_dec_refcount(session);
@@ -1792,7 +1818,7 @@ static const struct proto_ops pppol2tp_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = pppol2tp_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
        .setsockopt     = pppol2tp_setsockopt,
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 804de8490186..1beeea9549fa 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -1192,7 +1192,7 @@ static const struct proto_ops llc_ui_ops = {
        .socketpair  = sock_no_socketpair,
        .accept      = llc_ui_accept,
        .getname     = llc_ui_getname,
-        .poll_mask   = datagram_poll_mask,
+        .poll        = datagram_poll,
        .ioctl       = llc_ui_ioctl,
        .listen      = llc_ui_listen,
        .shutdown    = llc_ui_shutdown,
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 89178b46b32f..d9558ffb8acf 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -1186,7 +1186,7 @@ static int ieee80211_chsw_switch_vifs(struct ieee80211_local *local,
        lockdep_assert_held(&local->mtx);
        lockdep_assert_held(&local->chanctx_mtx);
-        vif_chsw = kzalloc(sizeof(vif_chsw[0]) * n_vifs, GFP_KERNEL);
+        vif_chsw = kcalloc(n_vifs, sizeof(vif_chsw[0]), GFP_KERNEL);
        if (!vif_chsw)
                return -ENOMEM;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 4d2e797e3f16..fb73451ed85e 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -772,7 +772,7 @@ static int ieee80211_init_cipher_suites(struct ieee80211_local *local)
                if (have_mfp)
                        n_suites += 4;
-                suites = kmalloc(sizeof(u32) * n_suites, GFP_KERNEL);
+                suites = kmalloc_array(n_suites, sizeof(u32), GFP_KERNEL);
                if (!suites)
                        return -ENOMEM;
@@ -1098,6 +1098,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        ieee80211_led_init(local);
+        result = ieee80211_txq_setup_flows(local);
+        if (result)
+                goto fail_flows;
        rtnl_lock();
        result = ieee80211_init_rate_ctrl_alg(local,
@@ -1120,10 +1124,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        rtnl_unlock();
-        result = ieee80211_txq_setup_flows(local);
-        if (result)
-                goto fail_flows;
 #ifdef CONFIG_INET
        local->ifa_notifier.notifier_call = ieee80211_ifa_changed;
        result = register_inetaddr_notifier(&local->ifa_notifier);
@@ -1149,8 +1149,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 #if defined(CONFIG_INET) || defined(CONFIG_IPV6)
 fail_ifa:
 #endif
-        ieee80211_txq_teardown_flows(local);
- fail_flows:
        rtnl_lock();
        rate_control_deinitialize(local);
        ieee80211_remove_interfaces(local);
@@ -1158,6 +1156,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
        rtnl_unlock();
        ieee80211_led_exit(local);
        ieee80211_wep_free(local);
+        ieee80211_txq_teardown_flows(local);
+ fail_flows:
        destroy_workqueue(local->workqueue);
 fail_workqueue:
        wiphy_unregister(local->hw.wiphy);
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 8221bc5582ab..76048b53c5b2 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -592,11 +592,11 @@ minstrel_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
                        max_rates = sband->n_bitrates;
        }
-        mi->r = kzalloc(sizeof(struct minstrel_rate) * max_rates, gfp);
+        mi->r = kcalloc(max_rates, sizeof(struct minstrel_rate), gfp);
        if (!mi->r)
                goto error;
-        mi->sample_table = kmalloc(SAMPLE_COLUMNS * max_rates, gfp);
+        mi->sample_table = kmalloc_array(max_rates, SAMPLE_COLUMNS, gfp);
        if (!mi->sample_table)
                goto error1;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index fb586b6e5d49..67ebdeaffbbc 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -1313,11 +1313,11 @@ minstrel_ht_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
        if (!msp)
                return NULL;
-        msp->ratelist = kzalloc(sizeof(struct minstrel_rate) * max_rates, gfp);
+        msp->ratelist = kcalloc(max_rates, sizeof(struct minstrel_rate), gfp);
        if (!msp->ratelist)
                goto error;
-        msp->sample_table = kmalloc(SAMPLE_COLUMNS * max_rates, gfp);
+        msp->sample_table = kmalloc_array(max_rates, SAMPLE_COLUMNS, gfp);
        if (!msp->sample_table)
                goto error1;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index a3b1bcc2b461..2e917a6d239d 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -1157,7 +1157,7 @@ int __ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                }
        }
-        ie = kzalloc(num_bands * iebufsz, GFP_KERNEL);
+        ie = kcalloc(iebufsz, num_bands, GFP_KERNEL);
        if (!ie) {
                ret = -ENOMEM;
                goto out;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 44b5dfe8727d..fa1f1e63a264 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -4845,7 +4845,9 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
        skb_reset_network_header(skb);
        skb_reset_mac_header(skb);
+        local_bh_disable();
        __ieee80211_subif_start_xmit(skb, skb->dev, flags);
+        local_bh_enable();
        return 0;
 }
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 2d82c88efd0b..5e2e511c4a6f 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1803,8 +1803,9 @@ static int ieee80211_reconfig_nan(struct ieee80211_sub_if_data *sdata)
        if (WARN_ON(res))
                return res;
-        funcs = kzalloc((sdata->local->hw.max_nan_de_entries + 1) *
+        funcs = kcalloc(sdata->local->hw.max_nan_de_entries + 1,
-                        sizeof(*funcs), GFP_KERNEL);
+                        sizeof(*funcs),
+                        GFP_KERNEL);
        if (!funcs)
                return -ENOMEM;
diff --git a/net/ncsi/ncsi-aen.c b/net/ncsi/ncsi-aen.c
index e7b05de1e6d1..25e483e8278b 100644
--- a/net/ncsi/ncsi-aen.c
+++ b/net/ncsi/ncsi-aen.c
@@ -73,8 +73,8 @@ static int ncsi_aen_handler_lsc(struct ncsi_dev_priv *ndp,
        ncm->data[2] = data;
        ncm->data[4] = ntohl(lsc->oem_status);
-        netdev_info(ndp->ndev.dev, "NCSI: LSC AEN - channel %u state %s\n",
+        netdev_dbg(ndp->ndev.dev, "NCSI: LSC AEN - channel %u state %s\n",
-                    nc->id, data & 0x1 ? "up" : "down");
+                   nc->id, data & 0x1 ? "up" : "down");
        chained = !list_empty(&nc->link);
        state = nc->state;
@@ -148,9 +148,9 @@ static int ncsi_aen_handler_hncdsc(struct ncsi_dev_priv *ndp,
        hncdsc = (struct ncsi_aen_hncdsc_pkt *)h;
        ncm->data[3] = ntohl(hncdsc->status);
        spin_unlock_irqrestore(&nc->lock, flags);
-        netdev_printk(KERN_DEBUG, ndp->ndev.dev,
+        netdev_dbg(ndp->ndev.dev,
-                      "NCSI: host driver %srunning on channel %u\n",
+                   "NCSI: host driver %srunning on channel %u\n",
-                      ncm->data[3] & 0x1 ? "" : "not ", nc->id);
+                   ncm->data[3] & 0x1 ? "" : "not ", nc->id);
        return 0;
 }
diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
index 5561e221b71f..091284760d21 100644
--- a/net/ncsi/ncsi-manage.c
+++ b/net/ncsi/ncsi-manage.c
@@ -788,8 +788,8 @@ static void ncsi_configure_channel(struct ncsi_dev_priv *ndp)
                }
                break;
        case ncsi_dev_state_config_done:
-                netdev_printk(KERN_DEBUG, ndp->ndev.dev,
+                netdev_dbg(ndp->ndev.dev, "NCSI: channel %u config done\n",
-                              "NCSI: channel %u config done\n", nc->id);
+                           nc->id);
                spin_lock_irqsave(&nc->lock, flags);
                if (nc->reconfigure_needed) {
                        /* This channel's configuration has been updated
@@ -804,8 +804,7 @@ static void ncsi_configure_channel(struct ncsi_dev_priv *ndp)
                        list_add_tail_rcu(&nc->link, &ndp->channel_queue);
                        spin_unlock_irqrestore(&ndp->lock, flags);
-                        netdev_printk(KERN_DEBUG, dev,
+                        netdev_dbg(dev, "Dirty NCSI channel state reset\n");
-                                      "Dirty NCSI channel state reset\n");
                        ncsi_process_next_channel(ndp);
                        break;
                }
@@ -816,9 +815,9 @@ static void ncsi_configure_channel(struct ncsi_dev_priv *ndp)
                } else {
                        hot_nc = NULL;
                        nc->state = NCSI_CHANNEL_INACTIVE;
-                        netdev_warn(ndp->ndev.dev,
+                        netdev_dbg(ndp->ndev.dev,
-                                    "NCSI: channel %u link down after config\n",
+                                   "NCSI: channel %u link down after config\n",
-                                    nc->id);
+                                   nc->id);
                }
                spin_unlock_irqrestore(&nc->lock, flags);
@@ -908,9 +907,9 @@ static int ncsi_choose_active_channel(struct ncsi_dev_priv *ndp)
        }
        ncm = &found->modes[NCSI_MODE_LINK];
-        netdev_printk(KERN_DEBUG, ndp->ndev.dev,
+        netdev_dbg(ndp->ndev.dev,
-                      "NCSI: Channel %u added to queue (link %s)\n",
+                   "NCSI: Channel %u added to queue (link %s)\n",
-                      found->id, ncm->data[2] & 0x1 ? "up" : "down");
+                   found->id, ncm->data[2] & 0x1 ? "up" : "down");
 out:
        spin_lock_irqsave(&ndp->lock, flags);
@@ -1199,14 +1198,14 @@ int ncsi_process_next_channel(struct ncsi_dev_priv *ndp)
        switch (old_state) {
        case NCSI_CHANNEL_INACTIVE:
                ndp->ndev.state = ncsi_dev_state_config;
-                netdev_info(ndp->ndev.dev, "NCSI: configuring channel %u\n",
+                netdev_dbg(ndp->ndev.dev, "NCSI: configuring channel %u\n",
-                            nc->id);
+                           nc->id);
                ncsi_configure_channel(ndp);
                break;
        case NCSI_CHANNEL_ACTIVE:
                ndp->ndev.state = ncsi_dev_state_suspend;
-                netdev_info(ndp->ndev.dev, "NCSI: suspending channel %u\n",
+                netdev_dbg(ndp->ndev.dev, "NCSI: suspending channel %u\n",
-                            nc->id);
+                           nc->id);
                ncsi_suspend_channel(ndp);
                break;
        default:
@@ -1226,8 +1225,6 @@ out:
                return ncsi_choose_active_channel(ndp);
        }
-        netdev_printk(KERN_DEBUG, ndp->ndev.dev,
-                      "NCSI: No more channels to process\n");
        ncsi_report_link(ndp, false);
        return -ENODEV;
 }
@@ -1318,9 +1315,9 @@ static int ncsi_kick_channels(struct ncsi_dev_priv *ndp)
                                if ((ndp->ndev.state & 0xff00) ==
                                                ncsi_dev_state_config ||
                                                !list_empty(&nc->link)) {
-                                        netdev_printk(KERN_DEBUG, nd->dev,
+                                        netdev_dbg(nd->dev,
-                                                      "NCSI: channel %p marked dirty\n",
+                                                   "NCSI: channel %p marked dirty\n",
-                                                      nc);
+                                                   nc);
                                        nc->reconfigure_needed = true;
                                }
                                spin_unlock_irqrestore(&nc->lock, flags);
@@ -1338,8 +1335,7 @@ static int ncsi_kick_channels(struct ncsi_dev_priv *ndp)
                        list_add_tail_rcu(&nc->link, &ndp->channel_queue);
                        spin_unlock_irqrestore(&ndp->lock, flags);
-                        netdev_printk(KERN_DEBUG, nd->dev,
+                        netdev_dbg(nd->dev, "NCSI: kicked channel %p\n", nc);
-                                      "NCSI: kicked channel %p\n", nc);
                        n++;
                }
        }
@@ -1370,8 +1366,8 @@ int ncsi_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
        list_for_each_entry_rcu(vlan, &ndp->vlan_vids, list) {
                n_vids++;
                if (vlan->vid == vid) {
-                        netdev_printk(KERN_DEBUG, dev,
+                        netdev_dbg(dev, "NCSI: vid %u already registered\n",
-                                      "NCSI: vid %u already registered\n", vid);
+                                   vid);
                        return 0;
                }
        }
@@ -1390,7 +1386,7 @@ int ncsi_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
        vlan->vid = vid;
        list_add_rcu(&vlan->list, &ndp->vlan_vids);
-        netdev_printk(KERN_DEBUG, dev, "NCSI: Added new vid %u\n", vid);
+        netdev_dbg(dev, "NCSI: Added new vid %u\n", vid);
        found = ncsi_kick_channels(ndp) != 0;
@@ -1419,8 +1415,7 @@ int ncsi_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)
        /* Remove the VLAN id from our internal list */
        list_for_each_entry_safe(vlan, tmp, &ndp->vlan_vids, list)
                if (vlan->vid == vid) {
-                        netdev_printk(KERN_DEBUG, dev,
+                        netdev_dbg(dev, "NCSI: vid %u found, removing\n", vid);
-                                      "NCSI: vid %u found, removing\n", vid);
                        list_del_rcu(&vlan->list);
                        found = true;
                        kfree(vlan);
@@ -1547,7 +1542,7 @@ void ncsi_stop_dev(struct ncsi_dev *nd)
                }
        }
-        netdev_printk(KERN_DEBUG, ndp->ndev.dev, "NCSI: Stopping device\n");
+        netdev_dbg(ndp->ndev.dev, "NCSI: Stopping device\n");
        ncsi_report_link(ndp, true);
 }
 EXPORT_SYMBOL_GPL(ncsi_stop_dev);
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index bbad940c0137..8a33dac4e805 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -1234,7 +1234,10 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
        pr_debug("Create set %s with family %s\n",
                 set->name, set->family == NFPROTO_IPV4 ? "inet" : "inet6");
-#ifndef IP_SET_PROTO_UNDEF
+#ifdef IP_SET_PROTO_UNDEF
+        if (set->family != NFPROTO_UNSPEC)
+                return -IPSET_ERR_INVALID_FAMILY;
+#else
        if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6))
                return -IPSET_ERR_INVALID_FAMILY;
 #endif
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index 61c3a389da89..99e0aa350dc5 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -1380,7 +1380,8 @@ int __init ip_vs_conn_init(void)
        /*
         * Allocate the connection hash table and initialize its list heads
         */
-        ip_vs_conn_tab = vmalloc(ip_vs_conn_tab_size * sizeof(*ip_vs_conn_tab));
+        ip_vs_conn_tab = vmalloc(array_size(ip_vs_conn_tab_size,
+                                            sizeof(*ip_vs_conn_tab)));
        if (!ip_vs_conn_tab)
                return -ENOMEM;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 0c03c0e16a96..dd21782e2f12 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -839,6 +839,9 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
                 *    For now only for NAT!
                 */
                ip_vs_rs_hash(ipvs, dest);
+                /* FTP-NAT requires conntrack for mangling */
+                if (svc->port == FTPPORT)
+                        ip_vs_register_conntrack(svc);
        }
        atomic_set(&dest->conn_flags, conn_flags);
@@ -1462,6 +1465,7 @@ static void __ip_vs_del_service(struct ip_vs_service *svc, bool cleanup)
 */
 static void ip_vs_unlink_service(struct ip_vs_service *svc, bool cleanup)
 {
+        ip_vs_unregister_conntrack(svc);
        /* Hold svc to avoid double release from dest_trash */
        atomic_inc(&svc->refcnt);
        /*
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index ba0a0fd045c8..473cce2a5231 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -168,7 +168,7 @@ static inline bool crosses_local_route_boundary(int skb_af, struct sk_buff *skb,
                                                bool new_rt_is_local)
 {
        bool rt_mode_allow_local = !!(rt_mode & IP_VS_RT_MODE_LOCAL);
-        bool rt_mode_allow_non_local = !!(rt_mode & IP_VS_RT_MODE_LOCAL);
+        bool rt_mode_allow_non_local = !!(rt_mode & IP_VS_RT_MODE_NON_LOCAL);
        bool rt_mode_allow_redirect = !!(rt_mode & IP_VS_RT_MODE_RDR);
        bool source_is_loopback;
        bool old_rt_is_local;
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index 3b5059a8dcdd..510039862aa9 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -46,6 +46,9 @@
 struct nf_conncount_tuple {
        struct hlist_node               node;
        struct nf_conntrack_tuple       tuple;
+        struct nf_conntrack_zone        zone;
+        int                             cpu;
+        u32                             jiffies32;
 };
 struct nf_conncount_rb {
@@ -80,7 +83,8 @@ static int key_diff(const u32 *a, const u32 *b, unsigned int klen)
 }
 bool nf_conncount_add(struct hlist_head *head,
-                      const struct nf_conntrack_tuple *tuple)
+                      const struct nf_conntrack_tuple *tuple,
+                      const struct nf_conntrack_zone *zone)
 {
        struct nf_conncount_tuple *conn;
@@ -88,11 +92,43 @@ bool nf_conncount_add(struct hlist_head *head,
        if (conn == NULL)
                return false;
        conn->tuple = *tuple;
+        conn->zone = *zone;
+        conn->cpu = raw_smp_processor_id();
+        conn->jiffies32 = (u32)jiffies;
        hlist_add_head(&conn->node, head);
        return true;
 }
 EXPORT_SYMBOL_GPL(nf_conncount_add);
+static const struct nf_conntrack_tuple_hash *
+find_or_evict(struct net *net, struct nf_conncount_tuple *conn)
+{
+        const struct nf_conntrack_tuple_hash *found;
+        unsigned long a, b;
+        int cpu = raw_smp_processor_id();
+        __s32 age;
+        found = nf_conntrack_find_get(net, &conn->zone, &conn->tuple);
+        if (found)
+                return found;
+        b = conn->jiffies32;
+        a = (u32)jiffies;
+        /* conn might have been added just before by another cpu and
+         * might still be unconfirmed.  In this case, nf_conntrack_find()
+         * returns no result.  Thus only evict if this cpu added the
+         * stale entry or if the entry is older than two jiffies.
+         */
+        age = a - b;
+        if (conn->cpu == cpu || age >= 2) {
+                hlist_del(&conn->node);
+                kmem_cache_free(conncount_conn_cachep, conn);
+                return ERR_PTR(-ENOENT);
+        }
+        return ERR_PTR(-EAGAIN);
+}
 unsigned int nf_conncount_lookup(struct net *net, struct hlist_head *head,
                                 const struct nf_conntrack_tuple *tuple,
                                 const struct nf_conntrack_zone *zone,
@@ -100,24 +136,34 @@ unsigned int nf_conncount_lookup(struct net *net, struct hlist_head *head,
 {
        const struct nf_conntrack_tuple_hash *found;
        struct nf_conncount_tuple *conn;
-        struct hlist_node *n;
        struct nf_conn *found_ct;
+        struct hlist_node *n;
        unsigned int length = 0;
        *addit = tuple ? true : false;
        /* check the saved connections */
        hlist_for_each_entry_safe(conn, n, head, node) {
-                found = nf_conntrack_find_get(net, zone, &conn->tuple);
+                found = find_or_evict(net, conn);
-                if (found == NULL) {
+                if (IS_ERR(found)) {
-                        hlist_del(&conn->node);
+                        /* Not found, but might be about to be confirmed */
-                        kmem_cache_free(conncount_conn_cachep, conn);
+                        if (PTR_ERR(found) == -EAGAIN) {
+                                length++;
+                                if (!tuple)
+                                        continue;
+                                if (nf_ct_tuple_equal(&conn->tuple, tuple) &&
+                                    nf_ct_zone_id(&conn->zone, conn->zone.dir) ==
+                                    nf_ct_zone_id(zone, zone->dir))
+                                        *addit = false;
+                        }
                        continue;
                }
                found_ct = nf_ct_tuplehash_to_ctrack(found);
-                if (tuple && nf_ct_tuple_equal(&conn->tuple, tuple)) {
+                if (tuple && nf_ct_tuple_equal(&conn->tuple, tuple) &&
+                    nf_ct_zone_equal(found_ct, zone, zone->dir)) {
                        /*
                         * Just to be sure we have it only once in the list.
                         * We should not see tuples twice unless someone hooks
@@ -196,7 +242,7 @@ count_tree(struct net *net, struct rb_root *root,
                        if (!addit)
                                return count;
-                        if (!nf_conncount_add(&rbconn->hhead, tuple))
+                        if (!nf_conncount_add(&rbconn->hhead, tuple, zone))
                                return 0; /* hotdrop */
                        return count + 1;
@@ -238,6 +284,7 @@ count_tree(struct net *net, struct rb_root *root,
        }
        conn->tuple = *tuple;
+        conn->zone = *zone;
        memcpy(rbconn->key, key, sizeof(u32) * keylen);
        INIT_HLIST_HEAD(&rbconn->hhead);
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 551a1eddf0fa..a75b11c39312 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -465,6 +465,11 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
        nf_ct_expect_iterate_destroy(expect_iter_me, NULL);
        nf_ct_iterate_destroy(unhelp, me);
+        /* Maybe someone has gotten the helper already when unhelp above.
+         * So need to wait it.
+         */
+        synchronize_rcu();
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 39327a42879f..20a2e37c76d1 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1446,7 +1446,8 @@ ctnetlink_parse_nat_setup(struct nf_conn *ct,
                }
                nfnl_lock(NFNL_SUBSYS_CTNETLINK);
                rcu_read_lock();
-                if (nat_hook->parse_nat_setup)
+                nat_hook = rcu_dereference(nf_nat_hook);
+                if (nat_hook)
                        return -EAGAIN;
 #endif
                return -EOPNOTSUPP;
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index afdeca53e88b..d88841fbc560 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -402,7 +402,8 @@ int nf_ct_l4proto_register_one(const struct nf_conntrack_l4proto *l4proto)
                struct nf_conntrack_l4proto __rcu **proto_array;
                int i;
-                proto_array = kmalloc(MAX_NF_CT_PROTO *
+                proto_array =
+                        kmalloc_array(MAX_NF_CT_PROTO,
                                      sizeof(struct nf_conntrack_l4proto *),
                                      GFP_KERNEL);
                if (proto_array == NULL) {
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 426457047578..a61d6df6e5f6 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -424,6 +424,10 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write,
        if (write) {
                struct ctl_table tmp = *table;
+                /* proc_dostring() can append to existing strings, so we need to
+                 * initialize it as an empty string.
+                 */
+                buf[0] = '\0';
                tmp.data = buf;
                r = proc_dostring(&tmp, write, buffer, lenp, ppos);
                if (r)
@@ -442,14 +446,17 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write,
                rcu_assign_pointer(net->nf.nf_loggers[tindex], logger);
                mutex_unlock(&nf_log_mutex);
        } else {
+                struct ctl_table tmp = *table;
+                tmp.data = buf;
                mutex_lock(&nf_log_mutex);
                logger = nft_log_dereference(net->nf.nf_loggers[tindex]);
                if (!logger)
-                        table->data = "NONE";
+                        strlcpy(buf, "NONE", sizeof(buf));
                else
-                        table->data = logger->name;
+                        strlcpy(buf, logger->name, sizeof(buf));
-                r = proc_dostring(table, write, buffer, lenp, ppos);
                mutex_unlock(&nf_log_mutex);
+                r = proc_dostring(&tmp, write, buffer, lenp, ppos);
        }
        return r;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index b7df32a56e7e..46f9df99d276 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -691,8 +691,9 @@ int nf_nat_l4proto_register(u8 l3proto, const struct nf_nat_l4proto *l4proto)
        mutex_lock(&nf_nat_proto_mutex);
        if (nf_nat_l4protos[l3proto] == NULL) {
-                l4protos = kmalloc(IPPROTO_MAX * sizeof(struct nf_nat_l4proto *),
+                l4protos = kmalloc_array(IPPROTO_MAX,
-                                   GFP_KERNEL);
+                                         sizeof(struct nf_nat_l4proto *),
+                                         GFP_KERNEL);
                if (l4protos == NULL) {
                        ret = -ENOMEM;
                        goto out;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index ca4c4d994ddb..896d4a36081d 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2890,12 +2890,13 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net,
        u32 id = ntohl(nla_get_be32(nla));
        list_for_each_entry(trans, &net->nft.commit_list, list) {
-                struct nft_set *set = nft_trans_set(trans);
+                if (trans->msg_type == NFT_MSG_NEWSET) {
+                        struct nft_set *set = nft_trans_set(trans);
-                if (trans->msg_type == NFT_MSG_NEWSET &&
+                        if (id == nft_trans_set_id(trans) &&
-                    id == nft_trans_set_id(trans) &&
+                            nft_active_genmask(set, genmask))
-                    nft_active_genmask(set, genmask))
+                                return set;
-                        return set;
+                }
        }
        return ERR_PTR(-ENOENT);
 }
@@ -5303,7 +5304,7 @@ static int nf_tables_flowtable_parse_hook(const struct nft_ctx *ctx,
        if (err < 0)
                return err;
-        ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
+        ops = kcalloc(n, sizeof(struct nf_hook_ops), GFP_KERNEL);
        if (!ops)
                return -ENOMEM;
@@ -5836,18 +5837,23 @@ static int nf_tables_flowtable_event(struct notifier_block *this,
        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct nft_flowtable *flowtable;
        struct nft_table *table;
+        struct net *net;
        if (event != NETDEV_UNREGISTER)
                return 0;
+        net = maybe_get_net(dev_net(dev));
+        if (!net)
+                return 0;
        nfnl_lock(NFNL_SUBSYS_NFTABLES);
-        list_for_each_entry(table, &dev_net(dev)->nft.tables, list) {
+        list_for_each_entry(table, &net->nft.tables, list) {
                list_for_each_entry(flowtable, &table->flowtables, list) {
                        nft_flowtable_event(event, dev, flowtable);
                }
        }
        nfnl_unlock(NFNL_SUBSYS_NFTABLES);
+        put_net(net);
        return NOTIFY_DONE;
 }
@@ -6438,7 +6444,7 @@ static void nf_tables_abort_release(struct nft_trans *trans)
        kfree(trans);
 }
-static int nf_tables_abort(struct net *net, struct sk_buff *skb)
+static int __nf_tables_abort(struct net *net)
 {
        struct nft_trans *trans, *next;
        struct nft_trans_elem *te;
@@ -6554,6 +6560,11 @@ static void nf_tables_cleanup(struct net *net)
        nft_validate_state_update(net, NFT_VALIDATE_SKIP);
 }
+static int nf_tables_abort(struct net *net, struct sk_buff *skb)
+{
+        return __nf_tables_abort(net);
+}
 static bool nf_tables_valid_genid(struct net *net, u32 genid)
 {
        return net->nft.base_seq == genid;
@@ -7148,9 +7159,12 @@ static int __net_init nf_tables_init_net(struct net *net)
 static void __net_exit nf_tables_exit_net(struct net *net)
 {
+        nfnl_lock(NFNL_SUBSYS_NFTABLES);
+        if (!list_empty(&net->nft.commit_list))
+                __nf_tables_abort(net);
        __nft_release_tables(net);
+        nfnl_unlock(NFNL_SUBSYS_NFTABLES);
        WARN_ON_ONCE(!list_empty(&net->nft.tables));
-        WARN_ON_ONCE(!list_empty(&net->nft.commit_list));
 }
 static struct pernet_operations nf_tables_net_ops = {
@@ -7164,8 +7178,8 @@ static int __init nf_tables_module_init(void)
        nft_chain_filter_init();
-        info = kmalloc(sizeof(struct nft_expr_info) * NFT_RULE_MAXEXPRS,
+        info = kmalloc_array(NFT_RULE_MAXEXPRS, sizeof(struct nft_expr_info),
-                       GFP_KERNEL);
+                             GFP_KERNEL);
        if (info == NULL) {
                err = -ENOMEM;
                goto err1;
@@ -7192,13 +7206,13 @@ err1:
 static void __exit nf_tables_module_exit(void)
 {
-        unregister_pernet_subsys(&nf_tables_net_ops);
        nfnetlink_subsys_unregister(&nf_tables_subsys);
        unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
+        nft_chain_filter_fini();
+        unregister_pernet_subsys(&nf_tables_net_ops);
        rcu_barrier();
        nf_tables_core_module_exit();
        kfree(info);
-        nft_chain_filter_fini();
 }
 module_init(nf_tables_module_init);
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index deff10adef9c..8de912ca53d3 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -183,7 +183,8 @@ next_rule:
        switch (regs.verdict.code) {
        case NFT_JUMP:
-                BUG_ON(stackptr >= NFT_JUMP_STACK_SIZE);
+                if (WARN_ON_ONCE(stackptr >= NFT_JUMP_STACK_SIZE))
+                        return NF_DROP;
                jumpstack[stackptr].chain = chain;
                jumpstack[stackptr].rules = rules + 1;
                stackptr++;
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 4d0da7042aff..e1b6be29848d 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -429,7 +429,7 @@ replay:
                         */
                        if (err == -EAGAIN) {
                                status |= NFNL_BATCH_REPLAY;
-                                goto next;
+                                goto done;
                        }
                }
 ack:
@@ -456,7 +456,7 @@ ack:
                        if (err)
                                status |= NFNL_BATCH_FAILURE;
                }
-next:
                msglen = NLMSG_ALIGN(nlh->nlmsg_len);
                if (msglen > skb->len)
                        msglen = skb->len;
@@ -464,7 +464,11 @@ next:
        }
 done:
        if (status & NFNL_BATCH_REPLAY) {
-                ss->abort(net, oskb);
+                const struct nfnetlink_subsystem *ss2;
+                ss2 = nfnl_dereference_protected(subsys_id);
+                if (ss2 == ss)
+                        ss->abort(net, oskb);
                nfnl_err_reset(&err_list);
                nfnl_unlock(subsys_id);
                kfree_skb(skb);
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index cb5b5f207777..e5d27b2e4eba 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -190,8 +190,9 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
        if (class_max > NF_CT_MAX_EXPECT_CLASSES)
                return -EOVERFLOW;
-        expect_policy = kzalloc(sizeof(struct nf_conntrack_expect_policy) *
+        expect_policy = kcalloc(class_max,
-                                class_max, GFP_KERNEL);
+                                sizeof(struct nf_conntrack_expect_policy),
+                                GFP_KERNEL);
        if (expect_policy == NULL)
                return -ENOMEM;
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 4ccd2988f9db..ea4ba551abb2 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1243,6 +1243,9 @@ static int nfqnl_recv_unsupp(struct net *net, struct sock *ctnl,
 static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = {
        [NFQA_CFG_CMD]          = { .len = sizeof(struct nfqnl_msg_config_cmd) },
        [NFQA_CFG_PARAMS]       = { .len = sizeof(struct nfqnl_msg_config_params) },
+        [NFQA_CFG_QUEUE_MAXLEN] = { .type = NLA_U32 },
+        [NFQA_CFG_MASK]         = { .type = NLA_U32 },
+        [NFQA_CFG_FLAGS]        = { .type = NLA_U32 },
 };
 static const struct nf_queue_handler nfqh = {
diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c
index 84c902477a91..d21834bed805 100644
--- a/net/netfilter/nft_chain_filter.c
+++ b/net/netfilter/nft_chain_filter.c
@@ -318,6 +318,10 @@ static int nf_tables_netdev_event(struct notifier_block *this,
            event != NETDEV_CHANGENAME)
                return NOTIFY_DONE;
+        ctx.net = maybe_get_net(ctx.net);
+        if (!ctx.net)
+                return NOTIFY_DONE;
        nfnl_lock(NFNL_SUBSYS_NFTABLES);
        list_for_each_entry(table, &ctx.net->nft.tables, list) {
                if (table->family != NFPROTO_NETDEV)
@@ -334,6 +338,7 @@ static int nf_tables_netdev_event(struct notifier_block *this,
                }
        }
        nfnl_unlock(NFNL_SUBSYS_NFTABLES);
+        put_net(ctx.net);
        return NOTIFY_DONE;
 }
diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c
index 50c068d660e5..a832c59f0a9c 100644
--- a/net/netfilter/nft_connlimit.c
+++ b/net/netfilter/nft_connlimit.c
@@ -52,7 +52,7 @@ static inline void nft_connlimit_do_eval(struct nft_connlimit *priv,
        if (!addit)
                goto out;
-        if (!nf_conncount_add(&priv->hhead, tuple_ptr)) {
+        if (!nf_conncount_add(&priv->hhead, tuple_ptr, zone)) {
                regs->verdict.code = NF_DROP;
                spin_unlock_bh(&priv->lock);
                return;
diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 4d49529cff61..27d7e4598ab6 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -203,9 +203,7 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
                                goto err1;
                        set->ops->gc_init(set);
                }
+        }
-        } else if (set->flags & NFT_SET_EVAL)
-                return -EINVAL;
        nft_set_ext_prepare(&priv->tmpl);
        nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_KEY, set->klen);
diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index 7eef1cffbf1b..655187bed5d8 100644
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -111,7 +111,7 @@ static void nft_log_eval(const struct nft_expr *expr,
        const struct nft_log *priv = nft_expr_priv(expr);
        if (priv->loginfo.type == NF_LOG_TYPE_LOG &&
-            priv->loginfo.u.log.level == LOGLEVEL_AUDIT) {
+            priv->loginfo.u.log.level == NFT_LOGLEVEL_AUDIT) {
                nft_log_eval_audit(pkt);
                return;
        }
@@ -166,9 +166,9 @@ static int nft_log_init(const struct nft_ctx *ctx,
                        li->u.log.level =
                                ntohl(nla_get_be32(tb[NFTA_LOG_LEVEL]));
                } else {
-                        li->u.log.level = LOGLEVEL_WARNING;
+                        li->u.log.level = NFT_LOGLEVEL_WARNING;
                }
-                if (li->u.log.level > LOGLEVEL_AUDIT) {
+                if (li->u.log.level > NFT_LOGLEVEL_AUDIT) {
                        err = -EINVAL;
                        goto err1;
                }
@@ -196,7 +196,7 @@ static int nft_log_init(const struct nft_ctx *ctx,
                break;
        }
-        if (li->u.log.level == LOGLEVEL_AUDIT)
+        if (li->u.log.level == NFT_LOGLEVEL_AUDIT)
                return 0;
        err = nf_logger_find_get(ctx->family, li->type);
@@ -220,7 +220,7 @@ static void nft_log_destroy(const struct nft_ctx *ctx,
        if (priv->prefix != nft_log_null_prefix)
                kfree(priv->prefix);
-        if (li->u.log.level == LOGLEVEL_AUDIT)
+        if (li->u.log.level == NFT_LOGLEVEL_AUDIT)
                return;
        nf_logger_put(ctx->family, li->type);
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index d260ce2d6671..7f3a9a211034 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -66,7 +66,7 @@ static bool __nft_rbtree_lookup(const struct net *net, const struct nft_set *set
                        parent = rcu_dereference_raw(parent->rb_left);
                        if (interval &&
                            nft_rbtree_equal(set, this, interval) &&
-                            nft_rbtree_interval_end(this) &&
+                            nft_rbtree_interval_end(rbe) &&
                            !nft_rbtree_interval_end(interval))
                                continue;
                        interval = rbe;
diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
index f28a0b944087..74e1b3bd6954 100644
--- a/net/netfilter/nft_socket.c
+++ b/net/netfilter/nft_socket.c
@@ -142,3 +142,4 @@ module_exit(nft_socket_module_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Máté Eckl");
 MODULE_DESCRIPTION("nf_tables socket match module");
+MODULE_ALIAS_NFT_EXPR("socket");
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index df9ab71b0ed9..d0d8397c9588 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -1904,7 +1904,7 @@ static int __init xt_init(void)
                seqcount_init(&per_cpu(xt_recseq, i));
        }
-        xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);
+        xt = kmalloc_array(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
        if (!xt)
                return -ENOMEM;
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 8790190c6feb..03b9a50ec93b 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -245,12 +245,22 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
        }
        if (info->helper[0]) {
+                if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
+                        ret = -ENAMETOOLONG;
+                        goto err3;
+                }
                ret = xt_ct_set_helper(ct, info->helper, par);
                if (ret < 0)
                        goto err3;
        }
        if (info->timeout[0]) {
+                if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
+                        ret = -ENAMETOOLONG;
+                        goto err4;
+                }
                ret = xt_ct_set_timeout(ct, par, info->timeout);
                if (ret < 0)
                        goto err4;
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 94df000abb92..29c38aa7f726 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -211,7 +211,7 @@ static int __init connmark_mt_init(void)
 static void __exit connmark_mt_exit(void)
 {
        xt_unregister_match(&connmark_mt_reg);
-        xt_unregister_target(connmark_tg_reg);
+        xt_unregister_targets(connmark_tg_reg, ARRAY_SIZE(connmark_tg_reg));
 }
 module_init(connmark_mt_init);
diff --git a/net/netfilter/xt_set.c b/net/netfilter/xt_set.c
index 6f4c5217d835..bf2890b13212 100644
--- a/net/netfilter/xt_set.c
+++ b/net/netfilter/xt_set.c
@@ -372,8 +372,8 @@ set_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
        /* Normalize to fit into jiffies */
        if (add_opt.ext.timeout != IPSET_NO_TIMEOUT &&
-            add_opt.ext.timeout > UINT_MAX / MSEC_PER_SEC)
+            add_opt.ext.timeout > IPSET_MAX_TIMEOUT)
-                add_opt.ext.timeout = UINT_MAX / MSEC_PER_SEC;
+                add_opt.ext.timeout = IPSET_MAX_TIMEOUT;
        if (info->add_set.index != IPSET_INVALID_ID)
                ip_set_add(info->add_set.index, skb, par, &add_opt);
        if (info->del_set.index != IPSET_INVALID_ID)
@@ -407,8 +407,8 @@ set_target_v3(struct sk_buff *skb, const struct xt_action_param *par)
        /* Normalize to fit into jiffies */
        if (add_opt.ext.timeout != IPSET_NO_TIMEOUT &&
-            add_opt.ext.timeout > UINT_MAX / MSEC_PER_SEC)
+            add_opt.ext.timeout > IPSET_MAX_TIMEOUT)
-                add_opt.ext.timeout = UINT_MAX / MSEC_PER_SEC;
+                add_opt.ext.timeout = IPSET_MAX_TIMEOUT;
        if (info->add_set.index != IPSET_INVALID_ID)
                ip_set_add(info->add_set.index, skb, par, &add_opt);
        if (info->del_set.index != IPSET_INVALID_ID)
@@ -470,7 +470,7 @@ set_target_v3_checkentry(const struct xt_tgchk_param *par)
                }
                if (((info->flags & IPSET_FLAG_MAP_SKBPRIO) |
                     (info->flags & IPSET_FLAG_MAP_SKBQUEUE)) &&
-                     !(par->hook_mask & (1 << NF_INET_FORWARD |
+                     (par->hook_mask & ~(1 << NF_INET_FORWARD |
                                         1 << NF_INET_LOCAL_OUT |
                                         1 << NF_INET_POST_ROUTING))) {
                        pr_info_ratelimited("mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains\n");
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 1189b84413d5..393573a99a5a 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2658,7 +2658,7 @@ static const struct proto_ops netlink_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      netlink_getname,
-        .poll_mask =    datagram_poll_mask,
+        .poll =         datagram_poll,
        .ioctl =        netlink_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     sock_no_shutdown,
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index b9ce82c9440f..25eeb6d2a75a 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -352,8 +352,9 @@ int genl_register_family(struct genl_family *family)
        }
        if (family->maxattr && !family->parallel_ops) {
-                family->attrbuf = kmalloc((family->maxattr+1) *
+                family->attrbuf = kmalloc_array(family->maxattr + 1,
-                                        sizeof(struct nlattr *), GFP_KERNEL);
+                                                sizeof(struct nlattr *),
+                                                GFP_KERNEL);
                if (family->attrbuf == NULL) {
                        err = -ENOMEM;
                        goto errout_locked;
@@ -566,8 +567,9 @@ static int genl_family_rcv_msg(const struct genl_family *family,
                return -EOPNOTSUPP;
        if (family->maxattr && family->parallel_ops) {
-                attrbuf = kmalloc((family->maxattr+1) *
+                attrbuf = kmalloc_array(family->maxattr + 1,
-                                        sizeof(struct nlattr *), GFP_KERNEL);
+                                        sizeof(struct nlattr *),
+                                        GFP_KERNEL);
                if (attrbuf == NULL)
                        return -ENOMEM;
        } else
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index b97eb766a1d5..03f37c4e64fe 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1355,7 +1355,7 @@ static const struct proto_ops nr_proto_ops = {
        .socketpair     =       sock_no_socketpair,
        .accept         =       nr_accept,
        .getname        =       nr_getname,
-        .poll_mask      =       datagram_poll_mask,
+        .poll           =       datagram_poll,
        .ioctl          =       nr_ioctl,
        .listen         =       nr_listen,
        .shutdown       =       sock_no_shutdown,
@@ -1395,7 +1395,7 @@ static int __init nr_proto_init(void)
                return -1;
        }
-        dev_nr = kzalloc(nr_ndevs * sizeof(struct net_device *), GFP_KERNEL);
+        dev_nr = kcalloc(nr_ndevs, sizeof(struct net_device *), GFP_KERNEL);
        if (dev_nr == NULL) {
                printk(KERN_ERR "NET/ROM: nr_proto_init - unable to allocate device array\n");
                return -1;
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index ab5bb14b49af..ea0c0c6f1874 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -548,13 +548,16 @@ static inline __poll_t llcp_accept_poll(struct sock *parent)
        return 0;
 }
-static __poll_t llcp_sock_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t llcp_sock_poll(struct file *file, struct socket *sock,
+                                   poll_table *wait)
 {
        struct sock *sk = sock->sk;
        __poll_t mask = 0;
        pr_debug("%p\n", sk);
+        sock_poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_state == LLCP_LISTEN)
                return llcp_accept_poll(sk);
@@ -896,7 +899,7 @@ static const struct proto_ops llcp_sock_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = llcp_sock_accept,
        .getname        = llcp_sock_getname,
-        .poll_mask      = llcp_sock_poll_mask,
+        .poll           = llcp_sock_poll,
        .ioctl          = sock_no_ioctl,
        .listen         = llcp_sock_listen,
        .shutdown       = sock_no_shutdown,
@@ -916,7 +919,7 @@ static const struct proto_ops llcp_rawsock_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = llcp_sock_getname,
-        .poll_mask      = llcp_sock_poll_mask,
+        .poll           = llcp_sock_poll,
        .ioctl          = sock_no_ioctl,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index 60c322531c49..e2188deb08dc 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -284,7 +284,7 @@ static const struct proto_ops rawsock_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = sock_no_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .ioctl          = sock_no_ioctl,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
@@ -304,7 +304,7 @@ static const struct proto_ops rawsock_raw_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = sock_no_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .ioctl          = sock_no_ioctl,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index a61818e94396..0f5ce77460d4 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1578,8 +1578,9 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
                goto err_destroy_table;
        }
-        dp->ports = kmalloc(DP_VPORT_HASH_BUCKETS * sizeof(struct hlist_head),
+        dp->ports = kmalloc_array(DP_VPORT_HASH_BUCKETS,
-                            GFP_KERNEL);
+                                  sizeof(struct hlist_head),
+                                  GFP_KERNEL);
        if (!dp->ports) {
                err = -ENOMEM;
                goto err_destroy_percpu;
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index f81c1d0ddff4..19f6765566e7 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -47,7 +47,7 @@ static struct hlist_head *dev_table;
 */
 int ovs_vport_init(void)
 {
-        dev_table = kzalloc(VPORT_HASH_BUCKETS * sizeof(struct hlist_head),
+        dev_table = kcalloc(VPORT_HASH_BUCKETS, sizeof(struct hlist_head),
                            GFP_KERNEL);
        if (!dev_table)
                return -ENOMEM;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 54ce66f68482..57634bc3da74 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2005,7 +2005,7 @@ static int packet_rcv_vnet(struct msghdr *msg, const struct sk_buff *skb,
                return -EINVAL;
        *len -= sizeof(vnet_hdr);
-        if (virtio_net_hdr_from_skb(skb, &vnet_hdr, vio_le(), true))
+        if (virtio_net_hdr_from_skb(skb, &vnet_hdr, vio_le(), true, 0))
                return -EINVAL;
        return memcpy_to_msg(msg, (void *)&vnet_hdr, sizeof(vnet_hdr));
@@ -2262,6 +2262,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
                if (po->stats.stats1.tp_drops)
                        status |= TP_STATUS_LOSING;
        }
+        if (do_vnet &&
+            virtio_net_hdr_from_skb(skb, h.raw + macoff -
+                                    sizeof(struct virtio_net_hdr),
+                                    vio_le(), true, 0))
+                goto drop_n_account;
        po->stats.stats1.tp_packets++;
        if (copy_skb) {
                status |= TP_STATUS_COPY;
@@ -2269,15 +2276,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
        }
        spin_unlock(&sk->sk_receive_queue.lock);
-        if (do_vnet) {
-                if (virtio_net_hdr_from_skb(skb, h.raw + macoff -
-                                            sizeof(struct virtio_net_hdr),
-                                            vio_le(), true)) {
-                        spin_lock(&sk->sk_receive_queue.lock);
-                        goto drop_n_account;
-                }
-        }
        skb_copy_bits(skb, 0, h.raw + macoff, snaplen);
        if (!(ts_status = tpacket_get_timestamp(skb, &ts, po->tp_tstamp)))
@@ -4078,11 +4076,12 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
        return 0;
 }
-static __poll_t packet_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t packet_poll(struct file *file, struct socket *sock,
+                                poll_table *wait)
 {
        struct sock *sk = sock->sk;
        struct packet_sock *po = pkt_sk(sk);
-        __poll_t mask = datagram_poll_mask(sock, events);
+        __poll_t mask = datagram_poll(file, sock, wait);
        spin_lock_bh(&sk->sk_receive_queue.lock);
        if (po->rx_ring.pg_vec) {
@@ -4161,7 +4160,7 @@ static char *alloc_one_pg_vec_page(unsigned long order)
                return buffer;
        /* __get_free_pages failed, fall back to vmalloc */
-        buffer = vzalloc((1 << order) * PAGE_SIZE);
+        buffer = vzalloc(array_size((1 << order), PAGE_SIZE));
        if (buffer)
                return buffer;
@@ -4424,7 +4423,7 @@ static const struct proto_ops packet_ops_spkt = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      packet_getname_spkt,
-        .poll_mask =    datagram_poll_mask,
+        .poll =         datagram_poll,
        .ioctl =        packet_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     sock_no_shutdown,
@@ -4445,7 +4444,7 @@ static const struct proto_ops packet_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       sock_no_accept,
        .getname =      packet_getname,
-        .poll_mask =    packet_poll_mask,
+        .poll =         packet_poll,
        .ioctl =        packet_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     sock_no_shutdown,
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index c295c4e20f01..30187990257f 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -340,12 +340,15 @@ static int pn_socket_getname(struct socket *sock, struct sockaddr *addr,
        return sizeof(struct sockaddr_pn);
 }
-static __poll_t pn_socket_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t pn_socket_poll(struct file *file, struct socket *sock,
+                                        poll_table *wait)
 {
        struct sock *sk = sock->sk;
        struct pep_sock *pn = pep_sk(sk);
        __poll_t mask = 0;
+        poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_state == TCP_CLOSE)
                return EPOLLERR;
        if (!skb_queue_empty(&sk->sk_receive_queue))
@@ -445,7 +448,7 @@ const struct proto_ops phonet_dgram_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = pn_socket_getname,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .ioctl          = pn_socket_ioctl,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
@@ -470,7 +473,7 @@ const struct proto_ops phonet_stream_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = pn_socket_accept,
        .getname        = pn_socket_getname,
-        .poll_mask      = pn_socket_poll_mask,
+        .poll           = pn_socket_poll,
        .ioctl          = pn_socket_ioctl,
        .listen         = pn_socket_listen,
        .shutdown       = sock_no_shutdown,
diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index 1b5025ea5b04..2aa07b547b16 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -1023,7 +1023,7 @@ static const struct proto_ops qrtr_proto_ops = {
        .recvmsg        = qrtr_recvmsg,
        .getname        = qrtr_getname,
        .ioctl          = qrtr_ioctl,
-        .poll_mask      = datagram_poll_mask,
+        .poll           = datagram_poll,
        .shutdown       = sock_no_shutdown,
        .setsockopt     = sock_no_setsockopt,
        .getsockopt     = sock_no_getsockopt,
diff --git a/net/rds/connection.c b/net/rds/connection.c
index abef75da89a7..cfb05953b0e5 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -659,11 +659,19 @@ static void rds_conn_info(struct socket *sock, unsigned int len,
 int rds_conn_init(void)
 {
+        int ret;
+        ret = rds_loop_net_init(); /* register pernet callback */
+        if (ret)
+                return ret;
        rds_conn_slab = kmem_cache_create("rds_connection",
                                          sizeof(struct rds_connection),
                                          0, 0, NULL);
-        if (!rds_conn_slab)
+        if (!rds_conn_slab) {
+                rds_loop_net_exit();
                return -ENOMEM;
+        }
        rds_info_register_func(RDS_INFO_CONNECTIONS, rds_conn_info);
        rds_info_register_func(RDS_INFO_SEND_MESSAGES,
@@ -676,6 +684,7 @@ int rds_conn_init(void)
 void rds_conn_exit(void)
 {
+        rds_loop_net_exit(); /* unregister pernet callback */
        rds_loop_exit();
        WARN_ON(!hlist_empty(rds_conn_hash));
diff --git a/net/rds/ib.c b/net/rds/ib.c
index 02deee29e7f1..b6ad38e48f62 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -163,7 +163,8 @@ static void rds_ib_add_one(struct ib_device *device)
        rds_ibdev->max_initiator_depth = device->attrs.max_qp_init_rd_atom;
        rds_ibdev->max_responder_resources = device->attrs.max_qp_rd_atom;
-        rds_ibdev->vector_load = kzalloc(sizeof(int) * device->num_comp_vectors,
+        rds_ibdev->vector_load = kcalloc(device->num_comp_vectors,
+                                         sizeof(int),
                                         GFP_KERNEL);
        if (!rds_ibdev->vector_load) {
                pr_err("RDS/IB: %s failed to allocate vector memory\n",
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 13b38ad0fa4a..f1684ae6abfd 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -526,7 +526,8 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                goto recv_hdrs_dma_out;
        }
-        ic->i_sends = vzalloc_node(ic->i_send_ring.w_nr * sizeof(struct rds_ib_send_work),
+        ic->i_sends = vzalloc_node(array_size(sizeof(struct rds_ib_send_work),
+                                              ic->i_send_ring.w_nr),
                                   ibdev_to_node(dev));
        if (!ic->i_sends) {
                ret = -ENOMEM;
@@ -534,7 +535,8 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
                goto ack_dma_out;
        }
-        ic->i_recvs = vzalloc_node(ic->i_recv_ring.w_nr * sizeof(struct rds_ib_recv_work),
+        ic->i_recvs = vzalloc_node(array_size(sizeof(struct rds_ib_recv_work),
+                                              ic->i_recv_ring.w_nr),
                                   ibdev_to_node(dev));
        if (!ic->i_recvs) {
                ret = -ENOMEM;
diff --git a/net/rds/info.c b/net/rds/info.c
index 140a44a5f7b7..e367a97a18c8 100644
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -188,7 +188,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
        nr_pages = (PAGE_ALIGN(start + len) - (start & PAGE_MASK))
                        >> PAGE_SHIFT;
-        pages = kmalloc(nr_pages * sizeof(struct page *), GFP_KERNEL);
+        pages = kmalloc_array(nr_pages, sizeof(struct page *), GFP_KERNEL);
        if (!pages) {
                ret = -ENOMEM;
                goto out;
diff --git a/net/rds/loop.c b/net/rds/loop.c
index f2bf78de5688..feea1f96ee2a 100644
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -33,6 +33,8 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/in.h>
+#include <net/net_namespace.h>
+#include <net/netns/generic.h>
 #include "rds_single_path.h"
 #include "rds.h"
@@ -40,6 +42,17 @@
 static DEFINE_SPINLOCK(loop_conns_lock);
 static LIST_HEAD(loop_conns);
+static atomic_t rds_loop_unloading = ATOMIC_INIT(0);
+static void rds_loop_set_unloading(void)
+{
+        atomic_set(&rds_loop_unloading, 1);
+}
+static bool rds_loop_is_unloading(struct rds_connection *conn)
+{
+        return atomic_read(&rds_loop_unloading) != 0;
+}
 /*
 * This 'loopback' transport is a special case for flows that originate
@@ -165,6 +178,8 @@ void rds_loop_exit(void)
        struct rds_loop_connection *lc, *_lc;
        LIST_HEAD(tmp_list);
+        rds_loop_set_unloading();
+        synchronize_rcu();
        /* avoid calling conn_destroy with irqs off */
        spin_lock_irq(&loop_conns_lock);
        list_splice(&loop_conns, &tmp_list);
@@ -177,6 +192,46 @@ void rds_loop_exit(void)
        }
 }
+static void rds_loop_kill_conns(struct net *net)
+{
+        struct rds_loop_connection *lc, *_lc;
+        LIST_HEAD(tmp_list);
+        spin_lock_irq(&loop_conns_lock);
+        list_for_each_entry_safe(lc, _lc, &loop_conns, loop_node)  {
+                struct net *c_net = read_pnet(&lc->conn->c_net);
+                if (net != c_net)
+                        continue;
+                list_move_tail(&lc->loop_node, &tmp_list);
+        }
+        spin_unlock_irq(&loop_conns_lock);
+        list_for_each_entry_safe(lc, _lc, &tmp_list, loop_node) {
+                WARN_ON(lc->conn->c_passive);
+                rds_conn_destroy(lc->conn);
+        }
+}
+static void __net_exit rds_loop_exit_net(struct net *net)
+{
+        rds_loop_kill_conns(net);
+}
+static struct pernet_operations rds_loop_net_ops = {
+        .exit = rds_loop_exit_net,
+};
+int rds_loop_net_init(void)
+{
+        return register_pernet_device(&rds_loop_net_ops);
+}
+void rds_loop_net_exit(void)
+{
+        unregister_pernet_device(&rds_loop_net_ops);
+}
 /*
 * This is missing .xmit_* because loop doesn't go through generic
 * rds_send_xmit() and doesn't call rds_recv_incoming().  .listen_stop and
@@ -193,4 +248,6 @@ struct rds_transport rds_loop_transport = {
        .inc_copy_to_user       = rds_message_inc_copy_to_user,
        .inc_free               = rds_loop_inc_free,
        .t_name                 = "loopback",
+        .t_type                 = RDS_TRANS_LOOP,
+        .t_unloading            = rds_loop_is_unloading,
 };
diff --git a/net/rds/loop.h b/net/rds/loop.h
index 469fa4b2da4f..bbc8cdd030df 100644
--- a/net/rds/loop.h
+++ b/net/rds/loop.h
@@ -5,6 +5,8 @@
 /* loop.c */
 extern struct rds_transport rds_loop_transport;
+int rds_loop_net_init(void);
+void rds_loop_net_exit(void);
 void rds_loop_exit(void);
 #endif
diff --git a/net/rds/rds.h b/net/rds/rds.h
index b04c333d9d1c..f2272fb8cd45 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -479,6 +479,11 @@ struct rds_notifier {
        int                     n_status;
 };
+/* Available as part of RDS core, so doesn't need to participate
+ * in get_preferred transport etc
+ */
+#define RDS_TRANS_LOOP  3
 /**
 * struct rds_transport -  transport specific behavioural hooks
 *
diff --git a/net/rds/recv.c b/net/rds/recv.c
index dc67458b52f0..192ac6f78ded 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -103,6 +103,11 @@ static void rds_recv_rcvbuf_delta(struct rds_sock *rs, struct sock *sk,
                rds_stats_add(s_recv_bytes_added_to_socket, delta);
        else
                rds_stats_add(s_recv_bytes_removed_from_socket, -delta);
+        /* loop transport doesn't send/recv congestion updates */
+        if (rs->rs_transport->t_type == RDS_TRANS_LOOP)
+                return;
        now_congested = rs->rs_rcv_bytes > rds_sk_rcvbuf(rs);
        rdsdebug("rs %p (%pI4:%u) recv bytes %d buf %d "
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 5b73fea849df..d00a0ef39a56 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1470,7 +1470,7 @@ static const struct proto_ops rose_proto_ops = {
        .socketpair     =       sock_no_socketpair,
        .accept         =       rose_accept,
        .getname        =       rose_getname,
-        .poll_mask      =       datagram_poll_mask,
+        .poll           =       datagram_poll,
        .ioctl          =       rose_ioctl,
        .listen         =       rose_listen,
        .shutdown       =       sock_no_shutdown,
@@ -1514,7 +1514,8 @@ static int __init rose_proto_init(void)
        rose_callsign = null_ax25_address;
-        dev_rose = kzalloc(rose_ndevs * sizeof(struct net_device *), GFP_KERNEL);
+        dev_rose = kcalloc(rose_ndevs, sizeof(struct net_device *),
+                           GFP_KERNEL);
        if (dev_rose == NULL) {
                printk(KERN_ERR "ROSE: rose_proto_init - unable to allocate device structure\n");
                rc = -ENOMEM;
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 3b1ac93efee2..2b463047dd7b 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -734,11 +734,15 @@ static int rxrpc_getsockopt(struct socket *sock, int level, int optname,
 /*
 * permit an RxRPC socket to be polled
 */
-static __poll_t rxrpc_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t rxrpc_poll(struct file *file, struct socket *sock,
+                               poll_table *wait)
 {
        struct sock *sk = sock->sk;
        struct rxrpc_sock *rx = rxrpc_sk(sk);
-        __poll_t mask = 0;
+        __poll_t mask;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        /* the socket is readable if there are any messages waiting on the Rx
         * queue */
@@ -945,7 +949,7 @@ static const struct proto_ops rxrpc_rpc_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = sock_no_getname,
-        .poll_mask      = rxrpc_poll_mask,
+        .poll           = rxrpc_poll,
        .ioctl          = sock_no_ioctl,
        .listen         = rxrpc_listen,
        .shutdown       = rxrpc_shutdown,
diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
index 6c0ae27fff84..278ac0807a60 100644
--- a/net/rxrpc/rxkad.c
+++ b/net/rxrpc/rxkad.c
@@ -432,7 +432,7 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
        sg = _sg;
        if (unlikely(nsg > 4)) {
-                sg = kmalloc(sizeof(*sg) * nsg, GFP_NOIO);
+                sg = kmalloc_array(nsg, sizeof(*sg), GFP_NOIO);
                if (!sg)
                        goto nomem;
        }
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 8527cfdc446d..20d7d36b2fc9 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -415,7 +415,8 @@ static void tcf_ife_cleanup(struct tc_action *a)
        spin_unlock_bh(&ife->tcf_lock);
        p = rcu_dereference_protected(ife->params, 1);
-        kfree_rcu(p, rcu);
+        if (p)
+                kfree_rcu(p, rcu);
 }
 /* under ife->tcf_lock for existing action */
@@ -516,8 +517,6 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
                        saddr = nla_data(tb[TCA_IFE_SMAC]);
        }
-        ife->tcf_action = parm->action;
        if (parm->flags & IFE_ENCODE) {
                if (daddr)
                        ether_addr_copy(p->eth_dst, daddr);
@@ -543,10 +542,8 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
                                       NULL, NULL);
                if (err) {
 metadata_parse_err:
-                        if (exists)
-                                tcf_idr_release(*a, bind);
                        if (ret == ACT_P_CREATED)
-                                _tcf_ife_cleanup(*a);
+                                tcf_idr_release(*a, bind);
                        if (exists)
                                spin_unlock_bh(&ife->tcf_lock);
@@ -567,7 +564,7 @@ metadata_parse_err:
                err = use_all_metadata(ife);
                if (err) {
                        if (ret == ACT_P_CREATED)
-                                _tcf_ife_cleanup(*a);
+                                tcf_idr_release(*a, bind);
                        if (exists)
                                spin_unlock_bh(&ife->tcf_lock);
@@ -576,6 +573,7 @@ metadata_parse_err:
                }
        }
+        ife->tcf_action = parm->action;
        if (exists)
                spin_unlock_bh(&ife->tcf_lock);
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 9618b4a83cee..98c4afe7c15b 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -53,22 +53,22 @@ static void tcf_simp_release(struct tc_action *a)
        kfree(d->tcfd_defdata);
 }
-static int alloc_defdata(struct tcf_defact *d, char *defdata)
+static int alloc_defdata(struct tcf_defact *d, const struct nlattr *defdata)
 {
        d->tcfd_defdata = kzalloc(SIMP_MAX_DATA, GFP_KERNEL);
        if (unlikely(!d->tcfd_defdata))
                return -ENOMEM;
-        strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);
+        nla_strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);
        return 0;
 }
-static void reset_policy(struct tcf_defact *d, char *defdata,
+static void reset_policy(struct tcf_defact *d, const struct nlattr *defdata,
                         struct tc_defact *p)
 {
        spin_lock_bh(&d->tcf_lock);
        d->tcf_action = p->action;
        memset(d->tcfd_defdata, 0, SIMP_MAX_DATA);
-        strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);
+        nla_strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);
        spin_unlock_bh(&d->tcf_lock);
 }
@@ -87,7 +87,6 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
        struct tcf_defact *d;
        bool exists = false;
        int ret = 0, err;
-        char *defdata;
        if (nla == NULL)
                return -EINVAL;
@@ -110,8 +109,6 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
                return -EINVAL;
        }
-        defdata = nla_data(tb[TCA_DEF_DATA]);
        if (!exists) {
                ret = tcf_idr_create(tn, parm->index, est, a,
                                     &act_simp_ops, bind, false);
@@ -119,7 +116,7 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
                        return ret;
                d = to_defact(*a);
-                ret = alloc_defdata(d, defdata);
+                ret = alloc_defdata(d, tb[TCA_DEF_DATA]);
                if (ret < 0) {
                        tcf_idr_release(*a, bind);
                        return ret;
@@ -133,7 +130,7 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
                if (!ovr)
                        return -EEXIST;
-                reset_policy(d, defdata, parm);
+                reset_policy(d, tb[TCA_DEF_DATA], parm);
        }
        if (ret == ACT_P_CREATED)
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 2b5be42a9f1c..9e8b26a80fb3 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -66,7 +66,7 @@ struct fl_flow_mask {
        struct rhashtable_params filter_ht_params;
        struct flow_dissector dissector;
        struct list_head filters;
-        struct rcu_head rcu;
+        struct rcu_work rwork;
        struct list_head list;
 };
@@ -203,6 +203,20 @@ static int fl_init(struct tcf_proto *tp)
        return rhashtable_init(&head->ht, &mask_ht_params);
 }
+static void fl_mask_free(struct fl_flow_mask *mask)
+{
+        rhashtable_destroy(&mask->ht);
+        kfree(mask);
+}
+static void fl_mask_free_work(struct work_struct *work)
+{
+        struct fl_flow_mask *mask = container_of(to_rcu_work(work),
+                                                 struct fl_flow_mask, rwork);
+        fl_mask_free(mask);
+}
 static bool fl_mask_put(struct cls_fl_head *head, struct fl_flow_mask *mask,
                        bool async)
 {
@@ -210,12 +224,11 @@ static bool fl_mask_put(struct cls_fl_head *head, struct fl_flow_mask *mask,
                return false;
        rhashtable_remove_fast(&head->ht, &mask->ht_node, mask_ht_params);
-        rhashtable_destroy(&mask->ht);
        list_del_rcu(&mask->list);
        if (async)
-                kfree_rcu(mask, rcu);
+                tcf_queue_work(&mask->rwork, fl_mask_free_work);
        else
-                kfree(mask);
+                fl_mask_free(mask);
        return true;
 }
diff --git a/net/sched/sch_blackhole.c b/net/sched/sch_blackhole.c
index c98a61e980ba..9c4c2bb547d7 100644
--- a/net/sched/sch_blackhole.c
+++ b/net/sched/sch_blackhole.c
@@ -21,7 +21,7 @@ static int blackhole_enqueue(struct sk_buff *skb, struct Qdisc *sch,
                             struct sk_buff **to_free)
 {
        qdisc_drop(skb, sch, to_free);
-        return NET_XMIT_SUCCESS;
+        return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
 }
 static struct sk_buff *blackhole_dequeue(struct Qdisc *sch)
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 22fa13cf5d8b..cd2e0e342fb6 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -489,11 +489,12 @@ static int fq_codel_init(struct Qdisc *sch, struct nlattr *opt,
                return err;
        if (!q->flows) {
-                q->flows = kvzalloc(q->flows_cnt *
+                q->flows = kvcalloc(q->flows_cnt,
-                                           sizeof(struct fq_codel_flow), GFP_KERNEL);
+                                    sizeof(struct fq_codel_flow),
+                                    GFP_KERNEL);
                if (!q->flows)
                        return -ENOMEM;
-                q->backlogs = kvzalloc(q->flows_cnt * sizeof(u32), GFP_KERNEL);
+                q->backlogs = kvcalloc(q->flows_cnt, sizeof(u32), GFP_KERNEL);
                if (!q->backlogs)
                        return -ENOMEM;
                for (i = 0; i < q->flows_cnt; i++) {
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 3ae9877ea205..3278a76f6861 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1385,8 +1385,8 @@ hfsc_schedule_watchdog(struct Qdisc *sch)
                if (next_time == 0 || next_time > q->root.cl_cfmin)
                        next_time = q->root.cl_cfmin;
        }
-        WARN_ON(next_time == 0);
+        if (next_time)
-        qdisc_watchdog_schedule(&q->watchdog, next_time);
+                qdisc_watchdog_schedule(&q->watchdog, next_time);
 }
 static int
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
index bce2632212d3..c3a8388dcdf6 100644
--- a/net/sched/sch_hhf.c
+++ b/net/sched/sch_hhf.c
@@ -599,8 +599,8 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt,
        if (!q->hh_flows) {
                /* Initialize heavy-hitter flow table. */
-                q->hh_flows = kvzalloc(HH_FLOWS_CNT *
+                q->hh_flows = kvcalloc(HH_FLOWS_CNT, sizeof(struct list_head),
-                                         sizeof(struct list_head), GFP_KERNEL);
+                                       GFP_KERNEL);
                if (!q->hh_flows)
                        return -ENOMEM;
                for (i = 0; i < HH_FLOWS_CNT; i++)
@@ -614,8 +614,9 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt,
                /* Initialize heavy-hitter filter arrays. */
                for (i = 0; i < HHF_ARRAYS_CNT; i++) {
-                        q->hhf_arrays[i] = kvzalloc(HHF_ARRAYS_LEN *
+                        q->hhf_arrays[i] = kvcalloc(HHF_ARRAYS_LEN,
-                                                      sizeof(u32), GFP_KERNEL);
+                                                    sizeof(u32),
+                                                    GFP_KERNEL);
                        if (!q->hhf_arrays[i]) {
                                /* Note: hhf_destroy() will be called
                                 * by our caller.
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index e64630cd3331..5b537613946f 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -482,8 +482,9 @@ int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp)
                return 0;
        /* Allocated the array of pointers to transorms */
-        ep->auth_hmacs = kzalloc(sizeof(struct crypto_shash *) *
+        ep->auth_hmacs = kcalloc(SCTP_AUTH_NUM_HMACS,
-                                 SCTP_AUTH_NUM_HMACS, gfp);
+                                 sizeof(struct crypto_shash *),
+                                 gfp);
        if (!ep->auth_hmacs)
                return -ENOMEM;
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 79daa98208c3..bfb9f812e2ef 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -237,7 +237,9 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
        /* Account for a different sized first fragment */
        if (msg_len >= first_len) {
                msg->can_delay = 0;
-                SCTP_INC_STATS(sock_net(asoc->base.sk), SCTP_MIB_FRAGUSRMSGS);
+                if (msg_len > first_len)
+                        SCTP_INC_STATS(sock_net(asoc->base.sk),
+                                       SCTP_MIB_FRAGUSRMSGS);
        } else {
                /* Which may be the only one... */
                first_len = msg_len;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 7339918a805d..0cd2e764f47f 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -1010,7 +1010,7 @@ static const struct proto_ops inet6_seqpacket_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = inet_accept,
        .getname           = sctp_getname,
-        .poll_mask         = sctp_poll_mask,
+        .poll              = sctp_poll,
        .ioctl             = inet6_ioctl,
        .listen            = sctp_inet_listen,
        .shutdown          = inet_shutdown,
diff --git a/net/sctp/output.c b/net/sctp/output.c
index e672dee302c7..7f849b01ec8e 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -409,6 +409,21 @@ static void sctp_packet_set_owner_w(struct sk_buff *skb, struct sock *sk)
        refcount_inc(&sk->sk_wmem_alloc);
 }
+static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb)
+{
+        if (SCTP_OUTPUT_CB(head)->last == head)
+                skb_shinfo(head)->frag_list = skb;
+        else
+                SCTP_OUTPUT_CB(head)->last->next = skb;
+        SCTP_OUTPUT_CB(head)->last = skb;
+        head->truesize += skb->truesize;
+        head->data_len += skb->len;
+        head->len += skb->len;
+        __skb_header_release(skb);
+}
 static int sctp_packet_pack(struct sctp_packet *packet,
                            struct sk_buff *head, int gso, gfp_t gfp)
 {
@@ -422,7 +437,7 @@ static int sctp_packet_pack(struct sctp_packet *packet,
        if (gso) {
                skb_shinfo(head)->gso_type = sk->sk_gso_type;
-                NAPI_GRO_CB(head)->last = head;
+                SCTP_OUTPUT_CB(head)->last = head;
        } else {
                nskb = head;
                pkt_size = packet->size;
@@ -503,15 +518,8 @@ merge:
                                         &packet->chunk_list);
                }
-                if (gso) {
+                if (gso)
-                        if (skb_gro_receive(&head, nskb)) {
+                        sctp_packet_gso_append(head, nskb);
-                                kfree_skb(nskb);
-                                return 0;
-                        }
-                        if (WARN_ON_ONCE(skb_shinfo(head)->gso_segs >=
-                                         sk->sk_gso_max_segs))
-                                return 0;
-                }
                pkt_count++;
        } while (!list_empty(&packet->chunk_list));
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 11d93377ba5e..67f73d3a1356 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1016,7 +1016,7 @@ static const struct proto_ops inet_seqpacket_ops = {
        .socketpair        = sock_no_socketpair,
        .accept            = inet_accept,
        .getname           = inet_getname,      /* Semantics are different.  */
-        .poll_mask         = sctp_poll_mask,
+        .poll              = sctp_poll,
        .ioctl             = inet_ioctl,
        .listen            = sctp_inet_listen,
        .shutdown          = inet_shutdown,     /* Looks harmless.  */
@@ -1438,7 +1438,7 @@ static __init int sctp_init(void)
        /* Allocate and initialize the endpoint hash table.  */
        sctp_ep_hashsize = 64;
        sctp_ep_hashtable =
-                kmalloc(64 * sizeof(struct sctp_hashbucket), GFP_KERNEL);
+                kmalloc_array(64, sizeof(struct sctp_hashbucket), GFP_KERNEL);
        if (!sctp_ep_hashtable) {
                pr_err("Failed endpoint_hash alloc\n");
                status = -ENOMEM;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d20f7addee19..ce620e878538 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -7717,12 +7717,14 @@ out:
 * here, again, by modeling the current TCP/UDP code.  We don't have
 * a good way to test with it yet.
 */
-__poll_t sctp_poll_mask(struct socket *sock, __poll_t events)
+__poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
        struct sock *sk = sock->sk;
        struct sctp_sock *sp = sctp_sk(sk);
        __poll_t mask;
+        poll_wait(file, sk_sleep(sk), wait);
        sock_rps_record_flow(sk);
        /* A TCP-style listening socket becomes readable when the accept queue
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 973b4471b532..3c1405df936c 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -45,6 +45,7 @@ static DEFINE_MUTEX(smc_create_lgr_pending);	/* serialize link group
                                                 */
 static void smc_tcp_listen_work(struct work_struct *);
+static void smc_connect_work(struct work_struct *);
 static void smc_set_keepalive(struct sock *sk, int val)
 {
@@ -122,6 +123,12 @@ static int smc_release(struct socket *sock)
                goto out;
        smc = smc_sk(sk);
+        /* cleanup for a dangling non-blocking connect */
+        flush_work(&smc->connect_work);
+        kfree(smc->connect_info);
+        smc->connect_info = NULL;
        if (sk->sk_state == SMC_LISTEN)
                /* smc_close_non_accepted() is called and acquires
                 * sock lock for child sockets again
@@ -186,6 +193,7 @@ static struct sock *smc_sock_alloc(struct net *net, struct socket *sock,
        sk->sk_protocol = protocol;
        smc = smc_sk(sk);
        INIT_WORK(&smc->tcp_listen_work, smc_tcp_listen_work);
+        INIT_WORK(&smc->connect_work, smc_connect_work);
        INIT_DELAYED_WORK(&smc->conn.tx_work, smc_tx_work);
        INIT_LIST_HEAD(&smc->accept_q);
        spin_lock_init(&smc->accept_q_lock);
@@ -576,6 +584,35 @@ static int __smc_connect(struct smc_sock *smc)
        return 0;
 }
+static void smc_connect_work(struct work_struct *work)
+{
+        struct smc_sock *smc = container_of(work, struct smc_sock,
+                                            connect_work);
+        int rc;
+        lock_sock(&smc->sk);
+        rc = kernel_connect(smc->clcsock, &smc->connect_info->addr,
+                            smc->connect_info->alen, smc->connect_info->flags);
+        if (smc->clcsock->sk->sk_err) {
+                smc->sk.sk_err = smc->clcsock->sk->sk_err;
+                goto out;
+        }
+        if (rc < 0) {
+                smc->sk.sk_err = -rc;
+                goto out;
+        }
+        rc = __smc_connect(smc);
+        if (rc < 0)
+                smc->sk.sk_err = -rc;
+out:
+        smc->sk.sk_state_change(&smc->sk);
+        kfree(smc->connect_info);
+        smc->connect_info = NULL;
+        release_sock(&smc->sk);
+}
 static int smc_connect(struct socket *sock, struct sockaddr *addr,
                       int alen, int flags)
 {
@@ -605,15 +642,32 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr,
        smc_copy_sock_settings_to_clc(smc);
        tcp_sk(smc->clcsock->sk)->syn_smc = 1;
-        rc = kernel_connect(smc->clcsock, addr, alen, flags);
+        if (flags & O_NONBLOCK) {
-        if (rc)
+                if (smc->connect_info) {
-                goto out;
+                        rc = -EALREADY;
+                        goto out;
+                }
+                smc->connect_info = kzalloc(alen + 2 * sizeof(int), GFP_KERNEL);
+                if (!smc->connect_info) {
+                        rc = -ENOMEM;
+                        goto out;
+                }
+                smc->connect_info->alen = alen;
+                smc->connect_info->flags = flags ^ O_NONBLOCK;
+                memcpy(&smc->connect_info->addr, addr, alen);
+                schedule_work(&smc->connect_work);
+                rc = -EINPROGRESS;
+        } else {
+                rc = kernel_connect(smc->clcsock, addr, alen, flags);
+                if (rc)
+                        goto out;
-        rc = __smc_connect(smc);
+                rc = __smc_connect(smc);
-        if (rc < 0)
+                if (rc < 0)
-                goto out;
+                        goto out;
-        else
+                else
-                rc = 0; /* success cases including fallback */
+                        rc = 0; /* success cases including fallback */
+        }
 out:
        release_sock(sk);
@@ -1279,40 +1333,20 @@ static __poll_t smc_poll(struct file *file, struct socket *sock,
        struct sock *sk = sock->sk;
        __poll_t mask = 0;
        struct smc_sock *smc;
-        int rc;
        if (!sk)
                return EPOLLNVAL;
        smc = smc_sk(sock->sk);
-        sock_hold(sk);
-        lock_sock(sk);
        if ((sk->sk_state == SMC_INIT) || smc->use_fallback) {
                /* delegate to CLC child sock */
-                release_sock(sk);
                mask = smc->clcsock->ops->poll(file, smc->clcsock, wait);
-                lock_sock(sk);
                sk->sk_err = smc->clcsock->sk->sk_err;
-                if (sk->sk_err) {
+                if (sk->sk_err)
                        mask |= EPOLLERR;
-                } else {
-                        /* if non-blocking connect finished ... */
-                        if (sk->sk_state == SMC_INIT &&
-                            mask & EPOLLOUT &&
-                            smc->clcsock->sk->sk_state != TCP_CLOSE) {
-                                rc = __smc_connect(smc);
-                                if (rc < 0)
-                                        mask |= EPOLLERR;
-                                /* success cases including fallback */
-                                mask |= EPOLLOUT | EPOLLWRNORM;
-                        }
-                }
        } else {
-                if (sk->sk_state != SMC_CLOSED) {
+                if (sk->sk_state != SMC_CLOSED)
-                        release_sock(sk);
                        sock_poll_wait(file, sk_sleep(sk), wait);
-                        lock_sock(sk);
-                }
                if (sk->sk_err)
                        mask |= EPOLLERR;
                if ((sk->sk_shutdown == SHUTDOWN_MASK) ||
@@ -1338,10 +1372,7 @@ static __poll_t smc_poll(struct file *file, struct socket *sock,
                }
                if (smc->conn.urg_state == SMC_URG_VALID)
                        mask |= EPOLLPRI;
        }
-        release_sock(sk);
-        sock_put(sk);
        return mask;
 }
diff --git a/net/smc/smc.h b/net/smc/smc.h
index 51ae1f10d81a..d7ca26570482 100644
--- a/net/smc/smc.h
+++ b/net/smc/smc.h
@@ -187,11 +187,19 @@ struct smc_connection {
        struct work_struct      close_work;     /* peer sent some closing */
 };
+struct smc_connect_info {
+        int                     flags;
+        int                     alen;
+        struct sockaddr         addr;
+};
 struct smc_sock {                               /* smc sock container */
        struct sock             sk;
        struct socket           *clcsock;       /* internal tcp socket */
        struct smc_connection   conn;           /* smc connection */
        struct smc_sock         *listen_smc;    /* listen parent */
+        struct smc_connect_info *connect_info;  /* connect address & flags */
+        struct work_struct      connect_work;   /* handle non-blocking connect*/
        struct work_struct      tcp_listen_work;/* handle tcp socket accepts */
        struct work_struct      smc_listen_work;/* prepare new accept socket */
        struct list_head        accept_q;       /* sockets to be accepted */
diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
index cc7c1bb60fe8..dbd2605d1962 100644
--- a/net/smc/smc_wr.c
+++ b/net/smc/smc_wr.c
@@ -584,9 +584,9 @@ int smc_wr_alloc_link_mem(struct smc_link *link)
                                   GFP_KERNEL);
        if (!link->wr_rx_sges)
                goto no_mem_wr_tx_sges;
-        link->wr_tx_mask = kzalloc(
+        link->wr_tx_mask = kcalloc(BITS_TO_LONGS(SMC_WR_BUF_CNT),
-                BITS_TO_LONGS(SMC_WR_BUF_CNT) * sizeof(*link->wr_tx_mask),
+                                   sizeof(*link->wr_tx_mask),
-                GFP_KERNEL);
+                                   GFP_KERNEL);
        if (!link->wr_tx_mask)
                goto no_mem_wr_rx_sges;
        link->wr_tx_pends = kcalloc(SMC_WR_BUF_CNT,
diff --git a/net/socket.c b/net/socket.c
index af57d85bcb48..85633622c94d 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -117,10 +117,8 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from);
 static int sock_mmap(struct file *file, struct vm_area_struct *vma);
 static int sock_close(struct inode *inode, struct file *file);
-static struct wait_queue_head *sock_get_poll_head(struct file *file,
+static __poll_t sock_poll(struct file *file,
-                __poll_t events);
+                              struct poll_table_struct *wait);
-static __poll_t sock_poll_mask(struct file *file, __poll_t);
-static __poll_t sock_poll(struct file *file, struct poll_table_struct *wait);
 static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 #ifdef CONFIG_COMPAT
 static long compat_sock_ioctl(struct file *file,
@@ -143,8 +141,6 @@ static const struct file_operations socket_file_ops = {
        .llseek =       no_llseek,
        .read_iter =    sock_read_iter,
        .write_iter =   sock_write_iter,
-        .get_poll_head = sock_get_poll_head,
-        .poll_mask =    sock_poll_mask,
        .poll =         sock_poll,
        .unlocked_ioctl = sock_ioctl,
 #ifdef CONFIG_COMPAT
@@ -541,7 +537,10 @@ static int sockfs_setattr(struct dentry *dentry, struct iattr *iattr)
        if (!err && (iattr->ia_valid & ATTR_UID)) {
                struct socket *sock = SOCKET_I(d_inode(dentry));
-                sock->sk->sk_uid = iattr->ia_uid;
+                if (sock->sk)
+                        sock->sk->sk_uid = iattr->ia_uid;
+                else
+                        err = -ENOENT;
        }
        return err;
@@ -590,12 +589,16 @@ EXPORT_SYMBOL(sock_alloc);
 *      an inode not a file.
 */
-void sock_release(struct socket *sock)
+static void __sock_release(struct socket *sock, struct inode *inode)
 {
        if (sock->ops) {
                struct module *owner = sock->ops->owner;
+                if (inode)
+                        inode_lock(inode);
                sock->ops->release(sock);
+                if (inode)
+                        inode_unlock(inode);
                sock->ops = NULL;
                module_put(owner);
        }
@@ -609,6 +612,11 @@ void sock_release(struct socket *sock)
        }
        sock->file = NULL;
 }
+void sock_release(struct socket *sock)
+{
+        __sock_release(sock, NULL);
+}
 EXPORT_SYMBOL(sock_release);
 void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags)
@@ -1118,48 +1126,16 @@ out_release:
 }
 EXPORT_SYMBOL(sock_create_lite);
-static struct wait_queue_head *sock_get_poll_head(struct file *file,
-                __poll_t events)
-{
-        struct socket *sock = file->private_data;
-        if (!sock->ops->poll_mask)
-                return NULL;
-        sock_poll_busy_loop(sock, events);
-        return sk_sleep(sock->sk);
-}
-static __poll_t sock_poll_mask(struct file *file, __poll_t events)
-{
-        struct socket *sock = file->private_data;
-        /*
-         * We need to be sure we are in sync with the socket flags modification.
-         *
-         * This memory barrier is paired in the wq_has_sleeper.
-         */
-        smp_mb();
-        /* this socket can poll_ll so tell the system call */
-        return sock->ops->poll_mask(sock, events) |
-                (sk_can_busy_loop(sock->sk) ? POLL_BUSY_LOOP : 0);
-}
 /* No kernel lock held - perfect */
 static __poll_t sock_poll(struct file *file, poll_table *wait)
 {
        struct socket *sock = file->private_data;
-        __poll_t events = poll_requested_events(wait), mask = 0;
+        __poll_t events = poll_requested_events(wait);
-        if (sock->ops->poll) {
-                sock_poll_busy_loop(sock, events);
-                mask = sock->ops->poll(file, sock, wait);
-        } else if (sock->ops->poll_mask) {
-                sock_poll_wait(file, sock_get_poll_head(file, events), wait);
-                mask = sock->ops->poll_mask(sock, events);
-        }
-        return mask | sock_poll_busy_flag(sock);
+        sock_poll_busy_loop(sock, events);
+        if (!sock->ops->poll)
+                return 0;
+        return sock->ops->poll(file, sock, wait) | sock_poll_busy_flag(sock);
 }
 static int sock_mmap(struct file *file, struct vm_area_struct *vma)
@@ -1171,7 +1147,7 @@ static int sock_mmap(struct file *file, struct vm_area_struct *vma)
 static int sock_close(struct inode *inode, struct file *filp)
 {
-        sock_release(SOCKET_I(inode));
+        __sock_release(SOCKET_I(inode), inode);
        return 0;
 }
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index 1a9695183599..625acb27efcc 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -35,7 +35,6 @@ struct _strp_msg {
         */
        struct strp_msg strp;
        int accum_len;
-        int early_eaten;
 };
 static inline struct _strp_msg *_strp_msg(struct sk_buff *skb)
@@ -115,20 +114,6 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
        head = strp->skb_head;
        if (head) {
                /* Message already in progress */
-                stm = _strp_msg(head);
-                if (unlikely(stm->early_eaten)) {
-                        /* Already some number of bytes on the receive sock
-                         * data saved in skb_head, just indicate they
-                         * are consumed.
-                         */
-                        eaten = orig_len <= stm->early_eaten ?
-                                orig_len : stm->early_eaten;
-                        stm->early_eaten -= eaten;
-                        return eaten;
-                }
                if (unlikely(orig_offset)) {
                        /* Getting data with a non-zero offset when a message is
                         * in progress is not expected. If it does happen, we
@@ -297,9 +282,9 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
                                }
                                stm->accum_len += cand_len;
+                                eaten += cand_len;
                                strp->need_bytes = stm->strp.full_len -
                                                       stm->accum_len;
-                                stm->early_eaten = cand_len;
                                STRP_STATS_ADD(strp->stats.bytes, cand_len);
                                desc->count = 0; /* Stop reading socket */
                                break;
@@ -392,7 +377,7 @@ static int strp_read_sock(struct strparser *strp)
 /* Lower sock lock held */
 void strp_data_ready(struct strparser *strp)
 {
-        if (unlikely(strp->stopped))
+        if (unlikely(strp->stopped) || strp->paused)
                return;
        /* This check is needed to synchronize with do_strp_work.
@@ -407,9 +392,6 @@ void strp_data_ready(struct strparser *strp)
                return;
        }
-        if (strp->paused)
-                return;
        if (strp->need_bytes) {
                if (strp_peek_len(strp) < strp->need_bytes)
                        return;
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 9463af4b32e8..be8f103d22fd 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1753,7 +1753,8 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
        last = (snd_buf->page_base + snd_buf->page_len - 1) >> PAGE_SHIFT;
        rqstp->rq_enc_pages_num = last - first + 1 + 1;
        rqstp->rq_enc_pages
-                = kmalloc(rqstp->rq_enc_pages_num * sizeof(struct page *),
+                = kmalloc_array(rqstp->rq_enc_pages_num,
+                                sizeof(struct page *),
                                GFP_NOFS);
        if (!rqstp->rq_enc_pages)
                goto out;
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
index 46b295e4f2b8..1c7c49dbf8ba 100644
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -224,7 +224,7 @@ static void gssp_free_receive_pages(struct gssx_arg_accept_sec_context *arg)
 static int gssp_alloc_receive_pages(struct gssx_arg_accept_sec_context *arg)
 {
        arg->npages = DIV_ROUND_UP(NGROUPS_MAX * 4, PAGE_SIZE);
-        arg->pages = kzalloc(arg->npages * sizeof(struct page *), GFP_KERNEL);
+        arg->pages = kcalloc(arg->npages, sizeof(struct page *), GFP_KERNEL);
        /*
         * XXX: actual pages are allocated by xdr layer in
         * xdr_partial_copy_from_skb.
@@ -298,9 +298,11 @@ int gssp_accept_sec_context_upcall(struct net *net,
        if (res.context_handle) {
                data->out_handle = rctxh.exported_context_token;
                data->mech_oid.len = rctxh.mech.len;
-                if (rctxh.mech.data)
+                if (rctxh.mech.data) {
                        memcpy(data->mech_oid.data, rctxh.mech.data,
                                                data->mech_oid.len);
+                        kfree(rctxh.mech.data);
+                }
                client_name = rctxh.src_name.display_name;
        }
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index cdda4744c9b1..109fbe591e7b 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1683,7 +1683,7 @@ struct cache_detail *cache_create_net(const struct cache_detail *tmpl, struct ne
        if (cd == NULL)
                return ERR_PTR(-ENOMEM);
-        cd->hash_table = kzalloc(cd->hash_size * sizeof(struct hlist_head),
+        cd->hash_table = kcalloc(cd->hash_size, sizeof(struct hlist_head),
                                 GFP_KERNEL);
        if (cd->hash_table == NULL) {
                kfree(cd);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index c2266f387213..d839c33ae7d9 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1546,6 +1546,7 @@ call_reserveresult(struct rpc_task *task)
        task->tk_status = 0;
        if (status >= 0) {
                if (task->tk_rqstp) {
+                        xprt_request_init(task);
                        task->tk_action = call_refresh;
                        return;
                }
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 70f005044f06..3fabf9f6a0f9 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -66,7 +66,7 @@
 * Local functions
 */
 static void      xprt_init(struct rpc_xprt *xprt, struct net *net);
-static void     xprt_request_init(struct rpc_task *, struct rpc_xprt *);
+static __be32   xprt_alloc_xid(struct rpc_xprt *xprt);
 static void     xprt_connect_status(struct rpc_task *task);
 static int      __xprt_get_cong(struct rpc_xprt *, struct rpc_task *);
 static void     __xprt_put_cong(struct rpc_xprt *, struct rpc_rqst *);
@@ -1163,10 +1163,10 @@ void xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
 out_init_req:
        xprt->stat.max_slots = max_t(unsigned int, xprt->stat.max_slots,
                                     xprt->num_reqs);
+        spin_unlock(&xprt->reserve_lock);
        task->tk_status = 0;
        task->tk_rqstp = req;
-        xprt_request_init(task, xprt);
-        spin_unlock(&xprt->reserve_lock);
 }
 EXPORT_SYMBOL_GPL(xprt_alloc_slot);
@@ -1184,7 +1184,7 @@ void xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
 }
 EXPORT_SYMBOL_GPL(xprt_lock_and_alloc_slot);
-static void xprt_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
+void xprt_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
 {
        spin_lock(&xprt->reserve_lock);
        if (!xprt_dynamic_free_slot(xprt, req)) {
@@ -1194,6 +1194,7 @@ static void xprt_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
        xprt_wake_up_backlog(xprt);
        spin_unlock(&xprt->reserve_lock);
 }
+EXPORT_SYMBOL_GPL(xprt_free_slot);
 static void xprt_free_all_slots(struct rpc_xprt *xprt)
 {
@@ -1295,7 +1296,12 @@ void xprt_retry_reserve(struct rpc_task *task)
 static inline __be32 xprt_alloc_xid(struct rpc_xprt *xprt)
 {
-        return (__force __be32)xprt->xid++;
+        __be32 xid;
+        spin_lock(&xprt->reserve_lock);
+        xid = (__force __be32)xprt->xid++;
+        spin_unlock(&xprt->reserve_lock);
+        return xid;
 }
 static inline void xprt_init_xid(struct rpc_xprt *xprt)
@@ -1303,8 +1309,9 @@ static inline void xprt_init_xid(struct rpc_xprt *xprt)
        xprt->xid = prandom_u32();
 }
-static void xprt_request_init(struct rpc_task *task, struct rpc_xprt *xprt)
+void xprt_request_init(struct rpc_task *task)
 {
+        struct rpc_xprt *xprt = task->tk_xprt;
        struct rpc_rqst *req = task->tk_rqstp;
        INIT_LIST_HEAD(&req->rq_list);
@@ -1312,7 +1319,7 @@ static void xprt_request_init(struct rpc_task *task, struct rpc_xprt *xprt)
        req->rq_task    = task;
        req->rq_xprt    = xprt;
        req->rq_buffer  = NULL;
-        req->rq_xid     = xprt_alloc_xid(xprt);
+        req->rq_xid     = xprt_alloc_xid(xprt);
        req->rq_connect_cookie = xprt->connect_cookie - 1;
        req->rq_bytes_sent = 0;
        req->rq_snd_buf.len = 0;
@@ -1373,7 +1380,7 @@ void xprt_release(struct rpc_task *task)
        dprintk("RPC: %5u release request %p\n", task->tk_pid, req);
        if (likely(!bc_prealloc(req)))
-                xprt_free_slot(xprt, req);
+                xprt->ops->free_slot(xprt, req);
        else
                xprt_free_bc_request(req);
 }
diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index 47ebac949769..90adeff4c06b 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -9,8 +9,10 @@
 #include <linux/sunrpc/xprt.h>
 #include <linux/sunrpc/svc.h>
 #include <linux/sunrpc/svc_xprt.h>
+#include <linux/sunrpc/svc_rdma.h>
 #include "xprt_rdma.h"
+#include <trace/events/rpcrdma.h>
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_TRANS
@@ -29,29 +31,41 @@ static void rpcrdma_bc_free_rqst(struct rpcrdma_xprt *r_xprt,
        spin_unlock(&buf->rb_reqslock);
        rpcrdma_destroy_req(req);
-        kfree(rqst);
 }
-static int rpcrdma_bc_setup_rqst(struct rpcrdma_xprt *r_xprt,
+static int rpcrdma_bc_setup_reqs(struct rpcrdma_xprt *r_xprt,
-                                 struct rpc_rqst *rqst)
+                                 unsigned int count)
 {
-        struct rpcrdma_regbuf *rb;
+        struct rpc_xprt *xprt = &r_xprt->rx_xprt;
-        struct rpcrdma_req *req;
+        struct rpc_rqst *rqst;
-        size_t size;
+        unsigned int i;
+        for (i = 0; i < (count << 1); i++) {
+                struct rpcrdma_regbuf *rb;
+                struct rpcrdma_req *req;
+                size_t size;
+                req = rpcrdma_create_req(r_xprt);
+                if (IS_ERR(req))
+                        return PTR_ERR(req);
+                rqst = &req->rl_slot;
+                rqst->rq_xprt = xprt;
+                INIT_LIST_HEAD(&rqst->rq_list);
+                INIT_LIST_HEAD(&rqst->rq_bc_list);
+                __set_bit(RPC_BC_PA_IN_USE, &rqst->rq_bc_pa_state);
+                spin_lock_bh(&xprt->bc_pa_lock);
+                list_add(&rqst->rq_bc_pa_list, &xprt->bc_pa_list);
+                spin_unlock_bh(&xprt->bc_pa_lock);
-        req = rpcrdma_create_req(r_xprt);
+                size = r_xprt->rx_data.inline_rsize;
-        if (IS_ERR(req))
+                rb = rpcrdma_alloc_regbuf(size, DMA_TO_DEVICE, GFP_KERNEL);
-                return PTR_ERR(req);
+                if (IS_ERR(rb))
+                        goto out_fail;
-        size = r_xprt->rx_data.inline_rsize;
+                req->rl_sendbuf = rb;
-        rb = rpcrdma_alloc_regbuf(size, DMA_TO_DEVICE, GFP_KERNEL);
+                xdr_buf_init(&rqst->rq_snd_buf, rb->rg_base,
-        if (IS_ERR(rb))
+                             min_t(size_t, size, PAGE_SIZE));
-                goto out_fail;
+        }
-        req->rl_sendbuf = rb;
-        xdr_buf_init(&rqst->rq_snd_buf, rb->rg_base,
-                     min_t(size_t, size, PAGE_SIZE));
-        rpcrdma_set_xprtdata(rqst, req);
        return 0;
 out_fail:
@@ -59,23 +73,6 @@ out_fail:
        return -ENOMEM;
 }
-/* Allocate and add receive buffers to the rpcrdma_buffer's
- * existing list of rep's. These are released when the
- * transport is destroyed.
- */
-static int rpcrdma_bc_setup_reps(struct rpcrdma_xprt *r_xprt,
-                                 unsigned int count)
-{
-        int rc = 0;
-        while (count--) {
-                rc = rpcrdma_create_rep(r_xprt);
-                if (rc)
-                        break;
-        }
-        return rc;
-}
 /**
 * xprt_rdma_bc_setup - Pre-allocate resources for handling backchannel requests
 * @xprt: transport associated with these backchannel resources
@@ -86,9 +83,6 @@ static int rpcrdma_bc_setup_reps(struct rpcrdma_xprt *r_xprt,
 int xprt_rdma_bc_setup(struct rpc_xprt *xprt, unsigned int reqs)
 {
        struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
-        struct rpcrdma_buffer *buffer = &r_xprt->rx_buf;
-        struct rpc_rqst *rqst;
-        unsigned int i;
        int rc;
        /* The backchannel reply path returns each rpc_rqst to the
@@ -103,35 +97,11 @@ int xprt_rdma_bc_setup(struct rpc_xprt *xprt, unsigned int reqs)
        if (reqs > RPCRDMA_BACKWARD_WRS >> 1)
                goto out_err;
-        for (i = 0; i < (reqs << 1); i++) {
+        rc = rpcrdma_bc_setup_reqs(r_xprt, reqs);
-                rqst = kzalloc(sizeof(*rqst), GFP_KERNEL);
-                if (!rqst)
-                        goto out_free;
-                dprintk("RPC:       %s: new rqst %p\n", __func__, rqst);
-                rqst->rq_xprt = &r_xprt->rx_xprt;
-                INIT_LIST_HEAD(&rqst->rq_list);
-                INIT_LIST_HEAD(&rqst->rq_bc_list);
-                __set_bit(RPC_BC_PA_IN_USE, &rqst->rq_bc_pa_state);
-                if (rpcrdma_bc_setup_rqst(r_xprt, rqst))
-                        goto out_free;
-                spin_lock_bh(&xprt->bc_pa_lock);
-                list_add(&rqst->rq_bc_pa_list, &xprt->bc_pa_list);
-                spin_unlock_bh(&xprt->bc_pa_lock);
-        }
-        rc = rpcrdma_bc_setup_reps(r_xprt, reqs);
        if (rc)
                goto out_free;
-        rc = rpcrdma_ep_post_extra_recv(r_xprt, reqs);
+        r_xprt->rx_buf.rb_bc_srv_max_requests = reqs;
-        if (rc)
-                goto out_free;
-        buffer->rb_bc_srv_max_requests = reqs;
        request_module("svcrdma");
        trace_xprtrdma_cb_setup(r_xprt, reqs);
        return 0;
@@ -235,6 +205,7 @@ int xprt_rdma_bc_send_reply(struct rpc_rqst *rqst)
        if (rc < 0)
                goto failed_marshal;
+        rpcrdma_post_recvs(r_xprt, true);
        if (rpcrdma_ep_post(&r_xprt->rx_ia, &r_xprt->rx_ep, req))
                goto drop_connection;
        return 0;
@@ -275,10 +246,14 @@ void xprt_rdma_bc_destroy(struct rpc_xprt *xprt, unsigned int reqs)
 */
 void xprt_rdma_bc_free_rqst(struct rpc_rqst *rqst)
 {
+        struct rpcrdma_req *req = rpcr_to_rdmar(rqst);
        struct rpc_xprt *xprt = rqst->rq_xprt;
        dprintk("RPC:       %s: freeing rqst %p (req %p)\n",
-                __func__, rqst, rpcr_to_rdmar(rqst));
+                __func__, rqst, req);
+        rpcrdma_recv_buffer_put(req->rl_reply);
+        req->rl_reply = NULL;
        spin_lock_bh(&xprt->bc_pa_lock);
        list_add_tail(&rqst->rq_bc_pa_list, &xprt->bc_pa_list);
diff --git a/net/sunrpc/xprtrdma/fmr_ops.c b/net/sunrpc/xprtrdma/fmr_ops.c
index f2f63959fddd..17fb1e025654 100644
--- a/net/sunrpc/xprtrdma/fmr_ops.c
+++ b/net/sunrpc/xprtrdma/fmr_ops.c
@@ -20,7 +20,10 @@
 * verb (fmr_op_unmap).
 */
+#include <linux/sunrpc/svc_rdma.h>
 #include "xprt_rdma.h"
+#include <trace/events/rpcrdma.h>
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_TRANS
@@ -156,10 +159,32 @@ out_release:
        fmr_op_release_mr(mr);
 }
+/* On success, sets:
+ *      ep->rep_attr.cap.max_send_wr
+ *      ep->rep_attr.cap.max_recv_wr
+ *      cdata->max_requests
+ *      ia->ri_max_segs
+ */
 static int
 fmr_op_open(struct rpcrdma_ia *ia, struct rpcrdma_ep *ep,
            struct rpcrdma_create_data_internal *cdata)
 {
+        int max_qp_wr;
+        max_qp_wr = ia->ri_device->attrs.max_qp_wr;
+        max_qp_wr -= RPCRDMA_BACKWARD_WRS;
+        max_qp_wr -= 1;
+        if (max_qp_wr < RPCRDMA_MIN_SLOT_TABLE)
+                return -ENOMEM;
+        if (cdata->max_requests > max_qp_wr)
+                cdata->max_requests = max_qp_wr;
+        ep->rep_attr.cap.max_send_wr = cdata->max_requests;
+        ep->rep_attr.cap.max_send_wr += RPCRDMA_BACKWARD_WRS;
+        ep->rep_attr.cap.max_send_wr += 1; /* for ib_drain_sq */
+        ep->rep_attr.cap.max_recv_wr = cdata->max_requests;
+        ep->rep_attr.cap.max_recv_wr += RPCRDMA_BACKWARD_WRS;
+        ep->rep_attr.cap.max_recv_wr += 1; /* for ib_drain_rq */
        ia->ri_max_segs = max_t(unsigned int, 1, RPCRDMA_MAX_DATA_SEGS /
                                RPCRDMA_MAX_FMR_SGES);
        return 0;
@@ -219,6 +244,7 @@ fmr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
                                     mr->mr_sg, i, mr->mr_dir);
        if (!mr->mr_nents)
                goto out_dmamap_err;
+        trace_xprtrdma_dma_map(mr);
        for (i = 0, dma_pages = mr->fmr.fm_physaddrs; i < mr->mr_nents; i++)
                dma_pages[i] = sg_dma_address(&mr->mr_sg[i]);
diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
index c59c5c788db0..c040de196e13 100644
--- a/net/sunrpc/xprtrdma/frwr_ops.c
+++ b/net/sunrpc/xprtrdma/frwr_ops.c
@@ -71,8 +71,10 @@
 */
 #include <linux/sunrpc/rpc_rdma.h>
+#include <linux/sunrpc/svc_rdma.h>
 #include "xprt_rdma.h"
+#include <trace/events/rpcrdma.h>
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_TRANS
@@ -202,12 +204,22 @@ out_release:
        frwr_op_release_mr(mr);
 }
+/* On success, sets:
+ *      ep->rep_attr.cap.max_send_wr
+ *      ep->rep_attr.cap.max_recv_wr
+ *      cdata->max_requests
+ *      ia->ri_max_segs
+ *
+ * And these FRWR-related fields:
+ *      ia->ri_max_frwr_depth
+ *      ia->ri_mrtype
+ */
 static int
 frwr_op_open(struct rpcrdma_ia *ia, struct rpcrdma_ep *ep,
             struct rpcrdma_create_data_internal *cdata)
 {
        struct ib_device_attr *attrs = &ia->ri_device->attrs;
-        int depth, delta;
+        int max_qp_wr, depth, delta;
        ia->ri_mrtype = IB_MR_TYPE_MEM_REG;
        if (attrs->device_cap_flags & IB_DEVICE_SG_GAPS_REG)
@@ -241,14 +253,26 @@ frwr_op_open(struct rpcrdma_ia *ia, struct rpcrdma_ep *ep,
                } while (delta > 0);
        }
-        ep->rep_attr.cap.max_send_wr *= depth;
+        max_qp_wr = ia->ri_device->attrs.max_qp_wr;
-        if (ep->rep_attr.cap.max_send_wr > attrs->max_qp_wr) {
+        max_qp_wr -= RPCRDMA_BACKWARD_WRS;
-                cdata->max_requests = attrs->max_qp_wr / depth;
+        max_qp_wr -= 1;
+        if (max_qp_wr < RPCRDMA_MIN_SLOT_TABLE)
+                return -ENOMEM;
+        if (cdata->max_requests > max_qp_wr)
+                cdata->max_requests = max_qp_wr;
+        ep->rep_attr.cap.max_send_wr = cdata->max_requests * depth;
+        if (ep->rep_attr.cap.max_send_wr > max_qp_wr) {
+                cdata->max_requests = max_qp_wr / depth;
                if (!cdata->max_requests)
                        return -EINVAL;
                ep->rep_attr.cap.max_send_wr = cdata->max_requests *
                                               depth;
        }
+        ep->rep_attr.cap.max_send_wr += RPCRDMA_BACKWARD_WRS;
+        ep->rep_attr.cap.max_send_wr += 1; /* for ib_drain_sq */
+        ep->rep_attr.cap.max_recv_wr = cdata->max_requests;
+        ep->rep_attr.cap.max_recv_wr += RPCRDMA_BACKWARD_WRS;
+        ep->rep_attr.cap.max_recv_wr += 1; /* for ib_drain_rq */
        ia->ri_max_segs = max_t(unsigned int, 1, RPCRDMA_MAX_DATA_SEGS /
                                ia->ri_max_frwr_depth);
@@ -393,6 +417,7 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
        mr->mr_nents = ib_dma_map_sg(ia->ri_device, mr->mr_sg, i, mr->mr_dir);
        if (!mr->mr_nents)
                goto out_dmamap_err;
+        trace_xprtrdma_dma_map(mr);
        ibmr = frwr->fr_mr;
        n = ib_map_mr_sg(ibmr, mr->mr_sg, mr->mr_nents, NULL, PAGE_SIZE);
diff --git a/net/sunrpc/xprtrdma/module.c b/net/sunrpc/xprtrdma/module.c
index a762d192372b..620327c01302 100644
--- a/net/sunrpc/xprtrdma/module.c
+++ b/net/sunrpc/xprtrdma/module.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
 * Copyright (c) 2015, 2017 Oracle.  All rights reserved.
 */
@@ -13,9 +14,11 @@
 #include <asm/swab.h>
-#define CREATE_TRACE_POINTS
 #include "xprt_rdma.h"
+#define CREATE_TRACE_POINTS
+#include <trace/events/rpcrdma.h>
 MODULE_AUTHOR("Open Grid Computing and Network Appliance, Inc.");
 MODULE_DESCRIPTION("RPC/RDMA Transport");
 MODULE_LICENSE("Dual BSD/GPL");
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index e8adad33d0bb..c8ae983c6cc0 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
 * Copyright (c) 2014-2017 Oracle.  All rights reserved.
 * Copyright (c) 2003-2007 Network Appliance, Inc. All rights reserved.
@@ -46,22 +47,17 @@
 * to the Linux RPC framework lives.
 */
-#include "xprt_rdma.h"
 #include <linux/highmem.h>
+#include <linux/sunrpc/svc_rdma.h>
+#include "xprt_rdma.h"
+#include <trace/events/rpcrdma.h>
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_TRANS
 #endif
-static const char transfertypes[][12] = {
-        "inline",       /* no chunks */
-        "read list",    /* some argument via rdma read */
-        "*read list",   /* entire request via rdma read */
-        "write list",   /* some result via rdma write */
-        "reply chunk"   /* entire reply via rdma write */
-};
 /* Returns size of largest RPC-over-RDMA header in a Call message
 *
 * The largest Call header contains a full-size Read list and a
@@ -230,7 +226,7 @@ rpcrdma_convert_iovs(struct rpcrdma_xprt *r_xprt, struct xdr_buf *xdrbuf,
                         */
                        *ppages = alloc_page(GFP_ATOMIC);
                        if (!*ppages)
-                                return -EAGAIN;
+                                return -ENOBUFS;
                }
                seg->mr_page = *ppages;
                seg->mr_offset = (char *)page_base;
@@ -365,7 +361,7 @@ rpcrdma_encode_read_list(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
                seg = r_xprt->rx_ia.ri_ops->ro_map(r_xprt, seg, nsegs,
                                                   false, &mr);
                if (IS_ERR(seg))
-                        goto out_maperr;
+                        return PTR_ERR(seg);
                rpcrdma_mr_push(mr, &req->rl_registered);
                if (encode_read_segment(xdr, mr, pos) < 0)
@@ -377,11 +373,6 @@ rpcrdma_encode_read_list(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
        } while (nsegs);
        return 0;
-out_maperr:
-        if (PTR_ERR(seg) == -EAGAIN)
-                xprt_wait_for_buffer_space(rqst->rq_task, NULL);
-        return PTR_ERR(seg);
 }
 /* Register and XDR encode the Write list. Supports encoding a list
@@ -428,7 +419,7 @@ rpcrdma_encode_write_list(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
                seg = r_xprt->rx_ia.ri_ops->ro_map(r_xprt, seg, nsegs,
                                                   true, &mr);
                if (IS_ERR(seg))
-                        goto out_maperr;
+                        return PTR_ERR(seg);
                rpcrdma_mr_push(mr, &req->rl_registered);
                if (encode_rdma_segment(xdr, mr) < 0)
@@ -445,11 +436,6 @@ rpcrdma_encode_write_list(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
        *segcount = cpu_to_be32(nchunks);
        return 0;
-out_maperr:
-        if (PTR_ERR(seg) == -EAGAIN)
-                xprt_wait_for_buffer_space(rqst->rq_task, NULL);
-        return PTR_ERR(seg);
 }
 /* Register and XDR encode the Reply chunk. Supports encoding an array
@@ -491,7 +477,7 @@ rpcrdma_encode_reply_chunk(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
                seg = r_xprt->rx_ia.ri_ops->ro_map(r_xprt, seg, nsegs,
                                                   true, &mr);
                if (IS_ERR(seg))
-                        goto out_maperr;
+                        return PTR_ERR(seg);
                rpcrdma_mr_push(mr, &req->rl_registered);
                if (encode_rdma_segment(xdr, mr) < 0)
@@ -508,11 +494,6 @@ rpcrdma_encode_reply_chunk(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
        *segcount = cpu_to_be32(nchunks);
        return 0;
-out_maperr:
-        if (PTR_ERR(seg) == -EAGAIN)
-                xprt_wait_for_buffer_space(rqst->rq_task, NULL);
-        return PTR_ERR(seg);
 }
 /**
@@ -709,7 +690,7 @@ rpcrdma_prepare_send_sges(struct rpcrdma_xprt *r_xprt,
 {
        req->rl_sendctx = rpcrdma_sendctx_get_locked(&r_xprt->rx_buf);
        if (!req->rl_sendctx)
-                return -ENOBUFS;
+                return -EAGAIN;
        req->rl_sendctx->sc_wr.num_sge = 0;
        req->rl_sendctx->sc_unmap_count = 0;
        req->rl_sendctx->sc_req = req;
@@ -883,7 +864,15 @@ rpcrdma_marshal_req(struct rpcrdma_xprt *r_xprt, struct rpc_rqst *rqst)
        return 0;
 out_err:
-        r_xprt->rx_stats.failed_marshal_count++;
+        switch (ret) {
+        case -EAGAIN:
+                xprt_wait_for_buffer_space(rqst->rq_task, NULL);
+                break;
+        case -ENOBUFS:
+                break;
+        default:
+                r_xprt->rx_stats.failed_marshal_count++;
+        }
        return ret;
 }
@@ -1026,8 +1015,6 @@ rpcrdma_is_bcall(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep)
 out_short:
        pr_warn("RPC/RDMA short backward direction call\n");
-        if (rpcrdma_ep_post_recv(&r_xprt->rx_ia, rep))
-                xprt_disconnect_done(&r_xprt->rx_xprt);
        return true;
 }
 #else   /* CONFIG_SUNRPC_BACKCHANNEL */
@@ -1333,13 +1320,14 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
        u32 credits;
        __be32 *p;
+        --buf->rb_posted_receives;
        if (rep->rr_hdrbuf.head[0].iov_len == 0)
                goto out_badstatus;
+        /* Fixed transport header fields */
        xdr_init_decode(&rep->rr_stream, &rep->rr_hdrbuf,
                        rep->rr_hdrbuf.head[0].iov_base);
-        /* Fixed transport header fields */
        p = xdr_inline_decode(&rep->rr_stream, 4 * sizeof(*p));
        if (unlikely(!p))
                goto out_shortreply;
@@ -1378,17 +1366,10 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
        trace_xprtrdma_reply(rqst->rq_task, rep, req, credits);
+        rpcrdma_post_recvs(r_xprt, false);
        queue_work(rpcrdma_receive_wq, &rep->rr_work);
        return;
-out_badstatus:
-        rpcrdma_recv_buffer_put(rep);
-        if (r_xprt->rx_ep.rep_connected == 1) {
-                r_xprt->rx_ep.rep_connected = -EIO;
-                rpcrdma_conn_func(&r_xprt->rx_ep);
-        }
-        return;
 out_badversion:
        trace_xprtrdma_reply_vers(rep);
        goto repost;
@@ -1408,7 +1389,7 @@ out_shortreply:
 * receive buffer before returning.
 */
 repost:
-        r_xprt->rx_stats.bad_reply_count++;
+        rpcrdma_post_recvs(r_xprt, false);
-        if (rpcrdma_ep_post_recv(&r_xprt->rx_ia, rep))
+out_badstatus:
-                rpcrdma_recv_buffer_put(rep);
+        rpcrdma_recv_buffer_put(rep);
 }
diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
index dd8a431dc2ae..357ba90c382d 100644
--- a/net/sunrpc/xprtrdma/svc_rdma.c
+++ b/net/sunrpc/xprtrdma/svc_rdma.c
@@ -1,4 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
+ * Copyright (c) 2015-2018 Oracle.  All rights reserved.
 * Copyright (c) 2005-2006 Network Appliance, Inc. All rights reserved.
 *
 * This software is available to you under a choice of one of two
@@ -46,7 +48,6 @@
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/sched.h>
 #include <linux/sunrpc/svc_rdma.h>
-#include "xprt_rdma.h"
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
index a73632ca9048..a68180090554 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
@@ -1,13 +1,16 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * Copyright (c) 2015 Oracle.  All rights reserved.
+ * Copyright (c) 2015-2018 Oracle.  All rights reserved.
 *
 * Support for backward direction RPCs on RPC/RDMA (server-side).
 */
 #include <linux/module.h>
 #include <linux/sunrpc/svc_rdma.h>
 #include "xprt_rdma.h"
+#include <trace/events/rpcrdma.h>
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
@@ -112,39 +115,21 @@ out_notfound:
 * the adapter has a small maximum SQ depth.
 */
 static int svc_rdma_bc_sendto(struct svcxprt_rdma *rdma,
-                              struct rpc_rqst *rqst)
+                              struct rpc_rqst *rqst,
+                              struct svc_rdma_send_ctxt *ctxt)
 {
-        struct svc_rdma_op_ctxt *ctxt;
        int ret;
-        ctxt = svc_rdma_get_context(rdma);
+        ret = svc_rdma_map_reply_msg(rdma, ctxt, &rqst->rq_snd_buf, NULL);
-        /* rpcrdma_bc_send_request builds the transport header and
-         * the backchannel RPC message in the same buffer. Thus only
-         * one SGE is needed to send both.
-         */
-        ret = svc_rdma_map_reply_hdr(rdma, ctxt, rqst->rq_buffer,
-                                     rqst->rq_snd_buf.len);
        if (ret < 0)
-                goto out_err;
+                return -EIO;
        /* Bump page refcnt so Send completion doesn't release
         * the rq_buffer before all retransmits are complete.
         */
        get_page(virt_to_page(rqst->rq_buffer));
-        ret = svc_rdma_post_send_wr(rdma, ctxt, 1, 0);
+        ctxt->sc_send_wr.opcode = IB_WR_SEND;
-        if (ret)
+        return svc_rdma_send(rdma, &ctxt->sc_send_wr);
-                goto out_unmap;
-out_err:
-        dprintk("svcrdma: %s returns %d\n", __func__, ret);
-        return ret;
-out_unmap:
-        svc_rdma_unmap_dma(ctxt);
-        svc_rdma_put_context(ctxt, 1);
-        ret = -EIO;
-        goto out_err;
 }
 /* Server-side transport endpoint wants a whole page for its send
@@ -191,13 +176,15 @@ rpcrdma_bc_send_request(struct svcxprt_rdma *rdma, struct rpc_rqst *rqst)
 {
        struct rpc_xprt *xprt = rqst->rq_xprt;
        struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
+        struct svc_rdma_send_ctxt *ctxt;
        __be32 *p;
        int rc;
-        /* Space in the send buffer for an RPC/RDMA header is reserved
+        ctxt = svc_rdma_send_ctxt_get(rdma);
-         * via xprt->tsh_size.
+        if (!ctxt)
-         */
+                goto drop_connection;
-        p = rqst->rq_buffer;
+        p = ctxt->sc_xprt_buf;
        *p++ = rqst->rq_xid;
        *p++ = rpcrdma_version;
        *p++ = cpu_to_be32(r_xprt->rx_buf.rb_bc_max_requests);
@@ -205,14 +192,17 @@ rpcrdma_bc_send_request(struct svcxprt_rdma *rdma, struct rpc_rqst *rqst)
        *p++ = xdr_zero;
        *p++ = xdr_zero;
        *p   = xdr_zero;
+        svc_rdma_sync_reply_hdr(rdma, ctxt, RPCRDMA_HDRLEN_MIN);
 #ifdef SVCRDMA_BACKCHANNEL_DEBUG
        pr_info("%s: %*ph\n", __func__, 64, rqst->rq_buffer);
 #endif
-        rc = svc_rdma_bc_sendto(rdma, rqst);
+        rc = svc_rdma_bc_sendto(rdma, rqst, ctxt);
-        if (rc)
+        if (rc) {
+                svc_rdma_send_ctxt_put(rdma, ctxt);
                goto drop_connection;
+        }
        return rc;
 drop_connection:
@@ -273,6 +263,7 @@ static const struct rpc_xprt_ops xprt_rdma_bc_procs = {
        .reserve_xprt           = xprt_reserve_xprt_cong,
        .release_xprt           = xprt_release_xprt_cong,
        .alloc_slot             = xprt_alloc_slot,
+        .free_slot              = xprt_free_slot,
        .release_request        = xprt_release_rqst_cong,
        .buf_alloc              = xprt_rdma_bc_allocate,
        .buf_free               = xprt_rdma_bc_free,
@@ -320,7 +311,7 @@ xprt_setup_rdma_bc(struct xprt_create *args)
        xprt->idle_timeout = RPCRDMA_IDLE_DISC_TO;
        xprt->prot = XPRT_TRANSPORT_BC_RDMA;
-        xprt->tsh_size = RPCRDMA_HDRLEN_MIN / sizeof(__be32);
+        xprt->tsh_size = 0;
        xprt->ops = &xprt_rdma_bc_procs;
        memcpy(&xprt->addr, args->dstaddr, args->addrlen);
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 3d45015dca97..841fca143804 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -1,5 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (c) 2016, 2017 Oracle. All rights reserved.
+ * Copyright (c) 2016-2018 Oracle. All rights reserved.
 * Copyright (c) 2014 Open Grid Computing, Inc. All rights reserved.
 * Copyright (c) 2005-2006 Network Appliance, Inc. All rights reserved.
 *
@@ -60,7 +61,7 @@
 * svc_rdma_recvfrom must post RDMA Reads to pull the RPC Call's
 * data payload from the client. svc_rdma_recvfrom sets up the
 * RDMA Reads using pages in svc_rqst::rq_pages, which are
- * transferred to an svc_rdma_op_ctxt for the duration of the
+ * transferred to an svc_rdma_recv_ctxt for the duration of the
 * I/O. svc_rdma_recvfrom then returns zero, since the RPC message
 * is still not yet ready.
 *
@@ -69,18 +70,18 @@
 * svc_rdma_recvfrom again. This second call may use a different
 * svc_rqst than the first one, thus any information that needs
 * to be preserved across these two calls is kept in an
- * svc_rdma_op_ctxt.
+ * svc_rdma_recv_ctxt.
 *
 * The second call to svc_rdma_recvfrom performs final assembly
 * of the RPC Call message, using the RDMA Read sink pages kept in
- * the svc_rdma_op_ctxt. The xdr_buf is copied from the
+ * the svc_rdma_recv_ctxt. The xdr_buf is copied from the
- * svc_rdma_op_ctxt to the second svc_rqst. The second call returns
+ * svc_rdma_recv_ctxt to the second svc_rqst. The second call returns
 * the length of the completed RPC Call message.
 *
 * Page Management
 *
 * Pages under I/O must be transferred from the first svc_rqst to an
- * svc_rdma_op_ctxt before the first svc_rdma_recvfrom call returns.
+ * svc_rdma_recv_ctxt before the first svc_rdma_recvfrom call returns.
 *
 * The first svc_rqst supplies pages for RDMA Reads. These are moved
 * from rqstp::rq_pages into ctxt::pages. The consumed elements of
@@ -88,78 +89,286 @@
 * svc_rdma_recvfrom call returns.
 *
 * During the second svc_rdma_recvfrom call, RDMA Read sink pages
- * are transferred from the svc_rdma_op_ctxt to the second svc_rqst
+ * are transferred from the svc_rdma_recv_ctxt to the second svc_rqst
 * (see rdma_read_complete() below).
 */
+#include <linux/spinlock.h>
 #include <asm/unaligned.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/rdma_cm.h>
-#include <linux/spinlock.h>
 #include <linux/sunrpc/xdr.h>
 #include <linux/sunrpc/debug.h>
 #include <linux/sunrpc/rpc_rdma.h>
 #include <linux/sunrpc/svc_rdma.h>
+#include "xprt_rdma.h"
+#include <trace/events/rpcrdma.h>
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
-/*
+static void svc_rdma_wc_receive(struct ib_cq *cq, struct ib_wc *wc);
- * Replace the pages in the rq_argpages array with the pages from the SGE in
- * the RDMA_RECV completion. The SGL should contain full pages up until the
+static inline struct svc_rdma_recv_ctxt *
- * last one.
+svc_rdma_next_recv_ctxt(struct list_head *list)
+{
+        return list_first_entry_or_null(list, struct svc_rdma_recv_ctxt,
+                                        rc_list);
+}
+static struct svc_rdma_recv_ctxt *
+svc_rdma_recv_ctxt_alloc(struct svcxprt_rdma *rdma)
+{
+        struct svc_rdma_recv_ctxt *ctxt;
+        dma_addr_t addr;
+        void *buffer;
+        ctxt = kmalloc(sizeof(*ctxt), GFP_KERNEL);
+        if (!ctxt)
+                goto fail0;
+        buffer = kmalloc(rdma->sc_max_req_size, GFP_KERNEL);
+        if (!buffer)
+                goto fail1;
+        addr = ib_dma_map_single(rdma->sc_pd->device, buffer,
+                                 rdma->sc_max_req_size, DMA_FROM_DEVICE);
+        if (ib_dma_mapping_error(rdma->sc_pd->device, addr))
+                goto fail2;
+        ctxt->rc_recv_wr.next = NULL;
+        ctxt->rc_recv_wr.wr_cqe = &ctxt->rc_cqe;
+        ctxt->rc_recv_wr.sg_list = &ctxt->rc_recv_sge;
+        ctxt->rc_recv_wr.num_sge = 1;
+        ctxt->rc_cqe.done = svc_rdma_wc_receive;
+        ctxt->rc_recv_sge.addr = addr;
+        ctxt->rc_recv_sge.length = rdma->sc_max_req_size;
+        ctxt->rc_recv_sge.lkey = rdma->sc_pd->local_dma_lkey;
+        ctxt->rc_recv_buf = buffer;
+        ctxt->rc_temp = false;
+        return ctxt;
+fail2:
+        kfree(buffer);
+fail1:
+        kfree(ctxt);
+fail0:
+        return NULL;
+}
+static void svc_rdma_recv_ctxt_destroy(struct svcxprt_rdma *rdma,
+                                       struct svc_rdma_recv_ctxt *ctxt)
+{
+        ib_dma_unmap_single(rdma->sc_pd->device, ctxt->rc_recv_sge.addr,
+                            ctxt->rc_recv_sge.length, DMA_FROM_DEVICE);
+        kfree(ctxt->rc_recv_buf);
+        kfree(ctxt);
+}
+/**
+ * svc_rdma_recv_ctxts_destroy - Release all recv_ctxt's for an xprt
+ * @rdma: svcxprt_rdma being torn down
+ *
 */
-static void svc_rdma_build_arg_xdr(struct svc_rqst *rqstp,
+void svc_rdma_recv_ctxts_destroy(struct svcxprt_rdma *rdma)
-                                   struct svc_rdma_op_ctxt *ctxt)
 {
-        struct page *page;
+        struct svc_rdma_recv_ctxt *ctxt;
-        int sge_no;
-        u32 len;
-        /* The reply path assumes the Call's transport header resides
+        while ((ctxt = svc_rdma_next_recv_ctxt(&rdma->sc_recv_ctxts))) {
-         * in rqstp->rq_pages[0].
+                list_del(&ctxt->rc_list);
-         */
+                svc_rdma_recv_ctxt_destroy(rdma, ctxt);
-        page = ctxt->pages[0];
-        put_page(rqstp->rq_pages[0]);
-        rqstp->rq_pages[0] = page;
-        /* Set up the XDR head */
-        rqstp->rq_arg.head[0].iov_base = page_address(page);
-        rqstp->rq_arg.head[0].iov_len =
-                min_t(size_t, ctxt->byte_len, ctxt->sge[0].length);
-        rqstp->rq_arg.len = ctxt->byte_len;
-        rqstp->rq_arg.buflen = ctxt->byte_len;
-        /* Compute bytes past head in the SGL */
-        len = ctxt->byte_len - rqstp->rq_arg.head[0].iov_len;
-        /* If data remains, store it in the pagelist */
-        rqstp->rq_arg.page_len = len;
-        rqstp->rq_arg.page_base = 0;
-        sge_no = 1;
-        while (len && sge_no < ctxt->count) {
-                page = ctxt->pages[sge_no];
-                put_page(rqstp->rq_pages[sge_no]);
-                rqstp->rq_pages[sge_no] = page;
-                len -= min_t(u32, len, ctxt->sge[sge_no].length);
-                sge_no++;
        }
-        rqstp->rq_respages = &rqstp->rq_pages[sge_no];
+}
-        rqstp->rq_next_page = rqstp->rq_respages + 1;
+static struct svc_rdma_recv_ctxt *
+svc_rdma_recv_ctxt_get(struct svcxprt_rdma *rdma)
+{
+        struct svc_rdma_recv_ctxt *ctxt;
+        spin_lock(&rdma->sc_recv_lock);
+        ctxt = svc_rdma_next_recv_ctxt(&rdma->sc_recv_ctxts);
+        if (!ctxt)
+                goto out_empty;
+        list_del(&ctxt->rc_list);
+        spin_unlock(&rdma->sc_recv_lock);
+out:
+        ctxt->rc_page_count = 0;
+        return ctxt;
+out_empty:
+        spin_unlock(&rdma->sc_recv_lock);
+        ctxt = svc_rdma_recv_ctxt_alloc(rdma);
+        if (!ctxt)
+                return NULL;
+        goto out;
+}
+/**
+ * svc_rdma_recv_ctxt_put - Return recv_ctxt to free list
+ * @rdma: controlling svcxprt_rdma
+ * @ctxt: object to return to the free list
+ *
+ */
+void svc_rdma_recv_ctxt_put(struct svcxprt_rdma *rdma,
+                            struct svc_rdma_recv_ctxt *ctxt)
+{
+        unsigned int i;
+        for (i = 0; i < ctxt->rc_page_count; i++)
+                put_page(ctxt->rc_pages[i]);
+        if (!ctxt->rc_temp) {
+                spin_lock(&rdma->sc_recv_lock);
+                list_add(&ctxt->rc_list, &rdma->sc_recv_ctxts);
+                spin_unlock(&rdma->sc_recv_lock);
+        } else
+                svc_rdma_recv_ctxt_destroy(rdma, ctxt);
+}
+static int __svc_rdma_post_recv(struct svcxprt_rdma *rdma,
+                                struct svc_rdma_recv_ctxt *ctxt)
+{
+        struct ib_recv_wr *bad_recv_wr;
+        int ret;
+        svc_xprt_get(&rdma->sc_xprt);
+        ret = ib_post_recv(rdma->sc_qp, &ctxt->rc_recv_wr, &bad_recv_wr);
+        trace_svcrdma_post_recv(&ctxt->rc_recv_wr, ret);
+        if (ret)
+                goto err_post;
+        return 0;
+err_post:
+        svc_rdma_recv_ctxt_put(rdma, ctxt);
+        svc_xprt_put(&rdma->sc_xprt);
+        return ret;
+}
-        /* If not all pages were used from the SGL, free the remaining ones */
+static int svc_rdma_post_recv(struct svcxprt_rdma *rdma)
-        len = sge_no;
+{
-        while (sge_no < ctxt->count) {
+        struct svc_rdma_recv_ctxt *ctxt;
-                page = ctxt->pages[sge_no++];
-                put_page(page);
+        ctxt = svc_rdma_recv_ctxt_get(rdma);
+        if (!ctxt)
+                return -ENOMEM;
+        return __svc_rdma_post_recv(rdma, ctxt);
+}
+/**
+ * svc_rdma_post_recvs - Post initial set of Recv WRs
+ * @rdma: fresh svcxprt_rdma
+ *
+ * Returns true if successful, otherwise false.
+ */
+bool svc_rdma_post_recvs(struct svcxprt_rdma *rdma)
+{
+        struct svc_rdma_recv_ctxt *ctxt;
+        unsigned int i;
+        int ret;
+        for (i = 0; i < rdma->sc_max_requests; i++) {
+                ctxt = svc_rdma_recv_ctxt_get(rdma);
+                if (!ctxt)
+                        return false;
+                ctxt->rc_temp = true;
+                ret = __svc_rdma_post_recv(rdma, ctxt);
+                if (ret) {
+                        pr_err("svcrdma: failure posting recv buffers: %d\n",
+                               ret);
+                        return false;
+                }
        }
-        ctxt->count = len;
+        return true;
+}
-        /* Set up tail */
+/**
-        rqstp->rq_arg.tail[0].iov_base = NULL;
+ * svc_rdma_wc_receive - Invoked by RDMA provider for each polled Receive WC
-        rqstp->rq_arg.tail[0].iov_len = 0;
+ * @cq: Completion Queue context
+ * @wc: Work Completion object
+ *
+ * NB: The svc_xprt/svcxprt_rdma is pinned whenever it's possible that
+ * the Receive completion handler could be running.
+ */
+static void svc_rdma_wc_receive(struct ib_cq *cq, struct ib_wc *wc)
+{
+        struct svcxprt_rdma *rdma = cq->cq_context;
+        struct ib_cqe *cqe = wc->wr_cqe;
+        struct svc_rdma_recv_ctxt *ctxt;
+        trace_svcrdma_wc_receive(wc);
+        /* WARNING: Only wc->wr_cqe and wc->status are reliable */
+        ctxt = container_of(cqe, struct svc_rdma_recv_ctxt, rc_cqe);
+        if (wc->status != IB_WC_SUCCESS)
+                goto flushed;
+        if (svc_rdma_post_recv(rdma))
+                goto post_err;
+        /* All wc fields are now known to be valid */
+        ctxt->rc_byte_len = wc->byte_len;
+        ib_dma_sync_single_for_cpu(rdma->sc_pd->device,
+                                   ctxt->rc_recv_sge.addr,
+                                   wc->byte_len, DMA_FROM_DEVICE);
+        spin_lock(&rdma->sc_rq_dto_lock);
+        list_add_tail(&ctxt->rc_list, &rdma->sc_rq_dto_q);
+        spin_unlock(&rdma->sc_rq_dto_lock);
+        set_bit(XPT_DATA, &rdma->sc_xprt.xpt_flags);
+        if (!test_bit(RDMAXPRT_CONN_PENDING, &rdma->sc_flags))
+                svc_xprt_enqueue(&rdma->sc_xprt);
+        goto out;
+flushed:
+        if (wc->status != IB_WC_WR_FLUSH_ERR)
+                pr_err("svcrdma: Recv: %s (%u/0x%x)\n",
+                       ib_wc_status_msg(wc->status),
+                       wc->status, wc->vendor_err);
+post_err:
+        svc_rdma_recv_ctxt_put(rdma, ctxt);
+        set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
+        svc_xprt_enqueue(&rdma->sc_xprt);
+out:
+        svc_xprt_put(&rdma->sc_xprt);
+}
+/**
+ * svc_rdma_flush_recv_queues - Drain pending Receive work
+ * @rdma: svcxprt_rdma being shut down
+ *
+ */
+void svc_rdma_flush_recv_queues(struct svcxprt_rdma *rdma)
+{
+        struct svc_rdma_recv_ctxt *ctxt;
+        while ((ctxt = svc_rdma_next_recv_ctxt(&rdma->sc_read_complete_q))) {
+                list_del(&ctxt->rc_list);
+                svc_rdma_recv_ctxt_put(rdma, ctxt);
+        }
+        while ((ctxt = svc_rdma_next_recv_ctxt(&rdma->sc_rq_dto_q))) {
+                list_del(&ctxt->rc_list);
+                svc_rdma_recv_ctxt_put(rdma, ctxt);
+        }
+}
+static void svc_rdma_build_arg_xdr(struct svc_rqst *rqstp,
+                                   struct svc_rdma_recv_ctxt *ctxt)
+{
+        struct xdr_buf *arg = &rqstp->rq_arg;
+        arg->head[0].iov_base = ctxt->rc_recv_buf;
+        arg->head[0].iov_len = ctxt->rc_byte_len;
+        arg->tail[0].iov_base = NULL;
+        arg->tail[0].iov_len = 0;
+        arg->page_len = 0;
+        arg->page_base = 0;
+        arg->buflen = ctxt->rc_byte_len;
+        arg->len = ctxt->rc_byte_len;
+        rqstp->rq_respages = &rqstp->rq_pages[0];
+        rqstp->rq_next_page = rqstp->rq_respages + 1;
 }
 /* This accommodates the largest possible Write chunk,
@@ -294,7 +503,6 @@ static int svc_rdma_xdr_decode_req(struct xdr_buf *rq_arg)
 {
        __be32 *p, *end, *rdma_argp;
        unsigned int hdr_len;
-        char *proc;
        /* Verify that there's enough bytes for header + something */
        if (rq_arg->len <= RPCRDMA_HDRLEN_ERR)
@@ -306,10 +514,8 @@ static int svc_rdma_xdr_decode_req(struct xdr_buf *rq_arg)
        switch (*(rdma_argp + 3)) {
        case rdma_msg:
-                proc = "RDMA_MSG";
                break;
        case rdma_nomsg:
-                proc = "RDMA_NOMSG";
                break;
        case rdma_done:
@@ -339,103 +545,94 @@ static int svc_rdma_xdr_decode_req(struct xdr_buf *rq_arg)
        hdr_len = (unsigned long)p - (unsigned long)rdma_argp;
        rq_arg->head[0].iov_len -= hdr_len;
        rq_arg->len -= hdr_len;
-        dprintk("svcrdma: received %s request for XID 0x%08x, hdr_len=%u\n",
+        trace_svcrdma_decode_rqst(rdma_argp, hdr_len);
-                proc, be32_to_cpup(rdma_argp), hdr_len);
        return hdr_len;
 out_short:
-        dprintk("svcrdma: header too short = %d\n", rq_arg->len);
+        trace_svcrdma_decode_short(rq_arg->len);
        return -EINVAL;
 out_version:
-        dprintk("svcrdma: bad xprt version: %u\n",
+        trace_svcrdma_decode_badvers(rdma_argp);
-                be32_to_cpup(rdma_argp + 1));
        return -EPROTONOSUPPORT;
 out_drop:
-        dprintk("svcrdma: dropping RDMA_DONE/ERROR message\n");
+        trace_svcrdma_decode_drop(rdma_argp);
        return 0;
 out_proc:
-        dprintk("svcrdma: bad rdma procedure (%u)\n",
+        trace_svcrdma_decode_badproc(rdma_argp);
-                be32_to_cpup(rdma_argp + 3));
        return -EINVAL;
 out_inval:
-        dprintk("svcrdma: failed to parse transport header\n");
+        trace_svcrdma_decode_parse(rdma_argp);
        return -EINVAL;
 }
 static void rdma_read_complete(struct svc_rqst *rqstp,
-                               struct svc_rdma_op_ctxt *head)
+                               struct svc_rdma_recv_ctxt *head)
 {
        int page_no;
-        /* Copy RPC pages */
+        /* Move Read chunk pages to rqstp so that they will be released
-        for (page_no = 0; page_no < head->count; page_no++) {
+         * when svc_process is done with them.
+         */
+        for (page_no = 0; page_no < head->rc_page_count; page_no++) {
                put_page(rqstp->rq_pages[page_no]);
-                rqstp->rq_pages[page_no] = head->pages[page_no];
+                rqstp->rq_pages[page_no] = head->rc_pages[page_no];
        }
+        head->rc_page_count = 0;
        /* Point rq_arg.pages past header */
-        rqstp->rq_arg.pages = &rqstp->rq_pages[head->hdr_count];
+        rqstp->rq_arg.pages = &rqstp->rq_pages[head->rc_hdr_count];
-        rqstp->rq_arg.page_len = head->arg.page_len;
+        rqstp->rq_arg.page_len = head->rc_arg.page_len;
        /* rq_respages starts after the last arg page */
        rqstp->rq_respages = &rqstp->rq_pages[page_no];
        rqstp->rq_next_page = rqstp->rq_respages + 1;
        /* Rebuild rq_arg head and tail. */
-        rqstp->rq_arg.head[0] = head->arg.head[0];
+        rqstp->rq_arg.head[0] = head->rc_arg.head[0];
-        rqstp->rq_arg.tail[0] = head->arg.tail[0];
+        rqstp->rq_arg.tail[0] = head->rc_arg.tail[0];
-        rqstp->rq_arg.len = head->arg.len;
+        rqstp->rq_arg.len = head->rc_arg.len;
-        rqstp->rq_arg.buflen = head->arg.buflen;
+        rqstp->rq_arg.buflen = head->rc_arg.buflen;
 }
 static void svc_rdma_send_error(struct svcxprt_rdma *xprt,
                                __be32 *rdma_argp, int status)
 {
-        struct svc_rdma_op_ctxt *ctxt;
+        struct svc_rdma_send_ctxt *ctxt;
-        __be32 *p, *err_msgp;
        unsigned int length;
-        struct page *page;
+        __be32 *p;
        int ret;
-        page = alloc_page(GFP_KERNEL);
+        ctxt = svc_rdma_send_ctxt_get(xprt);
-        if (!page)
+        if (!ctxt)
                return;
-        err_msgp = page_address(page);
-        p = err_msgp;
+        p = ctxt->sc_xprt_buf;
        *p++ = *rdma_argp;
        *p++ = *(rdma_argp + 1);
        *p++ = xprt->sc_fc_credits;
        *p++ = rdma_error;
-        if (status == -EPROTONOSUPPORT) {
+        switch (status) {
+        case -EPROTONOSUPPORT:
                *p++ = err_vers;
                *p++ = rpcrdma_version;
                *p++ = rpcrdma_version;
-        } else {
+                trace_svcrdma_err_vers(*rdma_argp);
+                break;
+        default:
                *p++ = err_chunk;
+                trace_svcrdma_err_chunk(*rdma_argp);
        }
-        length = (unsigned long)p - (unsigned long)err_msgp;
+        length = (unsigned long)p - (unsigned long)ctxt->sc_xprt_buf;
+        svc_rdma_sync_reply_hdr(xprt, ctxt, length);
-        /* Map transport header; no RPC message payload */
-        ctxt = svc_rdma_get_context(xprt);
-        ret = svc_rdma_map_reply_hdr(xprt, ctxt, err_msgp, length);
-        if (ret) {
-                dprintk("svcrdma: Error %d mapping send for protocol error\n",
-                        ret);
-                return;
-        }
-        ret = svc_rdma_post_send_wr(xprt, ctxt, 1, 0);
+        ctxt->sc_send_wr.opcode = IB_WR_SEND;
-        if (ret) {
+        ret = svc_rdma_send(xprt, &ctxt->sc_send_wr);
-                dprintk("svcrdma: Error %d posting send for protocol error\n",
+        if (ret)
-                        ret);
+                svc_rdma_send_ctxt_put(xprt, ctxt);
-                svc_rdma_unmap_dma(ctxt);
-                svc_rdma_put_context(ctxt, 1);
-        }
 }
 /* By convention, backchannel calls arrive via rdma_msg type
@@ -507,32 +704,28 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
        struct svc_xprt *xprt = rqstp->rq_xprt;
        struct svcxprt_rdma *rdma_xprt =
                container_of(xprt, struct svcxprt_rdma, sc_xprt);
-        struct svc_rdma_op_ctxt *ctxt;
+        struct svc_rdma_recv_ctxt *ctxt;
        __be32 *p;
        int ret;
        spin_lock(&rdma_xprt->sc_rq_dto_lock);
-        if (!list_empty(&rdma_xprt->sc_read_complete_q)) {
+        ctxt = svc_rdma_next_recv_ctxt(&rdma_xprt->sc_read_complete_q);
-                ctxt = list_first_entry(&rdma_xprt->sc_read_complete_q,
+        if (ctxt) {
-                                        struct svc_rdma_op_ctxt, list);
+                list_del(&ctxt->rc_list);
-                list_del(&ctxt->list);
                spin_unlock(&rdma_xprt->sc_rq_dto_lock);
                rdma_read_complete(rqstp, ctxt);
                goto complete;
-        } else if (!list_empty(&rdma_xprt->sc_rq_dto_q)) {
+        }
-                ctxt = list_first_entry(&rdma_xprt->sc_rq_dto_q,
+        ctxt = svc_rdma_next_recv_ctxt(&rdma_xprt->sc_rq_dto_q);
-                                        struct svc_rdma_op_ctxt, list);
+        if (!ctxt) {
-                list_del(&ctxt->list);
-        } else {
                /* No new incoming requests, terminate the loop */
                clear_bit(XPT_DATA, &xprt->xpt_flags);
                spin_unlock(&rdma_xprt->sc_rq_dto_lock);
                return 0;
        }
+        list_del(&ctxt->rc_list);
        spin_unlock(&rdma_xprt->sc_rq_dto_lock);
-        dprintk("svcrdma: recvfrom: ctxt=%p on xprt=%p, rqstp=%p\n",
-                ctxt, rdma_xprt, rqstp);
        atomic_inc(&rdma_stat_recv);
        svc_rdma_build_arg_xdr(rqstp, ctxt);
@@ -548,7 +741,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
        if (svc_rdma_is_backchannel_reply(xprt, p)) {
                ret = svc_rdma_handle_bc_reply(xprt->xpt_bc_xprt, p,
                                               &rqstp->rq_arg);
-                svc_rdma_put_context(ctxt, 0);
+                svc_rdma_recv_ctxt_put(rdma_xprt, ctxt);
                return ret;
        }
@@ -557,9 +750,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
                goto out_readchunk;
 complete:
-        svc_rdma_put_context(ctxt, 0);
+        rqstp->rq_xprt_ctxt = ctxt;
-        dprintk("svcrdma: recvfrom: xprt=%p, rqstp=%p, rq_arg.len=%u\n",
-                rdma_xprt, rqstp, rqstp->rq_arg.len);
        rqstp->rq_prot = IPPROTO_MAX;
        svc_xprt_copy_addrs(rqstp, xprt);
        return rqstp->rq_arg.len;
@@ -572,16 +763,16 @@ out_readchunk:
 out_err:
        svc_rdma_send_error(rdma_xprt, p, ret);
-        svc_rdma_put_context(ctxt, 0);
+        svc_rdma_recv_ctxt_put(rdma_xprt, ctxt);
        return 0;
 out_postfail:
        if (ret == -EINVAL)
                svc_rdma_send_error(rdma_xprt, p, ret);
-        svc_rdma_put_context(ctxt, 1);
+        svc_rdma_recv_ctxt_put(rdma_xprt, ctxt);
        return ret;
 out_drop:
-        svc_rdma_put_context(ctxt, 1);
+        svc_rdma_recv_ctxt_put(rdma_xprt, ctxt);
        return 0;
 }
diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c
index 12b9a7e0b6d2..ce3ea8419704 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c
@@ -1,15 +1,18 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * Copyright (c) 2016 Oracle.  All rights reserved.
+ * Copyright (c) 2016-2018 Oracle.  All rights reserved.
 *
 * Use the core R/W API to move RPC-over-RDMA Read and Write chunks.
 */
+#include <rdma/rw.h>
 #include <linux/sunrpc/rpc_rdma.h>
 #include <linux/sunrpc/svc_rdma.h>
 #include <linux/sunrpc/debug.h>
-#include <rdma/rw.h>
+#include "xprt_rdma.h"
+#include <trace/events/rpcrdma.h>
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
@@ -205,6 +208,8 @@ static void svc_rdma_write_done(struct ib_cq *cq, struct ib_wc *wc)
        struct svc_rdma_write_info *info =
                        container_of(cc, struct svc_rdma_write_info, wi_cc);
+        trace_svcrdma_wc_write(wc);
        atomic_add(cc->cc_sqecount, &rdma->sc_sq_avail);
        wake_up(&rdma->sc_send_wait);
@@ -222,7 +227,7 @@ static void svc_rdma_write_done(struct ib_cq *cq, struct ib_wc *wc)
 /* State for pulling a Read chunk.
 */
 struct svc_rdma_read_info {
-        struct svc_rdma_op_ctxt         *ri_readctxt;
+        struct svc_rdma_recv_ctxt       *ri_readctxt;
        unsigned int                    ri_position;
        unsigned int                    ri_pageno;
        unsigned int                    ri_pageoff;
@@ -266,6 +271,8 @@ static void svc_rdma_wc_read_done(struct ib_cq *cq, struct ib_wc *wc)
        struct svc_rdma_read_info *info =
                        container_of(cc, struct svc_rdma_read_info, ri_cc);
+        trace_svcrdma_wc_read(wc);
        atomic_add(cc->cc_sqecount, &rdma->sc_sq_avail);
        wake_up(&rdma->sc_send_wait);
@@ -275,10 +282,10 @@ static void svc_rdma_wc_read_done(struct ib_cq *cq, struct ib_wc *wc)
                        pr_err("svcrdma: read ctx: %s (%u/0x%x)\n",
                               ib_wc_status_msg(wc->status),
                               wc->status, wc->vendor_err);
-                svc_rdma_put_context(info->ri_readctxt, 1);
+                svc_rdma_recv_ctxt_put(rdma, info->ri_readctxt);
        } else {
                spin_lock(&rdma->sc_rq_dto_lock);
-                list_add_tail(&info->ri_readctxt->list,
+                list_add_tail(&info->ri_readctxt->rc_list,
                              &rdma->sc_read_complete_q);
                spin_unlock(&rdma->sc_rq_dto_lock);
@@ -323,18 +330,20 @@ static int svc_rdma_post_chunk_ctxt(struct svc_rdma_chunk_ctxt *cc)
                if (atomic_sub_return(cc->cc_sqecount,
                                      &rdma->sc_sq_avail) > 0) {
                        ret = ib_post_send(rdma->sc_qp, first_wr, &bad_wr);
+                        trace_svcrdma_post_rw(&cc->cc_cqe,
+                                              cc->cc_sqecount, ret);
                        if (ret)
                                break;
                        return 0;
                }
-                atomic_inc(&rdma_stat_sq_starve);
+                trace_svcrdma_sq_full(rdma);
                atomic_add(cc->cc_sqecount, &rdma->sc_sq_avail);
                wait_event(rdma->sc_send_wait,
                           atomic_read(&rdma->sc_sq_avail) > cc->cc_sqecount);
+                trace_svcrdma_sq_retry(rdma);
        } while (1);
-        pr_err("svcrdma: ib_post_send failed (%d)\n", ret);
        set_bit(XPT_CLOSE, &xprt->xpt_flags);
        /* If even one was posted, there will be a completion. */
@@ -437,6 +446,7 @@ svc_rdma_build_writes(struct svc_rdma_write_info *info,
                if (ret < 0)
                        goto out_initerr;
+                trace_svcrdma_encode_wseg(seg_handle, write_len, seg_offset);
                list_add(&ctxt->rw_list, &cc->cc_rwctxts);
                cc->cc_sqecount += ret;
                if (write_len == seg_length - info->wi_seg_off) {
@@ -462,7 +472,7 @@ out_noctx:
 out_initerr:
        svc_rdma_put_rw_ctxt(rdma, ctxt);
-        pr_err("svcrdma: failed to map pagelist (%d)\n", ret);
+        trace_svcrdma_dma_map_rwctx(rdma, ret);
        return -EIO;
 }
@@ -526,6 +536,8 @@ int svc_rdma_send_write_chunk(struct svcxprt_rdma *rdma, __be32 *wr_ch,
        ret = svc_rdma_post_chunk_ctxt(&info->wi_cc);
        if (ret < 0)
                goto out_err;
+        trace_svcrdma_encode_write(xdr->page_len);
        return xdr->page_len;
 out_err:
@@ -582,6 +594,8 @@ int svc_rdma_send_reply_chunk(struct svcxprt_rdma *rdma, __be32 *rp_ch,
        ret = svc_rdma_post_chunk_ctxt(&info->wi_cc);
        if (ret < 0)
                goto out_err;
+        trace_svcrdma_encode_reply(consumed);
        return consumed;
 out_err:
@@ -593,7 +607,7 @@ static int svc_rdma_build_read_segment(struct svc_rdma_read_info *info,
                                       struct svc_rqst *rqstp,
                                       u32 rkey, u32 len, u64 offset)
 {
-        struct svc_rdma_op_ctxt *head = info->ri_readctxt;
+        struct svc_rdma_recv_ctxt *head = info->ri_readctxt;
        struct svc_rdma_chunk_ctxt *cc = &info->ri_cc;
        struct svc_rdma_rw_ctxt *ctxt;
        unsigned int sge_no, seg_len;
@@ -606,18 +620,15 @@ static int svc_rdma_build_read_segment(struct svc_rdma_read_info *info,
                goto out_noctx;
        ctxt->rw_nents = sge_no;
-        dprintk("svcrdma: reading segment %u@0x%016llx:0x%08x (%u sges)\n",
-                len, offset, rkey, sge_no);
        sg = ctxt->rw_sg_table.sgl;
        for (sge_no = 0; sge_no < ctxt->rw_nents; sge_no++) {
                seg_len = min_t(unsigned int, len,
                                PAGE_SIZE - info->ri_pageoff);
-                head->arg.pages[info->ri_pageno] =
+                head->rc_arg.pages[info->ri_pageno] =
                        rqstp->rq_pages[info->ri_pageno];
                if (!info->ri_pageoff)
-                        head->count++;
+                        head->rc_page_count++;
                sg_set_page(sg, rqstp->rq_pages[info->ri_pageno],
                            seg_len, info->ri_pageoff);
@@ -656,8 +667,8 @@ out_overrun:
        return -EINVAL;
 out_initerr:
+        trace_svcrdma_dma_map_rwctx(cc->cc_rdma, ret);
        svc_rdma_put_rw_ctxt(cc->cc_rdma, ctxt);
-        pr_err("svcrdma: failed to map pagelist (%d)\n", ret);
        return -EIO;
 }
@@ -686,6 +697,7 @@ static int svc_rdma_build_read_chunk(struct svc_rqst *rqstp,
                if (ret < 0)
                        break;
+                trace_svcrdma_encode_rseg(rs_handle, rs_length, rs_offset);
                info->ri_chunklen += rs_length;
        }
@@ -693,9 +705,9 @@ static int svc_rdma_build_read_chunk(struct svc_rqst *rqstp,
 }
 /* Construct RDMA Reads to pull over a normal Read chunk. The chunk
- * data lands in the page list of head->arg.pages.
+ * data lands in the page list of head->rc_arg.pages.
 *
- * Currently NFSD does not look at the head->arg.tail[0] iovec.
+ * Currently NFSD does not look at the head->rc_arg.tail[0] iovec.
 * Therefore, XDR round-up of the Read chunk and trailing
 * inline content must both be added at the end of the pagelist.
 */
@@ -703,29 +715,27 @@ static int svc_rdma_build_normal_read_chunk(struct svc_rqst *rqstp,
                                            struct svc_rdma_read_info *info,
                                            __be32 *p)
 {
-        struct svc_rdma_op_ctxt *head = info->ri_readctxt;
+        struct svc_rdma_recv_ctxt *head = info->ri_readctxt;
        int ret;
-        dprintk("svcrdma: Reading Read chunk at position %u\n",
-                info->ri_position);
-        info->ri_pageno = head->hdr_count;
-        info->ri_pageoff = 0;
        ret = svc_rdma_build_read_chunk(rqstp, info, p);
        if (ret < 0)
                goto out;
+        trace_svcrdma_encode_read(info->ri_chunklen, info->ri_position);
+        head->rc_hdr_count = 0;
        /* Split the Receive buffer between the head and tail
         * buffers at Read chunk's position. XDR roundup of the
         * chunk is not included in either the pagelist or in
         * the tail.
         */
-        head->arg.tail[0].iov_base =
+        head->rc_arg.tail[0].iov_base =
-                head->arg.head[0].iov_base + info->ri_position;
+                head->rc_arg.head[0].iov_base + info->ri_position;
-        head->arg.tail[0].iov_len =
+        head->rc_arg.tail[0].iov_len =
-                head->arg.head[0].iov_len - info->ri_position;
+                head->rc_arg.head[0].iov_len - info->ri_position;
-        head->arg.head[0].iov_len = info->ri_position;
+        head->rc_arg.head[0].iov_len = info->ri_position;
        /* Read chunk may need XDR roundup (see RFC 8166, s. 3.4.5.2).
         *
@@ -738,9 +748,9 @@ static int svc_rdma_build_normal_read_chunk(struct svc_rqst *rqstp,
         */
        info->ri_chunklen = XDR_QUADLEN(info->ri_chunklen) << 2;
-        head->arg.page_len = info->ri_chunklen;
+        head->rc_arg.page_len = info->ri_chunklen;
-        head->arg.len += info->ri_chunklen;
+        head->rc_arg.len += info->ri_chunklen;
-        head->arg.buflen += info->ri_chunklen;
+        head->rc_arg.buflen += info->ri_chunklen;
 out:
        return ret;
@@ -749,7 +759,7 @@ out:
 /* Construct RDMA Reads to pull over a Position Zero Read chunk.
 * The start of the data lands in the first page just after
 * the Transport header, and the rest lands in the page list of
- * head->arg.pages.
+ * head->rc_arg.pages.
 *
 * Assumptions:
 *      - A PZRC has an XDR-aligned length (no implicit round-up).
@@ -761,35 +771,25 @@ static int svc_rdma_build_pz_read_chunk(struct svc_rqst *rqstp,
                                        struct svc_rdma_read_info *info,
                                        __be32 *p)
 {
-        struct svc_rdma_op_ctxt *head = info->ri_readctxt;
+        struct svc_rdma_recv_ctxt *head = info->ri_readctxt;
        int ret;
-        dprintk("svcrdma: Reading Position Zero Read chunk\n");
-        info->ri_pageno = head->hdr_count - 1;
-        info->ri_pageoff = offset_in_page(head->byte_len);
        ret = svc_rdma_build_read_chunk(rqstp, info, p);
        if (ret < 0)
                goto out;
-        head->arg.len += info->ri_chunklen;
+        trace_svcrdma_encode_pzr(info->ri_chunklen);
-        head->arg.buflen += info->ri_chunklen;
-        if (head->arg.buflen <= head->sge[0].length) {
+        head->rc_arg.len += info->ri_chunklen;
-                /* Transport header and RPC message fit entirely
+        head->rc_arg.buflen += info->ri_chunklen;
-                 * in page where head iovec resides.
-                 */
+        head->rc_hdr_count = 1;
-                head->arg.head[0].iov_len = info->ri_chunklen;
+        head->rc_arg.head[0].iov_base = page_address(head->rc_pages[0]);
-        } else {
+        head->rc_arg.head[0].iov_len = min_t(size_t, PAGE_SIZE,
-                /* Transport header and part of RPC message reside
+                                             info->ri_chunklen);
-                 * in the head iovec's page.
-                 */
+        head->rc_arg.page_len = info->ri_chunklen -
-                head->arg.head[0].iov_len =
+                                head->rc_arg.head[0].iov_len;
-                                head->sge[0].length - head->byte_len;
-                head->arg.page_len =
-                                info->ri_chunklen - head->arg.head[0].iov_len;
-        }
 out:
        return ret;
@@ -813,29 +813,30 @@ out:
 * - All Read segments in @p have the same Position value.
 */
 int svc_rdma_recv_read_chunk(struct svcxprt_rdma *rdma, struct svc_rqst *rqstp,
-                             struct svc_rdma_op_ctxt *head, __be32 *p)
+                             struct svc_rdma_recv_ctxt *head, __be32 *p)
 {
        struct svc_rdma_read_info *info;
        struct page **page;
        int ret;
        /* The request (with page list) is constructed in
-         * head->arg. Pages involved with RDMA Read I/O are
+         * head->rc_arg. Pages involved with RDMA Read I/O are
         * transferred there.
         */
-        head->hdr_count = head->count;
+        head->rc_arg.head[0] = rqstp->rq_arg.head[0];
-        head->arg.head[0] = rqstp->rq_arg.head[0];
+        head->rc_arg.tail[0] = rqstp->rq_arg.tail[0];
-        head->arg.tail[0] = rqstp->rq_arg.tail[0];
+        head->rc_arg.pages = head->rc_pages;
-        head->arg.pages = head->pages;
+        head->rc_arg.page_base = 0;
-        head->arg.page_base = 0;
+        head->rc_arg.page_len = 0;
-        head->arg.page_len = 0;
+        head->rc_arg.len = rqstp->rq_arg.len;
-        head->arg.len = rqstp->rq_arg.len;
+        head->rc_arg.buflen = rqstp->rq_arg.buflen;
-        head->arg.buflen = rqstp->rq_arg.buflen;
        info = svc_rdma_read_info_alloc(rdma);
        if (!info)
                return -ENOMEM;
        info->ri_readctxt = head;
+        info->ri_pageno = 0;
+        info->ri_pageoff = 0;
        info->ri_position = be32_to_cpup(p + 1);
        if (info->ri_position)
@@ -856,7 +857,7 @@ int svc_rdma_recv_read_chunk(struct svcxprt_rdma *rdma, struct svc_rqst *rqstp,
 out:
        /* Read sink pages have been moved from rqstp->rq_pages to
-         * head->arg.pages. Force svc_recv to refill those slots
+         * head->rc_arg.pages. Force svc_recv to refill those slots
         * in rq_pages.
         */
        for (page = rqstp->rq_pages; page < rqstp->rq_respages; page++)
diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
index 649441d5087d..4a3efaea277c 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
@@ -1,5 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (c) 2016 Oracle. All rights reserved.
+ * Copyright (c) 2016-2018 Oracle. All rights reserved.
 * Copyright (c) 2014 Open Grid Computing, Inc. All rights reserved.
 * Copyright (c) 2005-2006 Network Appliance, Inc. All rights reserved.
 *
@@ -74,11 +75,11 @@
 * DMA-unmap the pages under I/O for that Write segment. The Write
 * completion handler does not release any pages.
 *
- * When the Send WR is constructed, it also gets its own svc_rdma_op_ctxt.
+ * When the Send WR is constructed, it also gets its own svc_rdma_send_ctxt.
 * The ownership of all of the Reply's pages are transferred into that
 * ctxt, the Send WR is posted, and sendto returns.
 *
- * The svc_rdma_op_ctxt is presented when the Send WR completes. The
+ * The svc_rdma_send_ctxt is presented when the Send WR completes. The
 * Send completion handler finally releases the Reply's pages.
 *
 * This mechanism also assumes that completions on the transport's Send
@@ -98,16 +99,230 @@
 * where two different Write segments send portions of the same page.
 */
-#include <linux/sunrpc/debug.h>
-#include <linux/sunrpc/rpc_rdma.h>
 #include <linux/spinlock.h>
 #include <asm/unaligned.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/rdma_cm.h>
+#include <linux/sunrpc/debug.h>
+#include <linux/sunrpc/rpc_rdma.h>
 #include <linux/sunrpc/svc_rdma.h>
+#include "xprt_rdma.h"
+#include <trace/events/rpcrdma.h>
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
+static void svc_rdma_wc_send(struct ib_cq *cq, struct ib_wc *wc);
+static inline struct svc_rdma_send_ctxt *
+svc_rdma_next_send_ctxt(struct list_head *list)
+{
+        return list_first_entry_or_null(list, struct svc_rdma_send_ctxt,
+                                        sc_list);
+}
+static struct svc_rdma_send_ctxt *
+svc_rdma_send_ctxt_alloc(struct svcxprt_rdma *rdma)
+{
+        struct svc_rdma_send_ctxt *ctxt;
+        dma_addr_t addr;
+        void *buffer;
+        size_t size;
+        int i;
+        size = sizeof(*ctxt);
+        size += rdma->sc_max_send_sges * sizeof(struct ib_sge);
+        ctxt = kmalloc(size, GFP_KERNEL);
+        if (!ctxt)
+                goto fail0;
+        buffer = kmalloc(rdma->sc_max_req_size, GFP_KERNEL);
+        if (!buffer)
+                goto fail1;
+        addr = ib_dma_map_single(rdma->sc_pd->device, buffer,
+                                 rdma->sc_max_req_size, DMA_TO_DEVICE);
+        if (ib_dma_mapping_error(rdma->sc_pd->device, addr))
+                goto fail2;
+        ctxt->sc_send_wr.next = NULL;
+        ctxt->sc_send_wr.wr_cqe = &ctxt->sc_cqe;
+        ctxt->sc_send_wr.sg_list = ctxt->sc_sges;
+        ctxt->sc_send_wr.send_flags = IB_SEND_SIGNALED;
+        ctxt->sc_cqe.done = svc_rdma_wc_send;
+        ctxt->sc_xprt_buf = buffer;
+        ctxt->sc_sges[0].addr = addr;
+        for (i = 0; i < rdma->sc_max_send_sges; i++)
+                ctxt->sc_sges[i].lkey = rdma->sc_pd->local_dma_lkey;
+        return ctxt;
+fail2:
+        kfree(buffer);
+fail1:
+        kfree(ctxt);
+fail0:
+        return NULL;
+}
+/**
+ * svc_rdma_send_ctxts_destroy - Release all send_ctxt's for an xprt
+ * @rdma: svcxprt_rdma being torn down
+ *
+ */
+void svc_rdma_send_ctxts_destroy(struct svcxprt_rdma *rdma)
+{
+        struct svc_rdma_send_ctxt *ctxt;
+        while ((ctxt = svc_rdma_next_send_ctxt(&rdma->sc_send_ctxts))) {
+                list_del(&ctxt->sc_list);
+                ib_dma_unmap_single(rdma->sc_pd->device,
+                                    ctxt->sc_sges[0].addr,
+                                    rdma->sc_max_req_size,
+                                    DMA_TO_DEVICE);
+                kfree(ctxt->sc_xprt_buf);
+                kfree(ctxt);
+        }
+}
+/**
+ * svc_rdma_send_ctxt_get - Get a free send_ctxt
+ * @rdma: controlling svcxprt_rdma
+ *
+ * Returns a ready-to-use send_ctxt, or NULL if none are
+ * available and a fresh one cannot be allocated.
+ */
+struct svc_rdma_send_ctxt *svc_rdma_send_ctxt_get(struct svcxprt_rdma *rdma)
+{
+        struct svc_rdma_send_ctxt *ctxt;
+        spin_lock(&rdma->sc_send_lock);
+        ctxt = svc_rdma_next_send_ctxt(&rdma->sc_send_ctxts);
+        if (!ctxt)
+                goto out_empty;
+        list_del(&ctxt->sc_list);
+        spin_unlock(&rdma->sc_send_lock);
+out:
+        ctxt->sc_send_wr.num_sge = 0;
+        ctxt->sc_cur_sge_no = 0;
+        ctxt->sc_page_count = 0;
+        return ctxt;
+out_empty:
+        spin_unlock(&rdma->sc_send_lock);
+        ctxt = svc_rdma_send_ctxt_alloc(rdma);
+        if (!ctxt)
+                return NULL;
+        goto out;
+}
+/**
+ * svc_rdma_send_ctxt_put - Return send_ctxt to free list
+ * @rdma: controlling svcxprt_rdma
+ * @ctxt: object to return to the free list
+ *
+ * Pages left in sc_pages are DMA unmapped and released.
+ */
+void svc_rdma_send_ctxt_put(struct svcxprt_rdma *rdma,
+                            struct svc_rdma_send_ctxt *ctxt)
+{
+        struct ib_device *device = rdma->sc_cm_id->device;
+        unsigned int i;
+        /* The first SGE contains the transport header, which
+         * remains mapped until @ctxt is destroyed.
+         */
+        for (i = 1; i < ctxt->sc_send_wr.num_sge; i++)
+                ib_dma_unmap_page(device,
+                                  ctxt->sc_sges[i].addr,
+                                  ctxt->sc_sges[i].length,
+                                  DMA_TO_DEVICE);
+        for (i = 0; i < ctxt->sc_page_count; ++i)
+                put_page(ctxt->sc_pages[i]);
+        spin_lock(&rdma->sc_send_lock);
+        list_add(&ctxt->sc_list, &rdma->sc_send_ctxts);
+        spin_unlock(&rdma->sc_send_lock);
+}
+/**
+ * svc_rdma_wc_send - Invoked by RDMA provider for each polled Send WC
+ * @cq: Completion Queue context
+ * @wc: Work Completion object
+ *
+ * NB: The svc_xprt/svcxprt_rdma is pinned whenever it's possible that
+ * the Send completion handler could be running.
+ */
+static void svc_rdma_wc_send(struct ib_cq *cq, struct ib_wc *wc)
+{
+        struct svcxprt_rdma *rdma = cq->cq_context;
+        struct ib_cqe *cqe = wc->wr_cqe;
+        struct svc_rdma_send_ctxt *ctxt;
+        trace_svcrdma_wc_send(wc);
+        atomic_inc(&rdma->sc_sq_avail);
+        wake_up(&rdma->sc_send_wait);
+        ctxt = container_of(cqe, struct svc_rdma_send_ctxt, sc_cqe);
+        svc_rdma_send_ctxt_put(rdma, ctxt);
+        if (unlikely(wc->status != IB_WC_SUCCESS)) {
+                set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
+                svc_xprt_enqueue(&rdma->sc_xprt);
+                if (wc->status != IB_WC_WR_FLUSH_ERR)
+                        pr_err("svcrdma: Send: %s (%u/0x%x)\n",
+                               ib_wc_status_msg(wc->status),
+                               wc->status, wc->vendor_err);
+        }
+        svc_xprt_put(&rdma->sc_xprt);
+}
+/**
+ * svc_rdma_send - Post a single Send WR
+ * @rdma: transport on which to post the WR
+ * @wr: prepared Send WR to post
+ *
+ * Returns zero the Send WR was posted successfully. Otherwise, a
+ * negative errno is returned.
+ */
+int svc_rdma_send(struct svcxprt_rdma *rdma, struct ib_send_wr *wr)
+{
+        struct ib_send_wr *bad_wr;
+        int ret;
+        might_sleep();
+        /* If the SQ is full, wait until an SQ entry is available */
+        while (1) {
+                if ((atomic_dec_return(&rdma->sc_sq_avail) < 0)) {
+                        atomic_inc(&rdma_stat_sq_starve);
+                        trace_svcrdma_sq_full(rdma);
+                        atomic_inc(&rdma->sc_sq_avail);
+                        wait_event(rdma->sc_send_wait,
+                                   atomic_read(&rdma->sc_sq_avail) > 1);
+                        if (test_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags))
+                                return -ENOTCONN;
+                        trace_svcrdma_sq_retry(rdma);
+                        continue;
+                }
+                svc_xprt_get(&rdma->sc_xprt);
+                ret = ib_post_send(rdma->sc_qp, wr, &bad_wr);
+                trace_svcrdma_post_send(wr, ret);
+                if (ret) {
+                        set_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags);
+                        svc_xprt_put(&rdma->sc_xprt);
+                        wake_up(&rdma->sc_send_wait);
+                }
+                break;
+        }
+        return ret;
+}
 static u32 xdr_padsize(u32 len)
 {
        return (len & 3) ? (4 - (len & 3)) : 0;
@@ -296,41 +511,10 @@ static u32 svc_rdma_get_inv_rkey(__be32 *rdma_argp,
        return be32_to_cpup(p);
 }
-/* ib_dma_map_page() is used here because svc_rdma_dma_unmap()
- * is used during completion to DMA-unmap this memory, and
- * it uses ib_dma_unmap_page() exclusively.
- */
-static int svc_rdma_dma_map_buf(struct svcxprt_rdma *rdma,
-                                struct svc_rdma_op_ctxt *ctxt,
-                                unsigned int sge_no,
-                                unsigned char *base,
-                                unsigned int len)
-{
-        unsigned long offset = (unsigned long)base & ~PAGE_MASK;
-        struct ib_device *dev = rdma->sc_cm_id->device;
-        dma_addr_t dma_addr;
-        dma_addr = ib_dma_map_page(dev, virt_to_page(base),
-                                   offset, len, DMA_TO_DEVICE);
-        if (ib_dma_mapping_error(dev, dma_addr))
-                goto out_maperr;
-        ctxt->sge[sge_no].addr = dma_addr;
-        ctxt->sge[sge_no].length = len;
-        ctxt->sge[sge_no].lkey = rdma->sc_pd->local_dma_lkey;
-        svc_rdma_count_mappings(rdma, ctxt);
-        return 0;
-out_maperr:
-        pr_err("svcrdma: failed to map buffer\n");
-        return -EIO;
-}
 static int svc_rdma_dma_map_page(struct svcxprt_rdma *rdma,
-                                 struct svc_rdma_op_ctxt *ctxt,
+                                 struct svc_rdma_send_ctxt *ctxt,
-                                 unsigned int sge_no,
                                 struct page *page,
-                                 unsigned int offset,
+                                 unsigned long offset,
                                 unsigned int len)
 {
        struct ib_device *dev = rdma->sc_cm_id->device;
@@ -340,58 +524,71 @@ static int svc_rdma_dma_map_page(struct svcxprt_rdma *rdma,
        if (ib_dma_mapping_error(dev, dma_addr))
                goto out_maperr;
-        ctxt->sge[sge_no].addr = dma_addr;
+        ctxt->sc_sges[ctxt->sc_cur_sge_no].addr = dma_addr;
-        ctxt->sge[sge_no].length = len;
+        ctxt->sc_sges[ctxt->sc_cur_sge_no].length = len;
-        ctxt->sge[sge_no].lkey = rdma->sc_pd->local_dma_lkey;
+        ctxt->sc_send_wr.num_sge++;
-        svc_rdma_count_mappings(rdma, ctxt);
        return 0;
 out_maperr:
-        pr_err("svcrdma: failed to map page\n");
+        trace_svcrdma_dma_map_page(rdma, page);
        return -EIO;
 }
+/* ib_dma_map_page() is used here because svc_rdma_dma_unmap()
+ * handles DMA-unmap and it uses ib_dma_unmap_page() exclusively.
+ */
+static int svc_rdma_dma_map_buf(struct svcxprt_rdma *rdma,
+                                struct svc_rdma_send_ctxt *ctxt,
+                                unsigned char *base,
+                                unsigned int len)
+{
+        return svc_rdma_dma_map_page(rdma, ctxt, virt_to_page(base),
+                                     offset_in_page(base), len);
+}
 /**
- * svc_rdma_map_reply_hdr - DMA map the transport header buffer
+ * svc_rdma_sync_reply_hdr - DMA sync the transport header buffer
 * @rdma: controlling transport
- * @ctxt: op_ctxt for the Send WR
+ * @ctxt: send_ctxt for the Send WR
- * @rdma_resp: buffer containing transport header
 * @len: length of transport header
 *
- * Returns:
- *      %0 if the header is DMA mapped,
- *      %-EIO if DMA mapping failed.
 */
-int svc_rdma_map_reply_hdr(struct svcxprt_rdma *rdma,
+void svc_rdma_sync_reply_hdr(struct svcxprt_rdma *rdma,
-                           struct svc_rdma_op_ctxt *ctxt,
+                             struct svc_rdma_send_ctxt *ctxt,
-                           __be32 *rdma_resp,
+                             unsigned int len)
-                           unsigned int len)
 {
-        ctxt->direction = DMA_TO_DEVICE;
+        ctxt->sc_sges[0].length = len;
-        ctxt->pages[0] = virt_to_page(rdma_resp);
+        ctxt->sc_send_wr.num_sge++;
-        ctxt->count = 1;
+        ib_dma_sync_single_for_device(rdma->sc_pd->device,
-        return svc_rdma_dma_map_page(rdma, ctxt, 0, ctxt->pages[0], 0, len);
+                                      ctxt->sc_sges[0].addr, len,
+                                      DMA_TO_DEVICE);
 }
-/* Load the xdr_buf into the ctxt's sge array, and DMA map each
+/* svc_rdma_map_reply_msg - Map the buffer holding RPC message
+ * @rdma: controlling transport
+ * @ctxt: send_ctxt for the Send WR
+ * @xdr: prepared xdr_buf containing RPC message
+ * @wr_lst: pointer to Call header's Write list, or NULL
+ *
+ * Load the xdr_buf into the ctxt's sge array, and DMA map each
 * element as it is added.
 *
- * Returns the number of sge elements loaded on success, or
+ * Returns zero on success, or a negative errno on failure.
- * a negative errno on failure.
 */
-static int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
+int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
-                                  struct svc_rdma_op_ctxt *ctxt,
+                           struct svc_rdma_send_ctxt *ctxt,
-                                  struct xdr_buf *xdr, __be32 *wr_lst)
+                           struct xdr_buf *xdr, __be32 *wr_lst)
 {
-        unsigned int len, sge_no, remaining, page_off;
+        unsigned int len, remaining;
+        unsigned long page_off;
        struct page **ppages;
        unsigned char *base;
        u32 xdr_pad;
        int ret;
-        sge_no = 1;
+        if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
+                return -EIO;
-        ret = svc_rdma_dma_map_buf(rdma, ctxt, sge_no++,
+        ret = svc_rdma_dma_map_buf(rdma, ctxt,
                                   xdr->head[0].iov_base,
                                   xdr->head[0].iov_len);
        if (ret < 0)
@@ -421,8 +618,10 @@ static int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
        while (remaining) {
                len = min_t(u32, PAGE_SIZE - page_off, remaining);
-                ret = svc_rdma_dma_map_page(rdma, ctxt, sge_no++,
+                if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
-                                            *ppages++, page_off, len);
+                        return -EIO;
+                ret = svc_rdma_dma_map_page(rdma, ctxt, *ppages++,
+                                            page_off, len);
                if (ret < 0)
                        return ret;
@@ -434,12 +633,14 @@ static int svc_rdma_map_reply_msg(struct svcxprt_rdma *rdma,
        len = xdr->tail[0].iov_len;
 tail:
        if (len) {
-                ret = svc_rdma_dma_map_buf(rdma, ctxt, sge_no++, base, len);
+                if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
+                        return -EIO;
+                ret = svc_rdma_dma_map_buf(rdma, ctxt, base, len);
                if (ret < 0)
                        return ret;
        }
-        return sge_no - 1;
+        return 0;
 }
 /* The svc_rqst and all resources it owns are released as soon as
@@ -447,62 +648,25 @@ tail:
 * so they are released by the Send completion handler.
 */
 static void svc_rdma_save_io_pages(struct svc_rqst *rqstp,
-                                   struct svc_rdma_op_ctxt *ctxt)
+                                   struct svc_rdma_send_ctxt *ctxt)
 {
        int i, pages = rqstp->rq_next_page - rqstp->rq_respages;
-        ctxt->count += pages;
+        ctxt->sc_page_count += pages;
        for (i = 0; i < pages; i++) {
-                ctxt->pages[i + 1] = rqstp->rq_respages[i];
+                ctxt->sc_pages[i] = rqstp->rq_respages[i];
                rqstp->rq_respages[i] = NULL;
        }
        rqstp->rq_next_page = rqstp->rq_respages + 1;
 }
-/**
- * svc_rdma_post_send_wr - Set up and post one Send Work Request
- * @rdma: controlling transport
- * @ctxt: op_ctxt for transmitting the Send WR
- * @num_sge: number of SGEs to send
- * @inv_rkey: R_key argument to Send With Invalidate, or zero
- *
- * Returns:
- *      %0 if the Send* was posted successfully,
- *      %-ENOTCONN if the connection was lost or dropped,
- *      %-EINVAL if there was a problem with the Send we built,
- *      %-ENOMEM if ib_post_send failed.
- */
-int svc_rdma_post_send_wr(struct svcxprt_rdma *rdma,
-                          struct svc_rdma_op_ctxt *ctxt, int num_sge,
-                          u32 inv_rkey)
-{
-        struct ib_send_wr *send_wr = &ctxt->send_wr;
-        dprintk("svcrdma: posting Send WR with %u sge(s)\n", num_sge);
-        send_wr->next = NULL;
-        ctxt->cqe.done = svc_rdma_wc_send;
-        send_wr->wr_cqe = &ctxt->cqe;
-        send_wr->sg_list = ctxt->sge;
-        send_wr->num_sge = num_sge;
-        send_wr->send_flags = IB_SEND_SIGNALED;
-        if (inv_rkey) {
-                send_wr->opcode = IB_WR_SEND_WITH_INV;
-                send_wr->ex.invalidate_rkey = inv_rkey;
-        } else {
-                send_wr->opcode = IB_WR_SEND;
-        }
-        return svc_rdma_send(rdma, send_wr);
-}
 /* Prepare the portion of the RPC Reply that will be transmitted
 * via RDMA Send. The RPC-over-RDMA transport header is prepared
- * in sge[0], and the RPC xdr_buf is prepared in following sges.
+ * in sc_sges[0], and the RPC xdr_buf is prepared in following sges.
 *
 * Depending on whether a Write list or Reply chunk is present,
 * the server may send all, a portion of, or none of the xdr_buf.
- * In the latter case, only the transport header (sge[0]) is
+ * In the latter case, only the transport header (sc_sges[0]) is
 * transmitted.
 *
 * RDMA Send is the last step of transmitting an RPC reply. Pages
@@ -515,49 +679,32 @@ int svc_rdma_post_send_wr(struct svcxprt_rdma *rdma,
 * - The Reply's transport header will never be larger than a page.
 */
 static int svc_rdma_send_reply_msg(struct svcxprt_rdma *rdma,
-                                   __be32 *rdma_argp, __be32 *rdma_resp,
+                                   struct svc_rdma_send_ctxt *ctxt,
+                                   __be32 *rdma_argp,
                                   struct svc_rqst *rqstp,
                                   __be32 *wr_lst, __be32 *rp_ch)
 {
-        struct svc_rdma_op_ctxt *ctxt;
-        u32 inv_rkey;
        int ret;
-        dprintk("svcrdma: sending %s reply: head=%zu, pagelen=%u, tail=%zu\n",
-                (rp_ch ? "RDMA_NOMSG" : "RDMA_MSG"),
-                rqstp->rq_res.head[0].iov_len,
-                rqstp->rq_res.page_len,
-                rqstp->rq_res.tail[0].iov_len);
-        ctxt = svc_rdma_get_context(rdma);
-        ret = svc_rdma_map_reply_hdr(rdma, ctxt, rdma_resp,
-                                     svc_rdma_reply_hdr_len(rdma_resp));
-        if (ret < 0)
-                goto err;
        if (!rp_ch) {
                ret = svc_rdma_map_reply_msg(rdma, ctxt,
                                             &rqstp->rq_res, wr_lst);
                if (ret < 0)
-                        goto err;
+                        return ret;
        }
        svc_rdma_save_io_pages(rqstp, ctxt);
-        inv_rkey = 0;
+        ctxt->sc_send_wr.opcode = IB_WR_SEND;
-        if (rdma->sc_snd_w_inv)
+        if (rdma->sc_snd_w_inv) {
-                inv_rkey = svc_rdma_get_inv_rkey(rdma_argp, wr_lst, rp_ch);
+                ctxt->sc_send_wr.ex.invalidate_rkey =
-        ret = svc_rdma_post_send_wr(rdma, ctxt, 1 + ret, inv_rkey);
+                        svc_rdma_get_inv_rkey(rdma_argp, wr_lst, rp_ch);
-        if (ret)
+                if (ctxt->sc_send_wr.ex.invalidate_rkey)
-                goto err;
+                        ctxt->sc_send_wr.opcode = IB_WR_SEND_WITH_INV;
+        }
-        return 0;
+        dprintk("svcrdma: posting Send WR with %u sge(s)\n",
+                ctxt->sc_send_wr.num_sge);
-err:
+        return svc_rdma_send(rdma, &ctxt->sc_send_wr);
-        svc_rdma_unmap_dma(ctxt);
-        svc_rdma_put_context(ctxt, 1);
-        return ret;
 }
 /* Given the client-provided Write and Reply chunks, the server was not
@@ -568,38 +715,29 @@ err:
 * Remote Invalidation is skipped for simplicity.
 */
 static int svc_rdma_send_error_msg(struct svcxprt_rdma *rdma,
-                                   __be32 *rdma_resp, struct svc_rqst *rqstp)
+                                   struct svc_rdma_send_ctxt *ctxt,
+                                   struct svc_rqst *rqstp)
 {
-        struct svc_rdma_op_ctxt *ctxt;
        __be32 *p;
        int ret;
-        ctxt = svc_rdma_get_context(rdma);
+        p = ctxt->sc_xprt_buf;
+        trace_svcrdma_err_chunk(*p);
-        /* Replace the original transport header with an
+        p += 3;
-         * RDMA_ERROR response. XID etc are preserved.
-         */
-        p = rdma_resp + 3;
        *p++ = rdma_error;
        *p   = err_chunk;
+        svc_rdma_sync_reply_hdr(rdma, ctxt, RPCRDMA_HDRLEN_ERR);
-        ret = svc_rdma_map_reply_hdr(rdma, ctxt, rdma_resp, 20);
-        if (ret < 0)
-                goto err;
        svc_rdma_save_io_pages(rqstp, ctxt);
-        ret = svc_rdma_post_send_wr(rdma, ctxt, 1 + ret, 0);
+        ctxt->sc_send_wr.opcode = IB_WR_SEND;
-        if (ret)
+        ret = svc_rdma_send(rdma, &ctxt->sc_send_wr);
-                goto err;
+        if (ret) {
+                svc_rdma_send_ctxt_put(rdma, ctxt);
+                return ret;
+        }
        return 0;
-err:
-        pr_err("svcrdma: failed to post Send WR (%d)\n", ret);
-        svc_rdma_unmap_dma(ctxt);
-        svc_rdma_put_context(ctxt, 1);
-        return ret;
 }
 void svc_rdma_prep_reply_hdr(struct svc_rqst *rqstp)
@@ -623,20 +761,15 @@ int svc_rdma_sendto(struct svc_rqst *rqstp)
        struct svc_xprt *xprt = rqstp->rq_xprt;
        struct svcxprt_rdma *rdma =
                container_of(xprt, struct svcxprt_rdma, sc_xprt);
+        struct svc_rdma_recv_ctxt *rctxt = rqstp->rq_xprt_ctxt;
        __be32 *p, *rdma_argp, *rdma_resp, *wr_lst, *rp_ch;
        struct xdr_buf *xdr = &rqstp->rq_res;
-        struct page *res_page;
+        struct svc_rdma_send_ctxt *sctxt;
        int ret;
-        /* Find the call's chunk lists to decide how to send the reply.
+        rdma_argp = rctxt->rc_recv_buf;
-         * Receive places the Call's xprt header at the start of page 0.
-         */
-        rdma_argp = page_address(rqstp->rq_pages[0]);
        svc_rdma_get_write_arrays(rdma_argp, &wr_lst, &rp_ch);
-        dprintk("svcrdma: preparing response for XID 0x%08x\n",
-                be32_to_cpup(rdma_argp));
        /* Create the RDMA response header. xprt->xpt_mutex,
         * acquired in svc_send(), serializes RPC replies. The
         * code path below that inserts the credit grant value
@@ -644,10 +777,10 @@ int svc_rdma_sendto(struct svc_rqst *rqstp)
         * critical section.
         */
        ret = -ENOMEM;
-        res_page = alloc_page(GFP_KERNEL);
+        sctxt = svc_rdma_send_ctxt_get(rdma);
-        if (!res_page)
+        if (!sctxt)
                goto err0;
-        rdma_resp = page_address(res_page);
+        rdma_resp = sctxt->sc_xprt_buf;
        p = rdma_resp;
        *p++ = *rdma_argp;
@@ -674,26 +807,33 @@ int svc_rdma_sendto(struct svc_rqst *rqstp)
                svc_rdma_xdr_encode_reply_chunk(rdma_resp, rp_ch, ret);
        }
-        ret = svc_rdma_send_reply_msg(rdma, rdma_argp, rdma_resp, rqstp,
+        svc_rdma_sync_reply_hdr(rdma, sctxt, svc_rdma_reply_hdr_len(rdma_resp));
+        ret = svc_rdma_send_reply_msg(rdma, sctxt, rdma_argp, rqstp,
                                      wr_lst, rp_ch);
        if (ret < 0)
-                goto err0;
+                goto err1;
-        return 0;
+        ret = 0;
+out:
+        rqstp->rq_xprt_ctxt = NULL;
+        svc_rdma_recv_ctxt_put(rdma, rctxt);
+        return ret;
 err2:
        if (ret != -E2BIG && ret != -EINVAL)
                goto err1;
-        ret = svc_rdma_send_error_msg(rdma, rdma_resp, rqstp);
+        ret = svc_rdma_send_error_msg(rdma, sctxt, rqstp);
        if (ret < 0)
-                goto err0;
+                goto err1;
-        return 0;
+        ret = 0;
+        goto out;
 err1:
-        put_page(res_page);
+        svc_rdma_send_ctxt_put(rdma, sctxt);
 err0:
-        pr_err("svcrdma: Could not send reply, err=%d. Closing transport.\n",
+        trace_svcrdma_send_failed(rqstp, ret);
-               ret);
        set_bit(XPT_CLOSE, &xprt->xpt_flags);
-        return -ENOTCONN;
+        ret = -ENOTCONN;
+        goto out;
 }
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 96cc8f6597d3..e9535a66bab0 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -1,4 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
+ * Copyright (c) 2015-2018 Oracle. All rights reserved.
 * Copyright (c) 2014 Open Grid Computing, Inc. All rights reserved.
 * Copyright (c) 2005-2007 Network Appliance, Inc. All rights reserved.
 *
@@ -40,26 +42,30 @@
 * Author: Tom Tucker <tom@opengridcomputing.com>
 */
-#include <linux/sunrpc/svc_xprt.h>
-#include <linux/sunrpc/addr.h>
-#include <linux/sunrpc/debug.h>
-#include <linux/sunrpc/rpc_rdma.h>
 #include <linux/interrupt.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/workqueue.h>
+#include <linux/export.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/rdma_cm.h>
 #include <rdma/rw.h>
+#include <linux/sunrpc/addr.h>
+#include <linux/sunrpc/debug.h>
+#include <linux/sunrpc/rpc_rdma.h>
+#include <linux/sunrpc/svc_xprt.h>
 #include <linux/sunrpc/svc_rdma.h>
-#include <linux/export.h>
 #include "xprt_rdma.h"
+#include <trace/events/rpcrdma.h>
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
-static int svc_rdma_post_recv(struct svcxprt_rdma *xprt);
+static struct svcxprt_rdma *svc_rdma_create_xprt(struct svc_serv *serv,
-static struct svcxprt_rdma *rdma_create_xprt(struct svc_serv *, int);
+                                                 struct net *net);
 static struct svc_xprt *svc_rdma_create(struct svc_serv *serv,
                                        struct net *net,
                                        struct sockaddr *sa, int salen,
@@ -123,7 +129,7 @@ static struct svc_xprt *svc_rdma_bc_create(struct svc_serv *serv,
        struct svcxprt_rdma *cma_xprt;
        struct svc_xprt *xprt;
-        cma_xprt = rdma_create_xprt(serv, 0);
+        cma_xprt = svc_rdma_create_xprt(serv, net);
        if (!cma_xprt)
                return ERR_PTR(-ENOMEM);
        xprt = &cma_xprt->sc_xprt;
@@ -152,133 +158,20 @@ static void svc_rdma_bc_free(struct svc_xprt *xprt)
 }
 #endif  /* CONFIG_SUNRPC_BACKCHANNEL */
-static struct svc_rdma_op_ctxt *alloc_ctxt(struct svcxprt_rdma *xprt,
-                                           gfp_t flags)
-{
-        struct svc_rdma_op_ctxt *ctxt;
-        ctxt = kmalloc(sizeof(*ctxt), flags);
-        if (ctxt) {
-                ctxt->xprt = xprt;
-                INIT_LIST_HEAD(&ctxt->list);
-        }
-        return ctxt;
-}
-static bool svc_rdma_prealloc_ctxts(struct svcxprt_rdma *xprt)
-{
-        unsigned int i;
-        /* Each RPC/RDMA credit can consume one Receive and
-         * one Send WQE at the same time.
-         */
-        i = xprt->sc_sq_depth + xprt->sc_rq_depth;
-        while (i--) {
-                struct svc_rdma_op_ctxt *ctxt;
-                ctxt = alloc_ctxt(xprt, GFP_KERNEL);
-                if (!ctxt) {
-                        dprintk("svcrdma: No memory for RDMA ctxt\n");
-                        return false;
-                }
-                list_add(&ctxt->list, &xprt->sc_ctxts);
-        }
-        return true;
-}
-struct svc_rdma_op_ctxt *svc_rdma_get_context(struct svcxprt_rdma *xprt)
-{
-        struct svc_rdma_op_ctxt *ctxt = NULL;
-        spin_lock(&xprt->sc_ctxt_lock);
-        xprt->sc_ctxt_used++;
-        if (list_empty(&xprt->sc_ctxts))
-                goto out_empty;
-        ctxt = list_first_entry(&xprt->sc_ctxts,
-                                struct svc_rdma_op_ctxt, list);
-        list_del(&ctxt->list);
-        spin_unlock(&xprt->sc_ctxt_lock);
-out:
-        ctxt->count = 0;
-        ctxt->mapped_sges = 0;
-        return ctxt;
-out_empty:
-        /* Either pre-allocation missed the mark, or send
-         * queue accounting is broken.
-         */
-        spin_unlock(&xprt->sc_ctxt_lock);
-        ctxt = alloc_ctxt(xprt, GFP_NOIO);
-        if (ctxt)
-                goto out;
-        spin_lock(&xprt->sc_ctxt_lock);
-        xprt->sc_ctxt_used--;
-        spin_unlock(&xprt->sc_ctxt_lock);
-        WARN_ONCE(1, "svcrdma: empty RDMA ctxt list?\n");
-        return NULL;
-}
-void svc_rdma_unmap_dma(struct svc_rdma_op_ctxt *ctxt)
-{
-        struct svcxprt_rdma *xprt = ctxt->xprt;
-        struct ib_device *device = xprt->sc_cm_id->device;
-        unsigned int i;
-        for (i = 0; i < ctxt->mapped_sges; i++)
-                ib_dma_unmap_page(device,
-                                  ctxt->sge[i].addr,
-                                  ctxt->sge[i].length,
-                                  ctxt->direction);
-        ctxt->mapped_sges = 0;
-}
-void svc_rdma_put_context(struct svc_rdma_op_ctxt *ctxt, int free_pages)
-{
-        struct svcxprt_rdma *xprt = ctxt->xprt;
-        int i;
-        if (free_pages)
-                for (i = 0; i < ctxt->count; i++)
-                        put_page(ctxt->pages[i]);
-        spin_lock(&xprt->sc_ctxt_lock);
-        xprt->sc_ctxt_used--;
-        list_add(&ctxt->list, &xprt->sc_ctxts);
-        spin_unlock(&xprt->sc_ctxt_lock);
-}
-static void svc_rdma_destroy_ctxts(struct svcxprt_rdma *xprt)
-{
-        while (!list_empty(&xprt->sc_ctxts)) {
-                struct svc_rdma_op_ctxt *ctxt;
-                ctxt = list_first_entry(&xprt->sc_ctxts,
-                                        struct svc_rdma_op_ctxt, list);
-                list_del(&ctxt->list);
-                kfree(ctxt);
-        }
-}
 /* QP event handler */
 static void qp_event_handler(struct ib_event *event, void *context)
 {
        struct svc_xprt *xprt = context;
+        trace_svcrdma_qp_error(event, (struct sockaddr *)&xprt->xpt_remote);
        switch (event->event) {
        /* These are considered benign events */
        case IB_EVENT_PATH_MIG:
        case IB_EVENT_COMM_EST:
        case IB_EVENT_SQ_DRAINED:
        case IB_EVENT_QP_LAST_WQE_REACHED:
-                dprintk("svcrdma: QP event %s (%d) received for QP=%p\n",
-                        ib_event_msg(event->event), event->event,
-                        event->element.qp);
                break;
        /* These are considered fatal events */
        case IB_EVENT_PATH_MIG_ERR:
        case IB_EVENT_QP_FATAL:
@@ -286,111 +179,34 @@ static void qp_event_handler(struct ib_event *event, void *context)
        case IB_EVENT_QP_ACCESS_ERR:
        case IB_EVENT_DEVICE_FATAL:
        default:
-                dprintk("svcrdma: QP ERROR event %s (%d) received for QP=%p, "
-                        "closing transport\n",
-                        ib_event_msg(event->event), event->event,
-                        event->element.qp);
                set_bit(XPT_CLOSE, &xprt->xpt_flags);
                svc_xprt_enqueue(xprt);
                break;
        }
 }
-/**
+static struct svcxprt_rdma *svc_rdma_create_xprt(struct svc_serv *serv,
- * svc_rdma_wc_receive - Invoked by RDMA provider for each polled Receive WC
+                                                 struct net *net)
- * @cq:        completion queue
- * @wc:        completed WR
- *
- */
-static void svc_rdma_wc_receive(struct ib_cq *cq, struct ib_wc *wc)
-{
-        struct svcxprt_rdma *xprt = cq->cq_context;
-        struct ib_cqe *cqe = wc->wr_cqe;
-        struct svc_rdma_op_ctxt *ctxt;
-        /* WARNING: Only wc->wr_cqe and wc->status are reliable */
-        ctxt = container_of(cqe, struct svc_rdma_op_ctxt, cqe);
-        svc_rdma_unmap_dma(ctxt);
-        if (wc->status != IB_WC_SUCCESS)
-                goto flushed;
-        /* All wc fields are now known to be valid */
-        ctxt->byte_len = wc->byte_len;
-        spin_lock(&xprt->sc_rq_dto_lock);
-        list_add_tail(&ctxt->list, &xprt->sc_rq_dto_q);
-        spin_unlock(&xprt->sc_rq_dto_lock);
-        svc_rdma_post_recv(xprt);
-        set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
-        if (test_bit(RDMAXPRT_CONN_PENDING, &xprt->sc_flags))
-                goto out;
-        goto out_enqueue;
-flushed:
-        if (wc->status != IB_WC_WR_FLUSH_ERR)
-                pr_err("svcrdma: Recv: %s (%u/0x%x)\n",
-                       ib_wc_status_msg(wc->status),
-                       wc->status, wc->vendor_err);
-        set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
-        svc_rdma_put_context(ctxt, 1);
-out_enqueue:
-        svc_xprt_enqueue(&xprt->sc_xprt);
-out:
-        svc_xprt_put(&xprt->sc_xprt);
-}
-/**
- * svc_rdma_wc_send - Invoked by RDMA provider for each polled Send WC
- * @cq:        completion queue
- * @wc:        completed WR
- *
- */
-void svc_rdma_wc_send(struct ib_cq *cq, struct ib_wc *wc)
-{
-        struct svcxprt_rdma *xprt = cq->cq_context;
-        struct ib_cqe *cqe = wc->wr_cqe;
-        struct svc_rdma_op_ctxt *ctxt;
-        atomic_inc(&xprt->sc_sq_avail);
-        wake_up(&xprt->sc_send_wait);
-        ctxt = container_of(cqe, struct svc_rdma_op_ctxt, cqe);
-        svc_rdma_unmap_dma(ctxt);
-        svc_rdma_put_context(ctxt, 1);
-        if (unlikely(wc->status != IB_WC_SUCCESS)) {
-                set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
-                svc_xprt_enqueue(&xprt->sc_xprt);
-                if (wc->status != IB_WC_WR_FLUSH_ERR)
-                        pr_err("svcrdma: Send: %s (%u/0x%x)\n",
-                               ib_wc_status_msg(wc->status),
-                               wc->status, wc->vendor_err);
-        }
-        svc_xprt_put(&xprt->sc_xprt);
-}
-static struct svcxprt_rdma *rdma_create_xprt(struct svc_serv *serv,
-                                             int listener)
 {
        struct svcxprt_rdma *cma_xprt = kzalloc(sizeof *cma_xprt, GFP_KERNEL);
-        if (!cma_xprt)
+        if (!cma_xprt) {
+                dprintk("svcrdma: failed to create new transport\n");
                return NULL;
-        svc_xprt_init(&init_net, &svc_rdma_class, &cma_xprt->sc_xprt, serv);
+        }
+        svc_xprt_init(net, &svc_rdma_class, &cma_xprt->sc_xprt, serv);
        INIT_LIST_HEAD(&cma_xprt->sc_accept_q);
        INIT_LIST_HEAD(&cma_xprt->sc_rq_dto_q);
        INIT_LIST_HEAD(&cma_xprt->sc_read_complete_q);
-        INIT_LIST_HEAD(&cma_xprt->sc_ctxts);
+        INIT_LIST_HEAD(&cma_xprt->sc_send_ctxts);
+        INIT_LIST_HEAD(&cma_xprt->sc_recv_ctxts);
        INIT_LIST_HEAD(&cma_xprt->sc_rw_ctxts);
        init_waitqueue_head(&cma_xprt->sc_send_wait);
        spin_lock_init(&cma_xprt->sc_lock);
        spin_lock_init(&cma_xprt->sc_rq_dto_lock);
-        spin_lock_init(&cma_xprt->sc_ctxt_lock);
+        spin_lock_init(&cma_xprt->sc_send_lock);
+        spin_lock_init(&cma_xprt->sc_recv_lock);
        spin_lock_init(&cma_xprt->sc_rw_ctxt_lock);
        /*
@@ -401,70 +217,9 @@ static struct svcxprt_rdma *rdma_create_xprt(struct svc_serv *serv,
         */
        set_bit(XPT_CONG_CTRL, &cma_xprt->sc_xprt.xpt_flags);
-        if (listener) {
-                strcpy(cma_xprt->sc_xprt.xpt_remotebuf, "listener");
-                set_bit(XPT_LISTENER, &cma_xprt->sc_xprt.xpt_flags);
-        }
        return cma_xprt;
 }
-static int
-svc_rdma_post_recv(struct svcxprt_rdma *xprt)
-{
-        struct ib_recv_wr recv_wr, *bad_recv_wr;
-        struct svc_rdma_op_ctxt *ctxt;
-        struct page *page;
-        dma_addr_t pa;
-        int sge_no;
-        int buflen;
-        int ret;
-        ctxt = svc_rdma_get_context(xprt);
-        buflen = 0;
-        ctxt->direction = DMA_FROM_DEVICE;
-        ctxt->cqe.done = svc_rdma_wc_receive;
-        for (sge_no = 0; buflen < xprt->sc_max_req_size; sge_no++) {
-                if (sge_no >= xprt->sc_max_sge) {
-                        pr_err("svcrdma: Too many sges (%d)\n", sge_no);
-                        goto err_put_ctxt;
-                }
-                page = alloc_page(GFP_KERNEL);
-                if (!page)
-                        goto err_put_ctxt;
-                ctxt->pages[sge_no] = page;
-                pa = ib_dma_map_page(xprt->sc_cm_id->device,
-                                     page, 0, PAGE_SIZE,
-                                     DMA_FROM_DEVICE);
-                if (ib_dma_mapping_error(xprt->sc_cm_id->device, pa))
-                        goto err_put_ctxt;
-                svc_rdma_count_mappings(xprt, ctxt);
-                ctxt->sge[sge_no].addr = pa;
-                ctxt->sge[sge_no].length = PAGE_SIZE;
-                ctxt->sge[sge_no].lkey = xprt->sc_pd->local_dma_lkey;
-                ctxt->count = sge_no + 1;
-                buflen += PAGE_SIZE;
-        }
-        recv_wr.next = NULL;
-        recv_wr.sg_list = &ctxt->sge[0];
-        recv_wr.num_sge = ctxt->count;
-        recv_wr.wr_cqe = &ctxt->cqe;
-        svc_xprt_get(&xprt->sc_xprt);
-        ret = ib_post_recv(xprt->sc_qp, &recv_wr, &bad_recv_wr);
-        if (ret) {
-                svc_rdma_unmap_dma(ctxt);
-                svc_rdma_put_context(ctxt, 1);
-                svc_xprt_put(&xprt->sc_xprt);
-        }
-        return ret;
- err_put_ctxt:
-        svc_rdma_unmap_dma(ctxt);
-        svc_rdma_put_context(ctxt, 1);
-        return -ENOMEM;
-}
 static void
 svc_rdma_parse_connect_private(struct svcxprt_rdma *newxprt,
                               struct rdma_conn_param *param)
@@ -504,15 +259,12 @@ static void handle_connect_req(struct rdma_cm_id *new_cma_id,
        struct sockaddr *sa;
        /* Create a new transport */
-        newxprt = rdma_create_xprt(listen_xprt->sc_xprt.xpt_server, 0);
+        newxprt = svc_rdma_create_xprt(listen_xprt->sc_xprt.xpt_server,
-        if (!newxprt) {
+                                       listen_xprt->sc_xprt.xpt_net);
-                dprintk("svcrdma: failed to create new transport\n");
+        if (!newxprt)
                return;
-        }
        newxprt->sc_cm_id = new_cma_id;
        new_cma_id->context = newxprt;
-        dprintk("svcrdma: Creating newxprt=%p, cm_id=%p, listenxprt=%p\n",
-                newxprt, newxprt->sc_cm_id, listen_xprt);
        svc_rdma_parse_connect_private(newxprt, param);
        /* Save client advertised inbound read limit for use later in accept. */
@@ -543,9 +295,11 @@ static void handle_connect_req(struct rdma_cm_id *new_cma_id,
 static int rdma_listen_handler(struct rdma_cm_id *cma_id,
                               struct rdma_cm_event *event)
 {
-        struct svcxprt_rdma *xprt = cma_id->context;
+        struct sockaddr *sap = (struct sockaddr *)&cma_id->route.addr.src_addr;
        int ret = 0;
+        trace_svcrdma_cm_event(event, sap);
        switch (event->event) {
        case RDMA_CM_EVENT_CONNECT_REQUEST:
                dprintk("svcrdma: Connect request on cma_id=%p, xprt = %p, "
@@ -553,23 +307,8 @@ static int rdma_listen_handler(struct rdma_cm_id *cma_id,
                        rdma_event_msg(event->event), event->event);
                handle_connect_req(cma_id, &event->param.conn);
                break;
-        case RDMA_CM_EVENT_ESTABLISHED:
-                /* Accept complete */
-                dprintk("svcrdma: Connection completed on LISTEN xprt=%p, "
-                        "cm_id=%p\n", xprt, cma_id);
-                break;
-        case RDMA_CM_EVENT_DEVICE_REMOVAL:
-                dprintk("svcrdma: Device removal xprt=%p, cm_id=%p\n",
-                        xprt, cma_id);
-                if (xprt) {
-                        set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
-                        svc_xprt_enqueue(&xprt->sc_xprt);
-                }
-                break;
        default:
+                /* NB: No device removal upcall for INADDR_ANY listeners */
                dprintk("svcrdma: Unexpected event on listening endpoint %p, "
                        "event = %s (%d)\n", cma_id,
                        rdma_event_msg(event->event), event->event);
@@ -582,9 +321,12 @@ static int rdma_listen_handler(struct rdma_cm_id *cma_id,
 static int rdma_cma_handler(struct rdma_cm_id *cma_id,
                            struct rdma_cm_event *event)
 {
-        struct svc_xprt *xprt = cma_id->context;
+        struct sockaddr *sap = (struct sockaddr *)&cma_id->route.addr.dst_addr;
-        struct svcxprt_rdma *rdma =
+        struct svcxprt_rdma *rdma = cma_id->context;
-                container_of(xprt, struct svcxprt_rdma, sc_xprt);
+        struct svc_xprt *xprt = &rdma->sc_xprt;
+        trace_svcrdma_cm_event(event, sap);
        switch (event->event) {
        case RDMA_CM_EVENT_ESTABLISHED:
                /* Accept complete */
@@ -597,21 +339,17 @@ static int rdma_cma_handler(struct rdma_cm_id *cma_id,
        case RDMA_CM_EVENT_DISCONNECTED:
                dprintk("svcrdma: Disconnect on DTO xprt=%p, cm_id=%p\n",
                        xprt, cma_id);
-                if (xprt) {
+                set_bit(XPT_CLOSE, &xprt->xpt_flags);
-                        set_bit(XPT_CLOSE, &xprt->xpt_flags);
+                svc_xprt_enqueue(xprt);
-                        svc_xprt_enqueue(xprt);
+                svc_xprt_put(xprt);
-                        svc_xprt_put(xprt);
-                }
                break;
        case RDMA_CM_EVENT_DEVICE_REMOVAL:
                dprintk("svcrdma: Device removal cma_id=%p, xprt = %p, "
                        "event = %s (%d)\n", cma_id, xprt,
                        rdma_event_msg(event->event), event->event);
-                if (xprt) {
+                set_bit(XPT_CLOSE, &xprt->xpt_flags);
-                        set_bit(XPT_CLOSE, &xprt->xpt_flags);
+                svc_xprt_enqueue(xprt);
-                        svc_xprt_enqueue(xprt);
+                svc_xprt_put(xprt);
-                        svc_xprt_put(xprt);
-                }
                break;
        default:
                dprintk("svcrdma: Unexpected event on DTO endpoint %p, "
@@ -634,16 +372,18 @@ static struct svc_xprt *svc_rdma_create(struct svc_serv *serv,
        struct svcxprt_rdma *cma_xprt;
        int ret;
-        dprintk("svcrdma: Creating RDMA socket\n");
+        dprintk("svcrdma: Creating RDMA listener\n");
        if ((sa->sa_family != AF_INET) && (sa->sa_family != AF_INET6)) {
                dprintk("svcrdma: Address family %d is not supported.\n", sa->sa_family);
                return ERR_PTR(-EAFNOSUPPORT);
        }
-        cma_xprt = rdma_create_xprt(serv, 1);
+        cma_xprt = svc_rdma_create_xprt(serv, net);
        if (!cma_xprt)
                return ERR_PTR(-ENOMEM);
+        set_bit(XPT_LISTENER, &cma_xprt->sc_xprt.xpt_flags);
+        strcpy(cma_xprt->sc_xprt.xpt_remotebuf, "listener");
-        listen_id = rdma_create_id(&init_net, rdma_listen_handler, cma_xprt,
+        listen_id = rdma_create_id(net, rdma_listen_handler, cma_xprt,
                                   RDMA_PS_TCP, IB_QPT_RC);
        if (IS_ERR(listen_id)) {
                ret = PTR_ERR(listen_id);
@@ -708,9 +448,9 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
        struct rdma_conn_param conn_param;
        struct rpcrdma_connect_private pmsg;
        struct ib_qp_init_attr qp_attr;
+        unsigned int ctxts, rq_depth;
        struct ib_device *dev;
        struct sockaddr *sap;
-        unsigned int i, ctxts;
        int ret = 0;
        listen_rdma = container_of(xprt, struct svcxprt_rdma, sc_xprt);
@@ -736,24 +476,28 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
        /* Qualify the transport resource defaults with the
         * capabilities of this particular device */
-        newxprt->sc_max_sge = min((size_t)dev->attrs.max_sge,
+        newxprt->sc_max_send_sges = dev->attrs.max_sge;
-                                  (size_t)RPCSVC_MAXPAGES);
+        /* transport hdr, head iovec, one page list entry, tail iovec */
+        if (newxprt->sc_max_send_sges < 4) {
+                pr_err("svcrdma: too few Send SGEs available (%d)\n",
+                       newxprt->sc_max_send_sges);
+                goto errout;
+        }
        newxprt->sc_max_req_size = svcrdma_max_req_size;
        newxprt->sc_max_requests = svcrdma_max_requests;
        newxprt->sc_max_bc_requests = svcrdma_max_bc_requests;
-        newxprt->sc_rq_depth = newxprt->sc_max_requests +
+        rq_depth = newxprt->sc_max_requests + newxprt->sc_max_bc_requests;
-                               newxprt->sc_max_bc_requests;
+        if (rq_depth > dev->attrs.max_qp_wr) {
-        if (newxprt->sc_rq_depth > dev->attrs.max_qp_wr) {
                pr_warn("svcrdma: reducing receive depth to %d\n",
                        dev->attrs.max_qp_wr);
-                newxprt->sc_rq_depth = dev->attrs.max_qp_wr;
+                rq_depth = dev->attrs.max_qp_wr;
-                newxprt->sc_max_requests = newxprt->sc_rq_depth - 2;
+                newxprt->sc_max_requests = rq_depth - 2;
                newxprt->sc_max_bc_requests = 2;
        }
        newxprt->sc_fc_credits = cpu_to_be32(newxprt->sc_max_requests);
        ctxts = rdma_rw_mr_factor(dev, newxprt->sc_port_num, RPCSVC_MAXPAGES);
        ctxts *= newxprt->sc_max_requests;
-        newxprt->sc_sq_depth = newxprt->sc_rq_depth + ctxts;
+        newxprt->sc_sq_depth = rq_depth + ctxts;
        if (newxprt->sc_sq_depth > dev->attrs.max_qp_wr) {
                pr_warn("svcrdma: reducing send depth to %d\n",
                        dev->attrs.max_qp_wr);
@@ -761,9 +505,6 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
        }
        atomic_set(&newxprt->sc_sq_avail, newxprt->sc_sq_depth);
-        if (!svc_rdma_prealloc_ctxts(newxprt))
-                goto errout;
        newxprt->sc_pd = ib_alloc_pd(dev, 0);
        if (IS_ERR(newxprt->sc_pd)) {
                dprintk("svcrdma: error creating PD for connect request\n");
@@ -775,7 +516,7 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
                dprintk("svcrdma: error creating SQ CQ for connect request\n");
                goto errout;
        }
-        newxprt->sc_rq_cq = ib_alloc_cq(dev, newxprt, newxprt->sc_rq_depth,
+        newxprt->sc_rq_cq = ib_alloc_cq(dev, newxprt, rq_depth,
                                        0, IB_POLL_WORKQUEUE);
        if (IS_ERR(newxprt->sc_rq_cq)) {
                dprintk("svcrdma: error creating RQ CQ for connect request\n");
@@ -788,9 +529,9 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
        qp_attr.port_num = newxprt->sc_port_num;
        qp_attr.cap.max_rdma_ctxs = ctxts;
        qp_attr.cap.max_send_wr = newxprt->sc_sq_depth - ctxts;
-        qp_attr.cap.max_recv_wr = newxprt->sc_rq_depth;
+        qp_attr.cap.max_recv_wr = rq_depth;
-        qp_attr.cap.max_send_sge = newxprt->sc_max_sge;
+        qp_attr.cap.max_send_sge = newxprt->sc_max_send_sges;
-        qp_attr.cap.max_recv_sge = newxprt->sc_max_sge;
+        qp_attr.cap.max_recv_sge = 1;
        qp_attr.sq_sig_type = IB_SIGNAL_REQ_WR;
        qp_attr.qp_type = IB_QPT_RC;
        qp_attr.send_cq = newxprt->sc_sq_cq;
@@ -815,14 +556,8 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
            !rdma_ib_or_roce(dev, newxprt->sc_port_num))
                goto errout;
-        /* Post receive buffers */
+        if (!svc_rdma_post_recvs(newxprt))
-        for (i = 0; i < newxprt->sc_max_requests; i++) {
+                goto errout;
-                ret = svc_rdma_post_recv(newxprt);
-                if (ret) {
-                        dprintk("svcrdma: failure posting receive buffers\n");
-                        goto errout;
-                }
-        }
        /* Swap out the handler */
        newxprt->sc_cm_id->event_handler = rdma_cma_handler;
@@ -856,16 +591,18 @@ static struct svc_xprt *svc_rdma_accept(struct svc_xprt *xprt)
        dprintk("    local address   : %pIS:%u\n", sap, rpc_get_port(sap));
        sap = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.dst_addr;
        dprintk("    remote address  : %pIS:%u\n", sap, rpc_get_port(sap));
-        dprintk("    max_sge         : %d\n", newxprt->sc_max_sge);
+        dprintk("    max_sge         : %d\n", newxprt->sc_max_send_sges);
        dprintk("    sq_depth        : %d\n", newxprt->sc_sq_depth);
        dprintk("    rdma_rw_ctxs    : %d\n", ctxts);
        dprintk("    max_requests    : %d\n", newxprt->sc_max_requests);
        dprintk("    ord             : %d\n", conn_param.initiator_depth);
+        trace_svcrdma_xprt_accept(&newxprt->sc_xprt);
        return &newxprt->sc_xprt;
 errout:
        dprintk("svcrdma: failure accepting new connection rc=%d.\n", ret);
+        trace_svcrdma_xprt_fail(&newxprt->sc_xprt);
        /* Take a reference in case the DTO handler runs */
        svc_xprt_get(&newxprt->sc_xprt);
        if (newxprt->sc_qp && !IS_ERR(newxprt->sc_qp))
@@ -896,7 +633,6 @@ static void svc_rdma_detach(struct svc_xprt *xprt)
 {
        struct svcxprt_rdma *rdma =
                container_of(xprt, struct svcxprt_rdma, sc_xprt);
-        dprintk("svc: svc_rdma_detach(%p)\n", xprt);
        /* Disconnect and flush posted WQE */
        rdma_disconnect(rdma->sc_cm_id);
@@ -908,7 +644,7 @@ static void __svc_rdma_free(struct work_struct *work)
                container_of(work, struct svcxprt_rdma, sc_work);
        struct svc_xprt *xprt = &rdma->sc_xprt;
-        dprintk("svcrdma: %s(%p)\n", __func__, rdma);
+        trace_svcrdma_xprt_free(xprt);
        if (rdma->sc_qp && !IS_ERR(rdma->sc_qp))
                ib_drain_qp(rdma->sc_qp);
@@ -918,25 +654,7 @@ static void __svc_rdma_free(struct work_struct *work)
                pr_err("svcrdma: sc_xprt still in use? (%d)\n",
                       kref_read(&xprt->xpt_ref));
-        while (!list_empty(&rdma->sc_read_complete_q)) {
+        svc_rdma_flush_recv_queues(rdma);
-                struct svc_rdma_op_ctxt *ctxt;
-                ctxt = list_first_entry(&rdma->sc_read_complete_q,
-                                        struct svc_rdma_op_ctxt, list);
-                list_del(&ctxt->list);
-                svc_rdma_put_context(ctxt, 1);
-        }
-        while (!list_empty(&rdma->sc_rq_dto_q)) {
-                struct svc_rdma_op_ctxt *ctxt;
-                ctxt = list_first_entry(&rdma->sc_rq_dto_q,
-                                        struct svc_rdma_op_ctxt, list);
-                list_del(&ctxt->list);
-                svc_rdma_put_context(ctxt, 1);
-        }
-        /* Warn if we leaked a resource or under-referenced */
-        if (rdma->sc_ctxt_used != 0)
-                pr_err("svcrdma: ctxt still in use? (%d)\n",
-                       rdma->sc_ctxt_used);
        /* Final put of backchannel client transport */
        if (xprt->xpt_bc_xprt) {
@@ -945,7 +663,8 @@ static void __svc_rdma_free(struct work_struct *work)
        }
        svc_rdma_destroy_rw_ctxts(rdma);
-        svc_rdma_destroy_ctxts(rdma);
+        svc_rdma_send_ctxts_destroy(rdma);
+        svc_rdma_recv_ctxts_destroy(rdma);
        /* Destroy the QP if present (not a listener) */
        if (rdma->sc_qp && !IS_ERR(rdma->sc_qp))
@@ -998,51 +717,3 @@ static void svc_rdma_secure_port(struct svc_rqst *rqstp)
 static void svc_rdma_kill_temp_xprt(struct svc_xprt *xprt)
 {
 }
-int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
-{
-        struct ib_send_wr *bad_wr, *n_wr;
-        int wr_count;
-        int i;
-        int ret;
-        if (test_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags))
-                return -ENOTCONN;
-        wr_count = 1;
-        for (n_wr = wr->next; n_wr; n_wr = n_wr->next)
-                wr_count++;
-        /* If the SQ is full, wait until an SQ entry is available */
-        while (1) {
-                if ((atomic_sub_return(wr_count, &xprt->sc_sq_avail) < 0)) {
-                        atomic_inc(&rdma_stat_sq_starve);
-                        /* Wait until SQ WR available if SQ still full */
-                        atomic_add(wr_count, &xprt->sc_sq_avail);
-                        wait_event(xprt->sc_send_wait,
-                                   atomic_read(&xprt->sc_sq_avail) > wr_count);
-                        if (test_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags))
-                                return -ENOTCONN;
-                        continue;
-                }
-                /* Take a transport ref for each WR posted */
-                for (i = 0; i < wr_count; i++)
-                        svc_xprt_get(&xprt->sc_xprt);
-                /* Bump used SQ WR count and post */
-                ret = ib_post_send(xprt->sc_qp, wr, &bad_wr);
-                if (ret) {
-                        set_bit(XPT_CLOSE, &xprt->sc_xprt.xpt_flags);
-                        for (i = 0; i < wr_count; i ++)
-                                svc_xprt_put(&xprt->sc_xprt);
-                        dprintk("svcrdma: failed to post SQ WR rc=%d\n", ret);
-                        dprintk("    sc_sq_avail=%d, sc_sq_depth=%d\n",
-                                atomic_read(&xprt->sc_sq_avail),
-                                xprt->sc_sq_depth);
-                        wake_up(&xprt->sc_send_wait);
-                }
-                break;
-        }
-        return ret;
-}
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index cc1aad325496..143ce2579ba9 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
 * Copyright (c) 2014-2017 Oracle.  All rights reserved.
 * Copyright (c) 2003-2007 Network Appliance, Inc. All rights reserved.
@@ -51,9 +52,13 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/seq_file.h>
+#include <linux/smp.h>
 #include <linux/sunrpc/addr.h>
+#include <linux/sunrpc/svc_rdma.h>
 #include "xprt_rdma.h"
+#include <trace/events/rpcrdma.h>
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_TRANS
@@ -330,9 +335,7 @@ xprt_setup_rdma(struct xprt_create *args)
                return ERR_PTR(-EBADF);
        }
-        xprt = xprt_alloc(args->net, sizeof(struct rpcrdma_xprt),
+        xprt = xprt_alloc(args->net, sizeof(struct rpcrdma_xprt), 0, 0);
-                        xprt_rdma_slot_table_entries,
-                        xprt_rdma_slot_table_entries);
        if (xprt == NULL) {
                dprintk("RPC:       %s: couldn't allocate rpcrdma_xprt\n",
                        __func__);
@@ -364,7 +367,7 @@ xprt_setup_rdma(struct xprt_create *args)
                xprt_set_bound(xprt);
        xprt_rdma_format_addresses(xprt, sap);
-        cdata.max_requests = xprt->max_reqs;
+        cdata.max_requests = xprt_rdma_slot_table_entries;
        cdata.rsize = RPCRDMA_MAX_SEGS * PAGE_SIZE; /* RDMA write max */
        cdata.wsize = RPCRDMA_MAX_SEGS * PAGE_SIZE; /* RDMA read max */
@@ -537,6 +540,47 @@ xprt_rdma_connect(struct rpc_xprt *xprt, struct rpc_task *task)
        }
 }
+/**
+ * xprt_rdma_alloc_slot - allocate an rpc_rqst
+ * @xprt: controlling RPC transport
+ * @task: RPC task requesting a fresh rpc_rqst
+ *
+ * tk_status values:
+ *      %0 if task->tk_rqstp points to a fresh rpc_rqst
+ *      %-EAGAIN if no rpc_rqst is available; queued on backlog
+ */
+static void
+xprt_rdma_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
+{
+        struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
+        struct rpcrdma_req *req;
+        req = rpcrdma_buffer_get(&r_xprt->rx_buf);
+        if (!req)
+                goto out_sleep;
+        task->tk_rqstp = &req->rl_slot;
+        task->tk_status = 0;
+        return;
+out_sleep:
+        rpc_sleep_on(&xprt->backlog, task, NULL);
+        task->tk_status = -EAGAIN;
+}
+/**
+ * xprt_rdma_free_slot - release an rpc_rqst
+ * @xprt: controlling RPC transport
+ * @rqst: rpc_rqst to release
+ *
+ */
+static void
+xprt_rdma_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *rqst)
+{
+        memset(rqst, 0, sizeof(*rqst));
+        rpcrdma_buffer_put(rpcr_to_rdmar(rqst));
+        rpc_wake_up_next(&xprt->backlog);
+}
 static bool
 rpcrdma_get_sendbuf(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
                    size_t size, gfp_t flags)
@@ -607,13 +651,9 @@ xprt_rdma_allocate(struct rpc_task *task)
 {
        struct rpc_rqst *rqst = task->tk_rqstp;
        struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(rqst->rq_xprt);
-        struct rpcrdma_req *req;
+        struct rpcrdma_req *req = rpcr_to_rdmar(rqst);
        gfp_t flags;
-        req = rpcrdma_buffer_get(&r_xprt->rx_buf);
-        if (req == NULL)
-                goto out_get;
        flags = RPCRDMA_DEF_GFP;
        if (RPC_IS_SWAPPER(task))
                flags = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN;
@@ -623,15 +663,12 @@ xprt_rdma_allocate(struct rpc_task *task)
        if (!rpcrdma_get_recvbuf(r_xprt, req, rqst->rq_rcvsize, flags))
                goto out_fail;
-        rpcrdma_set_xprtdata(rqst, req);
        rqst->rq_buffer = req->rl_sendbuf->rg_base;
        rqst->rq_rbuffer = req->rl_recvbuf->rg_base;
        trace_xprtrdma_allocate(task, req);
        return 0;
 out_fail:
-        rpcrdma_buffer_put(req);
-out_get:
        trace_xprtrdma_allocate(task, NULL);
        return -ENOMEM;
 }
@@ -652,7 +689,6 @@ xprt_rdma_free(struct rpc_task *task)
        if (test_bit(RPCRDMA_REQ_F_PENDING, &req->rl_flags))
                rpcrdma_release_rqst(r_xprt, req);
        trace_xprtrdma_rpc_done(task, req);
-        rpcrdma_buffer_put(req);
 }
 /**
@@ -690,9 +726,6 @@ xprt_rdma_send_request(struct rpc_task *task)
        if (rc < 0)
                goto failed_marshal;
-        if (req->rl_reply == NULL)              /* e.g. reconnection */
-                rpcrdma_recv_buffer_get(req);
        /* Must suppress retransmit to maintain credits */
        if (rqst->rq_connect_cookie == xprt->connect_cookie)
                goto drop_connection;
@@ -779,7 +812,8 @@ xprt_rdma_disable_swap(struct rpc_xprt *xprt)
 static const struct rpc_xprt_ops xprt_rdma_procs = {
        .reserve_xprt           = xprt_reserve_xprt_cong,
        .release_xprt           = xprt_release_xprt_cong, /* sunrpc/xprt.c */
-        .alloc_slot             = xprt_alloc_slot,
+        .alloc_slot             = xprt_rdma_alloc_slot,
+        .free_slot              = xprt_rdma_free_slot,
        .release_request        = xprt_release_rqst_cong,       /* ditto */
        .set_retrans_timeout    = xprt_set_retrans_timeout_def, /* ditto */
        .timer                  = xprt_rdma_timer,
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index c345d365af88..16161a36dc73 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
 * Copyright (c) 2014-2017 Oracle.  All rights reserved.
 * Copyright (c) 2003-2007 Network Appliance, Inc. All rights reserved.
@@ -59,6 +60,7 @@
 #include <rdma/ib_cm.h>
 #include "xprt_rdma.h"
+#include <trace/events/rpcrdma.h>
 /*
 * Globals/Macros
@@ -71,8 +73,10 @@
 /*
 * internal functions
 */
+static void rpcrdma_sendctx_put_locked(struct rpcrdma_sendctx *sc);
 static void rpcrdma_mrs_create(struct rpcrdma_xprt *r_xprt);
 static void rpcrdma_mrs_destroy(struct rpcrdma_buffer *buf);
+static int rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt, bool temp);
 static void rpcrdma_dma_unmap_regbuf(struct rpcrdma_regbuf *rb);
 struct workqueue_struct *rpcrdma_receive_wq __read_mostly;
@@ -159,7 +163,7 @@ rpcrdma_wc_receive(struct ib_cq *cq, struct ib_wc *wc)
                                               rr_cqe);
        /* WARNING: Only wr_id and status are reliable at this point */
-        trace_xprtrdma_wc_receive(rep, wc);
+        trace_xprtrdma_wc_receive(wc);
        if (wc->status != IB_WC_SUCCESS)
                goto out_fail;
@@ -231,7 +235,7 @@ rpcrdma_conn_upcall(struct rdma_cm_id *id, struct rdma_cm_event *event)
                complete(&ia->ri_done);
                break;
        case RDMA_CM_EVENT_ADDR_ERROR:
-                ia->ri_async_rc = -EHOSTUNREACH;
+                ia->ri_async_rc = -EPROTO;
                complete(&ia->ri_done);
                break;
        case RDMA_CM_EVENT_ROUTE_ERROR:
@@ -262,7 +266,7 @@ rpcrdma_conn_upcall(struct rdma_cm_id *id, struct rdma_cm_event *event)
                connstate = -ENOTCONN;
                goto connected;
        case RDMA_CM_EVENT_UNREACHABLE:
-                connstate = -ENETDOWN;
+                connstate = -ENETUNREACH;
                goto connected;
        case RDMA_CM_EVENT_REJECTED:
                dprintk("rpcrdma: connection to %s:%s rejected: %s\n",
@@ -305,8 +309,8 @@ rpcrdma_create_id(struct rpcrdma_xprt *xprt, struct rpcrdma_ia *ia)
        init_completion(&ia->ri_done);
        init_completion(&ia->ri_remove_done);
-        id = rdma_create_id(&init_net, rpcrdma_conn_upcall, xprt, RDMA_PS_TCP,
+        id = rdma_create_id(xprt->rx_xprt.xprt_net, rpcrdma_conn_upcall,
-                            IB_QPT_RC);
+                            xprt, RDMA_PS_TCP, IB_QPT_RC);
        if (IS_ERR(id)) {
                rc = PTR_ERR(id);
                dprintk("RPC:       %s: rdma_create_id() failed %i\n",
@@ -500,8 +504,8 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
                  struct rpcrdma_create_data_internal *cdata)
 {
        struct rpcrdma_connect_private *pmsg = &ep->rep_cm_private;
-        unsigned int max_qp_wr, max_sge;
        struct ib_cq *sendcq, *recvcq;
+        unsigned int max_sge;
        int rc;
        max_sge = min_t(unsigned int, ia->ri_device->attrs.max_sge,
@@ -512,29 +516,13 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
        }
        ia->ri_max_send_sges = max_sge;
-        if (ia->ri_device->attrs.max_qp_wr <= RPCRDMA_BACKWARD_WRS) {
+        rc = ia->ri_ops->ro_open(ia, ep, cdata);
-                dprintk("RPC:       %s: insufficient wqe's available\n",
+        if (rc)
-                        __func__);
+                return rc;
-                return -ENOMEM;
-        }
-        max_qp_wr = ia->ri_device->attrs.max_qp_wr - RPCRDMA_BACKWARD_WRS - 1;
-        /* check provider's send/recv wr limits */
-        if (cdata->max_requests > max_qp_wr)
-                cdata->max_requests = max_qp_wr;
        ep->rep_attr.event_handler = rpcrdma_qp_async_error_upcall;
        ep->rep_attr.qp_context = ep;
        ep->rep_attr.srq = NULL;
-        ep->rep_attr.cap.max_send_wr = cdata->max_requests;
-        ep->rep_attr.cap.max_send_wr += RPCRDMA_BACKWARD_WRS;
-        ep->rep_attr.cap.max_send_wr += 1;      /* drain cqe */
-        rc = ia->ri_ops->ro_open(ia, ep, cdata);
-        if (rc)
-                return rc;
-        ep->rep_attr.cap.max_recv_wr = cdata->max_requests;
-        ep->rep_attr.cap.max_recv_wr += RPCRDMA_BACKWARD_WRS;
-        ep->rep_attr.cap.max_recv_wr += 1;      /* drain cqe */
        ep->rep_attr.cap.max_send_sge = max_sge;
        ep->rep_attr.cap.max_recv_sge = 1;
        ep->rep_attr.cap.max_inline_data = 0;
@@ -741,7 +729,6 @@ rpcrdma_ep_connect(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia)
 {
        struct rpcrdma_xprt *r_xprt = container_of(ia, struct rpcrdma_xprt,
                                                   rx_ia);
-        unsigned int extras;
        int rc;
 retry:
@@ -785,9 +772,8 @@ retry:
        }
        dprintk("RPC:       %s: connected\n", __func__);
-        extras = r_xprt->rx_buf.rb_bc_srv_max_requests;
-        if (extras)
+        rpcrdma_post_recvs(r_xprt, true);
-                rpcrdma_ep_post_extra_recv(r_xprt, extras);
 out:
        if (rc)
@@ -893,6 +879,7 @@ static int rpcrdma_sendctxs_create(struct rpcrdma_xprt *r_xprt)
                sc->sc_xprt = r_xprt;
                buf->rb_sc_ctxs[i] = sc;
        }
+        buf->rb_flags = 0;
        return 0;
@@ -950,7 +937,7 @@ out_emptyq:
         * completions recently. This is a sign the Send Queue is
         * backing up. Cause the caller to pause and try again.
         */
-        dprintk("RPC:       %s: empty sendctx queue\n", __func__);
+        set_bit(RPCRDMA_BUF_F_EMPTY_SCQ, &buf->rb_flags);
        r_xprt = container_of(buf, struct rpcrdma_xprt, rx_buf);
        r_xprt->rx_stats.empty_sendctx_q++;
        return NULL;
@@ -965,7 +952,8 @@ out_emptyq:
 *
 * The caller serializes calls to this function (per rpcrdma_buffer).
 */
-void rpcrdma_sendctx_put_locked(struct rpcrdma_sendctx *sc)
+static void
+rpcrdma_sendctx_put_locked(struct rpcrdma_sendctx *sc)
 {
        struct rpcrdma_buffer *buf = &sc->sc_xprt->rx_buf;
        unsigned long next_tail;
@@ -984,6 +972,11 @@ void rpcrdma_sendctx_put_locked(struct rpcrdma_sendctx *sc)
        /* Paired with READ_ONCE */
        smp_store_release(&buf->rb_sc_tail, next_tail);
+        if (test_and_clear_bit(RPCRDMA_BUF_F_EMPTY_SCQ, &buf->rb_flags)) {
+                smp_mb__after_atomic();
+                xprt_write_space(&sc->sc_xprt->rx_xprt);
+        }
 }
 static void
@@ -1097,14 +1090,8 @@ rpcrdma_create_req(struct rpcrdma_xprt *r_xprt)
        return req;
 }
-/**
+static int
- * rpcrdma_create_rep - Allocate an rpcrdma_rep object
+rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt, bool temp)
- * @r_xprt: controlling transport
- *
- * Returns 0 on success or a negative errno on failure.
- */
-int
-rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt)
 {
        struct rpcrdma_create_data_internal *cdata = &r_xprt->rx_data;
        struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
@@ -1132,6 +1119,7 @@ rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt)
        rep->rr_recv_wr.wr_cqe = &rep->rr_cqe;
        rep->rr_recv_wr.sg_list = &rep->rr_rdmabuf->rg_iov;
        rep->rr_recv_wr.num_sge = 1;
+        rep->rr_temp = temp;
        spin_lock(&buf->rb_lock);
        list_add(&rep->rr_list, &buf->rb_recv_bufs);
@@ -1183,12 +1171,8 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
                list_add(&req->rl_list, &buf->rb_send_bufs);
        }
+        buf->rb_posted_receives = 0;
        INIT_LIST_HEAD(&buf->rb_recv_bufs);
-        for (i = 0; i <= buf->rb_max_requests; i++) {
-                rc = rpcrdma_create_rep(r_xprt);
-                if (rc)
-                        goto out;
-        }
        rc = rpcrdma_sendctxs_create(r_xprt);
        if (rc)
@@ -1200,28 +1184,6 @@ out:
        return rc;
 }
-static struct rpcrdma_req *
-rpcrdma_buffer_get_req_locked(struct rpcrdma_buffer *buf)
-{
-        struct rpcrdma_req *req;
-        req = list_first_entry(&buf->rb_send_bufs,
-                               struct rpcrdma_req, rl_list);
-        list_del_init(&req->rl_list);
-        return req;
-}
-static struct rpcrdma_rep *
-rpcrdma_buffer_get_rep_locked(struct rpcrdma_buffer *buf)
-{
-        struct rpcrdma_rep *rep;
-        rep = list_first_entry(&buf->rb_recv_bufs,
-                               struct rpcrdma_rep, rr_list);
-        list_del(&rep->rr_list);
-        return rep;
-}
 static void
 rpcrdma_destroy_rep(struct rpcrdma_rep *rep)
 {
@@ -1280,10 +1242,11 @@ rpcrdma_buffer_destroy(struct rpcrdma_buffer *buf)
        while (!list_empty(&buf->rb_recv_bufs)) {
                struct rpcrdma_rep *rep;
-                rep = rpcrdma_buffer_get_rep_locked(buf);
+                rep = list_first_entry(&buf->rb_recv_bufs,
+                                       struct rpcrdma_rep, rr_list);
+                list_del(&rep->rr_list);
                rpcrdma_destroy_rep(rep);
        }
-        buf->rb_send_count = 0;
        spin_lock(&buf->rb_reqslock);
        while (!list_empty(&buf->rb_allreqs)) {
@@ -1298,7 +1261,6 @@ rpcrdma_buffer_destroy(struct rpcrdma_buffer *buf)
                spin_lock(&buf->rb_reqslock);
        }
        spin_unlock(&buf->rb_reqslock);
-        buf->rb_recv_count = 0;
        rpcrdma_mrs_destroy(buf);
 }
@@ -1371,27 +1333,11 @@ rpcrdma_mr_unmap_and_put(struct rpcrdma_mr *mr)
        __rpcrdma_mr_put(&r_xprt->rx_buf, mr);
 }
-static struct rpcrdma_rep *
+/**
-rpcrdma_buffer_get_rep(struct rpcrdma_buffer *buffers)
+ * rpcrdma_buffer_get - Get a request buffer
-{
+ * @buffers: Buffer pool from which to obtain a buffer
-        /* If an RPC previously completed without a reply (say, a
-         * credential problem or a soft timeout occurs) then hold off
-         * on supplying more Receive buffers until the number of new
-         * pending RPCs catches up to the number of posted Receives.
-         */
-        if (unlikely(buffers->rb_send_count < buffers->rb_recv_count))
-                return NULL;
-        if (unlikely(list_empty(&buffers->rb_recv_bufs)))
-                return NULL;
-        buffers->rb_recv_count++;
-        return rpcrdma_buffer_get_rep_locked(buffers);
-}
-/*
- * Get a set of request/reply buffers.
 *
- * Reply buffer (if available) is attached to send buffer upon return.
+ * Returns a fresh rpcrdma_req, or NULL if none are available.
 */
 struct rpcrdma_req *
 rpcrdma_buffer_get(struct rpcrdma_buffer *buffers)
@@ -1399,23 +1345,18 @@ rpcrdma_buffer_get(struct rpcrdma_buffer *buffers)
        struct rpcrdma_req *req;
        spin_lock(&buffers->rb_lock);
-        if (list_empty(&buffers->rb_send_bufs))
+        req = list_first_entry_or_null(&buffers->rb_send_bufs,
-                goto out_reqbuf;
+                                       struct rpcrdma_req, rl_list);
-        buffers->rb_send_count++;
+        if (req)
-        req = rpcrdma_buffer_get_req_locked(buffers);
+                list_del_init(&req->rl_list);
-        req->rl_reply = rpcrdma_buffer_get_rep(buffers);
        spin_unlock(&buffers->rb_lock);
        return req;
-out_reqbuf:
-        spin_unlock(&buffers->rb_lock);
-        return NULL;
 }
-/*
+/**
- * Put request/reply buffers back into pool.
+ * rpcrdma_buffer_put - Put request/reply buffers back into pool
- * Pre-decrement counter/array index.
+ * @req: object to return
+ *
 */
 void
 rpcrdma_buffer_put(struct rpcrdma_req *req)
@@ -1426,27 +1367,16 @@ rpcrdma_buffer_put(struct rpcrdma_req *req)
        req->rl_reply = NULL;
        spin_lock(&buffers->rb_lock);
-        buffers->rb_send_count--;
+        list_add(&req->rl_list, &buffers->rb_send_bufs);
-        list_add_tail(&req->rl_list, &buffers->rb_send_bufs);
        if (rep) {
-                buffers->rb_recv_count--;
+                if (!rep->rr_temp) {
-                list_add_tail(&rep->rr_list, &buffers->rb_recv_bufs);
+                        list_add(&rep->rr_list, &buffers->rb_recv_bufs);
+                        rep = NULL;
+                }
        }
        spin_unlock(&buffers->rb_lock);
-}
+        if (rep)
+                rpcrdma_destroy_rep(rep);
-/*
- * Recover reply buffers from pool.
- * This happens when recovering from disconnect.
- */
-void
-rpcrdma_recv_buffer_get(struct rpcrdma_req *req)
-{
-        struct rpcrdma_buffer *buffers = req->rl_buffer;
-        spin_lock(&buffers->rb_lock);
-        req->rl_reply = rpcrdma_buffer_get_rep(buffers);
-        spin_unlock(&buffers->rb_lock);
 }
 /*
@@ -1458,10 +1388,13 @@ rpcrdma_recv_buffer_put(struct rpcrdma_rep *rep)
 {
        struct rpcrdma_buffer *buffers = &rep->rr_rxprt->rx_buf;
-        spin_lock(&buffers->rb_lock);
+        if (!rep->rr_temp) {
-        buffers->rb_recv_count--;
+                spin_lock(&buffers->rb_lock);
-        list_add_tail(&rep->rr_list, &buffers->rb_recv_bufs);
+                list_add(&rep->rr_list, &buffers->rb_recv_bufs);
-        spin_unlock(&buffers->rb_lock);
+                spin_unlock(&buffers->rb_lock);
+        } else {
+                rpcrdma_destroy_rep(rep);
+        }
 }
 /**
@@ -1557,13 +1490,6 @@ rpcrdma_ep_post(struct rpcrdma_ia *ia,
        struct ib_send_wr *send_wr = &req->rl_sendctx->sc_wr;
        int rc;
-        if (req->rl_reply) {
-                rc = rpcrdma_ep_post_recv(ia, req->rl_reply);
-                if (rc)
-                        return rc;
-                req->rl_reply = NULL;
-        }
        if (!ep->rep_send_count ||
            test_bit(RPCRDMA_REQ_F_TX_RESOURCES, &req->rl_flags)) {
                send_wr->send_flags |= IB_SEND_SIGNALED;
@@ -1580,61 +1506,69 @@ rpcrdma_ep_post(struct rpcrdma_ia *ia,
        return 0;
 }
-int
-rpcrdma_ep_post_recv(struct rpcrdma_ia *ia,
-                     struct rpcrdma_rep *rep)
-{
-        struct ib_recv_wr *recv_wr_fail;
-        int rc;
-        if (!rpcrdma_dma_map_regbuf(ia, rep->rr_rdmabuf))
-                goto out_map;
-        rc = ib_post_recv(ia->ri_id->qp, &rep->rr_recv_wr, &recv_wr_fail);
-        trace_xprtrdma_post_recv(rep, rc);
-        if (rc)
-                return -ENOTCONN;
-        return 0;
-out_map:
-        pr_err("rpcrdma: failed to DMA map the Receive buffer\n");
-        return -EIO;
-}
 /**
- * rpcrdma_ep_post_extra_recv - Post buffers for incoming backchannel requests
+ * rpcrdma_post_recvs - Maybe post some Receive buffers
- * @r_xprt: transport associated with these backchannel resources
+ * @r_xprt: controlling transport
- * @count: minimum number of incoming requests expected
+ * @temp: when true, allocate temp rpcrdma_rep objects
 *
- * Returns zero if all requested buffers were posted, or a negative errno.
 */
-int
+void
-rpcrdma_ep_post_extra_recv(struct rpcrdma_xprt *r_xprt, unsigned int count)
+rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp)
 {
-        struct rpcrdma_buffer *buffers = &r_xprt->rx_buf;
+        struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
-        struct rpcrdma_ia *ia = &r_xprt->rx_ia;
+        struct ib_recv_wr *wr, *bad_wr;
-        struct rpcrdma_rep *rep;
+        int needed, count, rc;
-        int rc;
-        while (count--) {
+        needed = buf->rb_credits + (buf->rb_bc_srv_max_requests << 1);
-                spin_lock(&buffers->rb_lock);
+        if (buf->rb_posted_receives > needed)
-                if (list_empty(&buffers->rb_recv_bufs))
+                return;
-                        goto out_reqbuf;
+        needed -= buf->rb_posted_receives;
-                rep = rpcrdma_buffer_get_rep_locked(buffers);
-                spin_unlock(&buffers->rb_lock);
-                rc = rpcrdma_ep_post_recv(ia, rep);
+        count = 0;
-                if (rc)
+        wr = NULL;
-                        goto out_rc;
+        while (needed) {
-        }
+                struct rpcrdma_regbuf *rb;
+                struct rpcrdma_rep *rep;
-        return 0;
+                spin_lock(&buf->rb_lock);
+                rep = list_first_entry_or_null(&buf->rb_recv_bufs,
+                                               struct rpcrdma_rep, rr_list);
+                if (likely(rep))
+                        list_del(&rep->rr_list);
+                spin_unlock(&buf->rb_lock);
+                if (!rep) {
+                        if (rpcrdma_create_rep(r_xprt, temp))
+                                break;
+                        continue;
+                }
-out_reqbuf:
+                rb = rep->rr_rdmabuf;
-        spin_unlock(&buffers->rb_lock);
+                if (!rpcrdma_regbuf_is_mapped(rb)) {
-        trace_xprtrdma_noreps(r_xprt);
+                        if (!__rpcrdma_dma_map_regbuf(&r_xprt->rx_ia, rb)) {
-        return -ENOMEM;
+                                rpcrdma_recv_buffer_put(rep);
+                                break;
+                        }
+                }
-out_rc:
+                trace_xprtrdma_post_recv(rep->rr_recv_wr.wr_cqe);
-        rpcrdma_recv_buffer_put(rep);
+                rep->rr_recv_wr.next = wr;
-        return rc;
+                wr = &rep->rr_recv_wr;
+                ++count;
+                --needed;
+        }
+        if (!count)
+                return;
+        rc = ib_post_recv(r_xprt->rx_ia.ri_id->qp, wr, &bad_wr);
+        if (rc) {
+                for (wr = bad_wr; wr; wr = wr->next) {
+                        struct rpcrdma_rep *rep;
+                        rep = container_of(wr, struct rpcrdma_rep, rr_recv_wr);
+                        rpcrdma_recv_buffer_put(rep);
+                        --count;
+                }
+        }
+        buf->rb_posted_receives += count;
+        trace_xprtrdma_post_recvs(r_xprt, count, rc);
 }
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index cb41b12a3bf8..2ca14f7c2d51 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
 /*
 * Copyright (c) 2014-2017 Oracle.  All rights reserved.
 * Copyright (c) 2003-2007 Network Appliance, Inc. All rights reserved.
@@ -196,6 +197,7 @@ struct rpcrdma_rep {
        __be32                  rr_proc;
        int                     rr_wc_flags;
        u32                     rr_inv_rkey;
+        bool                    rr_temp;
        struct rpcrdma_regbuf   *rr_rdmabuf;
        struct rpcrdma_xprt     *rr_rxprt;
        struct work_struct      rr_work;
@@ -334,6 +336,7 @@ enum {
 struct rpcrdma_buffer;
 struct rpcrdma_req {
        struct list_head        rl_list;
+        struct rpc_rqst         rl_slot;
        struct rpcrdma_buffer   *rl_buffer;
        struct rpcrdma_rep      *rl_reply;
        struct xdr_stream       rl_stream;
@@ -356,16 +359,10 @@ enum {
        RPCRDMA_REQ_F_TX_RESOURCES,
 };
-static inline void
-rpcrdma_set_xprtdata(struct rpc_rqst *rqst, struct rpcrdma_req *req)
-{
-        rqst->rq_xprtdata = req;
-}
 static inline struct rpcrdma_req *
 rpcr_to_rdmar(const struct rpc_rqst *rqst)
 {
-        return rqst->rq_xprtdata;
+        return container_of(rqst, struct rpcrdma_req, rl_slot);
 }
 static inline void
@@ -401,11 +398,12 @@ struct rpcrdma_buffer {
        struct rpcrdma_sendctx  **rb_sc_ctxs;
        spinlock_t              rb_lock;        /* protect buf lists */
-        int                     rb_send_count, rb_recv_count;
        struct list_head        rb_send_bufs;
        struct list_head        rb_recv_bufs;
+        unsigned long           rb_flags;
        u32                     rb_max_requests;
        u32                     rb_credits;     /* most recent credit grant */
+        int                     rb_posted_receives;
        u32                     rb_bc_srv_max_requests;
        spinlock_t              rb_reqslock;    /* protect rb_allreqs */
@@ -420,6 +418,11 @@ struct rpcrdma_buffer {
 };
 #define rdmab_to_ia(b) (&container_of((b), struct rpcrdma_xprt, rx_buf)->rx_ia)
+/* rb_flags */
+enum {
+        RPCRDMA_BUF_F_EMPTY_SCQ = 0,
+};
 /*
 * Internal structure for transport instance creation. This
 * exists primarily for modularity.
@@ -561,18 +564,16 @@ void rpcrdma_ep_disconnect(struct rpcrdma_ep *, struct rpcrdma_ia *);
 int rpcrdma_ep_post(struct rpcrdma_ia *, struct rpcrdma_ep *,
                                struct rpcrdma_req *);
-int rpcrdma_ep_post_recv(struct rpcrdma_ia *, struct rpcrdma_rep *);
+void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp);
 /*
 * Buffer calls - xprtrdma/verbs.c
 */
 struct rpcrdma_req *rpcrdma_create_req(struct rpcrdma_xprt *);
 void rpcrdma_destroy_req(struct rpcrdma_req *);
-int rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt);
 int rpcrdma_buffer_create(struct rpcrdma_xprt *);
 void rpcrdma_buffer_destroy(struct rpcrdma_buffer *);
 struct rpcrdma_sendctx *rpcrdma_sendctx_get_locked(struct rpcrdma_buffer *buf);
-void rpcrdma_sendctx_put_locked(struct rpcrdma_sendctx *sc);
 struct rpcrdma_mr *rpcrdma_mr_get(struct rpcrdma_xprt *r_xprt);
 void rpcrdma_mr_put(struct rpcrdma_mr *mr);
@@ -581,7 +582,6 @@ void rpcrdma_mr_defer_recovery(struct rpcrdma_mr *mr);
 struct rpcrdma_req *rpcrdma_buffer_get(struct rpcrdma_buffer *);
 void rpcrdma_buffer_put(struct rpcrdma_req *);
-void rpcrdma_recv_buffer_get(struct rpcrdma_req *);
 void rpcrdma_recv_buffer_put(struct rpcrdma_rep *);
 struct rpcrdma_regbuf *rpcrdma_alloc_regbuf(size_t, enum dma_data_direction,
@@ -603,8 +603,6 @@ rpcrdma_dma_map_regbuf(struct rpcrdma_ia *ia, struct rpcrdma_regbuf *rb)
        return __rpcrdma_dma_map_regbuf(ia, rb);
 }
-int rpcrdma_ep_post_extra_recv(struct rpcrdma_xprt *, unsigned int);
 int rpcrdma_alloc_wq(void);
 void rpcrdma_destroy_wq(void);
@@ -675,5 +673,3 @@ void xprt_rdma_bc_destroy(struct rpc_xprt *, unsigned int);
 extern struct xprt_class xprt_rdma_bc;
 #endif                          /* _LINUX_SUNRPC_XPRT_RDMA_H */
-#include <trace/events/rpcrdma.h>
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index c8902f11efdd..9e1c5024aba9 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2763,6 +2763,7 @@ static const struct rpc_xprt_ops xs_local_ops = {
        .reserve_xprt           = xprt_reserve_xprt,
        .release_xprt           = xs_tcp_release_xprt,
        .alloc_slot             = xprt_alloc_slot,
+        .free_slot              = xprt_free_slot,
        .rpcbind                = xs_local_rpcbind,
        .set_port               = xs_local_set_port,
        .connect                = xs_local_connect,
@@ -2782,6 +2783,7 @@ static const struct rpc_xprt_ops xs_udp_ops = {
        .reserve_xprt           = xprt_reserve_xprt_cong,
        .release_xprt           = xprt_release_xprt_cong,
        .alloc_slot             = xprt_alloc_slot,
+        .free_slot              = xprt_free_slot,
        .rpcbind                = rpcb_getport_async,
        .set_port               = xs_set_port,
        .connect                = xs_connect,
@@ -2803,6 +2805,7 @@ static const struct rpc_xprt_ops xs_tcp_ops = {
        .reserve_xprt           = xprt_reserve_xprt,
        .release_xprt           = xs_tcp_release_xprt,
        .alloc_slot             = xprt_lock_and_alloc_slot,
+        .free_slot              = xprt_free_slot,
        .rpcbind                = rpcb_getport_async,
        .set_port               = xs_set_port,
        .connect                = xs_connect,
@@ -2834,6 +2837,7 @@ static const struct rpc_xprt_ops bc_tcp_ops = {
        .reserve_xprt           = xprt_reserve_xprt,
        .release_xprt           = xprt_release_xprt,
        .alloc_slot             = xprt_alloc_slot,
+        .free_slot              = xprt_free_slot,
        .buf_alloc              = bc_malloc,
        .buf_free               = bc_free,
        .send_request           = bc_send_request,
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 4492cda45566..a2f76743c73a 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -285,8 +285,9 @@ static int __tipc_nl_compat_doit(struct tipc_nl_compat_cmd_doit *cmd,
        if (!trans_buf)
                return -ENOMEM;
-        attrbuf = kmalloc((tipc_genl_family.maxattr + 1) *
+        attrbuf = kmalloc_array(tipc_genl_family.maxattr + 1,
-                        sizeof(struct nlattr *), GFP_KERNEL);
+                                sizeof(struct nlattr *),
+                                GFP_KERNEL);
        if (!attrbuf) {
                err = -ENOMEM;
                goto trans_out;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 14a5d055717d..930852c54d7a 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -692,9 +692,10 @@ static int tipc_getname(struct socket *sock, struct sockaddr *uaddr,
 }
 /**
- * tipc_poll - read pollmask
+ * tipc_poll - read and possibly block on pollmask
 * @file: file structure associated with the socket
 * @sock: socket for which to calculate the poll bits
+ * @wait: ???
 *
 * Returns pollmask value
 *
@@ -708,12 +709,15 @@ static int tipc_getname(struct socket *sock, struct sockaddr *uaddr,
 * imply that the operation will succeed, merely that it should be performed
 * and will not block.
 */
-static __poll_t tipc_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t tipc_poll(struct file *file, struct socket *sock,
+                              poll_table *wait)
 {
        struct sock *sk = sock->sk;
        struct tipc_sock *tsk = tipc_sk(sk);
        __poll_t revents = 0;
+        sock_poll_wait(file, sk_sleep(sk), wait);
        if (sk->sk_shutdown & RCV_SHUTDOWN)
                revents |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
        if (sk->sk_shutdown == SHUTDOWN_MASK)
@@ -3033,7 +3037,7 @@ static const struct proto_ops msg_ops = {
        .socketpair     = tipc_socketpair,
        .accept         = sock_no_accept,
        .getname        = tipc_getname,
-        .poll_mask      = tipc_poll_mask,
+        .poll           = tipc_poll,
        .ioctl          = tipc_ioctl,
        .listen         = sock_no_listen,
        .shutdown       = tipc_shutdown,
@@ -3054,7 +3058,7 @@ static const struct proto_ops packet_ops = {
        .socketpair     = tipc_socketpair,
        .accept         = tipc_accept,
        .getname        = tipc_getname,
-        .poll_mask      = tipc_poll_mask,
+        .poll           = tipc_poll,
        .ioctl          = tipc_ioctl,
        .listen         = tipc_listen,
        .shutdown       = tipc_shutdown,
@@ -3075,7 +3079,7 @@ static const struct proto_ops stream_ops = {
        .socketpair     = tipc_socketpair,
        .accept         = tipc_accept,
        .getname        = tipc_getname,
-        .poll_mask      = tipc_poll_mask,
+        .poll           = tipc_poll,
        .ioctl          = tipc_ioctl,
        .listen         = tipc_listen,
        .shutdown       = tipc_shutdown,
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 8ca57d01b18f..d2380548f8f6 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -191,18 +191,12 @@ static void tls_free_both_sg(struct sock *sk)
 }
 static int tls_do_encryption(struct tls_context *tls_ctx,
-                             struct tls_sw_context_tx *ctx, size_t data_len,
+                             struct tls_sw_context_tx *ctx,
-                             gfp_t flags)
+                             struct aead_request *aead_req,
+                             size_t data_len)
 {
-        unsigned int req_size = sizeof(struct aead_request) +
-                crypto_aead_reqsize(ctx->aead_send);
-        struct aead_request *aead_req;
        int rc;
-        aead_req = kzalloc(req_size, flags);
-        if (!aead_req)
-                return -ENOMEM;
        ctx->sg_encrypted_data[0].offset += tls_ctx->tx.prepend_size;
        ctx->sg_encrypted_data[0].length -= tls_ctx->tx.prepend_size;
@@ -219,7 +213,6 @@ static int tls_do_encryption(struct tls_context *tls_ctx,
        ctx->sg_encrypted_data[0].offset -= tls_ctx->tx.prepend_size;
        ctx->sg_encrypted_data[0].length += tls_ctx->tx.prepend_size;
-        kfree(aead_req);
        return rc;
 }
@@ -228,8 +221,14 @@ static int tls_push_record(struct sock *sk, int flags,
 {
        struct tls_context *tls_ctx = tls_get_ctx(sk);
        struct tls_sw_context_tx *ctx = tls_sw_ctx_tx(tls_ctx);
+        struct aead_request *req;
        int rc;
+        req = kzalloc(sizeof(struct aead_request) +
+                      crypto_aead_reqsize(ctx->aead_send), sk->sk_allocation);
+        if (!req)
+                return -ENOMEM;
        sg_mark_end(ctx->sg_plaintext_data + ctx->sg_plaintext_num_elem - 1);
        sg_mark_end(ctx->sg_encrypted_data + ctx->sg_encrypted_num_elem - 1);
@@ -245,15 +244,14 @@ static int tls_push_record(struct sock *sk, int flags,
        tls_ctx->pending_open_record_frags = 0;
        set_bit(TLS_PENDING_CLOSED_RECORD, &tls_ctx->flags);
-        rc = tls_do_encryption(tls_ctx, ctx, ctx->sg_plaintext_size,
+        rc = tls_do_encryption(tls_ctx, ctx, req, ctx->sg_plaintext_size);
-                               sk->sk_allocation);
        if (rc < 0) {
                /* If we are called from write_space and
                 * we fail, we need to set this SOCK_NOSPACE
                 * to trigger another write_space in the future.
                 */
                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
-                return rc;
+                goto out_req;
        }
        free_sg(sk, ctx->sg_plaintext_data, &ctx->sg_plaintext_num_elem,
@@ -268,6 +266,8 @@ static int tls_push_record(struct sock *sk, int flags,
                tls_err_abort(sk, EBADMSG);
        tls_advance_record_sn(sk, &tls_ctx->tx);
+out_req:
+        kfree(req);
        return rc;
 }
@@ -754,7 +754,7 @@ int tls_sw_recvmsg(struct sock *sk,
        struct sk_buff *skb;
        ssize_t copied = 0;
        bool cmsg = false;
-        int err = 0;
+        int target, err = 0;
        long timeo;
        flags |= nonblock;
@@ -764,6 +764,7 @@ int tls_sw_recvmsg(struct sock *sk,
        lock_sock(sk);
+        target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
        timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
        do {
                bool zc = false;
@@ -856,6 +857,9 @@ fallback_to_reg_recv:
                                        goto recv_end;
                        }
                }
+                /* If we have a new message from strparser, continue now. */
+                if (copied >= target && !ctx->recv_pkt)
+                        break;
        } while (len);
 recv_end:
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 95b02a71fd47..e5473c03d667 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -638,8 +638,9 @@ static int unix_stream_connect(struct socket *, struct sockaddr *,
 static int unix_socketpair(struct socket *, struct socket *);
 static int unix_accept(struct socket *, struct socket *, int, bool);
 static int unix_getname(struct socket *, struct sockaddr *, int);
-static __poll_t unix_poll_mask(struct socket *, __poll_t);
+static __poll_t unix_poll(struct file *, struct socket *, poll_table *);
-static __poll_t unix_dgram_poll_mask(struct socket *, __poll_t);
+static __poll_t unix_dgram_poll(struct file *, struct socket *,
+                                    poll_table *);
 static int unix_ioctl(struct socket *, unsigned int, unsigned long);
 static int unix_shutdown(struct socket *, int);
 static int unix_stream_sendmsg(struct socket *, struct msghdr *, size_t);
@@ -680,7 +681,7 @@ static const struct proto_ops unix_stream_ops = {
        .socketpair =   unix_socketpair,
        .accept =       unix_accept,
        .getname =      unix_getname,
-        .poll_mask =    unix_poll_mask,
+        .poll =         unix_poll,
        .ioctl =        unix_ioctl,
        .listen =       unix_listen,
        .shutdown =     unix_shutdown,
@@ -703,7 +704,7 @@ static const struct proto_ops unix_dgram_ops = {
        .socketpair =   unix_socketpair,
        .accept =       sock_no_accept,
        .getname =      unix_getname,
-        .poll_mask =    unix_dgram_poll_mask,
+        .poll =         unix_dgram_poll,
        .ioctl =        unix_ioctl,
        .listen =       sock_no_listen,
        .shutdown =     unix_shutdown,
@@ -725,7 +726,7 @@ static const struct proto_ops unix_seqpacket_ops = {
        .socketpair =   unix_socketpair,
        .accept =       unix_accept,
        .getname =      unix_getname,
-        .poll_mask =    unix_dgram_poll_mask,
+        .poll =         unix_dgram_poll,
        .ioctl =        unix_ioctl,
        .listen =       unix_listen,
        .shutdown =     unix_shutdown,
@@ -2629,10 +2630,13 @@ static int unix_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
        return err;
 }
-static __poll_t unix_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
        struct sock *sk = sock->sk;
-        __poll_t mask = 0;
+        __poll_t mask;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        /* exceptional events? */
        if (sk->sk_err)
@@ -2661,11 +2665,15 @@ static __poll_t unix_poll_mask(struct socket *sock, __poll_t events)
        return mask;
 }
-static __poll_t unix_dgram_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
+                                    poll_table *wait)
 {
        struct sock *sk = sock->sk, *other;
-        int writable;
+        unsigned int writable;
-        __poll_t mask = 0;
+        __poll_t mask;
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        /* exceptional events? */
        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
@@ -2691,7 +2699,7 @@ static __poll_t unix_dgram_poll_mask(struct socket *sock, __poll_t events)
        }
        /* No write status requested, avoid expensive OUT tests. */
-        if (!(events & (EPOLLWRBAND|EPOLLWRNORM|EPOLLOUT)))
+        if (!(poll_requested_events(wait) & (EPOLLWRBAND|EPOLLWRNORM|EPOLLOUT)))
                return mask;
        writable = unix_writable(sk);
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index bb5d5fa68c35..c1076c19b858 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -850,11 +850,18 @@ static int vsock_shutdown(struct socket *sock, int mode)
        return err;
 }
-static __poll_t vsock_poll_mask(struct socket *sock, __poll_t events)
+static __poll_t vsock_poll(struct file *file, struct socket *sock,
+                               poll_table *wait)
 {
-        struct sock *sk = sock->sk;
+        struct sock *sk;
-        struct vsock_sock *vsk = vsock_sk(sk);
+        __poll_t mask;
-        __poll_t mask = 0;
+        struct vsock_sock *vsk;
+        sk = sock->sk;
+        vsk = vsock_sk(sk);
+        poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
        if (sk->sk_err)
                /* Signify that there has been an error on this socket. */
@@ -1084,7 +1091,7 @@ static const struct proto_ops vsock_dgram_ops = {
        .socketpair = sock_no_socketpair,
        .accept = sock_no_accept,
        .getname = vsock_getname,
-        .poll_mask = vsock_poll_mask,
+        .poll = vsock_poll,
        .ioctl = sock_no_ioctl,
        .listen = sock_no_listen,
        .shutdown = vsock_shutdown,
@@ -1842,7 +1849,7 @@ static const struct proto_ops vsock_stream_ops = {
        .socketpair = sock_no_socketpair,
        .accept = vsock_accept,
        .getname = vsock_getname,
-        .poll_mask = vsock_poll_mask,
+        .poll = vsock_poll,
        .ioctl = sock_no_ioctl,
        .listen = vsock_listen,
        .shutdown = vsock_shutdown,
diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
index 8e03bd3f3668..5d3cce9e8744 100644
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -201,7 +201,7 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt)
                return -ENODEV;
        }
-        if (le32_to_cpu(pkt->hdr.dst_cid) == vsock->guest_cid)
+        if (le64_to_cpu(pkt->hdr.dst_cid) == vsock->guest_cid)
                return virtio_transport_send_pkt_loopback(vsock, pkt);
        if (pkt->reply)
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 5fe35aafdd9c..48e8097339ab 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -1012,6 +1012,7 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
        nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE);
        list_del_rcu(&wdev->list);
+        synchronize_rcu();
        rdev->devlist_generation++;
        switch (wdev->iftype) {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 07514ca011b2..4eece06be1e7 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6231,7 +6231,7 @@ do {									    \
                                  nl80211_check_s32);
        /*
         * Check HT operation mode based on
-         * IEEE 802.11 2012 8.4.2.59 HT Operation element.
+         * IEEE 802.11-2016 9.4.2.57 HT Operation element.
         */
        if (tb[NL80211_MESHCONF_HT_OPMODE]) {
                ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
@@ -6241,22 +6241,9 @@ do {									    \
                                  IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
                        return -EINVAL;
-                if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
+                /* NON_HT_STA bit is reserved, but some programs set it */
-                    (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+                ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
-                        return -EINVAL;
-                switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
-                case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
-                case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
-                        if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
-                                return -EINVAL;
-                        break;
-                case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
-                case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
-                        if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
-                                return -EINVAL;
-                        break;
-                }
                cfg->ht_opmode = ht_opmode;
                mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
        }
@@ -10833,7 +10820,7 @@ static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
        struct nlattr **tb;
        int err;
-        tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
+        tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
        if (!tb)
                return -ENOMEM;
@@ -10962,9 +10949,12 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                                    rem) {
                        u8 *mask_pat;
-                        nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
+                        err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
-                                         nl80211_packet_pattern_policy,
+                                               nl80211_packet_pattern_policy,
-                                         info->extack);
+                                               info->extack);
+                        if (err)
+                                goto error;
                        err = -EINVAL;
                        if (!pat_tb[NL80211_PKTPAT_MASK] ||
                            !pat_tb[NL80211_PKTPAT_PATTERN])
@@ -11213,8 +11203,11 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
                            rem) {
                u8 *mask_pat;
-                nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
+                err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
-                                 nl80211_packet_pattern_policy, NULL);
+                                       nl80211_packet_pattern_policy, NULL);
+                if (err)
+                        return err;
                if (!pat_tb[NL80211_PKTPAT_MASK] ||
                    !pat_tb[NL80211_PKTPAT_PATTERN])
                        return -EINVAL;
@@ -11793,7 +11786,7 @@ static int nl80211_nan_add_func(struct sk_buff *skb,
                        func->srf_num_macs = n_entries;
                        func->srf_macs =
-                                kzalloc(sizeof(*func->srf_macs) * n_entries,
+                                kcalloc(n_entries, sizeof(*func->srf_macs),
                                        GFP_KERNEL);
                        if (!func->srf_macs) {
                                err = -ENOMEM;
diff --git a/net/wireless/util.c b/net/wireless/util.c
index b5bb1c309914..3c654cd7ba56 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1746,6 +1746,8 @@ int cfg80211_get_station(struct net_device *dev, const u8 *mac_addr,
        if (!rdev->ops->get_station)
                return -EOPNOTSUPP;
+        memset(sinfo, 0, sizeof(*sinfo));
        return rdev_get_station(rdev, dev, mac_addr, sinfo);
 }
 EXPORT_SYMBOL(cfg80211_get_station);
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index f93365ae0fdd..d49aa79b7997 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1750,7 +1750,7 @@ static const struct proto_ops x25_proto_ops = {
        .socketpair =   sock_no_socketpair,
        .accept =       x25_accept,
        .getname =      x25_getname,
-        .poll_mask =    datagram_poll_mask,
+        .poll =         datagram_poll,
        .ioctl =        x25_ioctl,
 #ifdef CONFIG_COMPAT
        .compat_ioctl = compat_x25_ioctl,
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 7eb4948a38d2..f47abb46c587 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -132,8 +132,10 @@ static void xdp_umem_unpin_pages(struct xdp_umem *umem)
 static void xdp_umem_unaccount_pages(struct xdp_umem *umem)
 {
-        atomic_long_sub(umem->npgs, &umem->user->locked_vm);
+        if (umem->user) {
-        free_uid(umem->user);
+                atomic_long_sub(umem->npgs, &umem->user->locked_vm);
+                free_uid(umem->user);
+        }
 }
 static void xdp_umem_release(struct xdp_umem *umem)
@@ -202,7 +204,8 @@ static int xdp_umem_pin_pages(struct xdp_umem *umem)
        long npgs;
        int err;
-        umem->pgs = kcalloc(umem->npgs, sizeof(*umem->pgs), GFP_KERNEL);
+        umem->pgs = kcalloc(umem->npgs, sizeof(*umem->pgs),
+                            GFP_KERNEL | __GFP_NOWARN);
        if (!umem->pgs)
                return -ENOMEM;
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index c6ed2454f7ce..59fb7d3c36a3 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -118,6 +118,9 @@ int xsk_generic_rcv(struct xdp_sock *xs, struct xdp_buff *xdp)
        u64 addr;
        int err;
+        if (xs->dev != xdp->rxq->dev || xs->queue_id != xdp->rxq->queue_index)
+                return -EINVAL;
        if (!xskq_peek_addr(xs->umem->fq, &addr) ||
            len > xs->umem->chunk_size_nohr) {
                xs->rx_dropped++;
@@ -300,9 +303,10 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len)
        return (xs->zc) ? xsk_zc_xmit(sk) : xsk_generic_xmit(sk, m, total_len);
 }
-static __poll_t xsk_poll_mask(struct socket *sock, __poll_t events)
+static unsigned int xsk_poll(struct file *file, struct socket *sock,
+                             struct poll_table_struct *wait)
 {
-        __poll_t mask = datagram_poll_mask(sock, events);
+        unsigned int mask = datagram_poll(file, sock, wait);
        struct sock *sk = sock->sk;
        struct xdp_sock *xs = xdp_sk(sk);
@@ -643,7 +647,7 @@ static int xsk_getsockopt(struct socket *sock, int level, int optname,
 static int xsk_mmap(struct file *file, struct socket *sock,
                    struct vm_area_struct *vma)
 {
-        unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
+        loff_t offset = (loff_t)vma->vm_pgoff << PAGE_SHIFT;
        unsigned long size = vma->vm_end - vma->vm_start;
        struct xdp_sock *xs = xdp_sk(sock->sk);
        struct xsk_queue *q = NULL;
@@ -693,7 +697,7 @@ static const struct proto_ops xsk_proto_ops = {
        .socketpair     = sock_no_socketpair,
        .accept         = sock_no_accept,
        .getname        = sock_no_getname,
-        .poll_mask      = xsk_poll_mask,
+        .poll           = xsk_poll,
        .ioctl          = sock_no_ioctl,
        .listen         = sock_no_listen,
        .shutdown       = sock_no_shutdown,
author	Jiri Kosina <jkosina@suse.cz>	2018-08-20 12:05:17 -0400
committer	Jiri Kosina <jkosina@suse.cz>	2018-08-20 12:05:17 -0400
commit	415d2b3392d7a80903e0f97f051201aa02bf20e9 (patch)
tree	47492d2386a0e7f00ef645313cb44ae4960b7e7e /net
parent	4f65245f2d178b9cba48350620d76faa4a098841 (diff)
parent	b8e759b8f6dab1c473c30ac12709095d0b81078e (diff)