Backmerge tag 'v4.12-rc7' into drm-next

Linux 4.12-rc7

Needed at least rc6 for drm-misc-next-fixes, may as well go to rc7

59 files changed, 319 insertions, 248 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 467069b73ce1..9649579b5b9f 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -277,7 +277,8 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
         return 0;
 
 out_free_newdev:
-        free_netdev(new_dev);
+        if (new_dev->reg_state == NETREG_UNINITIALIZED)
+                free_netdev(new_dev);
         return err;
 }
 
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 953b6728bd00..abc5f400fc71 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -813,7 +813,6 @@ static void vlan_dev_free(struct net_device *dev)
 
         free_percpu(vlan->vlan_pcpu_stats);
         vlan->vlan_pcpu_stats = NULL;
-        free_netdev(dev);
 }
 
 void vlan_setup(struct net_device *dev)
@@ -826,7 +825,8 @@ void vlan_setup(struct net_device *dev)
         netif_keep_dst(dev);
 
         dev->netdev_ops         = &vlan_netdev_ops;
-        dev->destructor         = vlan_dev_free;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = vlan_dev_free;
         dev->ethtool_ops        = &vlan_ethtool_ops;
 
         dev->min_mtu            = 0;
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 013e970eff39..000ca2f113ab 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1064,8 +1064,9 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
 
                 skb_new->protocol = eth_type_trans(skb_new, soft_iface);
 
-                soft_iface->stats.rx_packets++;
-                soft_iface->stats.rx_bytes += skb->len + ETH_HLEN + hdr_size;
+                batadv_inc_counter(bat_priv, BATADV_CNT_RX);
+                batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
+                                   skb->len + ETH_HLEN + hdr_size);
 
                 netif_rx(skb_new);
                 batadv_dbg(BATADV_DBG_DAT, bat_priv, "ARP request replied locally\n");
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index e1ebe14ee2a6..ae9f4d37d34f 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -987,7 +987,7 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
                                 batadv_dbg(BATADV_DBG_BLA, bat_priv,
                                            "recv_unicast_packet(): Dropped unicast pkt received from another backbone gw %pM.\n",
                                            orig_addr_gw);
-                                return NET_RX_DROP;
+                                goto free_skb;
                         }
                 }
 
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index b25789abf7b9..10f7edfb176e 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -1034,8 +1034,6 @@ static void batadv_softif_free(struct net_device *dev)
          * netdev and its private data (bat_priv)
          */
         rcu_barrier();
-
-        free_netdev(dev);
 }
 
 /**
@@ -1047,7 +1045,8 @@ static void batadv_softif_init_early(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops = &batadv_netdev_ops;
-        dev->destructor = batadv_softif_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = batadv_softif_free;
         dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_NETNS_LOCAL;
         dev->priv_flags |= IFF_NO_QUEUE;
 
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 608959989f8e..ab3b654b05cc 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -598,7 +598,7 @@ static void netdev_setup(struct net_device *dev)
 
         dev->netdev_ops         = &netdev_ops;
         dev->header_ops         = &header_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 static struct device_type bt_type = {
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 430b53e7d941..f0f3447e8aa4 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -379,7 +379,7 @@ void br_dev_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops = &br_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
         dev->ethtool_ops = &br_ethtool_ops;
         SET_NETDEV_DEVTYPE(dev, &br_type);
         dev->priv_flags = IFF_EBRIDGE | IFF_NO_QUEUE;
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index adcad344c843..21f18ea2fce4 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -754,6 +754,10 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
 
         lock_sock(sk);
 
+        err = -EINVAL;
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                goto out;
+
         err = -EAFNOSUPPORT;
         if (uaddr->sa_family != AF_CAIF)
                 goto out;
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index 59ce1fcc220c..71b6ab240dea 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -81,11 +81,7 @@ static struct cfpkt *cfpkt_create_pfx(u16 len, u16 pfx)
 {
         struct sk_buff *skb;
 
-        if (likely(in_interrupt()))
-                skb = alloc_skb(len + pfx, GFP_ATOMIC);
-        else
-                skb = alloc_skb(len + pfx, GFP_KERNEL);
-
+        skb = alloc_skb(len + pfx, GFP_ATOMIC);
         if (unlikely(skb == NULL))
                 return NULL;
 
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 1816fc9f1ee7..fe3c53efb949 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -392,14 +392,14 @@ static void chnl_net_destructor(struct net_device *dev)
 {
         struct chnl_net *priv = netdev_priv(dev);
         caif_free_client(&priv->chnl);
-        free_netdev(dev);
 }
 
 static void ipcaif_net_setup(struct net_device *dev)
 {
         struct chnl_net *priv;
         dev->netdev_ops = &netdev_ops;
-        dev->destructor = chnl_net_destructor;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = chnl_net_destructor;
         dev->flags |= IFF_NOARP;
         dev->flags |= IFF_POINTOPOINT;
         dev->mtu = GPRS_PDP_MTU;
diff --git a/net/can/af_can.c b/net/can/af_can.c
index b6406fe33c76..88edac0f3e36 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -872,8 +872,7 @@ static int can_notifier(struct notifier_block *nb, unsigned long msg,
 
 static int can_pernet_init(struct net *net)
 {
-        net->can.can_rcvlists_lock =
-                __SPIN_LOCK_UNLOCKED(net->can.can_rcvlists_lock);
+        spin_lock_init(&net->can.can_rcvlists_lock);
         net->can.can_rx_alldev_list =
                 kzalloc(sizeof(struct dev_rcv_lists), GFP_KERNEL);
 
diff --git a/net/core/dev.c b/net/core/dev.c
index fca407b4a6ea..7243421c9783 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1253,8 +1253,9 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
         if (!new_ifalias)
                 return -ENOMEM;
         dev->ifalias = new_ifalias;
+        memcpy(dev->ifalias, alias, len);
+        dev->ifalias[len] = 0;
 
-        strlcpy(dev->ifalias, alias, len+1);
         return len;
 }
 
@@ -4948,6 +4949,19 @@ __sum16 __skb_gro_checksum_complete(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(__skb_gro_checksum_complete);
 
+static void net_rps_send_ipi(struct softnet_data *remsd)
+{
+#ifdef CONFIG_RPS
+        while (remsd) {
+                struct softnet_data *next = remsd->rps_ipi_next;
+
+                if (cpu_online(remsd->cpu))
+                        smp_call_function_single_async(remsd->cpu, &remsd->csd);
+                remsd = next;
+        }
+#endif
+}
+
 /*
  * net_rps_action_and_irq_enable sends any pending IPI's for rps.
  * Note: called with local irq disabled, but exits with local irq enabled.
@@ -4963,14 +4977,7 @@ static void net_rps_action_and_irq_enable(struct softnet_data *sd)
                 local_irq_enable();
 
                 /* Send pending IPI's to kick RPS processing on remote cpus. */
-                while (remsd) {
-                        struct softnet_data *next = remsd->rps_ipi_next;
-
-                        if (cpu_online(remsd->cpu))
-                                smp_call_function_single_async(remsd->cpu,
-                                                           &remsd->csd);
-                        remsd = next;
-                }
+                net_rps_send_ipi(remsd);
         } else
 #endif
                 local_irq_enable();
@@ -5199,8 +5206,6 @@ static void busy_poll_stop(struct napi_struct *napi, void *have_poll_lock)
         if (rc == BUSY_POLL_BUDGET)
                 __napi_schedule(napi);
         local_bh_enable();
-        if (local_softirq_pending())
-                do_softirq();
 }
 
 void napi_busy_loop(unsigned int napi_id,
@@ -7501,6 +7506,8 @@ out:
 err_uninit:
         if (dev->netdev_ops->ndo_uninit)
                 dev->netdev_ops->ndo_uninit(dev);
+        if (dev->priv_destructor)
+                dev->priv_destructor(dev);
         goto out;
 }
 EXPORT_SYMBOL(register_netdevice);
@@ -7708,8 +7715,10 @@ void netdev_run_todo(void)
                 WARN_ON(rcu_access_pointer(dev->ip6_ptr));
                 WARN_ON(dev->dn_ptr);
 
-                if (dev->destructor)
-                        dev->destructor(dev);
+                if (dev->priv_destructor)
+                        dev->priv_destructor(dev);
+                if (dev->needs_free_netdev)
+                        free_netdev(dev);
 
                 /* Report a network device has been unregistered */
                 rtnl_lock();
@@ -8192,7 +8201,7 @@ static int dev_cpu_dead(unsigned int oldcpu)
         struct sk_buff **list_skb;
         struct sk_buff *skb;
         unsigned int cpu;
-        struct softnet_data *sd, *oldsd;
+        struct softnet_data *sd, *oldsd, *remsd = NULL;
 
         local_irq_disable();
         cpu = smp_processor_id();
@@ -8233,6 +8242,13 @@ static int dev_cpu_dead(unsigned int oldcpu)
         raise_softirq_irqoff(NET_TX_SOFTIRQ);
         local_irq_enable();
 
+#ifdef CONFIG_RPS
+        remsd = oldsd->rps_ipi_list;
+        oldsd->rps_ipi_list = NULL;
+#endif
+        /* send out pending IPI's on offline CPU */
+        net_rps_send_ipi(remsd);
+
         /* Process offline CPU's input_pkt_queue */
         while ((skb = __skb_dequeue(&oldsd->process_queue))) {
                 netif_rx_ni(skb);
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index b94b1d293506..27fad31784a8 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -410,6 +410,22 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         if (cmd == SIOCGIFNAME)
                 return dev_ifname(net, (struct ifreq __user *)arg);
 
+        /*
+         * Take care of Wireless Extensions. Unfortunately struct iwreq
+         * isn't a proper subset of struct ifreq (it's 8 byte shorter)
+         * so we need to treat it specially, otherwise applications may
+         * fault if the struct they're passing happens to land at the
+         * end of a mapped page.
+         */
+        if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
+                struct iwreq iwr;
+
+                if (copy_from_user(&iwr, arg, sizeof(iwr)))
+                        return -EFAULT;
+
+                return wext_handle_ioctl(net, &iwr, cmd, arg);
+        }
+
         if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
                 return -EFAULT;
 
@@ -559,9 +575,6 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                                 ret = -EFAULT;
                         return ret;
                 }
-                /* Take care of Wireless Extensions */
-                if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)
-                        return wext_handle_ioctl(net, &ifr, cmd, arg);
                 return -ENOTTY;
         }
 }
diff --git a/net/core/dst.c b/net/core/dst.c
index 6192f11beec9..13ba4a090c41 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -469,6 +469,20 @@ static int dst_dev_event(struct notifier_block *this, unsigned long event,
                 spin_lock_bh(&dst_garbage.lock);
                 dst = dst_garbage.list;
                 dst_garbage.list = NULL;
+                /* The code in dst_ifdown places a hold on the loopback device.
+                 * If the gc entry processing is set to expire after a lengthy
+                 * interval, this hold can cause netdev_wait_allrefs() to hang
+                 * out and wait for a long time -- until the the loopback
+                 * interface is released.  If we're really unlucky, it'll emit
+                 * pr_emerg messages to console too.  Reset the interval here,
+                 * so dst cleanups occur in a more timely fashion.
+                 */
+                if (dst_garbage.timer_inc > DST_GC_INC) {
+                        dst_garbage.timer_inc = DST_GC_INC;
+                        dst_garbage.timer_expires = DST_GC_MIN;
+                        mod_delayed_work(system_wq, &dst_gc_work,
+                                         dst_garbage.timer_expires);
+                }
                 spin_unlock_bh(&dst_garbage.lock);
 
                 if (last)
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index f21c4d3aeae0..3bba291c6c32 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -568,7 +568,7 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct net *net = sock_net(skb->sk);
         struct fib_rule_hdr *frh = nlmsg_data(nlh);
         struct fib_rules_ops *ops = NULL;
-        struct fib_rule *rule, *tmp;
+        struct fib_rule *rule, *r;
         struct nlattr *tb[FRA_MAX+1];
         struct fib_kuid_range range;
         int err = -EINVAL;
@@ -668,16 +668,23 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh,
 
                 /*
                  * Check if this rule is a target to any of them. If so,
+                 * adjust to the next one with the same preference or
                  * disable them. As this operation is eventually very
-                 * expensive, it is only performed if goto rules have
-                 * actually been added.
+                 * expensive, it is only performed if goto rules, except
+                 * current if it is goto rule, have actually been added.
                  */
                 if (ops->nr_goto_rules > 0) {
-                        list_for_each_entry(tmp, &ops->rules_list, list) {
-                                if (rtnl_dereference(tmp->ctarget) == rule) {
-                                        RCU_INIT_POINTER(tmp->ctarget, NULL);
+                        struct fib_rule *n;
+
+                        n = list_next_entry(rule, list);
+                        if (&n->list == &ops->rules_list || n->pref != rule->pref)
+                                n = NULL;
+                        list_for_each_entry(r, &ops->rules_list, list) {
+                                if (rtnl_dereference(r->ctarget) != rule)
+                                        continue;
+                                rcu_assign_pointer(r->ctarget, n);
+                                if (!n)
                                         ops->unresolved_rules++;
-                                }
                         }
                 }
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 9e2c0a7cb325..467a2f4510a7 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -931,6 +931,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
                + nla_total_size(1) /* IFLA_LINKMODE */
                + nla_total_size(4) /* IFLA_CARRIER_CHANGES */
                + nla_total_size(4) /* IFLA_LINK_NETNSID */
+               + nla_total_size(4) /* IFLA_GROUP */
                + nla_total_size(ext_filter_mask
                                 & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
                + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
@@ -1124,6 +1125,8 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
         struct ifla_vf_mac vf_mac;
         struct ifla_vf_info ivi;
 
+        memset(&ivi, 0, sizeof(ivi));
+
         /* Not all SR-IOV capable drivers support the
          * spoofcheck and "RSS query enable" query.  Preset to
          * -1 so the user space tool can detect that the driver
@@ -1132,7 +1135,6 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
         ivi.spoofchk = -1;
         ivi.rss_query_en = -1;
         ivi.trusted = -1;
-        memset(ivi.mac, 0, sizeof(ivi.mac));
         /* The default value for VF link state is "auto"
          * IFLA_VF_LINK_STATE_AUTO which equals zero
          */
@@ -1467,6 +1469,7 @@ static const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_LINK_NETNSID]     = { .type = NLA_S32 },
         [IFLA_PROTO_DOWN]       = { .type = NLA_U8 },
         [IFLA_XDP]              = { .type = NLA_NESTED },
+        [IFLA_GROUP]            = { .type = NLA_U32 },
 };
 
 static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 4b9518a0d248..6f95612b4d32 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -188,12 +188,6 @@ static inline void dnrt_free(struct dn_route *rt)
         call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
 }
 
-static inline void dnrt_drop(struct dn_route *rt)
-{
-        dst_release(&rt->dst);
-        call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
-}
-
 static void dn_dst_check_expire(unsigned long dummy)
 {
         int i;
@@ -248,7 +242,7 @@ static int dn_dst_gc(struct dst_ops *ops)
                         }
                         *rtp = rt->dst.dn_next;
                         rt->dst.dn_next = NULL;
-                        dnrt_drop(rt);
+                        dnrt_free(rt);
                         break;
                 }
                 spin_unlock_bh(&dn_rt_hash_table[i].lock);
@@ -350,7 +344,7 @@ static int dn_insert_route(struct dn_route *rt, unsigned int hash, struct dn_rou
                         dst_use(&rth->dst, now);
                         spin_unlock_bh(&dn_rt_hash_table[hash].lock);
 
-                        dnrt_drop(rt);
+                        dst_free(&rt->dst);
                         *rp = rth;
                         return 0;
                 }
@@ -380,7 +374,7 @@ static void dn_run_flush(unsigned long dummy)
                 for(; rt; rt = next) {
                         next = rcu_dereference_raw(rt->dst.dn_next);
                         RCU_INIT_POINTER(rt->dst.dn_next, NULL);
-                        dst_free((struct dst_entry *)rt);
+                        dnrt_free(rt);
                 }
 
 nothing_to_declare:
@@ -1187,7 +1181,7 @@ make_route:
         if (dev_out->flags & IFF_LOOPBACK)
                 flags |= RTCF_LOCAL;
 
-        rt = dst_alloc(&dn_dst_ops, dev_out, 1, DST_OBSOLETE_NONE, DST_HOST);
+        rt = dst_alloc(&dn_dst_ops, dev_out, 0, DST_OBSOLETE_NONE, DST_HOST);
         if (rt == NULL)
                 goto e_nobufs;
 
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 1ed81ac6dd1a..aa8ffecc46a4 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -102,7 +102,9 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb)
 {
         struct nlmsghdr *nlh = nlmsg_hdr(skb);
 
-        if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
+        if (skb->len < sizeof(*nlh) ||
+            nlh->nlmsg_len < sizeof(*nlh) ||
+            skb->len < nlh->nlmsg_len)
                 return;
 
         if (!netlink_capable(skb, CAP_NET_ADMIN))
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index c73160fb11e7..0a0a392dc2bd 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -378,7 +378,6 @@ static void hsr_dev_destroy(struct net_device *hsr_dev)
         del_timer_sync(&hsr->announce_timer);
 
         synchronize_rcu();
-        free_netdev(hsr_dev);
 }
 
 static const struct net_device_ops hsr_device_ops = {
@@ -404,7 +403,8 @@ void hsr_dev_setup(struct net_device *dev)
         SET_NETDEV_DEVTYPE(dev, &hsr_type);
         dev->priv_flags |= IFF_NO_QUEUE;
 
-        dev->destructor = hsr_dev_destroy;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = hsr_dev_destroy;
 
         dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
                            NETIF_F_GSO_MASK | NETIF_F_HW_CSUM |
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 4ebe2aa3e7d3..04b5450c5a55 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -324,8 +324,7 @@ static int hsr_fill_frame_info(struct hsr_frame_info *frame,
         unsigned long irqflags;
 
         frame->is_supervision = is_supervision_frame(port->hsr, skb);
-        frame->node_src = hsr_get_node(&port->hsr->node_db, skb,
-                                       frame->is_supervision);
+        frame->node_src = hsr_get_node(port, skb, frame->is_supervision);
         if (frame->node_src == NULL)
                 return -1; /* Unknown node and !is_supervision, or no mem */
 
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 7ea925816f79..284a9b820df8 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -158,9 +158,10 @@ struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
 
 /* Get the hsr_node from which 'skb' was sent.
  */
-struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
+struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
                               bool is_sup)
 {
+        struct list_head *node_db = &port->hsr->node_db;
         struct hsr_node *node;
         struct ethhdr *ethhdr;
         u16 seq_out;
@@ -186,7 +187,11 @@ struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
                  */
                 seq_out = hsr_get_skb_sequence_nr(skb) - 1;
         } else {
-                WARN_ONCE(1, "%s: Non-HSR frame\n", __func__);
+                /* this is called also for frames from master port and
+                 * so warn only for non master ports
+                 */
+                if (port->type != HSR_PT_MASTER)
+                        WARN_ONCE(1, "%s: Non-HSR frame\n", __func__);
                 seq_out = HSR_SEQNR_START;
         }
 
diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h
index 438b40f98f5a..4e04f0e868e9 100644
--- a/net/hsr/hsr_framereg.h
+++ b/net/hsr/hsr_framereg.h
@@ -18,7 +18,7 @@ struct hsr_node;
 
 struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
                               u16 seq_out);
-struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
+struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
                               bool is_sup);
 void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr,
                           struct hsr_port *port);
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index d7efbf0dad20..0a866f332290 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -107,7 +107,7 @@ static void lowpan_setup(struct net_device *ldev)
 
         ldev->netdev_ops        = &lowpan_netdev_ops;
         ldev->header_ops        = &lowpan_header_ops;
-        ldev->destructor        = free_netdev;
+        ldev->needs_free_netdev = true;
         ldev->features          |= NETIF_F_NETNS_LOCAL;
 }
 
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 43318b5f5647..9144fa7df2ad 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -657,8 +657,12 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         /* Needed by both icmp_global_allow and icmp_xmit_lock */
         local_bh_disable();
 
-        /* Check global sysctl_icmp_msgs_per_sec ratelimit */
-        if (!icmpv4_global_allow(net, type, code))
+        /* Check global sysctl_icmp_msgs_per_sec ratelimit, unless
+         * incoming dev is loopback.  If outgoing dev change to not be
+         * loopback, then peer ratelimit still work (in icmpv4_xrlim_allow)
+         */
+        if (!(skb_in->dev && (skb_in->dev->flags&IFF_LOOPBACK)) &&
+              !icmpv4_global_allow(net, type, code))
                 goto out_bh_enable;
 
         sk = icmp_xmit_lock(net);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 44fd86de2823..ec9a396fa466 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1112,6 +1112,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
         pmc = kzalloc(sizeof(*pmc), GFP_KERNEL);
         if (!pmc)
                 return;
+        spin_lock_init(&pmc->lock);
         spin_lock_bh(&im->lock);
         pmc->interface = im->interface;
         in_dev_hold(in_dev);
@@ -2071,21 +2072,26 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
 
 static void ip_mc_clear_src(struct ip_mc_list *pmc)
 {
-        struct ip_sf_list *psf, *nextpsf;
+        struct ip_sf_list *psf, *nextpsf, *tomb, *sources;
 
-        for (psf = pmc->tomb; psf; psf = nextpsf) {
+        spin_lock_bh(&pmc->lock);
+        tomb = pmc->tomb;
+        pmc->tomb = NULL;
+        sources = pmc->sources;
+        pmc->sources = NULL;
+        pmc->sfmode = MCAST_EXCLUDE;
+        pmc->sfcount[MCAST_INCLUDE] = 0;
+        pmc->sfcount[MCAST_EXCLUDE] = 1;
+        spin_unlock_bh(&pmc->lock);
+
+        for (psf = tomb; psf; psf = nextpsf) {
                 nextpsf = psf->sf_next;
                 kfree(psf);
         }
-        pmc->tomb = NULL;
-        for (psf = pmc->sources; psf; psf = nextpsf) {
+        for (psf = sources; psf; psf = nextpsf) {
                 nextpsf = psf->sf_next;
                 kfree(psf);
         }
-        pmc->sources = NULL;
-        pmc->sfmode = MCAST_EXCLUDE;
-        pmc->sfcount[MCAST_INCLUDE] = 0;
-        pmc->sfcount[MCAST_EXCLUDE] = 1;
 }
 
 /* Join a multicast group
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index b878ecbc0608..129d1a3616f8 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -446,6 +446,8 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
         return 0;
 
 drop:
+        if (tun_dst)
+                dst_release((struct dst_entry *)tun_dst);
         kfree_skb(skb);
         return 0;
 }
@@ -967,7 +969,6 @@ static void ip_tunnel_dev_free(struct net_device *dev)
         gro_cells_destroy(&tunnel->gro_cells);
         dst_cache_destroy(&tunnel->dst_cache);
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 void ip_tunnel_dellink(struct net_device *dev, struct list_head *head)
@@ -1155,7 +1156,8 @@ int ip_tunnel_init(struct net_device *dev)
         struct iphdr *iph = &tunnel->parms.iph;
         int err;
 
-        dev->destructor = ip_tunnel_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip_tunnel_dev_free;
         dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 551de4d023a8..8ae425cad818 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -101,8 +101,8 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id);
 static void ipmr_free_table(struct mr_table *mrt);
 
 static void ip_mr_forward(struct net *net, struct mr_table *mrt,
-                          struct sk_buff *skb, struct mfc_cache *cache,
-                          int local);
+                          struct net_device *dev, struct sk_buff *skb,
+                          struct mfc_cache *cache, int local);
 static int ipmr_cache_report(struct mr_table *mrt,
                              struct sk_buff *pkt, vifi_t vifi, int assert);
 static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
@@ -501,7 +501,7 @@ static void reg_vif_setup(struct net_device *dev)
         dev->mtu                = ETH_DATA_LEN - sizeof(struct iphdr) - 8;
         dev->flags              = IFF_NOARP;
         dev->netdev_ops         = &reg_vif_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->features           |= NETIF_F_NETNS_LOCAL;
 }
 
@@ -988,7 +988,7 @@ static void ipmr_cache_resolve(struct net *net, struct mr_table *mrt,
 
                         rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
                 } else {
-                        ip_mr_forward(net, mrt, skb, c, 0);
+                        ip_mr_forward(net, mrt, skb->dev, skb, c, 0);
                 }
         }
 }
@@ -1073,7 +1073,7 @@ static int ipmr_cache_report(struct mr_table *mrt,
 
 /* Queue a packet for resolution. It gets locked cache entry! */
 static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi,
-                                 struct sk_buff *skb)
+                                 struct sk_buff *skb, struct net_device *dev)
 {
         const struct iphdr *iph = ip_hdr(skb);
         struct mfc_cache *c;
@@ -1130,6 +1130,10 @@ static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi,
                 kfree_skb(skb);
                 err = -ENOBUFS;
         } else {
+                if (dev) {
+                        skb->dev = dev;
+                        skb->skb_iif = dev->ifindex;
+                }
                 skb_queue_tail(&c->mfc_un.unres.unresolved, skb);
                 err = 0;
         }
@@ -1828,10 +1832,10 @@ static int ipmr_find_vif(struct mr_table *mrt, struct net_device *dev)
 
 /* "local" means that we should preserve one skb (for local delivery) */
 static void ip_mr_forward(struct net *net, struct mr_table *mrt,
-                          struct sk_buff *skb, struct mfc_cache *cache,
-                          int local)
+                          struct net_device *dev, struct sk_buff *skb,
+                          struct mfc_cache *cache, int local)
 {
-        int true_vifi = ipmr_find_vif(mrt, skb->dev);
+        int true_vifi = ipmr_find_vif(mrt, dev);
         int psend = -1;
         int vif, ct;
 
@@ -1853,13 +1857,7 @@ static void ip_mr_forward(struct net *net, struct mr_table *mrt,
         }
 
         /* Wrong interface: drop packet and (maybe) send PIM assert. */
-        if (mrt->vif_table[vif].dev != skb->dev) {
-                struct net_device *mdev;
-
-                mdev = l3mdev_master_dev_rcu(mrt->vif_table[vif].dev);
-                if (mdev == skb->dev)
-                        goto forward;
-
+        if (mrt->vif_table[vif].dev != dev) {
                 if (rt_is_output_route(skb_rtable(skb))) {
                         /* It is our own packet, looped back.
                          * Very complicated situation...
@@ -2053,7 +2051,7 @@ int ip_mr_input(struct sk_buff *skb)
                 read_lock(&mrt_lock);
                 vif = ipmr_find_vif(mrt, dev);
                 if (vif >= 0) {
-                        int err2 = ipmr_cache_unresolved(mrt, vif, skb);
+                        int err2 = ipmr_cache_unresolved(mrt, vif, skb, dev);
                         read_unlock(&mrt_lock);
 
                         return err2;
@@ -2064,7 +2062,7 @@ int ip_mr_input(struct sk_buff *skb)
         }
 
         read_lock(&mrt_lock);
-        ip_mr_forward(net, mrt, skb, cache, local);
+        ip_mr_forward(net, mrt, dev, skb, cache, local);
         read_unlock(&mrt_lock);
 
         if (local)
@@ -2238,7 +2236,7 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
                 iph->saddr = saddr;
                 iph->daddr = daddr;
                 iph->version = 0;
-                err = ipmr_cache_unresolved(mrt, vif, skb2);
+                err = ipmr_cache_unresolved(mrt, vif, skb2, dev);
                 read_unlock(&mrt_lock);
                 rcu_read_unlock();
                 return err;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 6a4fb1e629fb..686c92375e81 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -332,9 +332,9 @@ static void addrconf_mod_rs_timer(struct inet6_dev *idev,
 static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
                                    unsigned long delay)
 {
-        if (!delayed_work_pending(&ifp->dad_work))
-                in6_ifa_hold(ifp);
-        mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
+        in6_ifa_hold(ifp);
+        if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay))
+                in6_ifa_put(ifp);
 }
 
 static int snmp6_alloc_dev(struct inet6_dev *idev)
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index eea23b57c6a5..ec849d88a662 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -32,7 +32,6 @@ struct fib6_rule {
 struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
                                    int flags, pol_lookup_t lookup)
 {
-        struct rt6_info *rt;
         struct fib_lookup_arg arg = {
                 .lookup_ptr = lookup,
                 .flags = FIB_LOOKUP_NOREF,
@@ -44,21 +43,11 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
         fib_rules_lookup(net->ipv6.fib6_rules_ops,
                          flowi6_to_flowi(fl6), flags, &arg);
 
-        rt = arg.result;
+        if (arg.result)
+                return arg.result;
 
-        if (!rt) {
-                dst_hold(&net->ipv6.ip6_null_entry->dst);
-                return &net->ipv6.ip6_null_entry->dst;
-        }
-
-        if (rt->rt6i_flags & RTF_REJECT &&
-            rt->dst.error == -EAGAIN) {
-                ip6_rt_put(rt);
-                rt = net->ipv6.ip6_null_entry;
-                dst_hold(&rt->dst);
-        }
-
-        return &rt->dst;
+        dst_hold(&net->ipv6.ip6_null_entry->dst);
+        return &net->ipv6.ip6_null_entry->dst;
 }
 
 static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
@@ -121,7 +110,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                         flp6->saddr = saddr;
                 }
                 err = rt->dst.error;
-                goto out;
+                if (err != -EAGAIN)
+                        goto out;
         }
 again:
         ip6_rt_put(rt);
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 230b5aac9f03..8d7b113958b1 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -491,7 +491,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
         local_bh_disable();
 
         /* Check global sysctl_icmp_msgs_per_sec ratelimit */
-        if (!icmpv6_global_allow(type))
+        if (!(skb->dev->flags&IFF_LOOPBACK) && !icmpv6_global_allow(type))
                 goto out_bh_enable;
 
         mip6_addr_swap(skb);
diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
index 2fd5ca151dcf..77f7f8c7d93d 100644
--- a/net/ipv6/ila/ila_xlat.c
+++ b/net/ipv6/ila/ila_xlat.c
@@ -62,6 +62,7 @@ static inline u32 ila_locator_hash(struct ila_locator loc)
 {
         u32 *v = (u32 *)loc.v32;
 
+        __ila_hash_secret_init();
         return jhash_2words(v[0], v[1], hashrnd);
 }
 
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index d4bf2c68a545..e6b78ba0e636 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -289,8 +289,7 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
         struct rt6_info *rt;
 
         rt = lookup(net, net->ipv6.fib6_main_tbl, fl6, flags);
-        if (rt->rt6i_flags & RTF_REJECT &&
-            rt->dst.error == -EAGAIN) {
+        if (rt->dst.error == -EAGAIN) {
                 ip6_rt_put(rt);
                 rt = net->ipv6.ip6_null_entry;
                 dst_hold(&rt->dst);
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 0c5b4caa1949..64eea3962733 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -991,13 +991,13 @@ static void ip6gre_dev_free(struct net_device *dev)
 
         dst_cache_destroy(&t->dst_cache);
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 static void ip6gre_tunnel_setup(struct net_device *dev)
 {
         dev->netdev_ops = &ip6gre_netdev_ops;
-        dev->destructor = ip6gre_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip6gre_dev_free;
 
         dev->type = ARPHRD_IP6GRE;
 
@@ -1148,7 +1148,7 @@ static int __net_init ip6gre_init_net(struct net *net)
         return 0;
 
 err_reg_dev:
-        ip6gre_dev_free(ign->fb_tunnel_dev);
+        free_netdev(ign->fb_tunnel_dev);
 err_alloc_dev:
         return err;
 }
@@ -1300,7 +1300,8 @@ static void ip6gre_tap_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops = &ip6gre_tap_netdev_ops;
-        dev->destructor = ip6gre_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip6gre_dev_free;
 
         dev->features |= NETIF_F_NETNS_LOCAL;
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 9b37f9747fc6..8c6c3c8e7eef 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -254,7 +254,6 @@ static void ip6_dev_free(struct net_device *dev)
         gro_cells_destroy(&t->gro_cells);
         dst_cache_destroy(&t->dst_cache);
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 static int ip6_tnl_create2(struct net_device *dev)
@@ -322,7 +321,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
         return t;
 
 failed_free:
-        ip6_dev_free(dev);
+        free_netdev(dev);
 failed:
         return ERR_PTR(err);
 }
@@ -859,6 +858,8 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,
         return 0;
 
 drop:
+        if (tun_dst)
+                dst_release((struct dst_entry *)tun_dst);
         kfree_skb(skb);
         return 0;
 }
@@ -1247,7 +1248,7 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPIP;
                 fl6.daddr = key->u.ipv6.dst;
                 fl6.flowlabel = key->label;
-                dsfield = ip6_tclass(key->label);
+                dsfield =  key->tos;
         } else {
                 if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                         encap_limit = t->parms.encap_limit;
@@ -1318,7 +1319,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPV6;
                 fl6.daddr = key->u.ipv6.dst;
                 fl6.flowlabel = key->label;
-                dsfield = ip6_tclass(key->label);
+                dsfield = key->tos;
         } else {
                 offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
                 /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
@@ -1777,7 +1778,8 @@ static const struct net_device_ops ip6_tnl_netdev_ops = {
 static void ip6_tnl_dev_setup(struct net_device *dev)
 {
         dev->netdev_ops = &ip6_tnl_netdev_ops;
-        dev->destructor = ip6_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip6_dev_free;
 
         dev->type = ARPHRD_TUNNEL6;
         dev->flags |= IFF_NOARP;
@@ -2224,7 +2226,7 @@ static int __net_init ip6_tnl_init_net(struct net *net)
         return 0;
 
 err_register:
-        ip6_dev_free(ip6n->fb_tnl_dev);
+        free_netdev(ip6n->fb_tnl_dev);
 err_alloc_dev:
         return err;
 }
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index d67ef56454b2..837ea1eefe7f 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -180,7 +180,6 @@ vti6_tnl_unlink(struct vti6_net *ip6n, struct ip6_tnl *t)
 static void vti6_dev_free(struct net_device *dev)
 {
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 static int vti6_tnl_create2(struct net_device *dev)
@@ -235,7 +234,7 @@ static struct ip6_tnl *vti6_tnl_create(struct net *net, struct __ip6_tnl_parm *p
         return t;
 
 failed_free:
-        vti6_dev_free(dev);
+        free_netdev(dev);
 failed:
         return NULL;
 }
@@ -842,7 +841,8 @@ static const struct net_device_ops vti6_netdev_ops = {
 static void vti6_dev_setup(struct net_device *dev)
 {
         dev->netdev_ops = &vti6_netdev_ops;
-        dev->destructor = vti6_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = vti6_dev_free;
 
         dev->type = ARPHRD_TUNNEL6;
         dev->hard_header_len = LL_MAX_HEADER + sizeof(struct ipv6hdr);
@@ -1100,7 +1100,7 @@ static int __net_init vti6_init_net(struct net *net)
         return 0;
 
 err_register:
-        vti6_dev_free(ip6n->fb_tnl_dev);
+        free_netdev(ip6n->fb_tnl_dev);
 err_alloc_dev:
         return err;
 }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 374997d26488..2ecb39b943b5 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -733,7 +733,7 @@ static void reg_vif_setup(struct net_device *dev)
         dev->mtu                = 1500 - sizeof(struct ipv6hdr) - 8;
         dev->flags              = IFF_NOARP;
         dev->netdev_ops         = &reg_vif_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->features           |= NETIF_F_NETNS_LOCAL;
 }
 
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index cc8e3ae9ca73..e88bcb8ff0fd 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -219,7 +219,7 @@ static void snmp6_seq_show_item64(struct seq_file *seq, void __percpu *mib,
         u64 buff64[SNMP_MIB_MAX];
         int i;
 
-        memset(buff64, 0, sizeof(unsigned long) * SNMP_MIB_MAX);
+        memset(buff64, 0, sizeof(u64) * SNMP_MIB_MAX);
 
         snmp_get_cpu_field64_batch(buff64, itemlist, mib, syncpoff);
         for (i = 0; itemlist[i].name; i++)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index dc61b0b5e64e..7cebd954d5bb 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2804,6 +2804,7 @@ static int fib6_ifdown(struct rt6_info *rt, void *arg)
         if ((rt->dst.dev == dev || !dev) &&
             rt != adn->net->ipv6.ip6_null_entry &&
             (rt->rt6i_nsiblings == 0 ||
+             (dev && netdev_unregistering(dev)) ||
              !rt->rt6i_idev->cnf.ignore_routes_with_linkdown))
                 return -1;
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 61e5902f0687..2378503577b0 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -265,7 +265,7 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
         return nt;
 
 failed_free:
-        ipip6_dev_free(dev);
+        free_netdev(dev);
 failed:
         return NULL;
 }
@@ -1336,7 +1336,6 @@ static void ipip6_dev_free(struct net_device *dev)
 
         dst_cache_destroy(&tunnel->dst_cache);
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 #define SIT_FEATURES (NETIF_F_SG           | \
@@ -1351,7 +1350,8 @@ static void ipip6_tunnel_setup(struct net_device *dev)
         int t_hlen = tunnel->hlen + sizeof(struct iphdr);
 
         dev->netdev_ops         = &ipip6_netdev_ops;
-        dev->destructor         = ipip6_dev_free;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = ipip6_dev_free;
 
         dev->type               = ARPHRD_SIT;
         dev->hard_header_len    = LL_MAX_HEADER + t_hlen;
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 74d09f91709e..3be852808a9d 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -65,7 +65,7 @@ static void irlan_eth_setup(struct net_device *dev)
         ether_setup(dev);
 
         dev->netdev_ops         = &irlan_eth_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
         dev->min_mtu            = 0;
         dev->max_mtu            = ETH_MAX_MTU;
 
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 8b21af7321b9..4de2ec94b08c 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -114,12 +114,13 @@ static void l2tp_eth_get_stats64(struct net_device *dev,
 {
         struct l2tp_eth *priv = netdev_priv(dev);
 
-        stats->tx_bytes   = atomic_long_read(&priv->tx_bytes);
-        stats->tx_packets = atomic_long_read(&priv->tx_packets);
-        stats->tx_dropped = atomic_long_read(&priv->tx_dropped);
-        stats->rx_bytes   = atomic_long_read(&priv->rx_bytes);
-        stats->rx_packets = atomic_long_read(&priv->rx_packets);
-        stats->rx_errors  = atomic_long_read(&priv->rx_errors);
+        stats->tx_bytes   = (unsigned long) atomic_long_read(&priv->tx_bytes);
+        stats->tx_packets = (unsigned long) atomic_long_read(&priv->tx_packets);
+        stats->tx_dropped = (unsigned long) atomic_long_read(&priv->tx_dropped);
+        stats->rx_bytes   = (unsigned long) atomic_long_read(&priv->rx_bytes);
+        stats->rx_packets = (unsigned long) atomic_long_read(&priv->rx_packets);
+        stats->rx_errors  = (unsigned long) atomic_long_read(&priv->rx_errors);
+
 }
 
 static const struct net_device_ops l2tp_eth_netdev_ops = {
@@ -141,7 +142,7 @@ static void l2tp_eth_dev_setup(struct net_device *dev)
         dev->priv_flags         &= ~IFF_TX_SKB_SHARING;
         dev->features           |= NETIF_F_LLTX;
         dev->netdev_ops         = &l2tp_eth_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 6c2e6060cd54..4a388fe8c2d1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -902,6 +902,8 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
         default:
                 return -EINVAL;
         }
+        sdata->u.ap.req_smps = sdata->smps_mode;
+
         sdata->needed_rx_chains = sdata->local->rx_chains;
 
         sdata->vif.bss_conf.beacon_int = params->beacon_interval;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 665501ac358f..5e002f62c235 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1531,7 +1531,7 @@ ieee80211_have_rx_timestamp(struct ieee80211_rx_status *status)
                 return true;
         /* can't handle non-legacy preamble yet */
         if (status->flag & RX_FLAG_MACTIME_PLCP_START &&
-            status->encoding != RX_ENC_LEGACY)
+            status->encoding == RX_ENC_LEGACY)
                 return true;
         return false;
 }
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 8fae1a72e6a7..f5f50150ba1c 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1213,7 +1213,6 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
 static void ieee80211_if_free(struct net_device *dev)
 {
         free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 
 static void ieee80211_if_setup(struct net_device *dev)
@@ -1221,7 +1220,8 @@ static void ieee80211_if_setup(struct net_device *dev)
         ether_setup(dev);
         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->netdev_ops = &ieee80211_dataif_ops;
-        dev->destructor = ieee80211_if_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ieee80211_if_free;
 }
 
 static void ieee80211_if_setup_no_queue(struct net_device *dev)
@@ -1816,6 +1816,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                 ret = dev_alloc_name(ndev, ndev->name);
                 if (ret < 0) {
                         ieee80211_if_free(ndev);
+                        free_netdev(ndev);
                         return ret;
                 }
 
@@ -1905,7 +1906,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
                 ret = register_netdevice(ndev);
                 if (ret) {
-                        ieee80211_if_free(ndev);
+                        free_netdev(ndev);
                         return ret;
                 }
         }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0ea9712bd99e..cc8e6ea1b27e 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -601,7 +601,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_supported_band *sband;
         struct ieee80211_chanctx_conf *chanctx_conf;
         struct ieee80211_channel *chan;
-        u32 rate_flags, rates = 0;
+        u32 rates = 0;
 
         sdata_assert_lock(sdata);
 
@@ -612,7 +612,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 return;
         }
         chan = chanctx_conf->def.chan;
-        rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
         rcu_read_unlock();
         sband = local->hw.wiphy->bands[chan->band];
         shift = ieee80211_vif_get_shift(&sdata->vif);
@@ -636,9 +635,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                  */
                 rates_len = 0;
                 for (i = 0; i < sband->n_bitrates; i++) {
-                        if ((rate_flags & sband->bitrates[i].flags)
-                            != rate_flags)
-                                continue;
                         rates |= BIT(i);
                         rates_len++;
                 }
@@ -2818,7 +2814,7 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
                                 u32 *rates, u32 *basic_rates,
                                 bool *have_higher_than_11mbit,
                                 int *min_rate, int *min_rate_index,
-                                int shift, u32 rate_flags)
+                                int shift)
 {
         int i, j;
 
@@ -2846,8 +2842,6 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
                         int brate;
 
                         br = &sband->bitrates[j];
-                        if ((rate_flags & br->flags) != rate_flags)
-                                continue;
 
                         brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
                         if (brate == rate) {
@@ -4398,40 +4392,32 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                         return -ENOMEM;
         }
 
-        if (new_sta || override) {
-                err = ieee80211_prep_channel(sdata, cbss);
-                if (err) {
-                        if (new_sta)
-                                sta_info_free(local, new_sta);
-                        return -EINVAL;
-                }
-        }
-
+        /*
+         * Set up the information for the new channel before setting the
+         * new channel. We can't - completely race-free - change the basic
+         * rates bitmap and the channel (sband) that it refers to, but if
+         * we set it up before we at least avoid calling into the driver's
+         * bss_info_changed() method with invalid information (since we do
+         * call that from changing the channel - only for IDLE and perhaps
+         * some others, but ...).
+         *
+         * So to avoid that, just set up all the new information before the
+         * channel, but tell the driver to apply it only afterwards, since
+         * it might need the new channel for that.
+         */
         if (new_sta) {
                 u32 rates = 0, basic_rates = 0;
                 bool have_higher_than_11mbit;
                 int min_rate = INT_MAX, min_rate_index = -1;
-                struct ieee80211_chanctx_conf *chanctx_conf;
                 const struct cfg80211_bss_ies *ies;
                 int shift = ieee80211_vif_get_shift(&sdata->vif);
-                u32 rate_flags;
-
-                rcu_read_lock();
-                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-                if (WARN_ON(!chanctx_conf)) {
-                        rcu_read_unlock();
-                        sta_info_free(local, new_sta);
-                        return -EINVAL;
-                }
-                rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
-                rcu_read_unlock();
 
                 ieee80211_get_rates(sband, bss->supp_rates,
                                     bss->supp_rates_len,
                                     &rates, &basic_rates,
                                     &have_higher_than_11mbit,
                                     &min_rate, &min_rate_index,
-                                    shift, rate_flags);
+                                    shift);
 
                 /*
                  * This used to be a workaround for basic rates missing
@@ -4489,8 +4475,22 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                         sdata->vif.bss_conf.sync_dtim_count = 0;
                 }
                 rcu_read_unlock();
+        }
 
-                /* tell driver about BSSID, basic rates and timing */
+        if (new_sta || override) {
+                err = ieee80211_prep_channel(sdata, cbss);
+                if (err) {
+                        if (new_sta)
+                                sta_info_free(local, new_sta);
+                        return -EINVAL;
+                }
+        }
+
+        if (new_sta) {
+                /*
+                 * tell driver about BSSID, basic rates and timing
+                 * this was set up above, before setting the channel
+                 */
                 ieee80211_bss_info_change_notify(sdata,
                         BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
                         BSS_CHANGED_BEACON_INT);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 1f75280ba26c..3674fe3d67dc 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1613,12 +1613,16 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
          */
         if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
             !ieee80211_has_morefrags(hdr->frame_control) &&
+            !ieee80211_is_back_req(hdr->frame_control) &&
             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
-            /* PM bit is only checked in frames where it isn't reserved,
+            /*
+             * PM bit is only checked in frames where it isn't reserved,
              * in AP mode it's reserved in non-bufferable management frames
              * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
+             * BAR frames should be ignored as specified in
+             * IEEE 802.11-2012 10.2.1.2.
              */
             (!ieee80211_is_mgmt(hdr->frame_control) ||
              ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index c1ef22df865f..cc19614ff4e6 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -17,6 +17,7 @@
 #include <asm/unaligned.h>
 #include <net/mac80211.h>
 #include <crypto/aes.h>
+#include <crypto/algapi.h>
 
 #include "ieee80211_i.h"
 #include "michael.h"
@@ -153,7 +154,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
         data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
         key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
         michael_mic(key, hdr, data, data_len, mic);
-        if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0)
+        if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
                 goto mic_fail;
 
         /* remove Michael MIC from payload */
@@ -1048,7 +1049,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
                 bip_aad(skb, aad);
                 ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
                                    skb->data + 24, skb->len - 24, mic);
-                if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                         key->u.aes_cmac.icverrors++;
                         return RX_DROP_UNUSABLE;
                 }
@@ -1098,7 +1099,7 @@ ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)
                 bip_aad(skb, aad);
                 ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
                                        skb->data + 24, skb->len - 24, mic);
-                if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                         key->u.aes_cmac.icverrors++;
                         return RX_DROP_UNUSABLE;
                 }
@@ -1202,7 +1203,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
                 if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
                                        skb->data + 24, skb->len - 24,
                                        mic) < 0 ||
-                    memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                    crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                         key->u.aes_gmac.icverrors++;
                         return RX_DROP_UNUSABLE;
                 }
diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c
index 06019dba4b10..bd88a9b80773 100644
--- a/net/mac802154/iface.c
+++ b/net/mac802154/iface.c
@@ -526,8 +526,6 @@ static void mac802154_wpan_free(struct net_device *dev)
         struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
 
         mac802154_llsec_destroy(&sdata->sec);
-
-        free_netdev(dev);
 }
 
 static void ieee802154_if_setup(struct net_device *dev)
@@ -593,7 +591,8 @@ ieee802154_setup_sdata(struct ieee802154_sub_if_data *sdata,
                                         sdata->dev->dev_addr);
 
                 sdata->dev->header_ops = &mac802154_header_ops;
-                sdata->dev->destructor = mac802154_wpan_free;
+                sdata->dev->needs_free_netdev = true;
+                sdata->dev->priv_destructor = mac802154_wpan_free;
                 sdata->dev->netdev_ops = &mac802154_wpan_ops;
                 sdata->dev->ml_priv = &mac802154_mlme_wpan;
                 wpan_dev->promiscuous_mode = false;
@@ -608,7 +607,7 @@ ieee802154_setup_sdata(struct ieee802154_sub_if_data *sdata,
 
                 break;
         case NL802154_IFTYPE_MONITOR:
-                sdata->dev->destructor = free_netdev;
+                sdata->dev->needs_free_netdev = true;
                 sdata->dev->netdev_ops = &mac802154_monitor_ops;
                 wpan_dev->promiscuous_mode = true;
                 break;
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 89193a634da4..04a3128adcf0 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -94,7 +94,6 @@ static void internal_dev_destructor(struct net_device *dev)
         struct vport *vport = ovs_internal_dev_get_vport(dev);
 
         ovs_vport_free(vport);
-        free_netdev(dev);
 }
 
 static void
@@ -156,7 +155,8 @@ static void do_setup(struct net_device *netdev)
         netdev->priv_flags &= ~IFF_TX_SKB_SHARING;
         netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_OPENVSWITCH |
                               IFF_PHONY_HEADROOM | IFF_NO_QUEUE;
-        netdev->destructor = internal_dev_destructor;
+        netdev->needs_free_netdev = true;
+        netdev->priv_destructor = internal_dev_destructor;
         netdev->ethtool_ops = &internal_dev_ethtool_ops;
         netdev->rtnl_link_ops = &internal_dev_link_ops;
 
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index 21c28b51be94..2c9337946e30 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -236,7 +236,7 @@ static void gprs_setup(struct net_device *dev)
         dev->tx_queue_len       = 10;
 
         dev->netdev_ops         = &gprs_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 
 /*
diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
index 0a4e28477ad9..54369225766e 100644
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -217,7 +217,7 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
                                        unsigned int *_toklen)
 {
         const __be32 *xdr = *_xdr;
-        unsigned int toklen = *_toklen, n_parts, loop, tmp;
+        unsigned int toklen = *_toklen, n_parts, loop, tmp, paddedlen;
 
         /* there must be at least one name, and at least #names+1 length
          * words */
@@ -247,16 +247,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
                 toklen -= 4;
                 if (tmp <= 0 || tmp > AFSTOKEN_STRING_MAX)
                         return -EINVAL;
-                if (tmp > toklen)
+                paddedlen = (tmp + 3) & ~3;
+                if (paddedlen > toklen)
                         return -EINVAL;
                 princ->name_parts[loop] = kmalloc(tmp + 1, GFP_KERNEL);
                 if (!princ->name_parts[loop])
                         return -ENOMEM;
                 memcpy(princ->name_parts[loop], xdr, tmp);
                 princ->name_parts[loop][tmp] = 0;
-                tmp = (tmp + 3) & ~3;
-                toklen -= tmp;
-                xdr += tmp >> 2;
+                toklen -= paddedlen;
+                xdr += paddedlen >> 2;
         }
 
         if (toklen < 4)
@@ -265,16 +265,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
         toklen -= 4;
         if (tmp <= 0 || tmp > AFSTOKEN_K5_REALM_MAX)
                 return -EINVAL;
-        if (tmp > toklen)
+        paddedlen = (tmp + 3) & ~3;
+        if (paddedlen > toklen)
                 return -EINVAL;
         princ->realm = kmalloc(tmp + 1, GFP_KERNEL);
         if (!princ->realm)
                 return -ENOMEM;
         memcpy(princ->realm, xdr, tmp);
         princ->realm[tmp] = 0;
-        tmp = (tmp + 3) & ~3;
-        toklen -= tmp;
-        xdr += tmp >> 2;
+        toklen -= paddedlen;
+        xdr += paddedlen >> 2;
 
         _debug("%s/...@%s", princ->name_parts[0], princ->realm);
 
@@ -293,7 +293,7 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td,
                                          unsigned int *_toklen)
 {
         const __be32 *xdr = *_xdr;
-        unsigned int toklen = *_toklen, len;
+        unsigned int toklen = *_toklen, len, paddedlen;
 
         /* there must be at least one tag and one length word */
         if (toklen <= 8)
@@ -307,15 +307,17 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td,
         toklen -= 8;
         if (len > max_data_size)
                 return -EINVAL;
+        paddedlen = (len + 3) & ~3;
+        if (paddedlen > toklen)
+                return -EINVAL;
         td->data_len = len;
 
         if (len > 0) {
                 td->data = kmemdup(xdr, len, GFP_KERNEL);
                 if (!td->data)
                         return -ENOMEM;
-                len = (len + 3) & ~3;
-                toklen -= len;
-                xdr += len >> 2;
+                toklen -= paddedlen;
+                xdr += paddedlen >> 2;
         }
 
         _debug("tag %x len %x", td->tag, td->data_len);
@@ -387,7 +389,7 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
                                     const __be32 **_xdr, unsigned int *_toklen)
 {
         const __be32 *xdr = *_xdr;
-        unsigned int toklen = *_toklen, len;
+        unsigned int toklen = *_toklen, len, paddedlen;
 
         /* there must be at least one length word */
         if (toklen <= 4)
@@ -399,6 +401,9 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
         toklen -= 4;
         if (len > AFSTOKEN_K5_TIX_MAX)
                 return -EINVAL;
+        paddedlen = (len + 3) & ~3;
+        if (paddedlen > toklen)
+                return -EINVAL;
         *_tktlen = len;
 
         _debug("ticket len %u", len);
@@ -407,9 +412,8 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
                 *_ticket = kmemdup(xdr, len, GFP_KERNEL);
                 if (!*_ticket)
                         return -ENOMEM;
-                len = (len + 3) & ~3;
-                toklen -= len;
-                xdr += len >> 2;
+                toklen -= paddedlen;
+                xdr += paddedlen >> 2;
         }
 
         *_xdr = xdr;
@@ -552,7 +556,7 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
 {
         const __be32 *xdr = prep->data, *token;
         const char *cp;
-        unsigned int len, tmp, loop, ntoken, toklen, sec_ix;
+        unsigned int len, paddedlen, loop, ntoken, toklen, sec_ix;
         size_t datalen = prep->datalen;
         int ret;
 
@@ -578,22 +582,21 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
         if (len < 1 || len > AFSTOKEN_CELL_MAX)
                 goto not_xdr;
         datalen -= 4;
-        tmp = (len + 3) & ~3;
-        if (tmp > datalen)
+        paddedlen = (len + 3) & ~3;
+        if (paddedlen > datalen)
                 goto not_xdr;
 
         cp = (const char *) xdr;
         for (loop = 0; loop < len; loop++)
                 if (!isprint(cp[loop]))
                         goto not_xdr;
-        if (len < tmp)
-                for (; loop < tmp; loop++)
-                        if (cp[loop])
-                                goto not_xdr;
+        for (; loop < paddedlen; loop++)
+                if (cp[loop])
+                        goto not_xdr;
         _debug("cellname: [%u/%u] '%*.*s'",
-               len, tmp, len, len, (const char *) xdr);
-        datalen -= tmp;
-        xdr += tmp >> 2;
+               len, paddedlen, len, len, (const char *) xdr);
+        datalen -= paddedlen;
+        xdr += paddedlen >> 2;
 
         /* get the token count */
         if (datalen < 12)
@@ -614,10 +617,11 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
                 sec_ix = ntohl(*xdr);
                 datalen -= 4;
                 _debug("token: [%x/%zx] %x", toklen, datalen, sec_ix);
-                if (toklen < 20 || toklen > datalen)
+                paddedlen = (toklen + 3) & ~3;
+                if (toklen < 20 || toklen > datalen || paddedlen > datalen)
                         goto not_xdr;
-                datalen -= (toklen + 3) & ~3;
-                xdr += (toklen + 3) >> 2;
+                datalen -= paddedlen;
+                xdr += paddedlen >> 2;
 
         } while (--loop > 0);
 
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 164b5ac094be..7dc5892671c8 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -94,8 +94,10 @@ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,
                 k++;
         }
 
-        if (n)
+        if (n) {
+                err = -EINVAL;
                 goto err_out;
+        }
 
         return keys_ex;
 
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index f42008b29311..b062bc80c7cb 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -132,21 +132,21 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla,
                 }
         }
 
-        spin_lock_bh(&police->tcf_lock);
         if (est) {
                 err = gen_replace_estimator(&police->tcf_bstats, NULL,
                                             &police->tcf_rate_est,
                                             &police->tcf_lock,
                                             NULL, est);
                 if (err)
-                        goto failure_unlock;
+                        goto failure;
         } else if (tb[TCA_POLICE_AVRATE] &&
                    (ret == ACT_P_CREATED ||
                     !gen_estimator_active(&police->tcf_rate_est))) {
                 err = -EINVAL;
-                goto failure_unlock;
+                goto failure;
         }
 
+        spin_lock_bh(&police->tcf_lock);
         /* No failure allowed after this point */
         police->tcfp_mtu = parm->mtu;
         if (police->tcfp_mtu == 0) {
@@ -192,8 +192,6 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla,
 
         return ret;
 
-failure_unlock:
-        spin_unlock_bh(&police->tcf_lock);
 failure:
         qdisc_put_rtab(P_tab);
         qdisc_put_rtab(R_tab);
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 8c589230794f..3dcd0ecf3d99 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -275,6 +275,7 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
                 if (sctp_sk(sk)->bind_hash)
                         sctp_put_port(sk);
 
+                sctp_sk(sk)->ep = NULL;
                 sock_put(sk);
         }
 
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index 048954eee984..9a647214a91e 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -278,7 +278,6 @@ out:
 
 static int sctp_sock_dump(struct sock *sk, void *p)
 {
-        struct sctp_endpoint *ep = sctp_sk(sk)->ep;
         struct sctp_comm_param *commp = p;
         struct sk_buff *skb = commp->skb;
         struct netlink_callback *cb = commp->cb;
@@ -287,7 +286,9 @@ static int sctp_sock_dump(struct sock *sk, void *p)
         int err = 0;
 
         lock_sock(sk);
-        list_for_each_entry(assoc, &ep->asocs, asocs) {
+        if (!sctp_sk(sk)->ep)
+                goto release;
+        list_for_each_entry(assoc, &sctp_sk(sk)->ep->asocs, asocs) {
                 if (cb->args[4] < cb->args[1])
                         goto next;
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index f16c8d97b7f3..3a8318e518f1 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4622,13 +4622,13 @@ int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
 
         for (head = sctp_ep_hashtable; hash < sctp_ep_hashsize;
              hash++, head++) {
-                read_lock(&head->lock);
+                read_lock_bh(&head->lock);
                 sctp_for_each_hentry(epb, &head->chain) {
                         err = cb(sctp_ep(epb), p);
                         if (err)
                                 break;
                 }
-                read_unlock(&head->lock);
+                read_unlock_bh(&head->lock);
         }
 
         return err;
@@ -4666,9 +4666,8 @@ int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *),
         if (err)
                 return err;
 
-        sctp_transport_get_idx(net, &hti, pos);
-        obj = sctp_transport_get_next(net, &hti);
-        for (; obj && !IS_ERR(obj); obj = sctp_transport_get_next(net, &hti)) {
+        obj = sctp_transport_get_idx(net, &hti, pos + 1);
+        for (; !IS_ERR_OR_NULL(obj); obj = sctp_transport_get_next(net, &hti)) {
                 struct sctp_transport *transport = obj;
 
                 if (!sctp_transport_hold(transport))
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 312ef7de57d7..ab3087687a32 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -508,7 +508,7 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
         }
 
         if (skb_cloned(_skb) &&
-            pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_KERNEL))
+            pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
                 goto exit;
 
         /* Now reverse the concerned fields */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 6a7fe7660551..1a0c961f4ffe 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -999,7 +999,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct path path = { };
 
         err = -EINVAL;
-        if (sunaddr->sun_family != AF_UNIX)
+        if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
+            sunaddr->sun_family != AF_UNIX)
                 goto out;
 
         if (addr_len == sizeof(short)) {
@@ -1110,6 +1111,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
         unsigned int hash;
         int err;
 
+        err = -EINVAL;
+        if (alen < offsetofend(struct sockaddr, sa_family))
+                goto out;
+
         if (addr->sa_family != AF_UNSPEC) {
                 err = unix_mkname(sunaddr, alen, &hash);
                 if (err < 0)
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 1a4db6790e20..6cdb054484d6 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -914,13 +914,12 @@ int call_commit_handler(struct net_device *dev)
  * Main IOCTl dispatcher.
  * Check the type of IOCTL and call the appropriate wrapper...
  */
-static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
+static int wireless_process_ioctl(struct net *net, struct iwreq *iwr,
                                   unsigned int cmd,
                                   struct iw_request_info *info,
                                   wext_ioctl_func standard,
                                   wext_ioctl_func private)
 {
-        struct iwreq *iwr = (struct iwreq *) ifr;
         struct net_device *dev;
         iw_handler      handler;
 
@@ -928,7 +927,7 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
          * The copy_to/from_user() of ifr is also dealt with in there */
 
         /* Make sure the device exist */
-        if ((dev = __dev_get_by_name(net, ifr->ifr_name)) == NULL)
+        if ((dev = __dev_get_by_name(net, iwr->ifr_name)) == NULL)
                 return -ENODEV;
 
         /* A bunch of special cases, then the generic case...
@@ -957,9 +956,6 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                 else if (private)
                         return private(dev, iwr, cmd, info, handler);
         }
-        /* Old driver API : call driver ioctl handler */
-        if (dev->netdev_ops->ndo_do_ioctl)
-                return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
         return -EOPNOTSUPP;
 }
 
@@ -977,7 +973,7 @@ static int wext_permission_check(unsigned int cmd)
 }
 
 /* entry point from dev ioctl */
-static int wext_ioctl_dispatch(struct net *net, struct ifreq *ifr,
+static int wext_ioctl_dispatch(struct net *net, struct iwreq *iwr,
                                unsigned int cmd, struct iw_request_info *info,
                                wext_ioctl_func standard,
                                wext_ioctl_func private)
@@ -987,9 +983,9 @@ static int wext_ioctl_dispatch(struct net *net, struct ifreq *ifr,
         if (ret)
                 return ret;
 
-        dev_load(net, ifr->ifr_name);
+        dev_load(net, iwr->ifr_name);
         rtnl_lock();
-        ret = wireless_process_ioctl(net, ifr, cmd, info, standard, private);
+        ret = wireless_process_ioctl(net, iwr, cmd, info, standard, private);
         rtnl_unlock();
 
         return ret;
@@ -1039,18 +1035,18 @@ static int ioctl_standard_call(struct net_device *	dev,
 }
 
 
-int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
+int wext_handle_ioctl(struct net *net, struct iwreq *iwr, unsigned int cmd,
                       void __user *arg)
 {
         struct iw_request_info info = { .cmd = cmd, .flags = 0 };
         int ret;
 
-        ret = wext_ioctl_dispatch(net, ifr, cmd, &info,
+        ret = wext_ioctl_dispatch(net, iwr, cmd, &info,
                                   ioctl_standard_call,
                                   ioctl_private_call);
         if (ret >= 0 &&
             IW_IS_GET(cmd) &&
-            copy_to_user(arg, ifr, sizeof(struct iwreq)))
+            copy_to_user(arg, iwr, sizeof(struct iwreq)))
                 return -EFAULT;
 
         return ret;
@@ -1107,7 +1103,7 @@ int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
         info.cmd = cmd;
         info.flags = IW_REQUEST_FLAG_COMPAT;
 
-        ret = wext_ioctl_dispatch(net, (struct ifreq *) &iwr, cmd, &info,
+        ret = wext_ioctl_dispatch(net, &iwr, cmd, &info,
                                   compat_standard_call,
                                   compat_private_call);