Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Infinite loop in _decode_session6(), from Eric Dumazet.

 2) Pass correct argument to nla_strlcpy() in netfilter, also from Eric
    Dumazet.

 3) Out of bounds memory access in ipv6 srh code, from Mathieu Xhonneux.

 4) NULL deref in XDP_REDIRECT handling of tun driver, from Toshiaki
    Makita.

 5) Incorrect idr release in cls_flower, from Paul Blakey.

 6) Probe error handling fix in davinci_emac, from Dan Carpenter.

 7) Memory leak in XPS configuration, from Alexander Duyck.

 8) Use after free with cloned sockets in kcm, from Kirill Tkhai.

 9) MTU handling fixes fo ip_tunnel and ip6_tunnel, from Nicolas
    Dichtel.

10) Fix UAPI hole in bpf data structure for 32-bit compat applications,
    from Daniel Borkmann.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (33 commits)
  bpf: fix uapi hole for 32 bit compat applications
  net: usb: cdc_mbim: add flag FLAG_SEND_ZLP
  ip6_tunnel: remove magic mtu value 0xFFF8
  ip_tunnel: restore binding to ifaces with a large mtu
  net: dsa: b53: Add BCM5389 support
  kcm: Fix use-after-free caused by clonned sockets
  net-sysfs: Fix memory leak in XPS configuration
  ixgbe: fix parsing of TC actions for HW offload
  net: ethernet: davinci_emac: fix error handling in probe()
  net/ncsi: Fix array size in dumpit handler
  cls_flower: Fix incorrect idr release when failing to modify rule
  net/sonic: Use dma_mapping_error()
  xfrm Fix potential error pointer dereference in xfrm_bundle_create.
  vhost_net: flush batched heads before trying to busy polling
  tun: Fix NULL pointer dereference in XDP redirect
  be2net: Fix error detection logic for BE3
  net: qmi_wwan: Add Netgear Aircard 779S
  mlxsw: spectrum: Forbid creation of VLAN 1 over port/LAG
  atm: zatm: fix memcmp casting
  iwlwifi: pcie: compare with number of IRQs requested for, not number of CPUs
  ...

19 files changed, 97 insertions, 64 deletions

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 28a4c3490359..6ba639f6c51d 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1954,7 +1954,8 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
         int off, pad = 0;
         unsigned int size_kern, match_size = mwt->match_size;
 
-        strlcpy(name, mwt->u.name, sizeof(name));
+        if (strscpy(name, mwt->u.name, sizeof(name)) < 0)
+                return -EINVAL;
 
         if (state->buf_kern_start)
                 dst = state->buf_kern_start + state->buf_kern_offset;
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index c476f0794132..bb7e80f4ced3 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -1214,9 +1214,6 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue,
         cpumask_var_t mask;
         unsigned long index;
 
-        if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
-                return -ENOMEM;
-
         index = get_netdev_queue_index(queue);
 
         if (dev->num_tc) {
@@ -1226,6 +1223,9 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue,
                         return -EINVAL;
         }
 
+        if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+                return -ENOMEM;
+
         rcu_read_lock();
         dev_maps = rcu_dereference(dev->xps_maps);
         if (dev_maps) {
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 6b0e362cc99b..38d906baf1df 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -328,7 +328,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
 
         if (tdev) {
                 hlen = tdev->hard_header_len + tdev->needed_headroom;
-                mtu = tdev->mtu;
+                mtu = min(tdev->mtu, IP_MAX_MTU);
         }
 
         dev->needed_headroom = t_hlen + hlen;
@@ -362,7 +362,7 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,
         nt = netdev_priv(dev);
         t_hlen = nt->hlen + sizeof(struct iphdr);
         dev->min_mtu = ETH_MIN_MTU;
-        dev->max_mtu = 0xFFF8 - dev->hard_header_len - t_hlen;
+        dev->max_mtu = IP_MAX_MTU - dev->hard_header_len - t_hlen;
         ip_tunnel_add(itn, nt);
         return nt;
 
@@ -930,7 +930,7 @@ int __ip_tunnel_change_mtu(struct net_device *dev, int new_mtu, bool strict)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         int t_hlen = tunnel->hlen + sizeof(struct iphdr);
-        int max_mtu = 0xFFF8 - dev->hard_header_len - t_hlen;
+        int max_mtu = IP_MAX_MTU - dev->hard_header_len - t_hlen;
 
         if (new_mtu < ETH_MIN_MTU)
                 return -EINVAL;
@@ -1107,7 +1107,7 @@ int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
 
         mtu = ip_tunnel_bind_dev(dev);
         if (tb[IFLA_MTU]) {
-                unsigned int max = 0xfff8 - dev->hard_header_len - nt->hlen;
+                unsigned int max = IP_MAX_MTU - dev->hard_header_len - nt->hlen;
 
                 mtu = clamp(dev->mtu, (unsigned int)ETH_MIN_MTU,
                             (unsigned int)(max - sizeof(struct iphdr)));
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index da66aaac51ce..00e138a44cbb 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1692,8 +1692,13 @@ int ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
                 if (new_mtu < ETH_MIN_MTU)
                         return -EINVAL;
         }
-        if (new_mtu > 0xFFF8 - dev->hard_header_len)
-                return -EINVAL;
+        if (tnl->parms.proto == IPPROTO_IPV6 || tnl->parms.proto == 0) {
+                if (new_mtu > IP6_MAX_MTU - dev->hard_header_len)
+                        return -EINVAL;
+        } else {
+                if (new_mtu > IP_MAX_MTU - dev->hard_header_len)
+                        return -EINVAL;
+        }
         dev->mtu = new_mtu;
         return 0;
 }
@@ -1841,7 +1846,7 @@ ip6_tnl_dev_init_gen(struct net_device *dev)
         if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                 dev->mtu -= 8;
         dev->min_mtu = ETH_MIN_MTU;
-        dev->max_mtu = 0xFFF8 - dev->hard_header_len;
+        dev->max_mtu = IP6_MAX_MTU - dev->hard_header_len;
 
         return 0;
 
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 5fe139484919..bf4763fd68c2 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -103,7 +103,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
         hdrlen = (osrh->hdrlen + 1) << 3;
         tot_len = hdrlen + sizeof(*hdr);
 
-        err = skb_cow_head(skb, tot_len);
+        err = skb_cow_head(skb, tot_len + skb->mac_len);
         if (unlikely(err))
                 return err;
 
@@ -161,7 +161,7 @@ int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh)
 
         hdrlen = (osrh->hdrlen + 1) << 3;
 
-        err = skb_cow_head(skb, hdrlen);
+        err = skb_cow_head(skb, hdrlen + skb->mac_len);
         if (unlikely(err))
                 return err;
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 2afce37a7177..e9400ffa7875 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1371,7 +1371,7 @@ static void ipip6_tunnel_setup(struct net_device *dev)
         dev->hard_header_len    = LL_MAX_HEADER + t_hlen;
         dev->mtu                = ETH_DATA_LEN - t_hlen;
         dev->min_mtu            = IPV6_MIN_MTU;
-        dev->max_mtu            = 0xFFF8 - t_hlen;
+        dev->max_mtu            = IP6_MAX_MTU - t_hlen;
         dev->flags              = IFF_NOARP;
         netif_keep_dst(dev);
         dev->addr_len           = 4;
@@ -1583,7 +1583,8 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev,
         if (tb[IFLA_MTU]) {
                 u32 mtu = nla_get_u32(tb[IFLA_MTU]);
 
-                if (mtu >= IPV6_MIN_MTU && mtu <= 0xFFF8 - dev->hard_header_len)
+                if (mtu >= IPV6_MIN_MTU &&
+                    mtu <= IP6_MAX_MTU - dev->hard_header_len)
                         dev->mtu = mtu;
         }
 
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 416fe67271a9..86dba282a147 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -126,7 +126,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
         struct flowi6 *fl6 = &fl->u.ip6;
         int onlyproto = 0;
         const struct ipv6hdr *hdr = ipv6_hdr(skb);
-        u16 offset = sizeof(*hdr);
+        u32 offset = sizeof(*hdr);
         struct ipv6_opt_hdr *exthdr;
         const unsigned char *nh = skb_network_header(skb);
         u16 nhoff = IP6CB(skb)->nhoff;
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index dc76bc346829..d3601d421571 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1671,7 +1671,7 @@ static struct file *kcm_clone(struct socket *osock)
         __module_get(newsock->ops->owner);
 
         newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL,
-                         &kcm_proto, true);
+                         &kcm_proto, false);
         if (!newsk) {
                 sock_release(newsock);
                 return ERR_PTR(-ENOMEM);
diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c
index 8d7e849d4825..41cede4041d3 100644
--- a/net/ncsi/ncsi-netlink.c
+++ b/net/ncsi/ncsi-netlink.c
@@ -215,7 +215,7 @@ err:
 static int ncsi_pkg_info_all_nl(struct sk_buff *skb,
                                 struct netlink_callback *cb)
 {
-        struct nlattr *attrs[NCSI_ATTR_MAX];
+        struct nlattr *attrs[NCSI_ATTR_MAX + 1];
         struct ncsi_package *np, *package;
         struct ncsi_dev_priv *ndp;
         unsigned int package_id;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index f36098887ad0..3ecca0616d8c 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2381,8 +2381,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                         struct ipvs_sync_daemon_cfg cfg;
 
                         memset(&cfg, 0, sizeof(cfg));
-                        strlcpy(cfg.mcast_ifn, dm->mcast_ifn,
-                                sizeof(cfg.mcast_ifn));
+                        ret = -EINVAL;
+                        if (strscpy(cfg.mcast_ifn, dm->mcast_ifn,
+                                    sizeof(cfg.mcast_ifn)) <= 0)
+                                goto out_dec;
                         cfg.syncid = dm->syncid;
                         ret = start_sync_thread(ipvs, &cfg, dm->state);
                 } else {
@@ -2420,12 +2422,19 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                 }
         }
 
+        if ((cmd == IP_VS_SO_SET_ADD || cmd == IP_VS_SO_SET_EDIT) &&
+            strnlen(usvc.sched_name, IP_VS_SCHEDNAME_MAXLEN) ==
+            IP_VS_SCHEDNAME_MAXLEN) {
+                ret = -EINVAL;
+                goto out_unlock;
+        }
+
         /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
         if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
             usvc.protocol != IPPROTO_SCTP) {
-                pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
+                pr_err("set_ctl: invalid protocol: %d %pI4:%d\n",
                        usvc.protocol, &usvc.addr.ip,
-                       ntohs(usvc.port), usvc.sched_name);
+                       ntohs(usvc.port));
                 ret = -EFAULT;
                 goto out_unlock;
         }
@@ -2847,7 +2856,7 @@ static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
         [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
         [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
-                                            .len = IP_VS_IFNAME_MAXLEN },
+                                            .len = IP_VS_IFNAME_MAXLEN - 1 },
         [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
         [IPVS_DAEMON_ATTR_SYNC_MAXLEN]  = { .type = NLA_U16 },
         [IPVS_DAEMON_ATTR_MCAST_GROUP]  = { .type = NLA_U32 },
@@ -2865,7 +2874,7 @@ static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
         [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
         [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
         [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
-                                            .len = IP_VS_SCHEDNAME_MAXLEN },
+                                            .len = IP_VS_SCHEDNAME_MAXLEN - 1 },
         [IPVS_SVC_ATTR_PE_NAME]         = { .type = NLA_NUL_STRING,
                                             .len = IP_VS_PENAME_MAXLEN },
         [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 91e80aa852d6..501e48a7965b 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1298,8 +1298,10 @@ static void nft_chain_stats_replace(struct nft_base_chain *chain,
                 rcu_assign_pointer(chain->stats, newstats);
                 synchronize_rcu();
                 free_percpu(oldstats);
-        } else
+        } else {
                 rcu_assign_pointer(chain->stats, newstats);
+                static_branch_inc(&nft_counters_enabled);
+        }
 }
 
 static void nf_tables_chain_destroy(struct nft_ctx *ctx)
@@ -4706,7 +4708,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
                         if (idx > s_idx)
                                 memset(&cb->args[1], 0,
                                        sizeof(cb->args) - sizeof(cb->args[0]));
-                        if (filter && filter->table[0] &&
+                        if (filter && filter->table &&
                             strcmp(filter->table, table->name))
                                 goto cont;
                         if (filter &&
@@ -5380,7 +5382,7 @@ static int nf_tables_dump_flowtable(struct sk_buff *skb,
                         if (idx > s_idx)
                                 memset(&cb->args[1], 0,
                                        sizeof(cb->args) - sizeof(cb->args[0]));
-                        if (filter && filter->table[0] &&
+                        if (filter && filter->table &&
                             strcmp(filter->table, table->name))
                                 goto cont;
 
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 942702a2776f..40e744572283 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -126,15 +126,15 @@ static noinline void nft_update_chain_stats(const struct nft_chain *chain,
         if (!base_chain->stats)
                 return;
 
+        local_bh_disable();
         stats = this_cpu_ptr(rcu_dereference(base_chain->stats));
         if (stats) {
-                local_bh_disable();
                 u64_stats_update_begin(&stats->syncp);
                 stats->pkts++;
                 stats->bytes += pkt->skb->len;
                 u64_stats_update_end(&stats->syncp);
-                local_bh_enable();
         }
+        local_bh_enable();
 }
 
 struct nft_jumpstack {
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 6ddf89183e7b..a0e5adf0b3b6 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -115,7 +115,7 @@ static int nfnl_acct_new(struct net *net, struct sock *nfnl,
                 nfacct->flags = flags;
         }
 
-        nla_strlcpy(nfacct->name, nla_data(tb[NFACCT_NAME]), NFACCT_NAME_MAX);
+        nla_strlcpy(nfacct->name, tb[NFACCT_NAME], NFACCT_NAME_MAX);
 
         if (tb[NFACCT_BYTES]) {
                 atomic64_set(&nfacct->bytes,
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index fa026b269b36..cb5b5f207777 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -150,7 +150,7 @@ nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy,
                 return -EINVAL;
 
         nla_strlcpy(expect_policy->name,
-                    nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN);
+                    tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN);
         expect_policy->max_expected =
                 ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
         if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
@@ -235,7 +235,7 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
                 goto err1;
 
         nla_strlcpy(helper->name,
-                    nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
+                    tb[NFCTH_NAME], NF_CT_HELPER_NAME_LEN);
         size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
         if (size > FIELD_SIZEOF(struct nf_conn_help, data)) {
                 ret = -ENOMEM;
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index ea737fd789e8..5c0de704bad5 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -880,22 +880,26 @@ static int nft_ct_helper_obj_dump(struct sk_buff *skb,
                                   struct nft_object *obj, bool reset)
 {
         const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
-        const struct nf_conntrack_helper *helper = priv->helper4;
+        const struct nf_conntrack_helper *helper;
         u16 family;
 
+        if (priv->helper4 && priv->helper6) {
+                family = NFPROTO_INET;
+                helper = priv->helper4;
+        } else if (priv->helper6) {
+                family = NFPROTO_IPV6;
+                helper = priv->helper6;
+        } else {
+                family = NFPROTO_IPV4;
+                helper = priv->helper4;
+        }
+
         if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
                 return -1;
 
         if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
                 return -1;
 
-        if (priv->helper4 && priv->helper6)
-                family = NFPROTO_INET;
-        else if (priv->helper6)
-                family = NFPROTO_IPV6;
-        else
-                family = NFPROTO_IPV4;
-
         if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
                 return -1;
 
diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index a9fc298ef4c3..72f13a1144dd 100644
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -51,10 +51,13 @@ static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost)
         return !limit->invert;
 }
 
+/* Use same default as in iptables. */
+#define NFT_LIMIT_PKT_BURST_DEFAULT     5
+
 static int nft_limit_init(struct nft_limit *limit,
-                          const struct nlattr * const tb[])
+                          const struct nlattr * const tb[], bool pkts)
 {
-        u64 unit;
+        u64 unit, tokens;
 
         if (tb[NFTA_LIMIT_RATE] == NULL ||
             tb[NFTA_LIMIT_UNIT] == NULL)
@@ -68,18 +71,25 @@ static int nft_limit_init(struct nft_limit *limit,
 
         if (tb[NFTA_LIMIT_BURST])
                 limit->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST]));
-        else
-                limit->burst = 0;
+
+        if (pkts && limit->burst == 0)
+                limit->burst = NFT_LIMIT_PKT_BURST_DEFAULT;
 
         if (limit->rate + limit->burst < limit->rate)
                 return -EOVERFLOW;
 
-        /* The token bucket size limits the number of tokens can be
-         * accumulated. tokens_max specifies the bucket size.
-         * tokens_max = unit * (rate + burst) / rate.
-         */
-        limit->tokens = div_u64(limit->nsecs * (limit->rate + limit->burst),
-                                limit->rate);
+        if (pkts) {
+                tokens = div_u64(limit->nsecs, limit->rate) * limit->burst;
+        } else {
+                /* The token bucket size limits the number of tokens can be
+                 * accumulated. tokens_max specifies the bucket size.
+                 * tokens_max = unit * (rate + burst) / rate.
+                 */
+                tokens = div_u64(limit->nsecs * (limit->rate + limit->burst),
+                                 limit->rate);
+        }
+
+        limit->tokens = tokens;
         limit->tokens_max = limit->tokens;
 
         if (tb[NFTA_LIMIT_FLAGS]) {
@@ -144,7 +154,7 @@ static int nft_limit_pkts_init(const struct nft_ctx *ctx,
         struct nft_limit_pkts *priv = nft_expr_priv(expr);
         int err;
 
-        err = nft_limit_init(&priv->limit, tb);
+        err = nft_limit_init(&priv->limit, tb, true);
         if (err < 0)
                 return err;
 
@@ -185,7 +195,7 @@ static int nft_limit_bytes_init(const struct nft_ctx *ctx,
 {
         struct nft_limit *priv = nft_expr_priv(expr);
 
-        return nft_limit_init(priv, tb);
+        return nft_limit_init(priv, tb, false);
 }
 
 static int nft_limit_bytes_dump(struct sk_buff *skb,
@@ -246,7 +256,7 @@ static int nft_limit_obj_pkts_init(const struct nft_ctx *ctx,
         struct nft_limit_pkts *priv = nft_obj_data(obj);
         int err;
 
-        err = nft_limit_init(&priv->limit, tb);
+        err = nft_limit_init(&priv->limit, tb, true);
         if (err < 0)
                 return err;
 
@@ -289,7 +299,7 @@ static int nft_limit_obj_bytes_init(const struct nft_ctx *ctx,
 {
         struct nft_limit *priv = nft_obj_data(obj);
 
-        return nft_limit_init(priv, tb);
+        return nft_limit_init(priv, tb, false);
 }
 
 static int nft_limit_obj_bytes_dump(struct sk_buff *skb,
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 8fb91940e2e7..204af9899482 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -234,7 +234,7 @@ void nft_meta_set_eval(const struct nft_expr *expr,
         struct sk_buff *skb = pkt->skb;
         u32 *sreg = &regs->data[meta->sreg];
         u32 value = *sreg;
-        u8 pkt_type;
+        u8 value8;
 
         switch (meta->key) {
         case NFT_META_MARK:
@@ -244,15 +244,17 @@ void nft_meta_set_eval(const struct nft_expr *expr,
                 skb->priority = value;
                 break;
         case NFT_META_PKTTYPE:
-                pkt_type = nft_reg_load8(sreg);
+                value8 = nft_reg_load8(sreg);
 
-                if (skb->pkt_type != pkt_type &&
-                    skb_pkt_type_ok(pkt_type) &&
+                if (skb->pkt_type != value8 &&
+                    skb_pkt_type_ok(value8) &&
                     skb_pkt_type_ok(skb->pkt_type))
-                        skb->pkt_type = pkt_type;
+                        skb->pkt_type = value8;
                 break;
         case NFT_META_NFTRACE:
-                skb->nf_trace = !!value;
+                value8 = nft_reg_load8(sreg);
+
+                skb->nf_trace = !!value8;
                 break;
         default:
                 WARN_ON(1);
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index d964e60c730e..c79f6e71512e 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -977,7 +977,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
         return 0;
 
 errout_idr:
-        if (fnew->handle)
+        if (!fold)
                 idr_remove(&head->handle_idr, fnew->handle);
 errout:
         tcf_exts_destroy(&fnew->exts);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 40b54cc64243..5f48251c1319 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1658,7 +1658,6 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
                 trailer_len -= xdst_prev->u.dst.xfrm->props.trailer_len;
         }
 
-out:
         return &xdst0->u.dst;
 
 put_states:
@@ -1667,8 +1666,8 @@ put_states:
 free_dst:
         if (xdst0)
                 dst_release_immediate(&xdst0->u.dst);
-        xdst0 = ERR_PTR(err);
-        goto out;
+
+        return ERR_PTR(err);
 }
 
 static int xfrm_expand_policies(const struct flowi *fl, u16 family,