Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Lots more phydev and probe error path leaks in various drivers by
    Johan Hovold.

 2) Fix race in packet_set_ring(), from Philip Pettersson.

 3) Use after free in dccp_invalid_packet(), from Eric Dumazet.

 4) Signnedness overflow in SO_{SND,RCV}BUFFORCE, also from Eric
    Dumazet.

 5) When tunneling between ipv4 and ipv6 we can be left with the wrong
    skb->protocol value as we enter the IPSEC engine and this causes all
    kinds of problems. Set it before the output path does any
    dst_output() calls, from Eli Cooper.

 6) bcmgenet uses wrong device struct pointer in DMA API calls, fix from
    Florian Fainelli.

 7) Various netfilter nat bug fixes from FLorian Westphal.

 8) Fix memory leak in ipvlan_link_new(), from Gao Feng.

 9) Locking fixes, particularly wrt. socket lookups, in l2tp from
    Guillaume Nault.

10) Avoid invoking rhash teardowns in atomic context by moving netlink
    cb->done() dump completion from a worker thread. Fix from Herbert
    Xu.

11) Buffer refcount problems in tun and macvtap on errors, from Jason
    Wang.

12) We don't set Kconfig symbol DEFAULT_TCP_CONG properly when the user
    selects BBR. Fix from Julian Wollrath.

13) Fix deadlock in transmit path on altera TSE driver, from Lino
    Sanfilippo.

14) Fix unbalanced reference counting in dsa_switch_tree, from Nikita
    Yushchenko.

15) tc_tunnel_key needs to be properly exported to userspace via uapi,
    fix from Roi Dayan.

16) rds_tcp_init_net() doesn't unregister notifier in error path, fix
    from Sowmini Varadhan.

17) Stale packet header pointer access after pskb_expand_head() in
    genenve driver, fix from Sabrina Dubroca.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (103 commits)
  net: avoid signed overflows for SO_{SND|RCV}BUFFORCE
  geneve: avoid use-after-free of skb->data
  tipc: check minimum bearer MTU
  net: renesas: ravb: unintialized return value
  sh_eth: remove unchecked interrupts for RZ/A1
  net: bcmgenet: Utilize correct struct device for all DMA operations
  NET: usb: qmi_wwan: add support for Telit LE922A PID 0x1040
  cdc_ether: Fix handling connection notification
  ip6_offload: check segs for NULL in ipv6_gso_segment.
  RDS: TCP: unregister_netdevice_notifier() in error path of rds_tcp_init_net
  Revert: "ip6_tunnel: Update skb->protocol to ETH_P_IPV6 in ip6_tnl_xmit()"
  ipv6: Set skb->protocol properly for local output
  ipv4: Set skb->protocol properly for local output
  packet: fix race condition in packet_set_ring
  net: ethernet: altera: TSE: do not use tx queue lock in tx completion handler
  net: ethernet: altera: TSE: Remove unneeded dma sync for tx buffers
  net: ethernet: stmmac: fix of-node and fixed-link-phydev leaks
  net: ethernet: stmmac: platform: fix outdated function header
  net: ethernet: stmmac: dwmac-meson8b: fix probe error path
  net: ethernet: stmmac: dwmac-generic: fix probe error path
  ...

49 files changed, 372 insertions, 195 deletions

diff --git a/net/core/flow.c b/net/core/flow.c
index 3937b1b68d5b..18e8893d4be5 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -95,7 +95,6 @@ static void flow_cache_gc_task(struct work_struct *work)
         list_for_each_entry_safe(fce, n, &gc_list, u.gc_list) {
                 flow_entry_kill(fce, xfrm);
                 atomic_dec(&xfrm->flow_cache_gc_count);
-                WARN_ON(atomic_read(&xfrm->flow_cache_gc_count) < 0);
         }
 }
 
@@ -236,9 +235,8 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
                 if (fcp->hash_count > fc->high_watermark)
                         flow_cache_shrink(fc, fcp);
 
-                if (fcp->hash_count > 2 * fc->high_watermark ||
-                    atomic_read(&net->xfrm.flow_cache_gc_count) > fc->high_watermark) {
-                        atomic_inc(&net->xfrm.flow_cache_genid);
+                if (atomic_read(&net->xfrm.flow_cache_gc_count) >
+                    2 * num_online_cpus() * fc->high_watermark) {
                         flo = ERR_PTR(-ENOBUFS);
                         goto ret_object;
                 }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index deb35acbefd0..a6196cf844f6 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -931,8 +931,8 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
                + nla_total_size(4) /* IFLA_PROMISCUITY */
                + nla_total_size(4) /* IFLA_NUM_TX_QUEUES */
                + nla_total_size(4) /* IFLA_NUM_RX_QUEUES */
-               + nla_total_size(4) /* IFLA_MAX_GSO_SEGS */
-               + nla_total_size(4) /* IFLA_MAX_GSO_SIZE */
+               + nla_total_size(4) /* IFLA_GSO_MAX_SEGS */
+               + nla_total_size(4) /* IFLA_GSO_MAX_SIZE */
                + nla_total_size(1) /* IFLA_OPERSTATE */
                + nla_total_size(1) /* IFLA_LINKMODE */
                + nla_total_size(4) /* IFLA_CARRIER_CHANGES */
diff --git a/net/core/sock.c b/net/core/sock.c
index 5e3ca414357e..00a074dbfe9b 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -715,7 +715,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
                 val = min_t(u32, val, sysctl_wmem_max);
 set_sndbuf:
                 sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
-                sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF);
+                sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
                 /* Wake up sending tasks if we upped the value. */
                 sk->sk_write_space(sk);
                 break;
@@ -751,7 +751,7 @@ set_rcvbuf:
                  * returning the value we actually used in getsockopt
                  * is the most desirable behavior.
                  */
-                sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF);
+                sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
                 break;
 
         case SO_RCVBUFFORCE:
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index b567c8725aea..edbe59d203ef 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -700,6 +700,7 @@ int dccp_invalid_packet(struct sk_buff *skb)
 {
         const struct dccp_hdr *dh;
         unsigned int cscov;
+        u8 dccph_doff;
 
         if (skb->pkt_type != PACKET_HOST)
                 return 1;
@@ -721,18 +722,19 @@ int dccp_invalid_packet(struct sk_buff *skb)
         /*
          * If P.Data Offset is too small for packet type, drop packet and return
          */
-        if (dh->dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
-                DCCP_WARN("P.Data Offset(%u) too small\n", dh->dccph_doff);
+        dccph_doff = dh->dccph_doff;
+        if (dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
+                DCCP_WARN("P.Data Offset(%u) too small\n", dccph_doff);
                 return 1;
         }
         /*
          * If P.Data Offset is too too large for packet, drop packet and return
          */
-        if (!pskb_may_pull(skb, dh->dccph_doff * sizeof(u32))) {
-                DCCP_WARN("P.Data Offset(%u) too large\n", dh->dccph_doff);
+        if (!pskb_may_pull(skb, dccph_doff * sizeof(u32))) {
+                DCCP_WARN("P.Data Offset(%u) too large\n", dccph_doff);
                 return 1;
         }
-
+        dh = dccp_hdr(skb);
         /*
          * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet
          * has short sequence numbers), drop packet and return
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index a6902c1e2f28..7899919cd9f0 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -233,6 +233,8 @@ int dsa_cpu_dsa_setup(struct dsa_switch *ds, struct device *dev,
                 genphy_read_status(phydev);
                 if (ds->ops->adjust_link)
                         ds->ops->adjust_link(ds, port, phydev);
+
+                put_device(&phydev->mdio.dev);
         }
 
         return 0;
@@ -504,15 +506,8 @@ dsa_switch_setup(struct dsa_switch_tree *dst, int index,
 
 void dsa_cpu_dsa_destroy(struct device_node *port_dn)
 {
-        struct phy_device *phydev;
-
-        if (of_phy_is_fixed_link(port_dn)) {
-                phydev = of_phy_find_device(port_dn);
-                if (phydev) {
-                        phy_device_free(phydev);
-                        fixed_phy_unregister(phydev);
-                }
-        }
+        if (of_phy_is_fixed_link(port_dn))
+                of_phy_deregister_fixed_link(port_dn);
 }
 
 static void dsa_switch_destroy(struct dsa_switch *ds)
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index f8a7d9aab437..5fff951a0a49 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -28,8 +28,10 @@ static struct dsa_switch_tree *dsa_get_dst(u32 tree)
         struct dsa_switch_tree *dst;
 
         list_for_each_entry(dst, &dsa_switch_trees, list)
-                if (dst->tree == tree)
+                if (dst->tree == tree) {
+                        kref_get(&dst->refcount);
                         return dst;
+                }
         return NULL;
 }
 
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 6b1282c006b1..30e2e21d7619 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1125,7 +1125,7 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
         p->phy_interface = mode;
 
         phy_dn = of_parse_phandle(port_dn, "phy-handle", 0);
-        if (of_phy_is_fixed_link(port_dn)) {
+        if (!phy_dn && of_phy_is_fixed_link(port_dn)) {
                 /* In the case of a fixed PHY, the DT node associated
                  * to the fixed PHY is the Port DT node
                  */
@@ -1135,7 +1135,7 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
                         return ret;
                 }
                 phy_is_fixed = true;
-                phy_dn = port_dn;
+                phy_dn = of_node_get(port_dn);
         }
 
         if (ds->ops->get_phy_flags)
@@ -1154,6 +1154,7 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
                         ret = dsa_slave_phy_connect(p, slave_dev, phy_id);
                         if (ret) {
                                 netdev_err(slave_dev, "failed to connect to phy%d: %d\n", phy_id, ret);
+                                of_node_put(phy_dn);
                                 return ret;
                         }
                 } else {
@@ -1162,6 +1163,8 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
                                                 phy_flags,
                                                 p->phy_interface);
                 }
+
+                of_node_put(phy_dn);
         }
 
         if (p->phy && phy_is_fixed)
@@ -1174,6 +1177,8 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
                 ret = dsa_slave_phy_connect(p, slave_dev, p->port);
                 if (ret) {
                         netdev_err(slave_dev, "failed to connect to port %d: %d\n", p->port, ret);
+                        if (phy_is_fixed)
+                                of_phy_deregister_fixed_link(port_dn);
                         return ret;
                 }
         }
@@ -1289,10 +1294,18 @@ int dsa_slave_create(struct dsa_switch *ds, struct device *parent,
 void dsa_slave_destroy(struct net_device *slave_dev)
 {
         struct dsa_slave_priv *p = netdev_priv(slave_dev);
+        struct dsa_switch *ds = p->parent;
+        struct device_node *port_dn;
+
+        port_dn = ds->ports[p->port].dn;
 
         netif_carrier_off(slave_dev);
-        if (p->phy)
+        if (p->phy) {
                 phy_disconnect(p->phy);
+
+                if (of_phy_is_fixed_link(port_dn))
+                        of_phy_deregister_fixed_link(port_dn);
+        }
         unregister_netdev(slave_dev);
         free_netdev(slave_dev);
 }
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 300b06888fdf..b54b3ca939db 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -715,6 +715,7 @@ config DEFAULT_TCP_CONG
         default "reno" if DEFAULT_RENO
         default "dctcp" if DEFAULT_DCTCP
         default "cdg" if DEFAULT_CDG
+        default "bbr" if DEFAULT_BBR
         default "cubic"
 
 config TCP_MD5SIG
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 5ddf5cda07f4..215143246e4b 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1233,7 +1233,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
                 fixedid = !!(skb_shinfo(skb)->gso_type & SKB_GSO_TCP_FIXEDID);
 
                 /* fixed ID is invalid if DF bit is not set */
-                if (fixedid && !(iph->frag_off & htons(IP_DF)))
+                if (fixedid && !(ip_hdr(skb)->frag_off & htons(IP_DF)))
                         goto out;
         }
 
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index d95631d09248..20fb25e3027b 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -476,7 +476,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
                 esph = (void *)skb_push(skb, 4);
                 *seqhi = esph->spi;
                 esph->spi = esph->seq_no;
-                esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.input.hi);
+                esph->seq_no = XFRM_SKB_CB(skb)->seq.input.hi;
                 aead_request_set_callback(req, 0, esp_input_done_esn, skb);
         }
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 105908d841a3..877bdb02e887 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -107,6 +107,8 @@ int __ip_local_out(struct net *net, struct sock *sk, struct sk_buff *skb)
         if (unlikely(!skb))
                 return 0;
 
+        skb->protocol = htons(ETH_P_IP);
+
         return nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT,
                        net, sk, skb, NULL, skb_dst(skb)->dev,
                        dst_output);
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index c3776ff6749f..b3cc1335adbc 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -24,10 +24,11 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t
         struct flowi4 fl4 = {};
         __be32 saddr = iph->saddr;
         __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
+        struct net_device *dev = skb_dst(skb)->dev;
         unsigned int hh_len;
 
         if (addr_type == RTN_UNSPEC)
-                addr_type = inet_addr_type(net, saddr);
+                addr_type = inet_addr_type_dev_table(net, dev, saddr);
         if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
                 flags |= FLOWI_FLAG_ANYSRC;
         else
@@ -40,6 +41,8 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t
         fl4.saddr = saddr;
         fl4.flowi4_tos = RT_TOS(iph->tos);
         fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
+        if (!fl4.flowi4_oif)
+                fl4.flowi4_oif = l3mdev_master_ifindex(dev);
         fl4.flowi4_mark = skb->mark;
         fl4.flowi4_flags = flags;
         rt = ip_route_output_key(net, &fl4);
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index b31df597fd37..697538464e6e 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1201,8 +1201,8 @@ static int translate_compat_table(struct xt_table_info **pinfo,
 
         newinfo->number = compatr->num_entries;
         for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
-                newinfo->hook_entry[i] = info->hook_entry[i];
-                newinfo->underflow[i] = info->underflow[i];
+                newinfo->hook_entry[i] = compatr->hook_entry[i];
+                newinfo->underflow[i] = compatr->underflow[i];
         }
         entry1 = newinfo->entries;
         pos = entry1;
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 37874e2f30ed..ccf40550c475 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -139,7 +139,8 @@ void ip6_datagram_release_cb(struct sock *sk)
 }
 EXPORT_SYMBOL_GPL(ip6_datagram_release_cb);
 
-static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr,
+                           int addr_len)
 {
         struct sockaddr_in6     *usin = (struct sockaddr_in6 *) uaddr;
         struct inet_sock        *inet = inet_sk(sk);
@@ -252,6 +253,7 @@ ipv4_connected:
 out:
         return err;
 }
+EXPORT_SYMBOL_GPL(__ip6_datagram_connect);
 
 int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 060a60b2f8a6..111ba55fd512 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -418,7 +418,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
                 esph = (void *)skb_push(skb, 4);
                 *seqhi = esph->spi;
                 esph->spi = esph->seq_no;
-                esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.input.hi);
+                esph->seq_no = XFRM_SKB_CB(skb)->seq.input.hi;
                 aead_request_set_callback(req, 0, esp_input_done_esn, skb);
         }
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 7370ad2e693a..2772004ba5a1 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -447,8 +447,10 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
 
         if (__ipv6_addr_needs_scope_id(addr_type))
                 iif = skb->dev->ifindex;
-        else
-                iif = l3mdev_master_ifindex(skb_dst(skb)->dev);
+        else {
+                dst = skb_dst(skb);
+                iif = l3mdev_master_ifindex(dst ? dst->dev : skb->dev);
+        }
 
         /*
          *      Must not send error if the source does not uniquely
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 1fcf61f1cbc3..89c59e656f44 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -99,7 +99,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                 segs = ops->callbacks.gso_segment(skb, features);
         }
 
-        if (IS_ERR(segs))
+        if (IS_ERR_OR_NULL(segs))
                 goto out;
 
         gso_partial = !!(skb_shinfo(segs)->gso_type & SKB_GSO_PARTIAL);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 0a4759b89da2..d76674efe523 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1181,7 +1181,6 @@ route_lookup:
         if (err)
                 return err;
 
-        skb->protocol = htons(ETH_P_IPV6);
         skb_push(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         ipv6h = ipv6_hdr(skb);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 8a02ca8a11af..c299c1e2bbf0 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -1138,6 +1138,33 @@ static struct xfrm6_protocol vti_ipcomp6_protocol __read_mostly = {
         .priority       =       100,
 };
 
+static bool is_vti6_tunnel(const struct net_device *dev)
+{
+        return dev->netdev_ops == &vti6_netdev_ops;
+}
+
+static int vti6_device_event(struct notifier_block *unused,
+                             unsigned long event, void *ptr)
+{
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct ip6_tnl *t = netdev_priv(dev);
+
+        if (!is_vti6_tunnel(dev))
+                return NOTIFY_DONE;
+
+        switch (event) {
+        case NETDEV_DOWN:
+                if (!net_eq(t->net, dev_net(dev)))
+                        xfrm_garbage_collect(t->net);
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block vti6_notifier_block __read_mostly = {
+        .notifier_call = vti6_device_event,
+};
+
 /**
  * vti6_tunnel_init - register protocol and reserve needed resources
  *
@@ -1148,6 +1175,8 @@ static int __init vti6_tunnel_init(void)
         const char *msg;
         int err;
 
+        register_netdevice_notifier(&vti6_notifier_block);
+
         msg = "tunnel device";
         err = register_pernet_device(&vti6_net_ops);
         if (err < 0)
@@ -1180,6 +1209,7 @@ xfrm_proto_ah_failed:
 xfrm_proto_esp_failed:
         unregister_pernet_device(&vti6_net_ops);
 pernet_dev_failed:
+        unregister_netdevice_notifier(&vti6_notifier_block);
         pr_err("vti6 init: failed to register %s\n", msg);
         return err;
 }
@@ -1194,6 +1224,7 @@ static void __exit vti6_tunnel_cleanup(void)
         xfrm6_protocol_deregister(&vti_ah6_protocol, IPPROTO_AH);
         xfrm6_protocol_deregister(&vti_esp6_protocol, IPPROTO_ESP);
         unregister_pernet_device(&vti6_net_ops);
+        unregister_netdevice_notifier(&vti6_notifier_block);
 }
 
 module_init(vti6_tunnel_init);
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index e4347aeb2e65..9948b5ce52da 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -576,11 +576,11 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
         /* Jumbo payload inhibits frag. header */
         if (ipv6_hdr(skb)->payload_len == 0) {
                 pr_debug("payload len = 0\n");
-                return -EINVAL;
+                return 0;
         }
 
         if (find_prev_fhdr(skb, &prevhdr, &nhoff, &fhoff) < 0)
-                return -EINVAL;
+                return 0;
 
         if (!pskb_may_pull(skb, fhoff + sizeof(*fhdr)))
                 return -ENOMEM;
diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
index f7aab5ab93a5..f06b0471f39f 100644
--- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
+++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
@@ -69,7 +69,7 @@ static unsigned int ipv6_defrag(void *priv,
         if (err == -EINPROGRESS)
                 return NF_STOLEN;
 
-        return NF_ACCEPT;
+        return err == 0 ? NF_ACCEPT : NF_DROP;
 }
 
 static struct nf_hook_ops ipv6_defrag_ops[] = {
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index a5400223fd74..10090400c72f 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -156,6 +156,7 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
         fl6.daddr = oip6h->saddr;
         fl6.fl6_sport = otcph->dest;
         fl6.fl6_dport = otcph->source;
+        fl6.flowi6_oif = l3mdev_master_ifindex(skb_dst(oldskb)->dev);
         security_skb_classify_flow(oldskb, flowi6_to_flowi(&fl6));
         dst = ip6_route_output(net, NULL, &fl6);
         if (dst->error) {
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 7cca8ac66fe9..cd4252346a32 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -155,6 +155,8 @@ int __ip6_local_out(struct net *net, struct sock *sk, struct sk_buff *skb)
         if (unlikely(!skb))
                 return 0;
 
+        skb->protocol = htons(ETH_P_IPV6);
+
         return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
                        net, sk, skb, NULL, skb_dst(skb)->dev,
                        dst_output);
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 982f6c44ea01..8938b6ba57a0 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -61,7 +61,8 @@ static struct sock *__l2tp_ip_bind_lookup(struct net *net, __be32 laddr, int dif
                 if ((l2tp->conn_id == tunnel_id) &&
                     net_eq(sock_net(sk), net) &&
                     !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
-                    !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
+                    (!sk->sk_bound_dev_if || !dif ||
+                     sk->sk_bound_dev_if == dif))
                         goto found;
         }
 
@@ -182,15 +183,17 @@ pass_up:
                 struct iphdr *iph = (struct iphdr *) skb_network_header(skb);
 
                 read_lock_bh(&l2tp_ip_lock);
-                sk = __l2tp_ip_bind_lookup(net, iph->daddr, 0, tunnel_id);
+                sk = __l2tp_ip_bind_lookup(net, iph->daddr, inet_iif(skb),
+                                           tunnel_id);
+                if (!sk) {
+                        read_unlock_bh(&l2tp_ip_lock);
+                        goto discard;
+                }
+
+                sock_hold(sk);
                 read_unlock_bh(&l2tp_ip_lock);
         }
 
-        if (sk == NULL)
-                goto discard;
-
-        sock_hold(sk);
-
         if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_put;
 
@@ -256,15 +259,9 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (addr->l2tp_family != AF_INET)
                 return -EINVAL;
 
-        ret = -EADDRINUSE;
-        read_lock_bh(&l2tp_ip_lock);
-        if (__l2tp_ip_bind_lookup(net, addr->l2tp_addr.s_addr,
-                                  sk->sk_bound_dev_if, addr->l2tp_conn_id))
-                goto out_in_use;
-
-        read_unlock_bh(&l2tp_ip_lock);
-
         lock_sock(sk);
+
+        ret = -EINVAL;
         if (!sock_flag(sk, SOCK_ZAPPED))
                 goto out;
 
@@ -281,14 +278,22 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 inet->inet_rcv_saddr = inet->inet_saddr = addr->l2tp_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
                 inet->inet_saddr = 0;  /* Use device */
-        sk_dst_reset(sk);
 
+        write_lock_bh(&l2tp_ip_lock);
+        if (__l2tp_ip_bind_lookup(net, addr->l2tp_addr.s_addr,
+                                  sk->sk_bound_dev_if, addr->l2tp_conn_id)) {
+                write_unlock_bh(&l2tp_ip_lock);
+                ret = -EADDRINUSE;
+                goto out;
+        }
+
+        sk_dst_reset(sk);
         l2tp_ip_sk(sk)->conn_id = addr->l2tp_conn_id;
 
-        write_lock_bh(&l2tp_ip_lock);
         sk_add_bind_node(sk, &l2tp_ip_bind_table);
         sk_del_node_init(sk);
         write_unlock_bh(&l2tp_ip_lock);
+
         ret = 0;
         sock_reset_flag(sk, SOCK_ZAPPED);
 
@@ -296,11 +301,6 @@ out:
         release_sock(sk);
 
         return ret;
-
-out_in_use:
-        read_unlock_bh(&l2tp_ip_lock);
-
-        return ret;
 }
 
 static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
@@ -308,21 +308,24 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
         struct sockaddr_l2tpip *lsa = (struct sockaddr_l2tpip *) uaddr;
         int rc;
 
-        if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
-                return -EINVAL;
-
         if (addr_len < sizeof(*lsa))
                 return -EINVAL;
 
         if (ipv4_is_multicast(lsa->l2tp_addr.s_addr))
                 return -EINVAL;
 
-        rc = ip4_datagram_connect(sk, uaddr, addr_len);
-        if (rc < 0)
-                return rc;
-
         lock_sock(sk);
 
+        /* Must bind first - autobinding does not work */
+        if (sock_flag(sk, SOCK_ZAPPED)) {
+                rc = -EINVAL;
+                goto out_sk;
+        }
+
+        rc = __ip4_datagram_connect(sk, uaddr, addr_len);
+        if (rc < 0)
+                goto out_sk;
+
         l2tp_ip_sk(sk)->peer_conn_id = lsa->l2tp_conn_id;
 
         write_lock_bh(&l2tp_ip_lock);
@@ -330,7 +333,9 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
         sk_add_bind_node(sk, &l2tp_ip_bind_table);
         write_unlock_bh(&l2tp_ip_lock);
 
+out_sk:
         release_sock(sk);
+
         return rc;
 }
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 9978d01ba0ba..aa821cb639e5 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -72,8 +72,9 @@ static struct sock *__l2tp_ip6_bind_lookup(struct net *net,
 
                 if ((l2tp->conn_id == tunnel_id) &&
                     net_eq(sock_net(sk), net) &&
-                    !(addr && ipv6_addr_equal(addr, laddr)) &&
-                    !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
+                    (!addr || ipv6_addr_equal(addr, laddr)) &&
+                    (!sk->sk_bound_dev_if || !dif ||
+                     sk->sk_bound_dev_if == dif))
                         goto found;
         }
 
@@ -196,16 +197,17 @@ pass_up:
                 struct ipv6hdr *iph = ipv6_hdr(skb);
 
                 read_lock_bh(&l2tp_ip6_lock);
-                sk = __l2tp_ip6_bind_lookup(net, &iph->daddr,
-                                            0, tunnel_id);
+                sk = __l2tp_ip6_bind_lookup(net, &iph->daddr, inet6_iif(skb),
+                                            tunnel_id);
+                if (!sk) {
+                        read_unlock_bh(&l2tp_ip6_lock);
+                        goto discard;
+                }
+
+                sock_hold(sk);
                 read_unlock_bh(&l2tp_ip6_lock);
         }
 
-        if (sk == NULL)
-                goto discard;
-
-        sock_hold(sk);
-
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_put;
 
@@ -266,6 +268,7 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         struct sockaddr_l2tpip6 *addr = (struct sockaddr_l2tpip6 *) uaddr;
         struct net *net = sock_net(sk);
         __be32 v4addr = 0;
+        int bound_dev_if;
         int addr_type;
         int err;
 
@@ -284,13 +287,6 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (addr_type & IPV6_ADDR_MULTICAST)
                 return -EADDRNOTAVAIL;
 
-        err = -EADDRINUSE;
-        read_lock_bh(&l2tp_ip6_lock);
-        if (__l2tp_ip6_bind_lookup(net, &addr->l2tp_addr,
-                                   sk->sk_bound_dev_if, addr->l2tp_conn_id))
-                goto out_in_use;
-        read_unlock_bh(&l2tp_ip6_lock);
-
         lock_sock(sk);
 
         err = -EINVAL;
@@ -300,28 +296,25 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (sk->sk_state != TCP_CLOSE)
                 goto out_unlock;
 
+        bound_dev_if = sk->sk_bound_dev_if;
+
         /* Check if the address belongs to the host. */
         rcu_read_lock();
         if (addr_type != IPV6_ADDR_ANY) {
                 struct net_device *dev = NULL;
 
                 if (addr_type & IPV6_ADDR_LINKLOCAL) {
-                        if (addr_len >= sizeof(struct sockaddr_in6) &&
-                            addr->l2tp_scope_id) {
-                                /* Override any existing binding, if another
-                                 * one is supplied by user.
-                                 */
-                                sk->sk_bound_dev_if = addr->l2tp_scope_id;
-                        }
+                        if (addr->l2tp_scope_id)
+                                bound_dev_if = addr->l2tp_scope_id;
 
                         /* Binding to link-local address requires an
-                           interface */
-                        if (!sk->sk_bound_dev_if)
+                         * interface.
+                         */
+                        if (!bound_dev_if)
                                 goto out_unlock_rcu;
 
                         err = -ENODEV;
-                        dev = dev_get_by_index_rcu(sock_net(sk),
-                                                   sk->sk_bound_dev_if);
+                        dev = dev_get_by_index_rcu(sock_net(sk), bound_dev_if);
                         if (!dev)
                                 goto out_unlock_rcu;
                 }
@@ -336,13 +329,22 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         }
         rcu_read_unlock();
 
-        inet->inet_rcv_saddr = inet->inet_saddr = v4addr;
+        write_lock_bh(&l2tp_ip6_lock);
+        if (__l2tp_ip6_bind_lookup(net, &addr->l2tp_addr, bound_dev_if,
+                                   addr->l2tp_conn_id)) {
+                write_unlock_bh(&l2tp_ip6_lock);
+                err = -EADDRINUSE;
+                goto out_unlock;
+        }
+
+        inet->inet_saddr = v4addr;
+        inet->inet_rcv_saddr = v4addr;
+        sk->sk_bound_dev_if = bound_dev_if;
         sk->sk_v6_rcv_saddr = addr->l2tp_addr;
         np->saddr = addr->l2tp_addr;
 
         l2tp_ip6_sk(sk)->conn_id = addr->l2tp_conn_id;
 
-        write_lock_bh(&l2tp_ip6_lock);
         sk_add_bind_node(sk, &l2tp_ip6_bind_table);
         sk_del_node_init(sk);
         write_unlock_bh(&l2tp_ip6_lock);
@@ -355,10 +357,7 @@ out_unlock_rcu:
         rcu_read_unlock();
 out_unlock:
         release_sock(sk);
-        return err;
 
-out_in_use:
-        read_unlock_bh(&l2tp_ip6_lock);
         return err;
 }
 
@@ -371,9 +370,6 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
         int     addr_type;
         int rc;
 
-        if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
-                return -EINVAL;
-
         if (addr_len < sizeof(*lsa))
                 return -EINVAL;
 
@@ -390,10 +386,18 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
                         return -EINVAL;
         }
 
-        rc = ip6_datagram_connect(sk, uaddr, addr_len);
-
         lock_sock(sk);
 
+         /* Must bind first - autobinding does not work */
+        if (sock_flag(sk, SOCK_ZAPPED)) {
+                rc = -EINVAL;
+                goto out_sk;
+        }
+
+        rc = __ip6_datagram_connect(sk, uaddr, addr_len);
+        if (rc < 0)
+                goto out_sk;
+
         l2tp_ip6_sk(sk)->peer_conn_id = lsa->l2tp_conn_id;
 
         write_lock_bh(&l2tp_ip6_lock);
@@ -401,6 +405,7 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
         sk_add_bind_node(sk, &l2tp_ip6_bind_table);
         write_unlock_bh(&l2tp_ip6_lock);
 
+out_sk:
         release_sock(sk);
 
         return rc;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index bbb8f3df79f7..5b9c884a452e 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -42,7 +42,7 @@ struct nf_nat_conn_key {
         const struct nf_conntrack_zone *zone;
 };
 
-static struct rhashtable nf_nat_bysource_table;
+static struct rhltable nf_nat_bysource_table;
 
 inline const struct nf_nat_l3proto *
 __nf_nat_l3proto_find(u8 family)
@@ -193,9 +193,12 @@ static int nf_nat_bysource_cmp(struct rhashtable_compare_arg *arg,
         const struct nf_nat_conn_key *key = arg->key;
         const struct nf_conn *ct = obj;
 
-        return same_src(ct, key->tuple) &&
-               net_eq(nf_ct_net(ct), key->net) &&
-               nf_ct_zone_equal(ct, key->zone, IP_CT_DIR_ORIGINAL);
+        if (!same_src(ct, key->tuple) ||
+            !net_eq(nf_ct_net(ct), key->net) ||
+            !nf_ct_zone_equal(ct, key->zone, IP_CT_DIR_ORIGINAL))
+                return 1;
+
+        return 0;
 }
 
 static struct rhashtable_params nf_nat_bysource_params = {
@@ -204,7 +207,6 @@ static struct rhashtable_params nf_nat_bysource_params = {
         .obj_cmpfn = nf_nat_bysource_cmp,
         .nelem_hint = 256,
         .min_size = 1024,
-        .nulls_base = (1U << RHT_BASE_SHIFT),
 };
 
 /* Only called for SRC manip */
@@ -223,12 +225,15 @@ find_appropriate_src(struct net *net,
                 .tuple = tuple,
                 .zone = zone
         };
+        struct rhlist_head *hl;
 
-        ct = rhashtable_lookup_fast(&nf_nat_bysource_table, &key,
-                                    nf_nat_bysource_params);
-        if (!ct)
+        hl = rhltable_lookup(&nf_nat_bysource_table, &key,
+                             nf_nat_bysource_params);
+        if (!hl)
                 return 0;
 
+        ct = container_of(hl, typeof(*ct), nat_bysource);
+
         nf_ct_invert_tuplepr(result,
                              &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
         result->dst = tuple->dst;
@@ -446,11 +451,17 @@ nf_nat_setup_info(struct nf_conn *ct,
         }
 
         if (maniptype == NF_NAT_MANIP_SRC) {
+                struct nf_nat_conn_key key = {
+                        .net = nf_ct_net(ct),
+                        .tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                        .zone = nf_ct_zone(ct),
+                };
                 int err;
 
-                err = rhashtable_insert_fast(&nf_nat_bysource_table,
-                                             &ct->nat_bysource,
-                                             nf_nat_bysource_params);
+                err = rhltable_insert_key(&nf_nat_bysource_table,
+                                          &key,
+                                          &ct->nat_bysource,
+                                          nf_nat_bysource_params);
                 if (err)
                         return NF_DROP;
         }
@@ -567,8 +578,8 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
          * will delete entry from already-freed table.
          */
         ct->status &= ~IPS_NAT_DONE_MASK;
-        rhashtable_remove_fast(&nf_nat_bysource_table, &ct->nat_bysource,
-                               nf_nat_bysource_params);
+        rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
+                        nf_nat_bysource_params);
 
         /* don't delete conntrack.  Although that would make things a lot
          * simpler, we'd end up flushing all conntracks on nat rmmod.
@@ -698,8 +709,8 @@ static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
         if (!nat)
                 return;
 
-        rhashtable_remove_fast(&nf_nat_bysource_table, &ct->nat_bysource,
-                               nf_nat_bysource_params);
+        rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
+                        nf_nat_bysource_params);
 }
 
 static struct nf_ct_ext_type nat_extend __read_mostly = {
@@ -834,13 +845,13 @@ static int __init nf_nat_init(void)
 {
         int ret;
 
-        ret = rhashtable_init(&nf_nat_bysource_table, &nf_nat_bysource_params);
+        ret = rhltable_init(&nf_nat_bysource_table, &nf_nat_bysource_params);
         if (ret)
                 return ret;
 
         ret = nf_ct_extend_register(&nat_extend);
         if (ret < 0) {
-                rhashtable_destroy(&nf_nat_bysource_table);
+                rhltable_destroy(&nf_nat_bysource_table);
                 printk(KERN_ERR "nf_nat_core: Unable to register extension\n");
                 return ret;
         }
@@ -864,7 +875,7 @@ static int __init nf_nat_init(void)
         return 0;
 
  cleanup_extend:
-        rhashtable_destroy(&nf_nat_bysource_table);
+        rhltable_destroy(&nf_nat_bysource_table);
         nf_ct_extend_unregister(&nat_extend);
         return ret;
 }
@@ -883,7 +894,7 @@ static void __exit nf_nat_cleanup(void)
         for (i = 0; i < NFPROTO_NUMPROTO; i++)
                 kfree(nf_nat_l4protos[i]);
 
-        rhashtable_destroy(&nf_nat_bysource_table);
+        rhltable_destroy(&nf_nat_bysource_table);
 }
 
 MODULE_LICENSE("GPL");
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 026581b04ea8..e5194f6f906c 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2570,7 +2570,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
         }
 
         if (set->timeout &&
-            nla_put_be64(skb, NFTA_SET_TIMEOUT, cpu_to_be64(set->timeout),
+            nla_put_be64(skb, NFTA_SET_TIMEOUT,
+                         cpu_to_be64(jiffies_to_msecs(set->timeout)),
                          NFTA_SET_PAD))
                 goto nla_put_failure;
         if (set->gc_int &&
@@ -2859,7 +2860,8 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
         if (nla[NFTA_SET_TIMEOUT] != NULL) {
                 if (!(flags & NFT_SET_TIMEOUT))
                         return -EINVAL;
-                timeout = be64_to_cpu(nla_get_be64(nla[NFTA_SET_TIMEOUT]));
+                timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
+                                                nla[NFTA_SET_TIMEOUT])));
         }
         gc_int = 0;
         if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
@@ -3178,7 +3180,8 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,
 
         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
             nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
-                         cpu_to_be64(*nft_set_ext_timeout(ext)),
+                         cpu_to_be64(jiffies_to_msecs(
+                                                *nft_set_ext_timeout(ext))),
                          NFTA_SET_ELEM_PAD))
                 goto nla_put_failure;
 
@@ -3447,7 +3450,7 @@ void *nft_set_elem_init(const struct nft_set *set,
                 memcpy(nft_set_ext_data(ext), data, set->dlen);
         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
                 *nft_set_ext_expiration(ext) =
-                        jiffies + msecs_to_jiffies(timeout);
+                        jiffies + timeout;
         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
                 *nft_set_ext_timeout(ext) = timeout;
 
@@ -3535,7 +3538,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
         if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
                 if (!(set->flags & NFT_SET_TIMEOUT))
                         return -EINVAL;
-                timeout = be64_to_cpu(nla_get_be64(nla[NFTA_SET_ELEM_TIMEOUT]));
+                timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
+                                        nla[NFTA_SET_ELEM_TIMEOUT])));
         } else if (set->flags & NFT_SET_TIMEOUT) {
                 timeout = set->timeout;
         }
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index baf694de3935..d5447a22275c 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -53,6 +53,7 @@ static int nft_hash_init(const struct nft_ctx *ctx,
 {
         struct nft_hash *priv = nft_expr_priv(expr);
         u32 len;
+        int err;
 
         if (!tb[NFTA_HASH_SREG] ||
             !tb[NFTA_HASH_DREG] ||
@@ -67,8 +68,10 @@ static int nft_hash_init(const struct nft_ctx *ctx,
         priv->sreg = nft_parse_register(tb[NFTA_HASH_SREG]);
         priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
 
-        len = ntohl(nla_get_be32(tb[NFTA_HASH_LEN]));
-        if (len == 0 || len > U8_MAX)
+        err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len);
+        if (err < 0)
+                return err;
+        if (len == 0)
                 return -ERANGE;
 
         priv->len = len;
diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c
index fbc88009ca2e..8f0aaaea1376 100644
--- a/net/netfilter/nft_range.c
+++ b/net/netfilter/nft_range.c
@@ -59,6 +59,12 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr
         int err;
         u32 op;
 
+        if (!tb[NFTA_RANGE_SREG]      ||
+            !tb[NFTA_RANGE_OP]        ||
+            !tb[NFTA_RANGE_FROM_DATA] ||
+            !tb[NFTA_RANGE_TO_DATA])
+                return -EINVAL;
+
         err = nft_data_init(NULL, &priv->data_from, sizeof(priv->data_from),
                             &desc_from, tb[NFTA_RANGE_FROM_DATA]);
         if (err < 0)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 62bea4591054..602e5ebe9db3 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -322,14 +322,11 @@ static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
         sk_mem_charge(sk, skb->truesize);
 }
 
-static void netlink_sock_destruct(struct sock *sk)
+static void __netlink_sock_destruct(struct sock *sk)
 {
         struct netlink_sock *nlk = nlk_sk(sk);
 
         if (nlk->cb_running) {
-                if (nlk->cb.done)
-                        nlk->cb.done(&nlk->cb);
-
                 module_put(nlk->cb.module);
                 kfree_skb(nlk->cb.skb);
         }
@@ -346,6 +343,28 @@ static void netlink_sock_destruct(struct sock *sk)
         WARN_ON(nlk_sk(sk)->groups);
 }
 
+static void netlink_sock_destruct_work(struct work_struct *work)
+{
+        struct netlink_sock *nlk = container_of(work, struct netlink_sock,
+                                                work);
+
+        nlk->cb.done(&nlk->cb);
+        __netlink_sock_destruct(&nlk->sk);
+}
+
+static void netlink_sock_destruct(struct sock *sk)
+{
+        struct netlink_sock *nlk = nlk_sk(sk);
+
+        if (nlk->cb_running && nlk->cb.done) {
+                INIT_WORK(&nlk->work, netlink_sock_destruct_work);
+                schedule_work(&nlk->work);
+                return;
+        }
+
+        __netlink_sock_destruct(sk);
+}
+
 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
  * SMP. Look, when several writers sleep and reader wakes them up, all but one
  * immediately hit write lock and grab all the cpus. Exclusive sleep solves
diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
index 3cfd6cc60504..4fdb38318977 100644
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -3,6 +3,7 @@
 
 #include <linux/rhashtable.h>
 #include <linux/atomic.h>
+#include <linux/workqueue.h>
 #include <net/sock.h>
 
 #define NLGRPSZ(x)      (ALIGN(x, sizeof(unsigned long) * 8) / 8)
@@ -33,6 +34,7 @@ struct netlink_sock {
 
         struct rhash_head       node;
         struct rcu_head         rcu;
+        struct work_struct      work;
 };
 
 static inline struct netlink_sock *nlk_sk(struct sock *sk)
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 31045ef44a82..fecefa2dc94e 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -370,8 +370,11 @@ static int handle_fragments(struct net *net, struct sw_flow_key *key,
                 skb_orphan(skb);
                 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
                 err = nf_ct_frag6_gather(net, skb, user);
-                if (err)
+                if (err) {
+                        if (err != -EINPROGRESS)
+                                kfree_skb(skb);
                         return err;
+                }
 
                 key->ip.proto = ipv6_hdr(skb)->nexthdr;
                 ovs_cb.mru = IP6CB(skb)->frag_max_size;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index d2238b204691..dd2332390c45 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
                 if (optlen != sizeof(val))
                         return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
                 switch (val) {
                 case TPACKET_V1:
                 case TPACKET_V2:
                 case TPACKET_V3:
-                        po->tp_version = val;
-                        return 0;
+                        break;
                 default:
                         return -EINVAL;
                 }
+                lock_sock(sk);
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->tp_version = val;
+                        ret = 0;
+                }
+                release_sock(sk);
+                return ret;
         }
         case PACKET_RESERVE:
         {
@@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
         /* Added to avoid minimal code churn */
         struct tpacket_req *req = &req_u->req;
 
+        lock_sock(sk);
         /* Opening a Tx-ring is NOT supported in TPACKET_V3 */
         if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) {
                 net_warn_ratelimited("Tx-ring is not supported.\n");
@@ -4245,7 +4252,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                         goto out;
         }
 
-        lock_sock(sk);
 
         /* Detach socket from network */
         spin_lock(&po->bind_lock);
@@ -4294,11 +4300,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 if (!tx_ring)
                         prb_shutdown_retire_blk_timer(po, rb_queue);
         }
-        release_sock(sk);
 
         if (pg_vec)
                 free_pg_vec(pg_vec, order, req->tp_block_nr);
 out:
+        release_sock(sk);
         return err;
 }
 
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index fcddacc92e01..20e2923dc827 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -659,6 +659,8 @@ out_recv:
 out_pernet:
         unregister_pernet_subsys(&rds_tcp_net_ops);
 out_slab:
+        if (unregister_netdevice_notifier(&rds_tcp_dev_notifier))
+                pr_warn("could not unregister rds_tcp_dev_notifier\n");
         kmem_cache_destroy(rds_tcp_conn_slab);
 out:
         return ret;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index b54d56d4959b..cf9b2fe8eac6 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -108,6 +108,17 @@ static void tcf_pedit_cleanup(struct tc_action *a, int bind)
         kfree(keys);
 }
 
+static bool offset_valid(struct sk_buff *skb, int offset)
+{
+        if (offset > 0 && offset > skb->len)
+                return false;
+
+        if  (offset < 0 && -offset > skb_headroom(skb))
+                return false;
+
+        return true;
+}
+
 static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
                      struct tcf_result *res)
 {
@@ -134,6 +145,11 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
                         if (tkey->offmask) {
                                 char *d, _d;
 
+                                if (!offset_valid(skb, off + tkey->at)) {
+                                        pr_info("tc filter pedit 'at' offset %d out of bounds\n",
+                                                off + tkey->at);
+                                        goto bad;
+                                }
                                 d = skb_header_pointer(skb, off + tkey->at, 1,
                                                        &_d);
                                 if (!d)
@@ -146,10 +162,10 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
                                         " offset must be on 32 bit boundaries\n");
                                 goto bad;
                         }
-                        if (offset > 0 && offset > skb->len) {
-                                pr_info("tc filter pedit"
-                                        " offset %d can't exceed pkt length %d\n",
-                                       offset, skb->len);
+
+                        if (!offset_valid(skb, off + offset)) {
+                                pr_info("tc filter pedit offset %d out of bounds\n",
+                                        offset);
                                 goto bad;
                         }
 
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index eb219b78cd49..5877f6061b57 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -62,9 +62,6 @@ static unsigned long basic_get(struct tcf_proto *tp, u32 handle)
         struct basic_head *head = rtnl_dereference(tp->root);
         struct basic_filter *f;
 
-        if (head == NULL)
-                return 0UL;
-
         list_for_each_entry(f, &head->flist, link) {
                 if (f->handle == handle) {
                         l = (unsigned long) f;
@@ -109,7 +106,6 @@ static bool basic_destroy(struct tcf_proto *tp, bool force)
                 tcf_unbind_filter(tp, &f->res);
                 call_rcu(&f->rcu, basic_delete_filter);
         }
-        RCU_INIT_POINTER(tp->root, NULL);
         kfree_rcu(head, rcu);
         return true;
 }
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index bb1d5a487081..0a47ba5e6109 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -292,7 +292,6 @@ static bool cls_bpf_destroy(struct tcf_proto *tp, bool force)
                 call_rcu(&prog->rcu, __cls_bpf_delete_prog);
         }
 
-        RCU_INIT_POINTER(tp->root, NULL);
         kfree_rcu(head, rcu);
         return true;
 }
@@ -303,9 +302,6 @@ static unsigned long cls_bpf_get(struct tcf_proto *tp, u32 handle)
         struct cls_bpf_prog *prog;
         unsigned long ret = 0UL;
 
-        if (head == NULL)
-                return 0UL;
-
         list_for_each_entry(prog, &head->plist, link) {
                 if (prog->handle == handle) {
                         ret = (unsigned long) prog;
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 85233c470035..c1f20077837f 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -137,11 +137,10 @@ static bool cls_cgroup_destroy(struct tcf_proto *tp, bool force)
 
         if (!force)
                 return false;
-
-        if (head) {
-                RCU_INIT_POINTER(tp->root, NULL);
+        /* Head can still be NULL due to cls_cgroup_init(). */
+        if (head)
                 call_rcu(&head->rcu, cls_cgroup_destroy_rcu);
-        }
+
         return true;
 }
 
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index e39672394c7b..6575aba87630 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -596,7 +596,6 @@ static bool flow_destroy(struct tcf_proto *tp, bool force)
                 list_del_rcu(&f->list);
                 call_rcu(&f->rcu, flow_destroy_filter);
         }
-        RCU_INIT_POINTER(tp->root, NULL);
         kfree_rcu(head, rcu);
         return true;
 }
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index f6f40fba599b..904442421db3 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -13,6 +13,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/rhashtable.h>
+#include <linux/workqueue.h>
 
 #include <linux/if_ether.h>
 #include <linux/in6.h>
@@ -64,7 +65,10 @@ struct cls_fl_head {
         bool mask_assigned;
         struct list_head filters;
         struct rhashtable_params ht_params;
-        struct rcu_head rcu;
+        union {
+                struct work_struct work;
+                struct rcu_head rcu;
+        };
 };
 
 struct cls_fl_filter {
@@ -269,6 +273,24 @@ static void fl_hw_update_stats(struct tcf_proto *tp, struct cls_fl_filter *f)
         dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle, tp->protocol, &tc);
 }
 
+static void fl_destroy_sleepable(struct work_struct *work)
+{
+        struct cls_fl_head *head = container_of(work, struct cls_fl_head,
+                                                work);
+        if (head->mask_assigned)
+                rhashtable_destroy(&head->ht);
+        kfree(head);
+        module_put(THIS_MODULE);
+}
+
+static void fl_destroy_rcu(struct rcu_head *rcu)
+{
+        struct cls_fl_head *head = container_of(rcu, struct cls_fl_head, rcu);
+
+        INIT_WORK(&head->work, fl_destroy_sleepable);
+        schedule_work(&head->work);
+}
+
 static bool fl_destroy(struct tcf_proto *tp, bool force)
 {
         struct cls_fl_head *head = rtnl_dereference(tp->root);
@@ -282,10 +304,9 @@ static bool fl_destroy(struct tcf_proto *tp, bool force)
                 list_del_rcu(&f->list);
                 call_rcu(&f->rcu, fl_destroy_filter);
         }
-        RCU_INIT_POINTER(tp->root, NULL);
-        if (head->mask_assigned)
-                rhashtable_destroy(&head->ht);
-        kfree_rcu(head, rcu);
+
+        __module_get(THIS_MODULE);
+        call_rcu(&head->rcu, fl_destroy_rcu);
         return true;
 }
 
@@ -711,8 +732,9 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
                 goto errout;
 
         if (fold) {
-                rhashtable_remove_fast(&head->ht, &fold->ht_node,
-                                       head->ht_params);
+                if (!tc_skip_sw(fold->flags))
+                        rhashtable_remove_fast(&head->ht, &fold->ht_node,
+                                               head->ht_params);
                 fl_hw_destroy_filter(tp, (unsigned long)fold);
         }
 
@@ -739,8 +761,9 @@ static int fl_delete(struct tcf_proto *tp, unsigned long arg)
         struct cls_fl_head *head = rtnl_dereference(tp->root);
         struct cls_fl_filter *f = (struct cls_fl_filter *) arg;
 
-        rhashtable_remove_fast(&head->ht, &f->ht_node,
-                               head->ht_params);
+        if (!tc_skip_sw(f->flags))
+                rhashtable_remove_fast(&head->ht, &f->ht_node,
+                                       head->ht_params);
         list_del_rcu(&f->list);
         fl_hw_destroy_filter(tp, (unsigned long)f);
         tcf_unbind_filter(tp, &f->res);
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index 25927b6c4436..f935429bd5ef 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -114,7 +114,6 @@ static bool mall_destroy(struct tcf_proto *tp, bool force)
 
                 call_rcu(&f->rcu, mall_destroy_filter);
         }
-        RCU_INIT_POINTER(tp->root, NULL);
         kfree_rcu(head, rcu);
         return true;
 }
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 4f05a19fb073..322438fb3ffc 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -152,7 +152,8 @@ static int rsvp_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                 return -1;
         nhptr = ip_hdr(skb);
 #endif
-
+        if (unlikely(!head))
+                return -1;
 restart:
 
 #if RSVP_DST_LEN == 4
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 96144bdf30db..0751245a6ace 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -543,7 +543,6 @@ static bool tcindex_destroy(struct tcf_proto *tp, bool force)
         walker.fn = tcindex_destroy_element;
         tcindex_walk(tp, &walker);
 
-        RCU_INIT_POINTER(tp->root, NULL);
         call_rcu(&p->rcu, __tcindex_destroy);
         return true;
 }
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 975dbeb60ab0..52d74760fb68 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -421,6 +421,10 @@ int tipc_enable_l2_media(struct net *net, struct tipc_bearer *b,
         dev = dev_get_by_name(net, driver_name);
         if (!dev)
                 return -ENODEV;
+        if (tipc_mtu_bad(dev, 0)) {
+                dev_put(dev);
+                return -EINVAL;
+        }
 
         /* Associate TIPC bearer with L2 bearer */
         rcu_assign_pointer(b->media_ptr, dev);
@@ -610,8 +614,6 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
         if (!b)
                 return NOTIFY_DONE;
 
-        b->mtu = dev->mtu;
-
         switch (evt) {
         case NETDEV_CHANGE:
                 if (netif_carrier_ok(dev))
@@ -624,6 +626,11 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
                 tipc_reset_bearer(net, b);
                 break;
         case NETDEV_CHANGEMTU:
+                if (tipc_mtu_bad(dev, 0)) {
+                        bearer_disable(net, b);
+                        break;
+                }
+                b->mtu = dev->mtu;
                 tipc_reset_bearer(net, b);
                 break;
         case NETDEV_CHANGEADDR:
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 78892e2f53e3..278ff7f616f9 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -39,6 +39,7 @@
 
 #include "netlink.h"
 #include "core.h"
+#include "msg.h"
 #include <net/genetlink.h>
 
 #define MAX_MEDIA       3
@@ -59,6 +60,9 @@
 #define TIPC_MEDIA_TYPE_IB      2
 #define TIPC_MEDIA_TYPE_UDP     3
 
+/* minimum bearer MTU */
+#define TIPC_MIN_BEARER_MTU     (MAX_H_SIZE + INT_H_SIZE)
+
 /**
  * struct tipc_media_addr - destination address used by TIPC bearers
  * @value: address info (format defined by media)
@@ -215,4 +219,13 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id,
 void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id,
                          struct sk_buff_head *xmitq);
 
+/* check if device MTU is too low for tipc headers */
+static inline bool tipc_mtu_bad(struct net_device *dev, unsigned int reserve)
+{
+        if (dev->mtu >= TIPC_MIN_BEARER_MTU + reserve)
+                return false;
+        netdev_warn(dev, "MTU too low for tipc bearer\n");
+        return true;
+}
+
 #endif  /* _TIPC_BEARER_H */
diff --git a/net/tipc/link.c b/net/tipc/link.c
index ecc12411155e..bda89bf9f4ff 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -47,8 +47,8 @@
 #include <linux/pkt_sched.h>
 
 struct tipc_stats {
-        u32 sent_info;          /* used in counting # sent packets */
-        u32 recv_info;          /* used in counting # recv'd packets */
+        u32 sent_pkts;
+        u32 recv_pkts;
         u32 sent_states;
         u32 recv_states;
         u32 sent_probes;
@@ -857,7 +857,6 @@ void tipc_link_reset(struct tipc_link *l)
         l->acked = 0;
         l->silent_intv_cnt = 0;
         l->rst_cnt = 0;
-        l->stats.recv_info = 0;
         l->stale_count = 0;
         l->bc_peer_is_up = false;
         memset(&l->mon_state, 0, sizeof(l->mon_state));
@@ -888,6 +887,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
         struct sk_buff_head *transmq = &l->transmq;
         struct sk_buff_head *backlogq = &l->backlogq;
         struct sk_buff *skb, *_skb, *bskb;
+        int pkt_cnt = skb_queue_len(list);
 
         /* Match msg importance against this and all higher backlog limits: */
         if (!skb_queue_empty(backlogq)) {
@@ -901,6 +901,11 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
                 return -EMSGSIZE;
         }
 
+        if (pkt_cnt > 1) {
+                l->stats.sent_fragmented++;
+                l->stats.sent_fragments += pkt_cnt;
+        }
+
         /* Prepare each packet for sending, and add to relevant queue: */
         while (skb_queue_len(list)) {
                 skb = skb_peek(list);
@@ -920,6 +925,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
                         __skb_queue_tail(xmitq, _skb);
                         TIPC_SKB_CB(skb)->ackers = l->ackers;
                         l->rcv_unacked = 0;
+                        l->stats.sent_pkts++;
                         seqno++;
                         continue;
                 }
@@ -968,6 +974,7 @@ void tipc_link_advance_backlog(struct tipc_link *l, struct sk_buff_head *xmitq)
                 msg_set_ack(hdr, ack);
                 msg_set_bcast_ack(hdr, bc_ack);
                 l->rcv_unacked = 0;
+                l->stats.sent_pkts++;
                 seqno++;
         }
         l->snd_nxt = seqno;
@@ -1260,7 +1267,7 @@ int tipc_link_rcv(struct tipc_link *l, struct sk_buff *skb,
 
                 /* Deliver packet */
                 l->rcv_nxt++;
-                l->stats.recv_info++;
+                l->stats.recv_pkts++;
                 if (!tipc_data_input(l, skb, l->inputq))
                         rc |= tipc_link_input(l, skb, l->inputq);
                 if (unlikely(++l->rcv_unacked >= TIPC_MIN_LINK_WIN))
@@ -1800,10 +1807,6 @@ void tipc_link_set_queue_limits(struct tipc_link *l, u32 win)
 void tipc_link_reset_stats(struct tipc_link *l)
 {
         memset(&l->stats, 0, sizeof(l->stats));
-        if (!link_is_bc_sndlink(l)) {
-                l->stats.sent_info = l->snd_nxt;
-                l->stats.recv_info = l->rcv_nxt;
-        }
 }
 
 static void link_print(struct tipc_link *l, const char *str)
@@ -1867,12 +1870,12 @@ static int __tipc_nl_add_stats(struct sk_buff *skb, struct tipc_stats *s)
         };
 
         struct nla_map map[] = {
-                {TIPC_NLA_STATS_RX_INFO, s->recv_info},
+                {TIPC_NLA_STATS_RX_INFO, 0},
                 {TIPC_NLA_STATS_RX_FRAGMENTS, s->recv_fragments},
                 {TIPC_NLA_STATS_RX_FRAGMENTED, s->recv_fragmented},
                 {TIPC_NLA_STATS_RX_BUNDLES, s->recv_bundles},
                 {TIPC_NLA_STATS_RX_BUNDLED, s->recv_bundled},
-                {TIPC_NLA_STATS_TX_INFO, s->sent_info},
+                {TIPC_NLA_STATS_TX_INFO, 0},
                 {TIPC_NLA_STATS_TX_FRAGMENTS, s->sent_fragments},
                 {TIPC_NLA_STATS_TX_FRAGMENTED, s->sent_fragmented},
                 {TIPC_NLA_STATS_TX_BUNDLES, s->sent_bundles},
@@ -1947,9 +1950,9 @@ int __tipc_nl_add_link(struct net *net, struct tipc_nl_msg *msg,
                 goto attr_msg_full;
         if (nla_put_u32(msg->skb, TIPC_NLA_LINK_MTU, link->mtu))
                 goto attr_msg_full;
-        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_RX, link->rcv_nxt))
+        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_RX, link->stats.recv_pkts))
                 goto attr_msg_full;
-        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_TX, link->snd_nxt))
+        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_TX, link->stats.sent_pkts))
                 goto attr_msg_full;
 
         if (tipc_link_is_up(link))
@@ -2004,12 +2007,12 @@ static int __tipc_nl_add_bc_link_stat(struct sk_buff *skb,
         };
 
         struct nla_map map[] = {
-                {TIPC_NLA_STATS_RX_INFO, stats->recv_info},
+                {TIPC_NLA_STATS_RX_INFO, stats->recv_pkts},
                 {TIPC_NLA_STATS_RX_FRAGMENTS, stats->recv_fragments},
                 {TIPC_NLA_STATS_RX_FRAGMENTED, stats->recv_fragmented},
                 {TIPC_NLA_STATS_RX_BUNDLES, stats->recv_bundles},
                 {TIPC_NLA_STATS_RX_BUNDLED, stats->recv_bundled},
-                {TIPC_NLA_STATS_TX_INFO, stats->sent_info},
+                {TIPC_NLA_STATS_TX_INFO, stats->sent_pkts},
                 {TIPC_NLA_STATS_TX_FRAGMENTS, stats->sent_fragments},
                 {TIPC_NLA_STATS_TX_FRAGMENTED, stats->sent_fragmented},
                 {TIPC_NLA_STATS_TX_BUNDLES, stats->sent_bundles},
@@ -2076,9 +2079,9 @@ int tipc_nl_add_bc_link(struct net *net, struct tipc_nl_msg *msg)
                 goto attr_msg_full;
         if (nla_put_string(msg->skb, TIPC_NLA_LINK_NAME, bcl->name))
                 goto attr_msg_full;
-        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_RX, bcl->rcv_nxt))
+        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_RX, 0))
                 goto attr_msg_full;
-        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_TX, bcl->snd_nxt))
+        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_TX, 0))
                 goto attr_msg_full;
 
         prop = nla_nest_start(msg->skb, TIPC_NLA_LINK_PROP);
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index 78cab9c5a445..b58dc95f3d35 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -697,6 +697,11 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
                 udp_conf.local_ip.s_addr = htonl(INADDR_ANY);
                 udp_conf.use_udp_checksums = false;
                 ub->ifindex = dev->ifindex;
+                if (tipc_mtu_bad(dev, sizeof(struct iphdr) +
+                                      sizeof(struct udphdr))) {
+                        err = -EINVAL;
+                        goto err;
+                }
                 b->mtu = dev->mtu - sizeof(struct iphdr)
                         - sizeof(struct udphdr);
 #if IS_ENABLED(CONFIG_IPV6)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index fd6986634e6f..5bf7e1bfeac7 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1268,12 +1268,14 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
                         err = security_xfrm_policy_lookup(pol->security,
                                                       fl->flowi_secid,
                                                       policy_to_flow_dir(dir));
-                        if (!err && !xfrm_pol_hold_rcu(pol))
-                                goto again;
-                        else if (err == -ESRCH)
+                        if (!err) {
+                                if (!xfrm_pol_hold_rcu(pol))
+                                        goto again;
+                        } else if (err == -ESRCH) {
                                 pol = NULL;
-                        else
+                        } else {
                                 pol = ERR_PTR(err);
+                        }
                 } else
                         pol = NULL;
         }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 08892091cfe3..671a1d0333f0 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2450,7 +2450,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 
 #ifdef CONFIG_COMPAT
         if (in_compat_syscall())
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 #endif
 
         type = nlh->nlmsg_type;