Merge tag 'v4.2-rc7' into drm-next

Linux 4.2-rc7

Backmerge master for i915 fixes

92 files changed, 849 insertions, 422 deletions

diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 9dd49ca67dbc..6e70ddb158b4 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -704,6 +704,7 @@ static void p9_virtio_remove(struct virtio_device *vdev)
 
         mutex_unlock(&virtio_9p_lock);
 
+        vdev->config->reset(vdev);
         vdev->config->del_vqs(vdev);
 
         sysfs_remove_file(&(vdev->dev.kobj), &dev_attr_mount_tag.attr);
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index 1997538a5d23..3b78e8473a01 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -264,6 +264,7 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
 {
         ax25_clear_queues(ax25);
 
+        ax25_stop_heartbeat(ax25);
         ax25_stop_t1timer(ax25);
         ax25_stop_t2timer(ax25);
         ax25_stop_t3timer(ax25);
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index fb54e6aed096..6d0b471eede8 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1138,6 +1138,9 @@ void batadv_dat_snoop_outgoing_arp_reply(struct batadv_priv *bat_priv,
  * @bat_priv: the bat priv with all the soft interface information
  * @skb: packet to check
  * @hdr_size: size of the encapsulation header
+ *
+ * Returns true if the packet was snooped and consumed by DAT. False if the
+ * packet has to be delivered to the interface
  */
 bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
                                          struct sk_buff *skb, int hdr_size)
@@ -1145,7 +1148,7 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
         uint16_t type;
         __be32 ip_src, ip_dst;
         uint8_t *hw_src, *hw_dst;
-        bool ret = false;
+        bool dropped = false;
         unsigned short vid;
 
         if (!atomic_read(&bat_priv->distributed_arp_table))
@@ -1174,12 +1177,17 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
         /* if this REPLY is directed to a client of mine, let's deliver the
          * packet to the interface
          */
-        ret = !batadv_is_my_client(bat_priv, hw_dst, vid);
+        dropped = !batadv_is_my_client(bat_priv, hw_dst, vid);
+
+        /* if this REPLY is sent on behalf of a client of mine, let's drop the
+         * packet because the client will reply by itself
+         */
+        dropped |= batadv_is_my_client(bat_priv, hw_src, vid);
 out:
-        if (ret)
+        if (dropped)
                 kfree_skb(skb);
-        /* if ret == false -> packet has to be delivered to the interface */
-        return ret;
+        /* if dropped == false -> deliver to the interface */
+        return dropped;
 }
 
 /**
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index bb0158620628..cffa92dd9877 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -439,6 +439,8 @@ static void batadv_gw_node_add(struct batadv_priv *bat_priv,
 
         INIT_HLIST_NODE(&gw_node->list);
         gw_node->orig_node = orig_node;
+        gw_node->bandwidth_down = ntohl(gateway->bandwidth_down);
+        gw_node->bandwidth_up = ntohl(gateway->bandwidth_up);
         atomic_set(&gw_node->refcount, 1);
 
         spin_lock_bh(&bat_priv->gw.list_lock);
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index c002961da75d..a2fc843c2243 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -479,6 +479,9 @@ out:
  */
 void batadv_softif_vlan_free_ref(struct batadv_softif_vlan *vlan)
 {
+        if (!vlan)
+                return;
+
         if (atomic_dec_and_test(&vlan->refcount)) {
                 spin_lock_bh(&vlan->bat_priv->softif_vlan_list_lock);
                 hlist_del_rcu(&vlan->list);
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index b4824951010b..5e953297d3b2 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -594,6 +594,9 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const uint8_t *addr,
 
         /* increase the refcounter of the related vlan */
         vlan = batadv_softif_vlan_get(bat_priv, vid);
+        if (WARN(!vlan, "adding TT local entry %pM to non-existent VLAN %d",
+                 addr, BATADV_PRINT_VID(vid)))
+                goto out;
 
         batadv_dbg(BATADV_DBG_TT, bat_priv,
                    "Creating new local tt entry: %pM (vid: %d, ttvn: %d)\n",
@@ -1034,6 +1037,7 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
         struct batadv_tt_local_entry *tt_local_entry;
         uint16_t flags, curr_flags = BATADV_NO_FLAGS;
         struct batadv_softif_vlan *vlan;
+        void *tt_entry_exists;
 
         tt_local_entry = batadv_tt_local_hash_find(bat_priv, addr, vid);
         if (!tt_local_entry)
@@ -1061,11 +1065,22 @@ uint16_t batadv_tt_local_remove(struct batadv_priv *bat_priv,
          * immediately purge it
          */
         batadv_tt_local_event(bat_priv, tt_local_entry, BATADV_TT_CLIENT_DEL);
-        hlist_del_rcu(&tt_local_entry->common.hash_entry);
+
+        tt_entry_exists = batadv_hash_remove(bat_priv->tt.local_hash,
+                                             batadv_compare_tt,
+                                             batadv_choose_tt,
+                                             &tt_local_entry->common);
+        if (!tt_entry_exists)
+                goto out;
+
+        /* extra call to free the local tt entry */
         batadv_tt_local_entry_free_ref(tt_local_entry);
 
         /* decrease the reference held for this vlan */
         vlan = batadv_softif_vlan_get(bat_priv, vid);
+        if (!vlan)
+                goto out;
+
         batadv_softif_vlan_free_ref(vlan);
         batadv_softif_vlan_free_ref(vlan);
 
@@ -1166,8 +1181,10 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
                         /* decrease the reference held for this vlan */
                         vlan = batadv_softif_vlan_get(bat_priv,
                                                       tt_common_entry->vid);
-                        batadv_softif_vlan_free_ref(vlan);
-                        batadv_softif_vlan_free_ref(vlan);
+                        if (vlan) {
+                                batadv_softif_vlan_free_ref(vlan);
+                                batadv_softif_vlan_free_ref(vlan);
+                        }
 
                         batadv_tt_local_entry_free_ref(tt_local);
                 }
@@ -3207,8 +3224,10 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
 
                         /* decrease the reference held for this vlan */
                         vlan = batadv_softif_vlan_get(bat_priv, tt_common->vid);
-                        batadv_softif_vlan_free_ref(vlan);
-                        batadv_softif_vlan_free_ref(vlan);
+                        if (vlan) {
+                                batadv_softif_vlan_free_ref(vlan);
+                                batadv_softif_vlan_free_ref(vlan);
+                        }
 
                         batadv_tt_local_entry_free_ref(tt_local);
                 }
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 7998fb279165..92720f3fe573 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -7820,7 +7820,7 @@ void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent)
         /* Make sure we copy only the significant bytes based on the
          * encryption key size, and set the rest of the value to zeroes.
          */
-        memcpy(ev.key.val, key->val, sizeof(key->enc_size));
+        memcpy(ev.key.val, key->val, key->enc_size);
         memset(ev.key.val + key->enc_size, 0,
                sizeof(ev.key.val) - key->enc_size);
 
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 3d0f7d2a0616..ad82324f710f 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2312,6 +2312,10 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
                 return 1;
 
         chan = conn->smp;
+        if (!chan) {
+                BT_ERR("SMP security requested but not available");
+                return 1;
+        }
 
         if (!hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED))
                 return 1;
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 0ff6e1bbca91..fa7bfced888e 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -37,15 +37,30 @@ static inline int should_deliver(const struct net_bridge_port *p,
 
 int br_dev_queue_push_xmit(struct sock *sk, struct sk_buff *skb)
 {
-        if (!is_skb_forwardable(skb->dev, skb)) {
-                kfree_skb(skb);
-        } else {
-                skb_push(skb, ETH_HLEN);
-                br_drop_fake_rtable(skb);
-                skb_sender_cpu_clear(skb);
-                dev_queue_xmit(skb);
+        if (!is_skb_forwardable(skb->dev, skb))
+                goto drop;
+
+        skb_push(skb, ETH_HLEN);
+        br_drop_fake_rtable(skb);
+        skb_sender_cpu_clear(skb);
+
+        if (skb->ip_summed == CHECKSUM_PARTIAL &&
+            (skb->protocol == htons(ETH_P_8021Q) ||
+             skb->protocol == htons(ETH_P_8021AD))) {
+                int depth;
+
+                if (!__vlan_get_protocol(skb, skb->protocol, &depth))
+                        goto drop;
+
+                skb_set_network_header(skb, depth);
         }
 
+        dev_queue_xmit(skb);
+
+        return 0;
+
+drop:
+        kfree_skb(skb);
         return 0;
 }
 EXPORT_SYMBOL_GPL(br_dev_queue_push_xmit);
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index c11cf2611db0..c94321955db7 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -351,7 +351,6 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
         if (state == MDB_TEMPORARY)
                 mod_timer(&p->timer, now + br->multicast_membership_interval);
 
-        br_mdb_notify(br->dev, port, group, RTM_NEWMDB);
         return 0;
 }
 
@@ -446,6 +445,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
                 if (p->port->state == BR_STATE_DISABLED)
                         goto unlock;
 
+                entry->state = p->state;
                 rcu_assign_pointer(*pp, p->next);
                 hlist_del_init(&p->mglist);
                 del_timer(&p->timer);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 742a6c27d7a2..0b39dcc65b94 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -39,6 +39,16 @@ static void br_multicast_start_querier(struct net_bridge *br,
                                        struct bridge_mcast_own_query *query);
 static void br_multicast_add_router(struct net_bridge *br,
                                     struct net_bridge_port *port);
+static void br_ip4_multicast_leave_group(struct net_bridge *br,
+                                         struct net_bridge_port *port,
+                                         __be32 group,
+                                         __u16 vid);
+#if IS_ENABLED(CONFIG_IPV6)
+static void br_ip6_multicast_leave_group(struct net_bridge *br,
+                                         struct net_bridge_port *port,
+                                         const struct in6_addr *group,
+                                         __u16 vid);
+#endif
 unsigned int br_mdb_rehash_seq;
 
 static inline int br_ip_equal(const struct br_ip *a, const struct br_ip *b)
@@ -1010,9 +1020,15 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
                         continue;
                 }
 
-                err = br_ip4_multicast_add_group(br, port, group, vid);
-                if (err)
-                        break;
+                if ((type == IGMPV3_CHANGE_TO_INCLUDE ||
+                     type == IGMPV3_MODE_IS_INCLUDE) &&
+                    ntohs(grec->grec_nsrcs) == 0) {
+                        br_ip4_multicast_leave_group(br, port, group, vid);
+                } else {
+                        err = br_ip4_multicast_add_group(br, port, group, vid);
+                        if (err)
+                                break;
+                }
         }
 
         return err;
@@ -1071,10 +1087,17 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
                         continue;
                 }
 
-                err = br_ip6_multicast_add_group(br, port, &grec->grec_mca,
-                                                 vid);
-                if (err)
-                        break;
+                if ((grec->grec_type == MLD2_CHANGE_TO_INCLUDE ||
+                     grec->grec_type == MLD2_MODE_IS_INCLUDE) &&
+                    ntohs(*nsrcs) == 0) {
+                        br_ip6_multicast_leave_group(br, port, &grec->grec_mca,
+                                                     vid);
+                } else {
+                        err = br_ip6_multicast_add_group(br, port,
+                                                         &grec->grec_mca, vid);
+                        if (!err)
+                                break;
+                }
         }
 
         return err;
@@ -1393,8 +1416,7 @@ br_multicast_leave_group(struct net_bridge *br,
 
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev) ||
-            (port && port->state == BR_STATE_DISABLED) ||
-            timer_pending(&other_query->timer))
+            (port && port->state == BR_STATE_DISABLED))
                 goto out;
 
         mdb = mlock_dereference(br->mdb, br);
@@ -1402,6 +1424,31 @@ br_multicast_leave_group(struct net_bridge *br,
         if (!mp)
                 goto out;
 
+        if (port && (port->flags & BR_MULTICAST_FAST_LEAVE)) {
+                struct net_bridge_port_group __rcu **pp;
+
+                for (pp = &mp->ports;
+                     (p = mlock_dereference(*pp, br)) != NULL;
+                     pp = &p->next) {
+                        if (p->port != port)
+                                continue;
+
+                        rcu_assign_pointer(*pp, p->next);
+                        hlist_del_init(&p->mglist);
+                        del_timer(&p->timer);
+                        call_rcu_bh(&p->rcu, br_multicast_free_pg);
+                        br_mdb_notify(br->dev, port, group, RTM_DELMDB);
+
+                        if (!mp->ports && !mp->mglist &&
+                            netif_running(br->dev))
+                                mod_timer(&mp->timer, jiffies);
+                }
+                goto out;
+        }
+
+        if (timer_pending(&other_query->timer))
+                goto out;
+
         if (br->multicast_querier) {
                 __br_multicast_send_query(br, port, &mp->addr);
 
@@ -1427,28 +1474,6 @@ br_multicast_leave_group(struct net_bridge *br,
                 }
         }
 
-        if (port && (port->flags & BR_MULTICAST_FAST_LEAVE)) {
-                struct net_bridge_port_group __rcu **pp;
-
-                for (pp = &mp->ports;
-                     (p = mlock_dereference(*pp, br)) != NULL;
-                     pp = &p->next) {
-                        if (p->port != port)
-                                continue;
-
-                        rcu_assign_pointer(*pp, p->next);
-                        hlist_del_init(&p->mglist);
-                        del_timer(&p->timer);
-                        call_rcu_bh(&p->rcu, br_multicast_free_pg);
-                        br_mdb_notify(br->dev, port, group, RTM_DELMDB);
-
-                        if (!mp->ports && !mp->mglist &&
-                            netif_running(br->dev))
-                                mod_timer(&mp->timer, jiffies);
-                }
-                goto out;
-        }
-
         now = jiffies;
         time = now + br->multicast_last_member_count *
                      br->multicast_last_member_interval;
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 364bdc98bd9b..4d74a0639c4c 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -112,6 +112,8 @@ static inline size_t br_port_info_size(void)
                 + nla_total_size(1)     /* IFLA_BRPORT_FAST_LEAVE */
                 + nla_total_size(1)     /* IFLA_BRPORT_LEARNING */
                 + nla_total_size(1)     /* IFLA_BRPORT_UNICAST_FLOOD */
+                + nla_total_size(1)     /* IFLA_BRPORT_PROXYARP */
+                + nla_total_size(1)     /* IFLA_BRPORT_PROXYARP_WIFI */
                 + 0;
 }
 
@@ -506,6 +508,8 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = {
         [IFLA_BRPORT_FAST_LEAVE]= { .type = NLA_U8 },
         [IFLA_BRPORT_LEARNING]  = { .type = NLA_U8 },
         [IFLA_BRPORT_UNICAST_FLOOD] = { .type = NLA_U8 },
+        [IFLA_BRPORT_PROXYARP]  = { .type = NLA_U8 },
+        [IFLA_BRPORT_PROXYARP_WIFI] = { .type = NLA_U8 },
 };
 
 /* Change the state of the port and notify spanning tree */
@@ -693,9 +697,17 @@ static int br_port_slave_changelink(struct net_device *brdev,
                                     struct nlattr *tb[],
                                     struct nlattr *data[])
 {
+        struct net_bridge *br = netdev_priv(brdev);
+        int ret;
+
         if (!data)
                 return 0;
-        return br_setport(br_port_get_rtnl(dev), data);
+
+        spin_lock_bh(&br->lock);
+        ret = br_setport(br_port_get_rtnl(dev), data);
+        spin_unlock_bh(&br->lock);
+
+        return ret;
 }
 
 static int br_port_fill_slave_info(struct sk_buff *skb,
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index b4b6dab9c285..ed74ffaa851f 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -209,8 +209,9 @@ void br_transmit_config(struct net_bridge_port *p)
                 br_send_config_bpdu(p, &bpdu);
                 p->topology_change_ack = 0;
                 p->config_pending = 0;
-                mod_timer(&p->hold_timer,
-                          round_jiffies(jiffies + BR_HOLD_TIME));
+                if (p->br->stp_enabled == BR_KERNEL_STP)
+                        mod_timer(&p->hold_timer,
+                                  round_jiffies(jiffies + BR_HOLD_TIME));
         }
 }
 
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index a2730e7196cd..4ca449a16132 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -48,7 +48,8 @@ void br_stp_enable_bridge(struct net_bridge *br)
         struct net_bridge_port *p;
 
         spin_lock_bh(&br->lock);
-        mod_timer(&br->hello_timer, jiffies + br->hello_time);
+        if (br->stp_enabled == BR_KERNEL_STP)
+                mod_timer(&br->hello_timer, jiffies + br->hello_time);
         mod_timer(&br->gc_timer, jiffies + HZ/10);
 
         br_config_bpdu_generation(br);
@@ -127,6 +128,7 @@ static void br_stp_start(struct net_bridge *br)
         int r;
         char *argv[] = { BR_STP_PROG, br->dev->name, "start", NULL };
         char *envp[] = { NULL };
+        struct net_bridge_port *p;
 
         r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
 
@@ -140,6 +142,10 @@ static void br_stp_start(struct net_bridge *br)
         if (r == 0) {
                 br->stp_enabled = BR_USER_STP;
                 br_debug(br, "userspace STP started\n");
+                /* Stop hello and hold timers */
+                del_timer(&br->hello_timer);
+                list_for_each_entry(p, &br->port_list, list)
+                        del_timer(&p->hold_timer);
         } else {
                 br->stp_enabled = BR_KERNEL_STP;
                 br_debug(br, "using kernel STP\n");
@@ -156,12 +162,17 @@ static void br_stp_stop(struct net_bridge *br)
         int r;
         char *argv[] = { BR_STP_PROG, br->dev->name, "stop", NULL };
         char *envp[] = { NULL };
+        struct net_bridge_port *p;
 
         if (br->stp_enabled == BR_USER_STP) {
                 r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
                 br_info(br, "userspace STP stopped, return code %d\n", r);
 
                 /* To start timers on any ports left in blocking */
+                mod_timer(&br->hello_timer, jiffies + br->hello_time);
+                list_for_each_entry(p, &br->port_list, list)
+                        mod_timer(&p->hold_timer,
+                                  round_jiffies(jiffies + BR_HOLD_TIME));
                 spin_lock_bh(&br->lock);
                 br_port_state_selection(br);
                 spin_unlock_bh(&br->lock);
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index 7caf7fae2d5b..5f0f5af0ec35 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -40,7 +40,9 @@ static void br_hello_timer_expired(unsigned long arg)
         if (br->dev->flags & IFF_UP) {
                 br_config_bpdu_generation(br);
 
-                mod_timer(&br->hello_timer, round_jiffies(jiffies + br->hello_time));
+                if (br->stp_enabled != BR_USER_STP)
+                        mod_timer(&br->hello_timer,
+                                  round_jiffies(jiffies + br->hello_time));
         }
         spin_unlock(&br->lock);
 }
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 3cc71b9f5517..cc858919108e 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -121,12 +121,13 @@ static void caif_flow_ctrl(struct sock *sk, int mode)
  * Copied from sock.c:sock_queue_rcv_skb(), but changed so packets are
  * not dropped, but CAIF is sending flow off instead.
  */
-static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+static void caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         int err;
         unsigned long flags;
         struct sk_buff_head *list = &sk->sk_receive_queue;
         struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
+        bool queued = false;
 
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
                 (unsigned int)sk->sk_rcvbuf && rx_flow_is_on(cf_sk)) {
@@ -139,7 +140,8 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
         err = sk_filter(sk, skb);
         if (err)
-                return err;
+                goto out;
+
         if (!sk_rmem_schedule(sk, skb, skb->truesize) && rx_flow_is_on(cf_sk)) {
                 set_rx_flow_off(cf_sk);
                 net_dbg_ratelimited("sending flow OFF due to rmem_schedule\n");
@@ -147,21 +149,16 @@ static int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
         }
         skb->dev = NULL;
         skb_set_owner_r(skb, sk);
-        /* Cache the SKB length before we tack it onto the receive
-         * queue. Once it is added it no longer belongs to us and
-         * may be freed by other threads of control pulling packets
-         * from the queue.
-         */
         spin_lock_irqsave(&list->lock, flags);
-        if (!sock_flag(sk, SOCK_DEAD))
+        queued = !sock_flag(sk, SOCK_DEAD);
+        if (queued)
                 __skb_queue_tail(list, skb);
         spin_unlock_irqrestore(&list->lock, flags);
-
-        if (!sock_flag(sk, SOCK_DEAD))
+out:
+        if (queued)
                 sk->sk_data_ready(sk);
         else
                 kfree_skb(skb);
-        return 0;
 }
 
 /* Packet Receive Callback function called from CAIF Stack */
diff --git a/net/core/datagram.c b/net/core/datagram.c
index b80fb91bb3f7..617088aee21d 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -131,6 +131,35 @@ out_noerr:
         goto out;
 }
 
+static struct sk_buff *skb_set_peeked(struct sk_buff *skb)
+{
+        struct sk_buff *nskb;
+
+        if (skb->peeked)
+                return skb;
+
+        /* We have to unshare an skb before modifying it. */
+        if (!skb_shared(skb))
+                goto done;
+
+        nskb = skb_clone(skb, GFP_ATOMIC);
+        if (!nskb)
+                return ERR_PTR(-ENOMEM);
+
+        skb->prev->next = nskb;
+        skb->next->prev = nskb;
+        nskb->prev = skb->prev;
+        nskb->next = skb->next;
+
+        consume_skb(skb);
+        skb = nskb;
+
+done:
+        skb->peeked = 1;
+
+        return skb;
+}
+
 /**
  *      __skb_recv_datagram - Receive a datagram skbuff
  *      @sk: socket
@@ -165,7 +194,9 @@ out_noerr:
 struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                                     int *peeked, int *off, int *err)
 {
+        struct sk_buff_head *queue = &sk->sk_receive_queue;
         struct sk_buff *skb, *last;
+        unsigned long cpu_flags;
         long timeo;
         /*
          * Caller is allowed not to check sk->sk_err before skb_recv_datagram()
@@ -184,8 +215,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                  * Look at current nfs client by the way...
                  * However, this function was correct in any case. 8)
                  */
-                unsigned long cpu_flags;
-                struct sk_buff_head *queue = &sk->sk_receive_queue;
                 int _off = *off;
 
                 last = (struct sk_buff *)queue;
@@ -199,7 +228,12 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                                         _off -= skb->len;
                                         continue;
                                 }
-                                skb->peeked = 1;
+
+                                skb = skb_set_peeked(skb);
+                                error = PTR_ERR(skb);
+                                if (IS_ERR(skb))
+                                        goto unlock_err;
+
                                 atomic_inc(&skb->users);
                         } else
                                 __skb_unlink(skb, queue);
@@ -223,6 +257,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
 
         return NULL;
 
+unlock_err:
+        spin_unlock_irqrestore(&queue->lock, cpu_flags);
 no_packet:
         *err = error;
         return NULL;
@@ -622,7 +658,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len)
                     !skb->csum_complete_sw)
                         netdev_rx_csum_fault(skb->dev);
         }
-        skb->csum_valid = !sum;
+        if (!skb_shared(skb))
+                skb->csum_valid = !sum;
         return sum;
 }
 EXPORT_SYMBOL(__skb_checksum_complete_head);
@@ -642,11 +679,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb)
                         netdev_rx_csum_fault(skb->dev);
         }
 
-        /* Save full packet checksum */
-        skb->csum = csum;
-        skb->ip_summed = CHECKSUM_COMPLETE;
-        skb->csum_complete_sw = 1;
-        skb->csum_valid = !sum;
+        if (!skb_shared(skb)) {
+                /* Save full packet checksum */
+                skb->csum = csum;
+                skb->ip_summed = CHECKSUM_COMPLETE;
+                skb->csum_complete_sw = 1;
+                skb->csum_valid = !sum;
+        }
 
         return sum;
 }
diff --git a/net/core/dst.c b/net/core/dst.c
index e956ce6d1378..002144bea935 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -284,7 +284,9 @@ void dst_release(struct dst_entry *dst)
                 int newrefcnt;
 
                 newrefcnt = atomic_dec_return(&dst->__refcnt);
-                WARN_ON(newrefcnt < 0);
+                if (unlikely(newrefcnt < 0))
+                        net_warn_ratelimited("%s: dst:%p refcnt:%d\n",
+                                             __func__, dst, newrefcnt);
                 if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
                         call_rcu(&dst->rcu_head, dst_destroy_rcu);
         }
diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
index 1f2a126f4ffa..6441f47b1a8f 100644
--- a/net/core/netclassid_cgroup.c
+++ b/net/core/netclassid_cgroup.c
@@ -23,7 +23,8 @@ static inline struct cgroup_cls_state *css_cls_state(struct cgroup_subsys_state
 
 struct cgroup_cls_state *task_cls_state(struct task_struct *p)
 {
-        return css_cls_state(task_css(p, net_cls_cgrp_id));
+        return css_cls_state(task_css_check(p, net_cls_cgrp_id,
+                                            rcu_read_lock_bh_held()));
 }
 EXPORT_SYMBOL_GPL(task_cls_state);
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 1ebdf1c0d118..1cbd209192ea 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3514,8 +3514,6 @@ static int pktgen_thread_worker(void *arg)
 
         set_freezable();
 
-        __set_current_state(TASK_RUNNING);
-
         while (!kthread_should_stop()) {
                 pkt_dev = next_to_run(t);
 
@@ -3560,7 +3558,6 @@ static int pktgen_thread_worker(void *arg)
 
                 try_to_freeze();
         }
-        set_current_state(TASK_INTERRUPTIBLE);
 
         pr_debug("%s stopping all device\n", t->tsk->comm);
         pktgen_stop(t);
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 87b22c0bc08c..b42f0e26f89e 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -103,10 +103,16 @@ void reqsk_queue_destroy(struct request_sock_queue *queue)
                         spin_lock_bh(&queue->syn_wait_lock);
                         while ((req = lopt->syn_table[i]) != NULL) {
                                 lopt->syn_table[i] = req->dl_next;
+                                /* Because of following del_timer_sync(),
+                                 * we must release the spinlock here
+                                 * or risk a dead lock.
+                                 */
+                                spin_unlock_bh(&queue->syn_wait_lock);
                                 atomic_inc(&lopt->qlen_dec);
-                                if (del_timer(&req->rsk_timer))
+                                if (del_timer_sync(&req->rsk_timer))
                                         reqsk_put(req);
                                 reqsk_put(req);
+                                spin_lock_bh(&queue->syn_wait_lock);
                         }
                         spin_unlock_bh(&queue->syn_wait_lock);
                 }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 9e433d58d265..dc004b1e1f85 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1804,10 +1804,13 @@ static int do_setlink(const struct sk_buff *skb,
                         goto errout;
 
                 nla_for_each_nested(attr, tb[IFLA_VF_PORTS], rem) {
-                        if (nla_type(attr) != IFLA_VF_PORT)
-                                continue;
-                        err = nla_parse_nested(port, IFLA_PORT_MAX,
-                                attr, ifla_port_policy);
+                        if (nla_type(attr) != IFLA_VF_PORT ||
+                            nla_len(attr) < NLA_HDRLEN) {
+                                err = -EINVAL;
+                                goto errout;
+                        }
+                        err = nla_parse_nested(port, IFLA_PORT_MAX, attr,
+                                               ifla_port_policy);
                         if (err < 0)
                                 goto errout;
                         if (!port[IFLA_PORT_VF]) {
diff --git a/net/core/sock.c b/net/core/sock.c
index 08f16db46070..193901d09757 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1497,7 +1497,8 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                 sock_copy(newsk, sk);
 
                 /* SANITY */
-                get_net(sock_net(newsk));
+                if (likely(newsk->sk_net_refcnt))
+                        get_net(sock_net(newsk));
                 sk_node_init(&newsk->sk_node);
                 sock_lock_init(newsk);
                 bh_lock_sock(newsk);
@@ -1967,20 +1968,21 @@ static void __release_sock(struct sock *sk)
  * sk_wait_data - wait for data to arrive at sk_receive_queue
  * @sk:    sock to wait on
  * @timeo: for how long
+ * @skb:   last skb seen on sk_receive_queue
  *
  * Now socket state including sk->sk_err is changed only under lock,
  * hence we may omit checks after joining wait queue.
  * We check receive queue before schedule() only as optimization;
  * it is very likely that release_sock() added new data.
  */
-int sk_wait_data(struct sock *sk, long *timeo)
+int sk_wait_data(struct sock *sk, long *timeo, const struct sk_buff *skb)
 {
         int rc;
         DEFINE_WAIT(wait);
 
         prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
-        rc = sk_wait_event(sk, timeo, !skb_queue_empty(&sk->sk_receive_queue));
+        rc = sk_wait_event(sk, timeo, skb_peek_tail(&sk->sk_receive_queue) != skb);
         clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
         finish_wait(sk_sleep(sk), &wait);
         return rc;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 52a94016526d..b5cf13a28009 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -886,7 +886,7 @@ verify_sock_status:
                         break;
                 }
 
-                sk_wait_data(sk, &timeo);
+                sk_wait_data(sk, &timeo, NULL);
                 continue;
         found_ok_skb:
                 if (len > skb->len)
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 0917123790ea..35c47ddd04f0 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -756,7 +756,8 @@ static int dsa_slave_phy_connect(struct dsa_slave_priv *p,
                 return -ENODEV;
 
         /* Use already configured phy mode */
-        p->phy_interface = p->phy->interface;
+        if (p->phy_interface == PHY_INTERFACE_MODE_NA)
+                p->phy_interface = p->phy->interface;
         phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link,
                            p->phy_interface);
 
diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
index f46e4d1306f2..214d44aef35b 100644
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -207,7 +207,7 @@ found:
         } else {
                 fq->q.meat += skb->len;
         }
-        add_frag_mem_limit(&fq->q, skb->truesize);
+        add_frag_mem_limit(fq->q.net, skb->truesize);
 
         if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
             fq->q.meat == fq->q.len) {
@@ -287,7 +287,7 @@ static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *prev,
                 clone->data_len = clone->len;
                 head->data_len -= clone->len;
                 head->len -= clone->len;
-                add_frag_mem_limit(&fq->q, clone->truesize);
+                add_frag_mem_limit(fq->q.net, clone->truesize);
         }
 
         WARN_ON(head == NULL);
@@ -310,7 +310,7 @@ static int lowpan_frag_reasm(struct lowpan_frag_queue *fq, struct sk_buff *prev,
                 }
                 fp = next;
         }
-        sub_frag_mem_limit(&fq->q, sum_truesize);
+        sub_frag_mem_limit(fq->q.net, sum_truesize);
 
         head->next = NULL;
         head->dev = dev;
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 933a92820d26..6c8b1fbafce8 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1017,14 +1017,16 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev)
 
         neigh = neigh_lookup(&arp_tbl, &ip, dev);
         if (neigh) {
-                read_lock_bh(&neigh->lock);
-                memcpy(r->arp_ha.sa_data, neigh->ha, dev->addr_len);
-                r->arp_flags = arp_state_to_flags(neigh);
-                read_unlock_bh(&neigh->lock);
-                r->arp_ha.sa_family = dev->type;
-                strlcpy(r->arp_dev, dev->name, sizeof(r->arp_dev));
+                if (!(neigh->nud_state & NUD_NOARP)) {
+                        read_lock_bh(&neigh->lock);
+                        memcpy(r->arp_ha.sa_data, neigh->ha, dev->addr_len);
+                        r->arp_flags = arp_state_to_flags(neigh);
+                        read_unlock_bh(&neigh->lock);
+                        r->arp_ha.sa_family = dev->type;
+                        strlcpy(r->arp_dev, dev->name, sizeof(r->arp_dev));
+                        err = 0;
+                }
                 neigh_release(neigh);
-                err = 0;
         }
         return err;
 }
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 90c0e8386116..574fad9cca05 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -20,7 +20,7 @@
 #include <net/route.h>
 #include <net/tcp_states.h>
 
-int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct sockaddr_in *usin = (struct sockaddr_in *) uaddr;
@@ -39,8 +39,6 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 
         sk_dst_reset(sk);
 
-        lock_sock(sk);
-
         oif = sk->sk_bound_dev_if;
         saddr = inet->inet_saddr;
         if (ipv4_is_multicast(usin->sin_addr.s_addr)) {
@@ -82,9 +80,19 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_dst_set(sk, &rt->dst);
         err = 0;
 out:
-        release_sock(sk);
         return err;
 }
+EXPORT_SYMBOL(__ip4_datagram_connect);
+
+int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+{
+        int res;
+
+        lock_sock(sk);
+        res = __ip4_datagram_connect(sk, uaddr, addr_len);
+        release_sock(sk);
+        return res;
+}
 EXPORT_SYMBOL(ip4_datagram_connect);
 
 /* Because UDP xmit path can manipulate sk_dst_cache without holding
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index e813196c91c7..2d9cb1748f81 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -882,7 +882,6 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
                 queue_delayed_work(system_power_efficient_wq,
                                 &check_lifetime_work, 0);
                 rtmsg_ifa(RTM_NEWADDR, ifa, nlh, NETLINK_CB(skb).portid);
-                blocking_notifier_call_chain(&inetaddr_chain, NETDEV_UP, ifa);
         }
         return 0;
 }
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index c6211ed60b03..9c02920725db 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -13,6 +13,7 @@ struct fib_alias {
         u8                      fa_state;
         u8                      fa_slen;
         u32                     tb_id;
+        s16                     fa_default;
         struct rcu_head         rcu;
 };
 
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index c7358ea4ae93..3a06586b170c 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1202,23 +1202,40 @@ int fib_sync_down_dev(struct net_device *dev, unsigned long event)
 }
 
 /* Must be invoked inside of an RCU protected region.  */
-void fib_select_default(struct fib_result *res)
+void fib_select_default(const struct flowi4 *flp, struct fib_result *res)
 {
         struct fib_info *fi = NULL, *last_resort = NULL;
         struct hlist_head *fa_head = res->fa_head;
         struct fib_table *tb = res->table;
+        u8 slen = 32 - res->prefixlen;
         int order = -1, last_idx = -1;
-        struct fib_alias *fa;
+        struct fib_alias *fa, *fa1 = NULL;
+        u32 last_prio = res->fi->fib_priority;
+        u8 last_tos = 0;
 
         hlist_for_each_entry_rcu(fa, fa_head, fa_list) {
                 struct fib_info *next_fi = fa->fa_info;
 
+                if (fa->fa_slen != slen)
+                        continue;
+                if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos)
+                        continue;
+                if (fa->tb_id != tb->tb_id)
+                        continue;
+                if (next_fi->fib_priority > last_prio &&
+                    fa->fa_tos == last_tos) {
+                        if (last_tos)
+                                continue;
+                        break;
+                }
+                if (next_fi->fib_flags & RTNH_F_DEAD)
+                        continue;
+                last_tos = fa->fa_tos;
+                last_prio = next_fi->fib_priority;
+
                 if (next_fi->fib_scope != res->scope ||
                     fa->fa_type != RTN_UNICAST)
                         continue;
-
-                if (next_fi->fib_priority > res->fi->fib_priority)
-                        break;
                 if (!next_fi->fib_nh[0].nh_gw ||
                     next_fi->fib_nh[0].nh_scope != RT_SCOPE_LINK)
                         continue;
@@ -1228,10 +1245,11 @@ void fib_select_default(struct fib_result *res)
                 if (!fi) {
                         if (next_fi != res->fi)
                                 break;
+                        fa1 = fa;
                 } else if (!fib_detect_death(fi, order, &last_resort,
-                                             &last_idx, tb->tb_default)) {
+                                             &last_idx, fa1->fa_default)) {
                         fib_result_assign(res, fi);
-                        tb->tb_default = order;
+                        fa1->fa_default = order;
                         goto out;
                 }
                 fi = next_fi;
@@ -1239,20 +1257,21 @@ void fib_select_default(struct fib_result *res)
         }
 
         if (order <= 0 || !fi) {
-                tb->tb_default = -1;
+                if (fa1)
+                        fa1->fa_default = -1;
                 goto out;
         }
 
         if (!fib_detect_death(fi, order, &last_resort, &last_idx,
-                                tb->tb_default)) {
+                              fa1->fa_default)) {
                 fib_result_assign(res, fi);
-                tb->tb_default = order;
+                fa1->fa_default = order;
                 goto out;
         }
 
         if (last_idx >= 0)
                 fib_result_assign(res, last_resort);
-        tb->tb_default = last_idx;
+        fa1->fa_default = last_idx;
 out:
         return;
 }
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 15d32612e3c6..37c4bb89a708 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1171,6 +1171,7 @@ int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
                         new_fa->fa_state = state & ~FA_S_ACCESSED;
                         new_fa->fa_slen = fa->fa_slen;
                         new_fa->tb_id = tb->tb_id;
+                        new_fa->fa_default = -1;
 
                         err = switchdev_fib_ipv4_add(key, plen, fi,
                                                      new_fa->fa_tos,
@@ -1222,6 +1223,7 @@ int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
         new_fa->fa_state = 0;
         new_fa->fa_slen = slen;
         new_fa->tb_id = tb->tb_id;
+        new_fa->fa_default = -1;
 
         /* (Optionally) offload fib entry to switch hardware. */
         err = switchdev_fib_ipv4_add(key, plen, fi, tos, cfg->fc_type,
@@ -1791,8 +1793,6 @@ void fib_table_flush_external(struct fib_table *tb)
                 if (hlist_empty(&n->leaf)) {
                         put_child_root(pn, n->key, NULL);
                         node_free(n);
-                } else {
-                        leaf_pull_suffix(pn, n);
                 }
         }
 }
@@ -1862,8 +1862,6 @@ int fib_table_flush(struct fib_table *tb)
                 if (hlist_empty(&n->leaf)) {
                         put_child_root(pn, n->key, NULL);
                         node_free(n);
-                } else {
-                        leaf_pull_suffix(pn, n);
                 }
         }
 
@@ -1990,7 +1988,6 @@ struct fib_table *fib_trie_table(u32 id, struct fib_table *alias)
                 return NULL;
 
         tb->tb_id = id;
-        tb->tb_default = -1;
         tb->tb_num_default = 0;
         tb->tb_data = (alias ? alias->__data : tb->__data);
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 60021d0d9326..05e3145f7dc3 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -593,7 +593,7 @@ static bool reqsk_queue_unlink(struct request_sock_queue *queue,
         }
 
         spin_unlock(&queue->syn_wait_lock);
-        if (del_timer(&req->rsk_timer))
+        if (del_timer_sync(&req->rsk_timer))
                 reqsk_put(req);
         return found;
 }
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 5e346a082e5f..d0a7c0319e3d 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -131,34 +131,22 @@ inet_evict_bucket(struct inet_frags *f, struct inet_frag_bucket *hb)
         unsigned int evicted = 0;
         HLIST_HEAD(expired);
 
-evict_again:
         spin_lock(&hb->chain_lock);
 
         hlist_for_each_entry_safe(fq, n, &hb->chain, list) {
                 if (!inet_fragq_should_evict(fq))
                         continue;
 
-                if (!del_timer(&fq->timer)) {
-                        /* q expiring right now thus increment its refcount so
-                         * it won't be freed under us and wait until the timer
-                         * has finished executing then destroy it
-                         */
-                        atomic_inc(&fq->refcnt);
-                        spin_unlock(&hb->chain_lock);
-                        del_timer_sync(&fq->timer);
-                        inet_frag_put(fq, f);
-                        goto evict_again;
-                }
+                if (!del_timer(&fq->timer))
+                        continue;
 
-                fq->flags |= INET_FRAG_EVICTED;
-                hlist_del(&fq->list);
-                hlist_add_head(&fq->list, &expired);
+                hlist_add_head(&fq->list_evictor, &expired);
                 ++evicted;
         }
 
         spin_unlock(&hb->chain_lock);
 
-        hlist_for_each_entry_safe(fq, n, &expired, list)
+        hlist_for_each_entry_safe(fq, n, &expired, list_evictor)
                 f->frag_expire((unsigned long) fq);
 
         return evicted;
@@ -240,18 +228,20 @@ void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f)
         int i;
 
         nf->low_thresh = 0;
-        local_bh_disable();
 
 evict_again:
+        local_bh_disable();
         seq = read_seqbegin(&f->rnd_seqlock);
 
         for (i = 0; i < INETFRAGS_HASHSZ ; i++)
                 inet_evict_bucket(f, &f->hash[i]);
 
-        if (read_seqretry(&f->rnd_seqlock, seq))
-                goto evict_again;
-
         local_bh_enable();
+        cond_resched();
+
+        if (read_seqretry(&f->rnd_seqlock, seq) ||
+            percpu_counter_sum(&nf->mem))
+                goto evict_again;
 
         percpu_counter_destroy(&nf->mem);
 }
@@ -284,8 +274,8 @@ static inline void fq_unlink(struct inet_frag_queue *fq, struct inet_frags *f)
         struct inet_frag_bucket *hb;
 
         hb = get_frag_bucket_locked(fq, f);
-        if (!(fq->flags & INET_FRAG_EVICTED))
-                hlist_del(&fq->list);
+        hlist_del(&fq->list);
+        fq->flags |= INET_FRAG_COMPLETE;
         spin_unlock(&hb->chain_lock);
 }
 
@@ -297,7 +287,6 @@ void inet_frag_kill(struct inet_frag_queue *fq, struct inet_frags *f)
         if (!(fq->flags & INET_FRAG_COMPLETE)) {
                 fq_unlink(fq, f);
                 atomic_dec(&fq->refcnt);
-                fq->flags |= INET_FRAG_COMPLETE;
         }
 }
 EXPORT_SYMBOL(inet_frag_kill);
@@ -330,11 +319,12 @@ void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f)
                 fp = xp;
         }
         sum = sum_truesize + f->qsize;
-        sub_frag_mem_limit(q, sum);
 
         if (f->destructor)
                 f->destructor(q);
         kmem_cache_free(f->frags_cachep, q);
+
+        sub_frag_mem_limit(nf, sum);
 }
 EXPORT_SYMBOL(inet_frag_destroy);
 
@@ -390,7 +380,7 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
 
         q->net = nf;
         f->constructor(q, arg);
-        add_frag_mem_limit(q, f->qsize);
+        add_frag_mem_limit(nf, f->qsize);
 
         setup_timer(&q->timer, f->frag_expire, (unsigned long)q);
         spin_lock_init(&q->lock);
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 5f9b063bbe8a..0cb9165421d4 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -624,22 +624,21 @@ EXPORT_SYMBOL_GPL(inet_hashinfo_init);
 
 int inet_ehash_locks_alloc(struct inet_hashinfo *hashinfo)
 {
+        unsigned int locksz = sizeof(spinlock_t);
         unsigned int i, nblocks = 1;
 
-        if (sizeof(spinlock_t) != 0) {
+        if (locksz != 0) {
                 /* allocate 2 cache lines or at least one spinlock per cpu */
-                nblocks = max_t(unsigned int,
-                                2 * L1_CACHE_BYTES / sizeof(spinlock_t),
-                                1);
+                nblocks = max(2U * L1_CACHE_BYTES / locksz, 1U);
                 nblocks = roundup_pow_of_two(nblocks * num_possible_cpus());
 
                 /* no more locks than number of hash buckets */
                 nblocks = min(nblocks, hashinfo->ehash_mask + 1);
 
-                hashinfo->ehash_locks = kmalloc_array(nblocks, sizeof(spinlock_t),
+                hashinfo->ehash_locks = kmalloc_array(nblocks, locksz,
                                                       GFP_KERNEL | __GFP_NOWARN);
                 if (!hashinfo->ehash_locks)
-                        hashinfo->ehash_locks = vmalloc(nblocks * sizeof(spinlock_t));
+                        hashinfo->ehash_locks = vmalloc(nblocks * locksz);
 
                 if (!hashinfo->ehash_locks)
                         return -ENOMEM;
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index a50dc6d408d1..921138f6c97c 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -202,7 +202,7 @@ static void ip_expire(unsigned long arg)
         ipq_kill(qp);
         IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
 
-        if (!(qp->q.flags & INET_FRAG_EVICTED)) {
+        if (!inet_frag_evicting(&qp->q)) {
                 struct sk_buff *head = qp->q.fragments;
                 const struct iphdr *iph;
                 int err;
@@ -309,7 +309,7 @@ static int ip_frag_reinit(struct ipq *qp)
                 kfree_skb(fp);
                 fp = xp;
         } while (fp);
-        sub_frag_mem_limit(&qp->q, sum_truesize);
+        sub_frag_mem_limit(qp->q.net, sum_truesize);
 
         qp->q.flags = 0;
         qp->q.len = 0;
@@ -351,7 +351,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
         ihl = ip_hdrlen(skb);
 
         /* Determine the position of this fragment. */
-        end = offset + skb->len - ihl;
+        end = offset + skb->len - skb_network_offset(skb) - ihl;
         err = -EINVAL;
 
         /* Is this the final fragment? */
@@ -381,7 +381,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
                 goto err;
 
         err = -ENOMEM;
-        if (!pskb_pull(skb, ihl))
+        if (!pskb_pull(skb, skb_network_offset(skb) + ihl))
                 goto err;
 
         err = pskb_trim_rcsum(skb, end - offset);
@@ -455,7 +455,7 @@ found:
                                 qp->q.fragments = next;
 
                         qp->q.meat -= free_it->len;
-                        sub_frag_mem_limit(&qp->q, free_it->truesize);
+                        sub_frag_mem_limit(qp->q.net, free_it->truesize);
                         kfree_skb(free_it);
                 }
         }
@@ -479,7 +479,7 @@ found:
         qp->q.stamp = skb->tstamp;
         qp->q.meat += skb->len;
         qp->ecn |= ecn;
-        add_frag_mem_limit(&qp->q, skb->truesize);
+        add_frag_mem_limit(qp->q.net, skb->truesize);
         if (offset == 0)
                 qp->q.flags |= INET_FRAG_FIRST_IN;
 
@@ -587,7 +587,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 head->len -= clone->len;
                 clone->csum = 0;
                 clone->ip_summed = head->ip_summed;
-                add_frag_mem_limit(&qp->q, clone->truesize);
+                add_frag_mem_limit(qp->q.net, clone->truesize);
         }
 
         skb_push(head, head->data - skb_network_header(head));
@@ -615,7 +615,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 }
                 fp = next;
         }
-        sub_frag_mem_limit(&qp->q, sum_truesize);
+        sub_frag_mem_limit(qp->q.net, sum_truesize);
 
         head->next = NULL;
         head->dev = dev;
@@ -641,6 +641,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 iph->frag_off = 0;
         }
 
+        ip_send_check(iph);
+
         IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
         qp->q.fragments = NULL;
         qp->q.fragments_tail = NULL;
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index fe8cc183411e..95ea633e8356 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -226,7 +226,8 @@ synproxy_send_client_ack(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+        synproxy_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+                          niph, nth, tcp_hdr_size);
 }
 
 static bool
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index d0362a2de3d3..e681b852ced1 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2176,7 +2176,7 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
         if (!res.prefixlen &&
             res.table->tb_num_default > 1 &&
             res.type == RTN_UNICAST && !fl4->flowi4_oif)
-                fib_select_default(&res);
+                fib_select_default(fl4, &res);
 
         if (!fl4->saddr)
                 fl4->saddr = FIB_RES_PREFSRC(net, res);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 7f4056785acc..45534a5ab430 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -780,7 +780,7 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
                                 ret = -EAGAIN;
                                 break;
                         }
-                        sk_wait_data(sk, &timeo);
+                        sk_wait_data(sk, &timeo, NULL);
                         if (signal_pending(current)) {
                                 ret = sock_intr_errno(timeo);
                                 break;
@@ -1575,7 +1575,7 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
         int target;             /* Read at least this many bytes */
         long timeo;
         struct task_struct *user_recv = NULL;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *last;
         u32 urg_hole = 0;
 
         if (unlikely(flags & MSG_ERRQUEUE))
@@ -1635,7 +1635,9 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
 
                 /* Next get a buffer. */
 
+                last = skb_peek_tail(&sk->sk_receive_queue);
                 skb_queue_walk(&sk->sk_receive_queue, skb) {
+                        last = skb;
                         /* Now that we have two receive queues this
                          * shouldn't happen.
                          */
@@ -1754,8 +1756,9 @@ int tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int nonblock,
                         /* Do not sleep, just process backlog. */
                         release_sock(sk);
                         lock_sock(sk);
-                } else
-                        sk_wait_data(sk, &timeo);
+                } else {
+                        sk_wait_data(sk, &timeo, last);
+                }
 
                 if (user_recv) {
                         int chunk;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 684f095d196e..728f5b3d3c64 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1917,14 +1917,13 @@ void tcp_enter_loss(struct sock *sk)
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
-        bool new_recovery = false;
+        bool new_recovery = icsk->icsk_ca_state < TCP_CA_Recovery;
         bool is_reneg;                  /* is receiver reneging on SACKs? */
 
         /* Reduce ssthresh if it has not yet been made inside this window. */
         if (icsk->icsk_ca_state <= TCP_CA_Disorder ||
             !after(tp->high_seq, tp->snd_una) ||
             (icsk->icsk_ca_state == TCP_CA_Loss && !icsk->icsk_retransmits)) {
-                new_recovery = true;
                 tp->prior_ssthresh = tcp_current_ssthresh(sk);
                 tp->snd_ssthresh = icsk->icsk_ca_ops->ssthresh(sk);
                 tcp_ca_event(sk, CA_EVENT_LOSS);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index d7d4c2b79cf2..0ea2e1c5d395 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1348,7 +1348,7 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
         req = inet_csk_search_req(sk, th->source, iph->saddr, iph->daddr);
         if (req) {
                 nsk = tcp_check_req(sk, skb, req, false);
-                if (!nsk)
+                if (!nsk || nsk == sk)
                         reqsk_put(req);
                 return nsk;
         }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 83aa604f9273..1b8c5ba7d5f7 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1995,12 +1995,19 @@ void udp_v4_early_demux(struct sk_buff *skb)
 
         skb->sk = sk;
         skb->destructor = sock_efree;
-        dst = sk->sk_rx_dst;
+        dst = READ_ONCE(sk->sk_rx_dst);
 
         if (dst)
                 dst = dst_check(dst, 0);
-        if (dst)
-                skb_dst_set_noref(skb, dst);
+        if (dst) {
+                /* DST_NOCACHE can not be used without taking a reference */
+                if (dst->flags & DST_NOCACHE) {
+                        if (likely(atomic_inc_not_zero(&dst->__refcnt)))
+                                skb_dst_set(skb, dst);
+                } else {
+                        skb_dst_set_noref(skb, dst);
+                }
+        }
 }
 
 int udp_rcv(struct sk_buff *skb)
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 62d908e64eeb..b10a88986a98 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -40,7 +40,7 @@ static bool ipv6_mapped_addr_any(const struct in6_addr *a)
         return ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0);
 }
 
-int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
         struct sockaddr_in6     *usin = (struct sockaddr_in6 *) uaddr;
         struct inet_sock        *inet = inet_sk(sk);
@@ -56,7 +56,7 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (usin->sin6_family == AF_INET) {
                 if (__ipv6_only_sock(sk))
                         return -EAFNOSUPPORT;
-                err = ip4_datagram_connect(sk, uaddr, addr_len);
+                err = __ip4_datagram_connect(sk, uaddr, addr_len);
                 goto ipv4_connected;
         }
 
@@ -98,9 +98,9 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 sin.sin_addr.s_addr = daddr->s6_addr32[3];
                 sin.sin_port = usin->sin6_port;
 
-                err = ip4_datagram_connect(sk,
-                                           (struct sockaddr *) &sin,
-                                           sizeof(sin));
+                err = __ip4_datagram_connect(sk,
+                                             (struct sockaddr *) &sin,
+                                             sizeof(sin));
 
 ipv4_connected:
                 if (err)
@@ -204,6 +204,16 @@ out:
         fl6_sock_release(flowlabel);
         return err;
 }
+
+int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+{
+        int res;
+
+        lock_sock(sk);
+        res = __ip6_datagram_connect(sk, uaddr, addr_len);
+        release_sock(sk);
+        return res;
+}
 EXPORT_SYMBOL_GPL(ip6_datagram_connect);
 
 int ip6_datagram_connect_v6_only(struct sock *sk, struct sockaddr *uaddr,
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index e893cd18612f..08b62047c67f 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -292,8 +292,6 @@ static struct packet_offload ipv6_packet_offload __read_mostly = {
 static const struct net_offload sit_offload = {
         .callbacks = {
                 .gso_segment    = ipv6_gso_segment,
-                .gro_receive    = ipv6_gro_receive,
-                .gro_complete   = ipv6_gro_complete,
         },
 };
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 0a05b35a90fc..c53331cfed95 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1650,6 +1650,7 @@ int ndisc_rcv(struct sk_buff *skb)
 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct netdev_notifier_change_info *change_info;
         struct net *net = dev_net(dev);
         struct inet6_dev *idev;
 
@@ -1664,6 +1665,11 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
                         ndisc_send_unsol_na(dev);
                 in6_dev_put(idev);
                 break;
+        case NETDEV_CHANGE:
+                change_info = ptr;
+                if (change_info->flags_changed & IFF_NOARP)
+                        neigh_changeaddr(&nd_tbl, dev);
+                break;
         case NETDEV_DOWN:
                 neigh_ifdown(&nd_tbl, dev);
                 fib6_run_gc(0, net, false);
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index 6edb7b106de7..ebbb754c2111 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -37,12 +37,13 @@ synproxy_build_ip(struct sk_buff *skb, const struct in6_addr *saddr,
 }
 
 static void
-synproxy_send_tcp(const struct sk_buff *skb, struct sk_buff *nskb,
+synproxy_send_tcp(const struct synproxy_net *snet,
+                  const struct sk_buff *skb, struct sk_buff *nskb,
                   struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
                   struct ipv6hdr *niph, struct tcphdr *nth,
                   unsigned int tcp_hdr_size)
 {
-        struct net *net = nf_ct_net((struct nf_conn *)nfct);
+        struct net *net = nf_ct_net(snet->tmpl);
         struct dst_entry *dst;
         struct flowi6 fl6;
 
@@ -83,7 +84,8 @@ free_nskb:
 }
 
 static void
-synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th,
+synproxy_send_client_synack(const struct synproxy_net *snet,
+                            const struct sk_buff *skb, const struct tcphdr *th,
                             const struct synproxy_options *opts)
 {
         struct sk_buff *nskb;
@@ -119,7 +121,7 @@ synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+        synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
                           niph, nth, tcp_hdr_size);
 }
 
@@ -163,7 +165,7 @@ synproxy_send_server_syn(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
+        synproxy_send_tcp(snet, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
                           niph, nth, tcp_hdr_size);
 }
 
@@ -203,7 +205,7 @@ synproxy_send_server_ack(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+        synproxy_send_tcp(snet, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
 }
 
 static void
@@ -241,7 +243,8 @@ synproxy_send_client_ack(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+        synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+                          niph, nth, tcp_hdr_size);
 }
 
 static bool
@@ -301,7 +304,7 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
                                           XT_SYNPROXY_OPT_SACK_PERM |
                                           XT_SYNPROXY_OPT_ECN);
 
-                synproxy_send_client_synack(skb, th, &opts);
+                synproxy_send_client_synack(snet, skb, th, &opts);
                 return NF_DROP;
 
         } else if (th->ack && !(th->fin || th->rst || th->syn)) {
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 6f187c8d8a1b..6d02498172c1 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -348,7 +348,7 @@ found:
         fq->ecn |= ecn;
         if (payload_len > fq->q.max_size)
                 fq->q.max_size = payload_len;
-        add_frag_mem_limit(&fq->q, skb->truesize);
+        add_frag_mem_limit(fq->q.net, skb->truesize);
 
         /* The first fragment.
          * nhoffset is obtained from the first fragment, of course.
@@ -430,7 +430,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
                 clone->ip_summed = head->ip_summed;
 
                 NFCT_FRAG6_CB(clone)->orig = NULL;
-                add_frag_mem_limit(&fq->q, clone->truesize);
+                add_frag_mem_limit(fq->q.net, clone->truesize);
         }
 
         /* We have to remove fragment header from datagram and to relocate
@@ -454,7 +454,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
                         head->csum = csum_add(head->csum, fp->csum);
                 head->truesize += fp->truesize;
         }
-        sub_frag_mem_limit(&fq->q, head->truesize);
+        sub_frag_mem_limit(fq->q.net, head->truesize);
 
         head->ignore_df = 1;
         head->next = NULL;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 8ffa2c8cce77..f1159bb76e0a 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -144,7 +144,7 @@ void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq,
 
         IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
 
-        if (fq->q.flags & INET_FRAG_EVICTED)
+        if (inet_frag_evicting(&fq->q))
                 goto out_rcu_unlock;
 
         IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
@@ -330,7 +330,7 @@ found:
         fq->q.stamp = skb->tstamp;
         fq->q.meat += skb->len;
         fq->ecn |= ecn;
-        add_frag_mem_limit(&fq->q, skb->truesize);
+        add_frag_mem_limit(fq->q.net, skb->truesize);
 
         /* The first fragment.
          * nhoffset is obtained from the first fragment, of course.
@@ -443,7 +443,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                 head->len -= clone->len;
                 clone->csum = 0;
                 clone->ip_summed = head->ip_summed;
-                add_frag_mem_limit(&fq->q, clone->truesize);
+                add_frag_mem_limit(fq->q.net, clone->truesize);
         }
 
         /* We have to remove fragment header from datagram and to relocate
@@ -481,7 +481,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                 }
                 fp = next;
         }
-        sub_frag_mem_limit(&fq->q, sum_truesize);
+        sub_frag_mem_limit(fq->q.net, sum_truesize);
 
         head->next = NULL;
         head->dev = dev;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6090969937f8..9de4d2bcd916 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1831,6 +1831,7 @@ int ip6_route_add(struct fib6_config *cfg)
                 int gwa_type;
 
                 gw_addr = &cfg->fc_gateway;
+                gwa_type = ipv6_addr_type(gw_addr);
 
                 /* if gw_addr is local we will fail to detect this in case
                  * address is still TENTATIVE (DAD in progress). rt6_lookup()
@@ -1838,11 +1839,12 @@ int ip6_route_add(struct fib6_config *cfg)
                  * prefix route was assigned to, which might be non-loopback.
                  */
                 err = -EINVAL;
-                if (ipv6_chk_addr_and_flags(net, gw_addr, NULL, 0, 0))
+                if (ipv6_chk_addr_and_flags(net, gw_addr,
+                                            gwa_type & IPV6_ADDR_LINKLOCAL ?
+                                            dev : NULL, 0, 0))
                         goto out;
 
                 rt->rt6i_gateway = *gw_addr;
-                gwa_type = ipv6_addr_type(gw_addr);
 
                 if (gwa_type != (IPV6_ADDR_LINKLOCAL|IPV6_ADDR_UNICAST)) {
                         struct rt6_info *grt;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 6748c4277aff..7a6cea5e4274 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -943,7 +943,7 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk, struct sk_buff *skb)
                                    &ipv6_hdr(skb)->daddr, tcp_v6_iif(skb));
         if (req) {
                 nsk = tcp_check_req(sk, skb, req, false);
-                if (!nsk)
+                if (!nsk || nsk == sk)
                         reqsk_put(req);
                 return nsk;
         }
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 8fd9febaa5ba..8dab4e569571 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -613,7 +613,7 @@ static int llc_wait_data(struct sock *sk, long timeo)
                 if (signal_pending(current))
                         break;
                 rc = 0;
-                if (sk_wait_data(sk, &timeo))
+                if (sk_wait_data(sk, &timeo, NULL))
                         break;
         }
         return rc;
@@ -802,7 +802,7 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                         release_sock(sk);
                         lock_sock(sk);
                 } else
-                        sk_wait_data(sk, &timeo);
+                        sk_wait_data(sk, &timeo, NULL);
 
                 if ((flags & MSG_PEEK) && peek_seq != llc->copied_seq) {
                         net_dbg_ratelimited("LLC(%s:%d): Application bug, race in MSG_PEEK\n",
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 29236e832e44..c09c0131bfa2 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -723,6 +723,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
 
         debugfs_remove_recursive(sdata->vif.debugfs_dir);
         sdata->vif.debugfs_dir = NULL;
+        sdata->debugfs.subdir_stations = NULL;
 }
 
 void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index ed1edac14372..553ac6dd4867 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1863,10 +1863,6 @@ void ieee80211_sdata_stop(struct ieee80211_sub_if_data *sdata)
         ieee80211_teardown_sdata(sdata);
 }
 
-/*
- * Remove all interfaces, may only be called at hardware unregistration
- * time because it doesn't do RCU-safe list removals.
- */
 void ieee80211_remove_interfaces(struct ieee80211_local *local)
 {
         struct ieee80211_sub_if_data *sdata, *tmp;
@@ -1875,14 +1871,21 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
 
         ASSERT_RTNL();
 
-        /*
-         * Close all AP_VLAN interfaces first, as otherwise they
-         * might be closed while the AP interface they belong to
-         * is closed, causing unregister_netdevice_many() to crash.
+        /* Before destroying the interfaces, make sure they're all stopped so
+         * that the hardware is stopped. Otherwise, the driver might still be
+         * iterating the interfaces during the shutdown, e.g. from a worker
+         * or from RX processing or similar, and if it does so (using atomic
+         * iteration) while we're manipulating the list, the iteration will
+         * crash.
+         *
+         * After this, the hardware should be stopped and the driver should
+         * have stopped all of its activities, so that we can do RCU-unaware
+         * manipulations of the interface list below.
          */
-        list_for_each_entry(sdata, &local->interfaces, list)
-                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                        dev_close(sdata->dev);
+        cfg80211_shutdown_all_interfaces(local->hw.wiphy);
+
+        WARN(local->open_count, "%s: open count remains %d\n",
+             wiphy_name(local->hw.wiphy), local->open_count);
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 5438d13e2f00..3b59099413fb 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -306,7 +306,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
                 if (action == WLAN_SP_MESH_PEERING_CONFIRM) {
                         /* AID */
                         pos = skb_put(skb, 2);
-                        put_unaligned_le16(plid, pos + 2);
+                        put_unaligned_le16(plid, pos);
                 }
                 if (ieee80211_add_srates_ie(sdata, skb, true, band) ||
                     ieee80211_add_ext_srates_ie(sdata, skb, true, band) ||
@@ -1122,6 +1122,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
                                                 WLAN_SP_MESH_PEERING_CONFIRM) {
                 baseaddr += 4;
                 baselen += 4;
+
+                if (baselen > len)
+                        return;
         }
         ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems);
         mesh_process_plink_frame(sdata, mgmt, &elems);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 06b60980c62c..b676b9fa707b 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -76,6 +76,22 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                                 continue;
                         ieee80211_mgd_quiesce(sdata);
+                        /* If suspended during TX in progress, and wowlan
+                         * is enabled (connection will be active) there
+                         * can be a race where the driver is put out
+                         * of power-save due to TX and during suspend
+                         * dynamic_ps_timer is cancelled and TX packet
+                         * is flushed, leaving the driver in ACTIVE even
+                         * after resuming until dynamic_ps_timer puts
+                         * driver back in DOZE.
+                         */
+                        if (sdata->u.mgd.associated &&
+                            sdata->u.mgd.powersave &&
+                             !(local->hw.conf.flags & IEEE80211_CONF_PS)) {
+                                local->hw.conf.flags |= IEEE80211_CONF_PS;
+                                ieee80211_hw_config(local,
+                                                    IEEE80211_CONF_CHANGE_PS);
+                        }
                 }
 
                 err = drv_suspend(local, wowlan);
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index ad31b2dab4f5..8db6e2994bbc 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -60,6 +60,7 @@ ieee80211_tdls_add_subband(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_channel *ch;
         struct cfg80211_chan_def chandef;
         int i, subband_start;
+        struct wiphy *wiphy = sdata->local->hw.wiphy;
 
         for (i = start; i <= end; i += spacing) {
                 if (!ch_cnt)
@@ -70,9 +71,8 @@ ieee80211_tdls_add_subband(struct ieee80211_sub_if_data *sdata,
                         /* we will be active on the channel */
                         cfg80211_chandef_create(&chandef, ch,
                                                 NL80211_CHAN_NO_HT);
-                        if (cfg80211_reg_can_beacon(sdata->local->hw.wiphy,
-                                                    &chandef,
-                                                    sdata->wdev.iftype)) {
+                        if (cfg80211_reg_can_beacon_relax(wiphy, &chandef,
+                                                          sdata->wdev.iftype)) {
                                 ch_cnt++;
                                 /*
                                  * check if the next channel is also part of
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8410bb3bf5e8..b8233505bf9f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1117,7 +1117,9 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
                         queued = true;
                         info->control.vif = &tx->sdata->vif;
                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
-                        info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
+                        info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS |
+                                        IEEE80211_TX_CTL_NO_PS_BUFFER |
+                                        IEEE80211_TX_STATUS_EOSP;
                         __skb_queue_tail(&tid_tx->pending, skb);
                         if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
                                 purge_skb = __skb_dequeue(&tid_tx->pending);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 5d2b806a862e..38fbc194b9cb 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -319,7 +319,13 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
                  * return *ignored=0 i.e. ICMP and NF_DROP
                  */
                 sched = rcu_dereference(svc->scheduler);
-                dest = sched->schedule(svc, skb, iph);
+                if (sched) {
+                        /* read svc->sched_data after svc->scheduler */
+                        smp_rmb();
+                        dest = sched->schedule(svc, skb, iph);
+                } else {
+                        dest = NULL;
+                }
                 if (!dest) {
                         IP_VS_DBG(1, "p-schedule: no dest found.\n");
                         kfree(param.pe_data);
@@ -467,7 +473,13 @@ ip_vs_schedule(struct ip_vs_service *svc, struct sk_buff *skb,
         }
 
         sched = rcu_dereference(svc->scheduler);
-        dest = sched->schedule(svc, skb, iph);
+        if (sched) {
+                /* read svc->sched_data after svc->scheduler */
+                smp_rmb();
+                dest = sched->schedule(svc, skb, iph);
+        } else {
+                dest = NULL;
+        }
         if (dest == NULL) {
                 IP_VS_DBG(1, "Schedule: no dest found.\n");
                 return NULL;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 285eae3a1454..24c554201a76 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -842,15 +842,16 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
         __ip_vs_dst_cache_reset(dest);
         spin_unlock_bh(&dest->dst_lock);
 
-        sched = rcu_dereference_protected(svc->scheduler, 1);
         if (add) {
                 ip_vs_start_estimator(svc->net, &dest->stats);
                 list_add_rcu(&dest->n_list, &svc->destinations);
                 svc->num_dests++;
-                if (sched->add_dest)
+                sched = rcu_dereference_protected(svc->scheduler, 1);
+                if (sched && sched->add_dest)
                         sched->add_dest(svc, dest);
         } else {
-                if (sched->upd_dest)
+                sched = rcu_dereference_protected(svc->scheduler, 1);
+                if (sched && sched->upd_dest)
                         sched->upd_dest(svc, dest);
         }
 }
@@ -1084,7 +1085,7 @@ static void __ip_vs_unlink_dest(struct ip_vs_service *svc,
                 struct ip_vs_scheduler *sched;
 
                 sched = rcu_dereference_protected(svc->scheduler, 1);
-                if (sched->del_dest)
+                if (sched && sched->del_dest)
                         sched->del_dest(svc, dest);
         }
 }
@@ -1175,11 +1176,14 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
         ip_vs_use_count_inc();
 
         /* Lookup the scheduler by 'u->sched_name' */
-        sched = ip_vs_scheduler_get(u->sched_name);
-        if (sched == NULL) {
-                pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
-                ret = -ENOENT;
-                goto out_err;
+        if (strcmp(u->sched_name, "none")) {
+                sched = ip_vs_scheduler_get(u->sched_name);
+                if (!sched) {
+                        pr_info("Scheduler module ip_vs_%s not found\n",
+                                u->sched_name);
+                        ret = -ENOENT;
+                        goto out_err;
+                }
         }
 
         if (u->pe_name && *u->pe_name) {
@@ -1240,10 +1244,12 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
         spin_lock_init(&svc->stats.lock);
 
         /* Bind the scheduler */
-        ret = ip_vs_bind_scheduler(svc, sched);
-        if (ret)
-                goto out_err;
-        sched = NULL;
+        if (sched) {
+                ret = ip_vs_bind_scheduler(svc, sched);
+                if (ret)
+                        goto out_err;
+                sched = NULL;
+        }
 
         /* Bind the ct retriever */
         RCU_INIT_POINTER(svc->pe, pe);
@@ -1291,17 +1297,20 @@ ip_vs_add_service(struct net *net, struct ip_vs_service_user_kern *u,
 static int
 ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
 {
-        struct ip_vs_scheduler *sched, *old_sched;
+        struct ip_vs_scheduler *sched = NULL, *old_sched;
         struct ip_vs_pe *pe = NULL, *old_pe = NULL;
         int ret = 0;
 
         /*
          * Lookup the scheduler, by 'u->sched_name'
          */
-        sched = ip_vs_scheduler_get(u->sched_name);
-        if (sched == NULL) {
-                pr_info("Scheduler module ip_vs_%s not found\n", u->sched_name);
-                return -ENOENT;
+        if (strcmp(u->sched_name, "none")) {
+                sched = ip_vs_scheduler_get(u->sched_name);
+                if (!sched) {
+                        pr_info("Scheduler module ip_vs_%s not found\n",
+                                u->sched_name);
+                        return -ENOENT;
+                }
         }
         old_sched = sched;
 
@@ -1329,14 +1338,20 @@ ip_vs_edit_service(struct ip_vs_service *svc, struct ip_vs_service_user_kern *u)
 
         old_sched = rcu_dereference_protected(svc->scheduler, 1);
         if (sched != old_sched) {
+                if (old_sched) {
+                        ip_vs_unbind_scheduler(svc, old_sched);
+                        RCU_INIT_POINTER(svc->scheduler, NULL);
+                        /* Wait all svc->sched_data users */
+                        synchronize_rcu();
+                }
                 /* Bind the new scheduler */
-                ret = ip_vs_bind_scheduler(svc, sched);
-                if (ret) {
-                        old_sched = sched;
-                        goto out;
+                if (sched) {
+                        ret = ip_vs_bind_scheduler(svc, sched);
+                        if (ret) {
+                                ip_vs_scheduler_put(sched);
+                                goto out;
+                        }
                 }
-                /* Unbind the old scheduler on success */
-                ip_vs_unbind_scheduler(svc, old_sched);
         }
 
         /*
@@ -1982,6 +1997,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
                 const struct ip_vs_iter *iter = seq->private;
                 const struct ip_vs_dest *dest;
                 struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
+                char *sched_name = sched ? sched->name : "none";
 
                 if (iter->table == ip_vs_svc_table) {
 #ifdef CONFIG_IP_VS_IPV6
@@ -1990,18 +2006,18 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
                                            ip_vs_proto_name(svc->protocol),
                                            &svc->addr.in6,
                                            ntohs(svc->port),
-                                           sched->name);
+                                           sched_name);
                         else
 #endif
                                 seq_printf(seq, "%s  %08X:%04X %s %s ",
                                            ip_vs_proto_name(svc->protocol),
                                            ntohl(svc->addr.ip),
                                            ntohs(svc->port),
-                                           sched->name,
+                                           sched_name,
                                            (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
                 } else {
                         seq_printf(seq, "FWM  %08X %s %s",
-                                   svc->fwmark, sched->name,
+                                   svc->fwmark, sched_name,
                                    (svc->flags & IP_VS_SVC_F_ONEPACKET)?"ops ":"");
                 }
 
@@ -2427,13 +2443,15 @@ ip_vs_copy_service(struct ip_vs_service_entry *dst, struct ip_vs_service *src)
 {
         struct ip_vs_scheduler *sched;
         struct ip_vs_kstats kstats;
+        char *sched_name;
 
         sched = rcu_dereference_protected(src->scheduler, 1);
+        sched_name = sched ? sched->name : "none";
         dst->protocol = src->protocol;
         dst->addr = src->addr.ip;
         dst->port = src->port;
         dst->fwmark = src->fwmark;
-        strlcpy(dst->sched_name, sched->name, sizeof(dst->sched_name));
+        strlcpy(dst->sched_name, sched_name, sizeof(dst->sched_name));
         dst->flags = src->flags;
         dst->timeout = src->timeout / HZ;
         dst->netmask = src->netmask;
@@ -2892,6 +2910,7 @@ static int ip_vs_genl_fill_service(struct sk_buff *skb,
         struct ip_vs_flags flags = { .flags = svc->flags,
                                      .mask = ~0 };
         struct ip_vs_kstats kstats;
+        char *sched_name;
 
         nl_service = nla_nest_start(skb, IPVS_CMD_ATTR_SERVICE);
         if (!nl_service)
@@ -2910,8 +2929,9 @@ static int ip_vs_genl_fill_service(struct sk_buff *skb,
         }
 
         sched = rcu_dereference_protected(svc->scheduler, 1);
+        sched_name = sched ? sched->name : "none";
         pe = rcu_dereference_protected(svc->pe, 1);
-        if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched->name) ||
+        if (nla_put_string(skb, IPVS_SVC_ATTR_SCHED_NAME, sched_name) ||
             (pe && nla_put_string(skb, IPVS_SVC_ATTR_PE_NAME, pe->name)) ||
             nla_put(skb, IPVS_SVC_ATTR_FLAGS, sizeof(flags), &flags) ||
             nla_put_u32(skb, IPVS_SVC_ATTR_TIMEOUT, svc->timeout / HZ) ||
diff --git a/net/netfilter/ipvs/ip_vs_sched.c b/net/netfilter/ipvs/ip_vs_sched.c
index 199760c71f39..7e8141647943 100644
--- a/net/netfilter/ipvs/ip_vs_sched.c
+++ b/net/netfilter/ipvs/ip_vs_sched.c
@@ -74,7 +74,7 @@ void ip_vs_unbind_scheduler(struct ip_vs_service *svc,
 
         if (sched->done_service)
                 sched->done_service(svc);
-        /* svc->scheduler can not be set to NULL */
+        /* svc->scheduler can be set to NULL only by caller */
 }
 
 
@@ -147,21 +147,21 @@ void ip_vs_scheduler_put(struct ip_vs_scheduler *scheduler)
 
 void ip_vs_scheduler_err(struct ip_vs_service *svc, const char *msg)
 {
-        struct ip_vs_scheduler *sched;
+        struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler);
+        char *sched_name = sched ? sched->name : "none";
 
-        sched = rcu_dereference(svc->scheduler);
         if (svc->fwmark) {
                 IP_VS_ERR_RL("%s: FWM %u 0x%08X - %s\n",
-                             sched->name, svc->fwmark, svc->fwmark, msg);
+                             sched_name, svc->fwmark, svc->fwmark, msg);
 #ifdef CONFIG_IP_VS_IPV6
         } else if (svc->af == AF_INET6) {
                 IP_VS_ERR_RL("%s: %s [%pI6c]:%d - %s\n",
-                             sched->name, ip_vs_proto_name(svc->protocol),
+                             sched_name, ip_vs_proto_name(svc->protocol),
                              &svc->addr.in6, ntohs(svc->port), msg);
 #endif
         } else {
                 IP_VS_ERR_RL("%s: %s %pI4:%d - %s\n",
-                             sched->name, ip_vs_proto_name(svc->protocol),
+                             sched_name, ip_vs_proto_name(svc->protocol),
                              &svc->addr.ip, ntohs(svc->port), msg);
         }
 }
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index b08ba9538d12..d99ad93eb855 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -612,7 +612,7 @@ static void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp,
                         pkts = atomic_add_return(1, &cp->in_pkts);
                 else
                         pkts = sysctl_sync_threshold(ipvs);
-                ip_vs_sync_conn(net, cp->control, pkts);
+                ip_vs_sync_conn(net, cp, pkts);
         }
 }
 
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index bf66a8657a5f..258a0b0e82a2 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -130,7 +130,6 @@ static struct rtable *do_output_route4(struct net *net, __be32 daddr,
 
         memset(&fl4, 0, sizeof(fl4));
         fl4.daddr = daddr;
-        fl4.saddr = (rt_mode & IP_VS_RT_MODE_CONNECT) ? *saddr : 0;
         fl4.flowi4_flags = (rt_mode & IP_VS_RT_MODE_KNOWN_NH) ?
                            FLOWI_FLAG_KNOWN_NH : 0;
 
@@ -505,6 +504,13 @@ err_put:
         return -1;
 
 err_unreach:
+        /* The ip6_link_failure function requires the dev field to be set
+         * in order to get the net (further for the sake of fwmark
+         * reflection).
+         */
+        if (!skb->dev)
+                skb->dev = skb_dst(skb)->dev;
+
         dst_link_failure(skb);
         return -1;
 }
@@ -523,10 +529,27 @@ static inline int ip_vs_tunnel_xmit_prepare(struct sk_buff *skb,
         if (ret == NF_ACCEPT) {
                 nf_reset(skb);
                 skb_forward_csum(skb);
+                if (!skb->sk)
+                        skb_sender_cpu_clear(skb);
         }
         return ret;
 }
 
+/* In the event of a remote destination, it's possible that we would have
+ * matches against an old socket (particularly a TIME-WAIT socket). This
+ * causes havoc down the line (ip_local_out et. al. expect regular sockets
+ * and invalid memory accesses will happen) so simply drop the association
+ * in this case.
+*/
+static inline void ip_vs_drop_early_demux_sk(struct sk_buff *skb)
+{
+        /* If dev is set, the packet came from the LOCAL_IN callback and
+         * not from a local TCP socket.
+         */
+        if (skb->dev)
+                skb_orphan(skb);
+}
+
 /* return NF_STOLEN (sent) or NF_ACCEPT if local=1 (not sent) */
 static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,
                                          struct ip_vs_conn *cp, int local)
@@ -538,12 +561,23 @@ static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb,
                 ip_vs_notrack(skb);
         else
                 ip_vs_update_conntrack(skb, cp, 1);
+
+        /* Remove the early_demux association unless it's bound for the
+         * exact same port and address on this host after translation.
+         */
+        if (!local || cp->vport != cp->dport ||
+            !ip_vs_addr_equal(cp->af, &cp->vaddr, &cp->daddr))
+                ip_vs_drop_early_demux_sk(skb);
+
         if (!local) {
                 skb_forward_csum(skb);
+                if (!skb->sk)
+                        skb_sender_cpu_clear(skb);
                 NF_HOOK(pf, NF_INET_LOCAL_OUT, NULL, skb,
                         NULL, skb_dst(skb)->dev, dst_output_sk);
         } else
                 ret = NF_ACCEPT;
+
         return ret;
 }
 
@@ -557,7 +591,10 @@ static inline int ip_vs_send_or_cont(int pf, struct sk_buff *skb,
         if (likely(!(cp->flags & IP_VS_CONN_F_NFCT)))
                 ip_vs_notrack(skb);
         if (!local) {
+                ip_vs_drop_early_demux_sk(skb);
                 skb_forward_csum(skb);
+                if (!skb->sk)
+                        skb_sender_cpu_clear(skb);
                 NF_HOOK(pf, NF_INET_LOCAL_OUT, NULL, skb,
                         NULL, skb_dst(skb)->dev, dst_output_sk);
         } else
@@ -845,6 +882,8 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af,
         struct ipv6hdr *old_ipv6h = NULL;
 #endif
 
+        ip_vs_drop_early_demux_sk(skb);
+
         if (skb_headroom(skb) < max_headroom || skb_cloned(skb)) {
                 new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 13fad8668f83..3c20d02aee73 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -287,6 +287,46 @@ static void nf_ct_del_from_dying_or_unconfirmed_list(struct nf_conn *ct)
         spin_unlock(&pcpu->lock);
 }
 
+/* Released via destroy_conntrack() */
+struct nf_conn *nf_ct_tmpl_alloc(struct net *net, u16 zone, gfp_t flags)
+{
+        struct nf_conn *tmpl;
+
+        tmpl = kzalloc(sizeof(*tmpl), flags);
+        if (tmpl == NULL)
+                return NULL;
+
+        tmpl->status = IPS_TEMPLATE;
+        write_pnet(&tmpl->ct_net, net);
+
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+        if (zone) {
+                struct nf_conntrack_zone *nf_ct_zone;
+
+                nf_ct_zone = nf_ct_ext_add(tmpl, NF_CT_EXT_ZONE, flags);
+                if (!nf_ct_zone)
+                        goto out_free;
+                nf_ct_zone->id = zone;
+        }
+#endif
+        atomic_set(&tmpl->ct_general.use, 0);
+
+        return tmpl;
+#ifdef CONFIG_NF_CONNTRACK_ZONES
+out_free:
+        kfree(tmpl);
+        return NULL;
+#endif
+}
+EXPORT_SYMBOL_GPL(nf_ct_tmpl_alloc);
+
+static void nf_ct_tmpl_free(struct nf_conn *tmpl)
+{
+        nf_ct_ext_destroy(tmpl);
+        nf_ct_ext_free(tmpl);
+        kfree(tmpl);
+}
+
 static void
 destroy_conntrack(struct nf_conntrack *nfct)
 {
@@ -298,6 +338,10 @@ destroy_conntrack(struct nf_conntrack *nfct)
         NF_CT_ASSERT(atomic_read(&nfct->use) == 0);
         NF_CT_ASSERT(!timer_pending(&ct->timeout));
 
+        if (unlikely(nf_ct_is_template(ct))) {
+                nf_ct_tmpl_free(ct);
+                return;
+        }
         rcu_read_lock();
         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
         if (l4proto && l4proto->destroy)
@@ -540,28 +584,6 @@ out:
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
 
-/* deletion from this larval template list happens via nf_ct_put() */
-void nf_conntrack_tmpl_insert(struct net *net, struct nf_conn *tmpl)
-{
-        struct ct_pcpu *pcpu;
-
-        __set_bit(IPS_TEMPLATE_BIT, &tmpl->status);
-        __set_bit(IPS_CONFIRMED_BIT, &tmpl->status);
-        nf_conntrack_get(&tmpl->ct_general);
-
-        /* add this conntrack to the (per cpu) tmpl list */
-        local_bh_disable();
-        tmpl->cpu = smp_processor_id();
-        pcpu = per_cpu_ptr(nf_ct_net(tmpl)->ct.pcpu_lists, tmpl->cpu);
-
-        spin_lock(&pcpu->lock);
-        /* Overload tuple linked list to put us in template list. */
-        hlist_nulls_add_head_rcu(&tmpl->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
-                                 &pcpu->tmpl);
-        spin_unlock_bh(&pcpu->lock);
-}
-EXPORT_SYMBOL_GPL(nf_conntrack_tmpl_insert);
-
 /* Confirm a connection given skb; places it in hash table */
 int
 __nf_conntrack_confirm(struct sk_buff *skb)
@@ -1522,10 +1544,8 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls)
         sz = nr_slots * sizeof(struct hlist_nulls_head);
         hash = (void *)__get_free_pages(GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO,
                                         get_order(sz));
-        if (!hash) {
-                printk(KERN_WARNING "nf_conntrack: falling back to vmalloc.\n");
+        if (!hash)
                 hash = vzalloc(sz);
-        }
 
         if (hash && nulls)
                 for (i = 0; i < nr_slots; i++)
@@ -1751,7 +1771,6 @@ int nf_conntrack_init_net(struct net *net)
                 spin_lock_init(&pcpu->lock);
                 INIT_HLIST_NULLS_HEAD(&pcpu->unconfirmed, UNCONFIRMED_NULLS_VAL);
                 INIT_HLIST_NULLS_HEAD(&pcpu->dying, DYING_NULLS_VAL);
-                INIT_HLIST_NULLS_HEAD(&pcpu->tmpl, TEMPLATE_NULLS_VAL);
         }
 
         net->ct.stat = alloc_percpu(struct ip_conntrack_stat);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 7a17070c5dab..b45a4223cb05 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -219,7 +219,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
                         a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
         }
 
-        return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
+        return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
+               nf_ct_zone(a->master) == nf_ct_zone(b->master);
 }
 
 static inline int expect_matches(const struct nf_conntrack_expect *a,
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index d1c23940a86a..6b8b0abbfab4 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2995,11 +2995,6 @@ ctnetlink_create_expect(struct net *net, u16 zone,
         }
 
         err = nf_ct_expect_related_report(exp, portid, report);
-        if (err < 0)
-                goto err_exp;
-
-        return 0;
-err_exp:
         nf_ct_expect_put(exp);
 err_ct:
         nf_ct_put(ct);
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index 789feeae6c44..d7f168527903 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -349,23 +349,20 @@ static void __net_exit synproxy_proc_exit(struct net *net)
 static int __net_init synproxy_net_init(struct net *net)
 {
         struct synproxy_net *snet = synproxy_pernet(net);
-        struct nf_conntrack_tuple t;
         struct nf_conn *ct;
         int err = -ENOMEM;
 
-        memset(&t, 0, sizeof(t));
-        ct = nf_conntrack_alloc(net, 0, &t, &t, GFP_KERNEL);
-        if (IS_ERR(ct)) {
-                err = PTR_ERR(ct);
+        ct = nf_ct_tmpl_alloc(net, 0, GFP_KERNEL);
+        if (!ct)
                 goto err1;
-        }
 
         if (!nfct_seqadj_ext_add(ct))
                 goto err2;
         if (!nfct_synproxy_ext_add(ct))
                 goto err2;
 
-        nf_conntrack_tmpl_insert(net, ct);
+        __set_bit(IPS_CONFIRMED_BIT, &ct->status);
+        nf_conntrack_get(&ct->ct_general);
         snet->tmpl = ct;
 
         snet->stats = alloc_percpu(struct synproxy_stats);
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 75747aecdebe..43ddeee404e9 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -184,7 +184,6 @@ out:
 static int xt_ct_tg_check(const struct xt_tgchk_param *par,
                           struct xt_ct_target_info_v1 *info)
 {
-        struct nf_conntrack_tuple t;
         struct nf_conn *ct;
         int ret = -EOPNOTSUPP;
 
@@ -202,11 +201,11 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
         if (ret < 0)
                 goto err1;
 
-        memset(&t, 0, sizeof(t));
-        ct = nf_conntrack_alloc(par->net, info->zone, &t, &t, GFP_KERNEL);
-        ret = PTR_ERR(ct);
-        if (IS_ERR(ct))
+        ct = nf_ct_tmpl_alloc(par->net, info->zone, GFP_KERNEL);
+        if (!ct) {
+                ret = -ENOMEM;
                 goto err2;
+        }
 
         ret = 0;
         if ((info->ct_events || info->exp_events) &&
@@ -227,8 +226,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par,
                 if (ret < 0)
                         goto err3;
         }
-
-        nf_conntrack_tmpl_insert(par->net, ct);
+        __set_bit(IPS_CONFIRMED_BIT, &ct->status);
+        nf_conntrack_get(&ct->ct_general);
 out:
         info->ct = ct;
         return 0;
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index f407ebc13481..29d2c31f406c 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -126,6 +126,7 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
                 goto out;
         }
 
+        sysfs_attr_init(&info->timer->attr.attr);
         info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL);
         if (!info->timer->attr.attr.name) {
                 ret = -ENOMEM;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 9a0ae7172f92..67d210477863 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -357,25 +357,52 @@ err1:
         return NULL;
 }
 
+
+static void
+__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec,
+                   unsigned int order)
+{
+        struct netlink_sock *nlk = nlk_sk(sk);
+        struct sk_buff_head *queue;
+        struct netlink_ring *ring;
+
+        queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
+        ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
+
+        spin_lock_bh(&queue->lock);
+
+        ring->frame_max         = req->nm_frame_nr - 1;
+        ring->head              = 0;
+        ring->frame_size        = req->nm_frame_size;
+        ring->pg_vec_pages      = req->nm_block_size / PAGE_SIZE;
+
+        swap(ring->pg_vec_len, req->nm_block_nr);
+        swap(ring->pg_vec_order, order);
+        swap(ring->pg_vec, pg_vec);
+
+        __skb_queue_purge(queue);
+        spin_unlock_bh(&queue->lock);
+
+        WARN_ON(atomic_read(&nlk->mapped));
+
+        if (pg_vec)
+                free_pg_vec(pg_vec, order, req->nm_block_nr);
+}
+
 static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
-                            bool closing, bool tx_ring)
+                            bool tx_ring)
 {
         struct netlink_sock *nlk = nlk_sk(sk);
         struct netlink_ring *ring;
-        struct sk_buff_head *queue;
         void **pg_vec = NULL;
         unsigned int order = 0;
-        int err;
 
         ring  = tx_ring ? &nlk->tx_ring : &nlk->rx_ring;
-        queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
 
-        if (!closing) {
-                if (atomic_read(&nlk->mapped))
-                        return -EBUSY;
-                if (atomic_read(&ring->pending))
-                        return -EBUSY;
-        }
+        if (atomic_read(&nlk->mapped))
+                return -EBUSY;
+        if (atomic_read(&ring->pending))
+                return -EBUSY;
 
         if (req->nm_block_nr) {
                 if (ring->pg_vec != NULL)
@@ -407,31 +434,19 @@ static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req,
                         return -EINVAL;
         }
 
-        err = -EBUSY;
         mutex_lock(&nlk->pg_vec_lock);
-        if (closing || atomic_read(&nlk->mapped) == 0) {
-                err = 0;
-                spin_lock_bh(&queue->lock);
-
-                ring->frame_max         = req->nm_frame_nr - 1;
-                ring->head              = 0;
-                ring->frame_size        = req->nm_frame_size;
-                ring->pg_vec_pages      = req->nm_block_size / PAGE_SIZE;
-
-                swap(ring->pg_vec_len, req->nm_block_nr);
-                swap(ring->pg_vec_order, order);
-                swap(ring->pg_vec, pg_vec);
-
-                __skb_queue_purge(queue);
-                spin_unlock_bh(&queue->lock);
-
-                WARN_ON(atomic_read(&nlk->mapped));
+        if (atomic_read(&nlk->mapped) == 0) {
+                __netlink_set_ring(sk, req, tx_ring, pg_vec, order);
+                mutex_unlock(&nlk->pg_vec_lock);
+                return 0;
         }
+
         mutex_unlock(&nlk->pg_vec_lock);
 
         if (pg_vec)
                 free_pg_vec(pg_vec, order, req->nm_block_nr);
-        return err;
+
+        return -EBUSY;
 }
 
 static void netlink_mm_open(struct vm_area_struct *vma)
@@ -900,10 +915,10 @@ static void netlink_sock_destruct(struct sock *sk)
 
                 memset(&req, 0, sizeof(req));
                 if (nlk->rx_ring.pg_vec)
-                        netlink_set_ring(sk, &req, true, false);
+                        __netlink_set_ring(sk, &req, false, NULL, 0);
                 memset(&req, 0, sizeof(req));
                 if (nlk->tx_ring.pg_vec)
-                        netlink_set_ring(sk, &req, true, true);
+                        __netlink_set_ring(sk, &req, true, NULL, 0);
         }
 #endif /* CONFIG_NETLINK_MMAP */
 
@@ -1081,6 +1096,11 @@ static int netlink_insert(struct sock *sk, u32 portid)
 
         err = __netlink_insert(table, sk);
         if (err) {
+                /* In case the hashtable backend returns with -EBUSY
+                 * from here, it must not escape to the caller.
+                 */
+                if (unlikely(err == -EBUSY))
+                        err = -EOVERFLOW;
                 if (err == -EEXIST)
                         err = -EADDRINUSE;
                 nlk_sk(sk)->portid = 0;
@@ -2223,7 +2243,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
                         return -EINVAL;
                 if (copy_from_user(&req, optval, sizeof(req)))
                         return -EFAULT;
-                err = netlink_set_ring(sk, &req, false,
+                err = netlink_set_ring(sk, &req,
                                        optname == NETLINK_TX_RING);
                 break;
         }
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 8a8c0b8b4f63..ee34f474ad14 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -273,28 +273,36 @@ static int set_eth_addr(struct sk_buff *skb, struct sw_flow_key *flow_key,
         return 0;
 }
 
-static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh,
-                        __be32 *addr, __be32 new_addr)
+static void update_ip_l4_checksum(struct sk_buff *skb, struct iphdr *nh,
+                                  __be32 addr, __be32 new_addr)
 {
         int transport_len = skb->len - skb_transport_offset(skb);
 
+        if (nh->frag_off & htons(IP_OFFSET))
+                return;
+
         if (nh->protocol == IPPROTO_TCP) {
                 if (likely(transport_len >= sizeof(struct tcphdr)))
                         inet_proto_csum_replace4(&tcp_hdr(skb)->check, skb,
-                                                 *addr, new_addr, 1);
+                                                 addr, new_addr, 1);
         } else if (nh->protocol == IPPROTO_UDP) {
                 if (likely(transport_len >= sizeof(struct udphdr))) {
                         struct udphdr *uh = udp_hdr(skb);
 
                         if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) {
                                 inet_proto_csum_replace4(&uh->check, skb,
-                                                         *addr, new_addr, 1);
+                                                         addr, new_addr, 1);
                                 if (!uh->check)
                                         uh->check = CSUM_MANGLED_0;
                         }
                 }
         }
+}
 
+static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh,
+                        __be32 *addr, __be32 new_addr)
+{
+        update_ip_l4_checksum(skb, nh, *addr, new_addr);
         csum_replace4(&nh->check, *addr, new_addr);
         skb_clear_hash(skb);
         *addr = new_addr;
diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
index 4613df8c8290..65523948fb95 100644
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -752,7 +752,7 @@ int ovs_flow_init(void)
         BUILD_BUG_ON(sizeof(struct sw_flow_key) % sizeof(long));
 
         flow_cache = kmem_cache_create("sw_flow", sizeof(struct sw_flow)
-                                       + (num_possible_nodes()
+                                       + (nr_node_ids
                                           * sizeof(struct flow_stats *)),
                                        0, 0, NULL);
         if (flow_cache == NULL)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c9e8741226c6..ed458b315ef4 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2403,7 +2403,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                 }
                 tp_len = tpacket_fill_skb(po, skb, ph, dev, size_max, proto,
                                           addr, hlen);
-                if (tp_len > dev->mtu + dev->hard_header_len) {
+                if (likely(tp_len >= 0) &&
+                    tp_len > dev->mtu + dev->hard_header_len) {
                         struct ethhdr *ehdr;
                         /* Earlier code assumed this would be a VLAN pkt,
                          * double-check this now that we have the actual
@@ -2784,7 +2785,7 @@ static int packet_release(struct socket *sock)
 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto)
 {
         struct packet_sock *po = pkt_sk(sk);
-        const struct net_device *dev_curr;
+        struct net_device *dev_curr;
         __be16 proto_curr;
         bool need_rehook;
 
@@ -2808,15 +2809,13 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto)
 
                 po->num = proto;
                 po->prot_hook.type = proto;
-
-                if (po->prot_hook.dev)
-                        dev_put(po->prot_hook.dev);
-
                 po->prot_hook.dev = dev;
 
                 po->ifindex = dev ? dev->ifindex : 0;
                 packet_cached_dev_assign(po, dev);
         }
+        if (dev_curr)
+                dev_put(dev_curr);
 
         if (proto == 0 || !need_rehook)
                 goto out_unlock;
diff --git a/net/rds/info.c b/net/rds/info.c
index 9a6b4f66187c..140a44a5f7b7 100644
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
 
         /* check for all kinds of wrapping and the like */
         start = (unsigned long)optval;
-        if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
+        if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
                 ret = -EINVAL;
                 goto out;
         }
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index af427a3dbcba..43ec92680ae8 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -45,7 +45,7 @@ void tcf_hash_destroy(struct tc_action *a)
 }
 EXPORT_SYMBOL(tcf_hash_destroy);
 
-int tcf_hash_release(struct tc_action *a, int bind)
+int __tcf_hash_release(struct tc_action *a, bool bind, bool strict)
 {
         struct tcf_common *p = a->priv;
         int ret = 0;
@@ -53,7 +53,7 @@ int tcf_hash_release(struct tc_action *a, int bind)
         if (p) {
                 if (bind)
                         p->tcfc_bindcnt--;
-                else if (p->tcfc_bindcnt > 0)
+                else if (strict && p->tcfc_bindcnt > 0)
                         return -EPERM;
 
                 p->tcfc_refcnt--;
@@ -64,9 +64,10 @@ int tcf_hash_release(struct tc_action *a, int bind)
                         ret = 1;
                 }
         }
+
         return ret;
 }
-EXPORT_SYMBOL(tcf_hash_release);
+EXPORT_SYMBOL(__tcf_hash_release);
 
 static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb,
                            struct tc_action *a)
@@ -136,7 +137,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a)
                 head = &hinfo->htab[tcf_hash(i, hinfo->hmask)];
                 hlist_for_each_entry_safe(p, n, head, tcfc_head) {
                         a->priv = p;
-                        ret = tcf_hash_release(a, 0);
+                        ret = __tcf_hash_release(a, false, true);
                         if (ret == ACT_P_DELETED) {
                                 module_put(a->ops->owner);
                                 n_i++;
@@ -408,7 +409,7 @@ int tcf_action_destroy(struct list_head *actions, int bind)
         int ret = 0;
 
         list_for_each_entry_safe(a, tmp, actions, list) {
-                ret = tcf_hash_release(a, bind);
+                ret = __tcf_hash_release(a, bind, true);
                 if (ret == ACT_P_DELETED)
                         module_put(a->ops->owner);
                 else if (ret < 0)
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 1d56903fd4c7..d0edeb7a1950 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -27,9 +27,10 @@
 struct tcf_bpf_cfg {
         struct bpf_prog *filter;
         struct sock_filter *bpf_ops;
-        char *bpf_name;
+        const char *bpf_name;
         u32 bpf_fd;
         u16 bpf_num_ops;
+        bool is_ebpf;
 };
 
 static int tcf_bpf(struct sk_buff *skb, const struct tc_action *act,
@@ -207,6 +208,7 @@ static int tcf_bpf_init_from_ops(struct nlattr **tb, struct tcf_bpf_cfg *cfg)
         cfg->bpf_ops = bpf_ops;
         cfg->bpf_num_ops = bpf_num_ops;
         cfg->filter = fp;
+        cfg->is_ebpf = false;
 
         return 0;
 }
@@ -241,18 +243,40 @@ static int tcf_bpf_init_from_efd(struct nlattr **tb, struct tcf_bpf_cfg *cfg)
         cfg->bpf_fd = bpf_fd;
         cfg->bpf_name = name;
         cfg->filter = fp;
+        cfg->is_ebpf = true;
 
         return 0;
 }
 
+static void tcf_bpf_cfg_cleanup(const struct tcf_bpf_cfg *cfg)
+{
+        if (cfg->is_ebpf)
+                bpf_prog_put(cfg->filter);
+        else
+                bpf_prog_destroy(cfg->filter);
+
+        kfree(cfg->bpf_ops);
+        kfree(cfg->bpf_name);
+}
+
+static void tcf_bpf_prog_fill_cfg(const struct tcf_bpf *prog,
+                                  struct tcf_bpf_cfg *cfg)
+{
+        cfg->is_ebpf = tcf_bpf_is_ebpf(prog);
+        cfg->filter = prog->filter;
+
+        cfg->bpf_ops = prog->bpf_ops;
+        cfg->bpf_name = prog->bpf_name;
+}
+
 static int tcf_bpf_init(struct net *net, struct nlattr *nla,
                         struct nlattr *est, struct tc_action *act,
                         int replace, int bind)
 {
         struct nlattr *tb[TCA_ACT_BPF_MAX + 1];
+        struct tcf_bpf_cfg cfg, old;
         struct tc_act_bpf *parm;
         struct tcf_bpf *prog;
-        struct tcf_bpf_cfg cfg;
         bool is_bpf, is_ebpf;
         int ret;
 
@@ -301,6 +325,9 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
         prog = to_bpf(act);
         spin_lock_bh(&prog->tcf_lock);
 
+        if (ret != ACT_P_CREATED)
+                tcf_bpf_prog_fill_cfg(prog, &old);
+
         prog->bpf_ops = cfg.bpf_ops;
         prog->bpf_name = cfg.bpf_name;
 
@@ -316,29 +343,22 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
 
         if (ret == ACT_P_CREATED)
                 tcf_hash_insert(act);
+        else
+                tcf_bpf_cfg_cleanup(&old);
 
         return ret;
 
 destroy_fp:
-        if (is_ebpf)
-                bpf_prog_put(cfg.filter);
-        else
-                bpf_prog_destroy(cfg.filter);
-
-        kfree(cfg.bpf_ops);
-        kfree(cfg.bpf_name);
-
+        tcf_bpf_cfg_cleanup(&cfg);
         return ret;
 }
 
 static void tcf_bpf_cleanup(struct tc_action *act, int bind)
 {
-        const struct tcf_bpf *prog = act->priv;
+        struct tcf_bpf_cfg tmp;
 
-        if (tcf_bpf_is_ebpf(prog))
-                bpf_prog_put(prog->filter);
-        else
-                bpf_prog_destroy(prog->filter);
+        tcf_bpf_prog_fill_cfg(act->priv, &tmp);
+        tcf_bpf_cfg_cleanup(&tmp);
 }
 
 static struct tc_action_ops act_bpf_ops __read_mostly = {
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index a42a3b257226..268545050ddb 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -98,6 +98,8 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
                         return ret;
                 ret = ACT_P_CREATED;
         } else {
+                if (bind)
+                        return 0;
                 if (!ovr) {
                         tcf_hash_release(a, bind);
                         return -EEXIST;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 17e6d6669c7f..ff8b466a73f6 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -68,13 +68,12 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
                 }
                 ret = ACT_P_CREATED;
         } else {
-                p = to_pedit(a);
-                tcf_hash_release(a, bind);
                 if (bind)
                         return 0;
+                tcf_hash_release(a, bind);
                 if (!ovr)
                         return -EEXIST;
-
+                p = to_pedit(a);
                 if (p->tcfp_nkeys && p->tcfp_nkeys != parm->nkeys) {
                         keys = kmalloc(ksize, GFP_KERNEL);
                         if (keys == NULL)
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index c79ecfd36e0f..e5168f8b9640 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -378,7 +378,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb,
                 goto errout;
 
         if (oldprog) {
-                list_replace_rcu(&prog->link, &oldprog->link);
+                list_replace_rcu(&oldprog->link, &prog->link);
                 tcf_unbind_filter(tp, &oldprog->res);
                 call_rcu(&oldprog->rcu, __cls_bpf_delete_prog);
         } else {
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index 76bc3a20ffdb..bb2a0f529c1f 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -425,6 +425,8 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
         if (!fnew)
                 goto err2;
 
+        tcf_exts_init(&fnew->exts, TCA_FLOW_ACT, TCA_FLOW_POLICE);
+
         fold = (struct flow_filter *)*arg;
         if (fold) {
                 err = -EINVAL;
@@ -486,7 +488,6 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
                 fnew->mask  = ~0U;
                 fnew->tp = tp;
                 get_random_bytes(&fnew->hashrnd, 4);
-                tcf_exts_init(&fnew->exts, TCA_FLOW_ACT, TCA_FLOW_POLICE);
         }
 
         fnew->perturb_timer.function = flow_perturbation;
@@ -526,7 +527,7 @@ static int flow_change(struct net *net, struct sk_buff *in_skb,
         if (*arg == 0)
                 list_add_tail_rcu(&fnew->list, &head->filters);
         else
-                list_replace_rcu(&fnew->list, &fold->list);
+                list_replace_rcu(&fold->list, &fnew->list);
 
         *arg = (unsigned long)fnew;
 
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 9d37ccd95062..2f3d03f99487 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -499,7 +499,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
         *arg = (unsigned long) fnew;
 
         if (fold) {
-                list_replace_rcu(&fnew->list, &fold->list);
+                list_replace_rcu(&fold->list, &fnew->list);
                 tcf_unbind_filter(tp, &fold->res);
                 call_rcu(&fold->rcu, fl_destroy_filter);
         } else {
diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
index 93d5742dc7e0..6a783afe4960 100644
--- a/net/sched/sch_choke.c
+++ b/net/sched/sch_choke.c
@@ -385,6 +385,19 @@ static void choke_reset(struct Qdisc *sch)
 {
         struct choke_sched_data *q = qdisc_priv(sch);
 
+        while (q->head != q->tail) {
+                struct sk_buff *skb = q->tab[q->head];
+
+                q->head = (q->head + 1) & q->tab_mask;
+                if (!skb)
+                        continue;
+                qdisc_qstats_backlog_dec(sch, skb);
+                --sch->q.qlen;
+                qdisc_drop(skb, sch);
+        }
+
+        memset(q->tab, 0, (q->tab_mask + 1) * sizeof(struct sk_buff *));
+        q->head = q->tail = 0;
         red_restart(&q->vars);
 }
 
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index d75993f89fac..a9ba030435a2 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -155,14 +155,23 @@ static unsigned int fq_codel_drop(struct Qdisc *sch)
         skb = dequeue_head(flow);
         len = qdisc_pkt_len(skb);
         q->backlogs[idx] -= len;
-        kfree_skb(skb);
         sch->q.qlen--;
         qdisc_qstats_drop(sch);
         qdisc_qstats_backlog_dec(sch, skb);
+        kfree_skb(skb);
         flow->dropped++;
         return idx;
 }
 
+static unsigned int fq_codel_qdisc_drop(struct Qdisc *sch)
+{
+        unsigned int prev_backlog;
+
+        prev_backlog = sch->qstats.backlog;
+        fq_codel_drop(sch);
+        return prev_backlog - sch->qstats.backlog;
+}
+
 static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct fq_codel_sched_data *q = qdisc_priv(sch);
@@ -279,10 +288,26 @@ begin:
 
 static void fq_codel_reset(struct Qdisc *sch)
 {
-        struct sk_buff *skb;
+        struct fq_codel_sched_data *q = qdisc_priv(sch);
+        int i;
 
-        while ((skb = fq_codel_dequeue(sch)) != NULL)
-                kfree_skb(skb);
+        INIT_LIST_HEAD(&q->new_flows);
+        INIT_LIST_HEAD(&q->old_flows);
+        for (i = 0; i < q->flows_cnt; i++) {
+                struct fq_codel_flow *flow = q->flows + i;
+
+                while (flow->head) {
+                        struct sk_buff *skb = dequeue_head(flow);
+
+                        qdisc_qstats_backlog_dec(sch, skb);
+                        kfree_skb(skb);
+                }
+
+                INIT_LIST_HEAD(&flow->flowchain);
+                codel_vars_init(&flow->cvars);
+        }
+        memset(q->backlogs, 0, q->flows_cnt * sizeof(u32));
+        sch->q.qlen = 0;
 }
 
 static const struct nla_policy fq_codel_policy[TCA_FQ_CODEL_MAX + 1] = {
@@ -604,7 +629,7 @@ static struct Qdisc_ops fq_codel_qdisc_ops __read_mostly = {
         .enqueue        =       fq_codel_enqueue,
         .dequeue        =       fq_codel_dequeue,
         .peek           =       qdisc_peek_dequeued,
-        .drop           =       fq_codel_drop,
+        .drop           =       fq_codel_qdisc_drop,
         .init           =       fq_codel_init,
         .reset          =       fq_codel_reset,
         .destroy        =       fq_codel_destroy,
diff --git a/net/sched/sch_plug.c b/net/sched/sch_plug.c
index 89f8fcf73f18..ade9445a55ab 100644
--- a/net/sched/sch_plug.c
+++ b/net/sched/sch_plug.c
@@ -216,6 +216,7 @@ static struct Qdisc_ops plug_qdisc_ops __read_mostly = {
         .peek        =       qdisc_peek_head,
         .init        =       plug_init,
         .change      =       plug_change,
+        .reset       =       qdisc_reset_queue,
         .owner       =       THIS_MODULE,
 };
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 7d1492663360..52f75a5473e1 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -306,10 +306,10 @@ drop:
                 len = qdisc_pkt_len(skb);
                 slot->backlog -= len;
                 sfq_dec(q, x);
-                kfree_skb(skb);
                 sch->q.qlen--;
                 qdisc_qstats_drop(sch);
                 qdisc_qstats_backlog_dec(sch, skb);
+                kfree_skb(skb);
                 return len;
         }
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 1425ec2bbd5a..17bef01b9aa3 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2200,12 +2200,6 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
         if (copy_from_user(&sctp_sk(sk)->subscribe, optval, optlen))
                 return -EFAULT;
 
-        if (sctp_sk(sk)->subscribe.sctp_data_io_event)
-                pr_warn_ratelimited(DEPRECATED "%s (pid %d) "
-                                    "Requested SCTP_SNDRCVINFO event.\n"
-                                    "Use SCTP_RCVINFO through SCTP_RECVRCVINFO option instead.\n",
-                                    current->comm, task_pid_nr(current));
-
         /* At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
          * if there is no data to be sent or retransmit, the stack will
          * immediately send up this notification.
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 9825ff0f91d6..6255d141133b 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -240,8 +240,8 @@ static struct rpc_rqst *xprt_alloc_bc_request(struct rpc_xprt *xprt, __be32 xid)
                 req = xprt_alloc_bc_req(xprt, GFP_ATOMIC);
                 if (!req)
                         goto not_found;
-                /* Note: this 'free' request adds it to xprt->bc_pa_list */
-                xprt_free_bc_request(req);
+                list_add_tail(&req->rq_bc_pa_list, &xprt->bc_pa_list);
+                xprt->bc_alloc_count++;
         }
         req = list_first_entry(&xprt->bc_pa_list, struct rpc_rqst,
                                 rq_bc_pa_list);
@@ -336,7 +336,7 @@ void xprt_complete_bc_request(struct rpc_rqst *req, uint32_t copied)
 
         spin_lock(&xprt->bc_pa_lock);
         list_del(&req->rq_bc_pa_list);
-        xprt->bc_alloc_count--;
+        xprt_dec_alloc_count(xprt, 1);
         spin_unlock(&xprt->bc_pa_lock);
 
         req->rq_private_buf.len = copied;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index cbc6af923dd1..23608eb0ded2 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1902,6 +1902,7 @@ call_transmit_status(struct rpc_task *task)
 
         switch (task->tk_status) {
         case -EAGAIN:
+        case -ENOBUFS:
                 break;
         default:
                 dprint_status(task);
@@ -1928,7 +1929,6 @@ call_transmit_status(struct rpc_task *task)
         case -ECONNABORTED:
         case -EADDRINUSE:
         case -ENOTCONN:
-        case -ENOBUFS:
         case -EPIPE:
                 rpc_task_force_reencode(task);
         }
@@ -2057,12 +2057,13 @@ call_status(struct rpc_task *task)
         case -ECONNABORTED:
                 rpc_force_rebind(clnt);
         case -EADDRINUSE:
-        case -ENOBUFS:
                 rpc_delay(task, 3*HZ);
         case -EPIPE:
         case -ENOTCONN:
                 task->tk_action = call_bind;
                 break;
+        case -ENOBUFS:
+                rpc_delay(task, HZ>>2);
         case -EAGAIN:
                 task->tk_action = call_transmit;
                 break;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index e193c2b5476b..0030376327b7 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -527,6 +527,10 @@ static int xs_local_send_request(struct rpc_task *task)
                               true, &sent);
         dprintk("RPC:       %s(%u) = %d\n",
                         __func__, xdr->len - req->rq_bytes_sent, status);
+
+        if (status == -EAGAIN && sock_writeable(transport->inet))
+                status = -ENOBUFS;
+
         if (likely(sent > 0) || status == 0) {
                 req->rq_bytes_sent += sent;
                 req->rq_xmit_bytes_sent += sent;
@@ -539,6 +543,7 @@ static int xs_local_send_request(struct rpc_task *task)
 
         switch (status) {
         case -ENOBUFS:
+                break;
         case -EAGAIN:
                 status = xs_nospace(task);
                 break;
@@ -589,6 +594,9 @@ static int xs_udp_send_request(struct rpc_task *task)
         if (status == -EPERM)
                 goto process_status;
 
+        if (status == -EAGAIN && sock_writeable(transport->inet))
+                status = -ENOBUFS;
+
         if (sent > 0 || status == 0) {
                 req->rq_xmit_bytes_sent += sent;
                 if (sent >= req->rq_slen)
@@ -669,9 +677,6 @@ static int xs_tcp_send_request(struct rpc_task *task)
                 dprintk("RPC:       xs_tcp_send_request(%u) = %d\n",
                                 xdr->len - req->rq_bytes_sent, status);
 
-                if (unlikely(sent == 0 && status < 0))
-                        break;
-
                 /* If we've sent the entire packet, immediately
                  * reset the count of bytes sent. */
                 req->rq_bytes_sent += sent;
@@ -681,18 +686,21 @@ static int xs_tcp_send_request(struct rpc_task *task)
                         return 0;
                 }
 
-                if (sent != 0)
-                        continue;
-                status = -EAGAIN;
-                break;
+                if (status < 0)
+                        break;
+                if (sent == 0) {
+                        status = -EAGAIN;
+                        break;
+                }
         }
+        if (status == -EAGAIN && sk_stream_is_writeable(transport->inet))
+                status = -ENOBUFS;
 
         switch (status) {
         case -ENOTSOCK:
                 status = -ENOTCONN;
                 /* Should we call xs_close() here? */
                 break;
-        case -ENOBUFS:
         case -EAGAIN:
                 status = xs_nospace(task);
                 break;
@@ -703,6 +711,7 @@ static int xs_tcp_send_request(struct rpc_task *task)
         case -ECONNREFUSED:
         case -ENOTCONN:
         case -EADDRINUSE:
+        case -ENOBUFS:
         case -EPIPE:
                 clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags);
         }
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 915b328b9ac5..59cabc9bce69 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -797,23 +797,18 @@ static bool cfg80211_ir_permissive_chan(struct wiphy *wiphy,
         return false;
 }
 
-bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
-                             struct cfg80211_chan_def *chandef,
-                             enum nl80211_iftype iftype)
+static bool _cfg80211_reg_can_beacon(struct wiphy *wiphy,
+                                     struct cfg80211_chan_def *chandef,
+                                     enum nl80211_iftype iftype,
+                                     bool check_no_ir)
 {
         bool res;
         u32 prohibited_flags = IEEE80211_CHAN_DISABLED |
                                IEEE80211_CHAN_RADAR;
 
-        trace_cfg80211_reg_can_beacon(wiphy, chandef, iftype);
+        trace_cfg80211_reg_can_beacon(wiphy, chandef, iftype, check_no_ir);
 
-        /*
-         * Under certain conditions suggested by some regulatory bodies a
-         * GO/STA can IR on channels marked with IEEE80211_NO_IR. Set this flag
-         * only if such relaxations are not enabled and the conditions are not
-         * met.
-         */
-        if (!cfg80211_ir_permissive_chan(wiphy, iftype, chandef->chan))
+        if (check_no_ir)
                 prohibited_flags |= IEEE80211_CHAN_NO_IR;
 
         if (cfg80211_chandef_dfs_required(wiphy, chandef, iftype) > 0 &&
@@ -827,8 +822,36 @@ bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
         trace_cfg80211_return_bool(res);
         return res;
 }
+
+bool cfg80211_reg_can_beacon(struct wiphy *wiphy,
+                             struct cfg80211_chan_def *chandef,
+                             enum nl80211_iftype iftype)
+{
+        return _cfg80211_reg_can_beacon(wiphy, chandef, iftype, true);
+}
 EXPORT_SYMBOL(cfg80211_reg_can_beacon);
 
+bool cfg80211_reg_can_beacon_relax(struct wiphy *wiphy,
+                                   struct cfg80211_chan_def *chandef,
+                                   enum nl80211_iftype iftype)
+{
+        bool check_no_ir;
+
+        ASSERT_RTNL();
+
+        /*
+         * Under certain conditions suggested by some regulatory bodies a
+         * GO/STA can IR on channels marked with IEEE80211_NO_IR. Set this flag
+         * only if such relaxations are not enabled and the conditions are not
+         * met.
+         */
+        check_no_ir = !cfg80211_ir_permissive_chan(wiphy, iftype,
+                                                   chandef->chan);
+
+        return _cfg80211_reg_can_beacon(wiphy, chandef, iftype, check_no_ir);
+}
+EXPORT_SYMBOL(cfg80211_reg_can_beacon_relax);
+
 int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
                                  struct cfg80211_chan_def *chandef)
 {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index c264effd00a6..76b41578a838 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2003,7 +2003,8 @@ static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
         switch (iftype) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
-                if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
+                if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
+                                                   iftype)) {
                         result = -EINVAL;
                         break;
                 }
@@ -3403,8 +3404,8 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
         } else if (!nl80211_get_ap_channel(rdev, &params))
                 return -EINVAL;
 
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
-                                     wdev->iftype))
+        if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
+                                           wdev->iftype))
                 return -EINVAL;
 
         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
@@ -6492,8 +6493,8 @@ skip_beacons:
         if (err)
                 return err;
 
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
-                                     wdev->iftype))
+        if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
+                                           wdev->iftype))
                 return -EINVAL;
 
         err = cfg80211_chandef_dfs_required(wdev->wiphy,
@@ -10170,7 +10171,8 @@ static int nl80211_tdls_channel_switch(struct sk_buff *skb,
                 return -EINVAL;
 
         /* we will be active on the TDLS link */
-        if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, wdev->iftype))
+        if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
+                                           wdev->iftype))
                 return -EINVAL;
 
         /* don't allow switching to DFS channels */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index d359e0610198..aa2d75482017 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -544,15 +544,15 @@ static int call_crda(const char *alpha2)
         reg_regdb_query(alpha2);
 
         if (reg_crda_timeouts > REG_MAX_CRDA_TIMEOUTS) {
-                pr_info("Exceeded CRDA call max attempts. Not calling CRDA\n");
+                pr_debug("Exceeded CRDA call max attempts. Not calling CRDA\n");
                 return -EINVAL;
         }
 
         if (!is_world_regdom((char *) alpha2))
-                pr_info("Calling CRDA for country: %c%c\n",
+                pr_debug("Calling CRDA for country: %c%c\n",
                         alpha2[0], alpha2[1]);
         else
-                pr_info("Calling CRDA to update world regulatory domain\n");
+                pr_debug("Calling CRDA to update world regulatory domain\n");
 
         return kobject_uevent_env(&reg_pdev->dev.kobj, KOBJ_CHANGE, env);
 }
@@ -1589,7 +1589,7 @@ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
         case NL80211_IFTYPE_ADHOC:
-                return cfg80211_reg_can_beacon(wiphy, &chandef, iftype);
+                return cfg80211_reg_can_beacon_relax(wiphy, &chandef, iftype);
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_P2P_CLIENT:
                 return cfg80211_chandef_usable(wiphy, &chandef,
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index af3617c9879e..a808279a432a 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -2358,20 +2358,23 @@ TRACE_EVENT(cfg80211_cqm_rssi_notify,
 
 TRACE_EVENT(cfg80211_reg_can_beacon,
         TP_PROTO(struct wiphy *wiphy, struct cfg80211_chan_def *chandef,
-                 enum nl80211_iftype iftype),
-        TP_ARGS(wiphy, chandef, iftype),
+                 enum nl80211_iftype iftype, bool check_no_ir),
+        TP_ARGS(wiphy, chandef, iftype, check_no_ir),
         TP_STRUCT__entry(
                 WIPHY_ENTRY
                 CHAN_DEF_ENTRY
                 __field(enum nl80211_iftype, iftype)
+                __field(bool, check_no_ir)
         ),
         TP_fast_assign(
                 WIPHY_ASSIGN;
                 CHAN_DEF_ASSIGN(chandef);
                 __entry->iftype = iftype;
+                __entry->check_no_ir = check_no_ir;
         ),
-        TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT ", iftype=%d",
-                  WIPHY_PR_ARG, CHAN_DEF_PR_ARG, __entry->iftype)
+        TP_printk(WIPHY_PR_FMT ", " CHAN_DEF_PR_FMT ", iftype=%d check_no_ir=%s",
+                  WIPHY_PR_ARG, CHAN_DEF_PR_ARG, __entry->iftype,
+                  BOOL_TO_STR(__entry->check_no_ir))
 );
 
 TRACE_EVENT(cfg80211_chandef_dfs_required,