Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

32 files changed, 262 insertions, 136 deletions

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index c996c09d095f..b2c807f67aba 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -939,9 +939,6 @@ struct ubuf_info *sock_zerocopy_alloc(struct sock *sk, size_t size)
 
         WARN_ON_ONCE(!in_task());
 
-        if (!sock_flag(sk, SOCK_ZEROCOPY))
-                return NULL;
-
         skb = sock_omalloc(sk, 0, GFP_KERNEL);
         if (!skb)
                 return NULL;
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index cab3e4a5124b..da930b01a147 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -602,6 +602,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *skb,
                         nextp = &fp->next;
                         fp->prev = NULL;
                         memset(&fp->rbnode, 0, sizeof(fp->rbnode));
+                        fp->sk = NULL;
                         head->data_len += fp->len;
                         head->len += fp->len;
                         if (head->ip_summed != fp->ip_summed)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index ae714aecc31c..8cce0e9ea08c 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -178,6 +178,9 @@ static void ipgre_err(struct sk_buff *skb, u32 info,
 
         if (tpi->proto == htons(ETH_P_TEB))
                 itn = net_generic(net, gre_tap_net_id);
+        else if (tpi->proto == htons(ETH_P_ERSPAN) ||
+                 tpi->proto == htons(ETH_P_ERSPAN2))
+                itn = net_generic(net, erspan_net_id);
         else
                 itn = net_generic(net, ipgre_net_id);
 
@@ -328,6 +331,8 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                 ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error);
                 return PACKET_RCVD;
         }
+        return PACKET_REJECT;
+
 drop:
         kfree_skb(skb);
         return PACKET_RCVD;
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index d9504adc47b3..184bf2e0a1ed 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -106,6 +106,10 @@ config NF_NAT_IPV4
 
 if NF_NAT_IPV4
 
+config NF_NAT_MASQUERADE_IPV4
+        bool
+
+if NF_TABLES
 config NFT_CHAIN_NAT_IPV4
         depends on NF_TABLES_IPV4
         tristate "IPv4 nf_tables nat chain support"
@@ -115,9 +119,6 @@ config NFT_CHAIN_NAT_IPV4
           packet transformations such as the source, destination address and
           source and destination ports.
 
-config NF_NAT_MASQUERADE_IPV4
-        bool
-
 config NFT_MASQ_IPV4
         tristate "IPv4 masquerading support for nf_tables"
         depends on NF_TABLES_IPV4
@@ -135,6 +136,7 @@ config NFT_REDIR_IPV4
         help
           This is the expression that provides IPv4 redirect support for
           nf_tables.
+endif # NF_TABLES
 
 config NF_NAT_SNMP_BASIC
         tristate "Basic SNMP-ALG support"
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 8c4235c098fd..67670fac7c8d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1185,7 +1185,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
 
         flags = msg->msg_flags;
 
-        if (flags & MSG_ZEROCOPY && size) {
+        if (flags & MSG_ZEROCOPY && size && sock_flag(sk, SOCK_ZEROCOPY)) {
                 if (sk->sk_state != TCP_ESTABLISHED) {
                         err = -EINVAL;
                         goto out_err;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 62508a2f9b21..d9034073138c 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6380,8 +6380,8 @@ static bool tcp_syn_flood_action(const struct sock *sk,
         if (!queue->synflood_warned &&
             net->ipv4.sysctl_tcp_syncookies != 2 &&
             xchg(&queue->synflood_warned, 1) == 0)
-                pr_info("%s: Possible SYN flooding on port %d. %s.  Check SNMP counters.\n",
-                        proto, ntohs(tcp_hdr(skb)->dest), msg);
+                net_info_ratelimited("%s: Possible SYN flooding on port %d. %s.  Check SNMP counters.\n",
+                                     proto, ntohs(tcp_hdr(skb)->dest), msg);
 
         return want_cookie;
 }
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 00e20004d241..b8ac369f98ad 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -445,6 +445,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct sk_buff *prev,  struct net_devic
                 else if (head->ip_summed == CHECKSUM_COMPLETE)
                         head->csum = csum_add(head->csum, fp->csum);
                 head->truesize += fp->truesize;
+                fp->sk = NULL;
         }
         sub_frag_mem_limit(fq->q.net, head->truesize);
 
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index a21d8ed0a325..e2f16a0173a9 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -351,20 +351,28 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
                 memcpy(&phs_hdr->iucv_hdr, imsg, sizeof(struct iucv_message));
 
         skb->dev = iucv->hs_dev;
-        if (!skb->dev)
-                return -ENODEV;
-        if (!(skb->dev->flags & IFF_UP) || !netif_carrier_ok(skb->dev))
-                return -ENETDOWN;
+        if (!skb->dev) {
+                err = -ENODEV;
+                goto err_free;
+        }
+        if (!(skb->dev->flags & IFF_UP) || !netif_carrier_ok(skb->dev)) {
+                err = -ENETDOWN;
+                goto err_free;
+        }
         if (skb->len > skb->dev->mtu) {
-                if (sock->sk_type == SOCK_SEQPACKET)
-                        return -EMSGSIZE;
-                else
-                        skb_trim(skb, skb->dev->mtu);
+                if (sock->sk_type == SOCK_SEQPACKET) {
+                        err = -EMSGSIZE;
+                        goto err_free;
+                }
+                skb_trim(skb, skb->dev->mtu);
         }
         skb->protocol = cpu_to_be16(ETH_P_AF_IUCV);
         nskb = skb_clone(skb, GFP_ATOMIC);
-        if (!nskb)
-                return -ENOMEM;
+        if (!nskb) {
+                err = -ENOMEM;
+                goto err_free;
+        }
+
         skb_queue_tail(&iucv->send_skb_q, nskb);
         err = dev_queue_xmit(skb);
         if (net_xmit_eval(err)) {
@@ -375,6 +383,10 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
                 WARN_ON(atomic_read(&iucv->msg_recv) < 0);
         }
         return net_xmit_eval(err);
+
+err_free:
+        kfree_skb(skb);
+        return err;
 }
 
 static struct sock *__iucv_get_sock_by_name(char *nm)
@@ -1167,7 +1179,7 @@ static int iucv_sock_sendmsg(struct socket *sock, struct msghdr *msg,
                 err = afiucv_hs_send(&txmsg, sk, skb, 0);
                 if (err) {
                         atomic_dec(&iucv->msg_sent);
-                        goto fail;
+                        goto out;
                 }
         } else { /* Classic VM IUCV transport */
                 skb_queue_tail(&iucv->send_skb_q, skb);
@@ -2155,8 +2167,8 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
         struct sock *sk;
         struct iucv_sock *iucv;
         struct af_iucv_trans_hdr *trans_hdr;
+        int err = NET_RX_SUCCESS;
         char nullstring[8];
-        int err = 0;
 
         if (skb->len < (ETH_HLEN + sizeof(struct af_iucv_trans_hdr))) {
                 WARN_ONCE(1, "AF_IUCV too short skb, len=%d, min=%d",
@@ -2254,7 +2266,7 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
                 err = afiucv_hs_callback_rx(sk, skb);
                 break;
         default:
-                ;
+                kfree_skb(skb);
         }
 
         return err;
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 8f7ef167c45a..eb502c6290c2 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -1874,7 +1874,7 @@ static void iucv_pm_complete(struct device *dev)
  * Returns 0 if there are still iucv pathes defined
  *         1 if there are no iucv pathes defined
  */
-int iucv_path_table_empty(void)
+static int iucv_path_table_empty(void)
 {
         int i;
 
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 71709c104081..f61c306de1d0 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -771,13 +771,13 @@ config NETFILTER_XT_TARGET_CHECKSUM
         depends on NETFILTER_ADVANCED
         ---help---
           This option adds a `CHECKSUM' target, which can be used in the iptables mangle
-          table.
+          table to work around buggy DHCP clients in virtualized environments.
 
-          You can use this target to compute and fill in the checksum in
-          a packet that lacks a checksum.  This is particularly useful,
-          if you need to work around old applications such as dhcp clients,
-          that do not work well with checksum offloads, but don't want to disable
-          checksum offload in your device.
+          Some old DHCP clients drop packets because they are not aware
+          that the checksum would normally be offloaded to hardware and
+          thus should be considered valid.
+          This target can be used to fill in the checksum using iptables
+          when such packets are sent via a virtual network device.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index 9f14b0df6960..51c5d7eec0a3 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -776,9 +776,26 @@ static const struct nf_hook_ops ipv6_conntrack_ops[] = {
 };
 #endif
 
+static int nf_ct_tcp_fixup(struct nf_conn *ct, void *_nfproto)
+{
+        u8 nfproto = (unsigned long)_nfproto;
+
+        if (nf_ct_l3num(ct) != nfproto)
+                return 0;
+
+        if (nf_ct_protonum(ct) == IPPROTO_TCP &&
+            ct->proto.tcp.state == TCP_CONNTRACK_ESTABLISHED) {
+                ct->proto.tcp.seen[0].td_maxwin = 0;
+                ct->proto.tcp.seen[1].td_maxwin = 0;
+        }
+
+        return 0;
+}
+
 static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
 {
         struct nf_conntrack_net *cnet = net_generic(net, nf_conntrack_net_id);
+        bool fixup_needed = false;
         int err = 0;
 
         mutex_lock(&nf_ct_proto_mutex);
@@ -798,6 +815,8 @@ static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
                                             ARRAY_SIZE(ipv4_conntrack_ops));
                 if (err)
                         cnet->users4 = 0;
+                else
+                        fixup_needed = true;
                 break;
 #if IS_ENABLED(CONFIG_IPV6)
         case NFPROTO_IPV6:
@@ -814,6 +833,8 @@ static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
                                             ARRAY_SIZE(ipv6_conntrack_ops));
                 if (err)
                         cnet->users6 = 0;
+                else
+                        fixup_needed = true;
                 break;
 #endif
         default:
@@ -822,6 +843,11 @@ static int nf_ct_netns_do_get(struct net *net, u8 nfproto)
         }
  out_unlock:
         mutex_unlock(&nf_ct_proto_mutex);
+
+        if (fixup_needed)
+                nf_ct_iterate_cleanup_net(net, nf_ct_tcp_fixup,
+                                          (void *)(unsigned long)nfproto, 0, 0);
+
         return err;
 }
 
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index 8c58f96b59e7..f3f91ed2c21a 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -675,7 +675,7 @@ static int nlattr_to_dccp(struct nlattr *cda[], struct nf_conn *ct)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -697,6 +697,8 @@ static int dccp_timeout_nlattr_to_obj(struct nlattr *tb[],
                         timeouts[i] = ntohl(nla_get_be32(tb[i])) * HZ;
                 }
         }
+
+        timeouts[CTA_TIMEOUT_DCCP_UNSPEC] = timeouts[CTA_TIMEOUT_DCCP_REQUEST];
         return 0;
 }
 
@@ -726,7 +728,7 @@ dccp_timeout_nla_policy[CTA_TIMEOUT_DCCP_MAX+1] = {
         [CTA_TIMEOUT_DCCP_CLOSING]      = { .type = NLA_U32 },
         [CTA_TIMEOUT_DCCP_TIMEWAIT]     = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 #ifdef CONFIG_SYSCTL
 /* template, data assigned later */
@@ -827,6 +829,11 @@ static int dccp_init_net(struct net *net, u_int16_t proto)
                 dn->dccp_timeout[CT_DCCP_CLOSEREQ]      = 64 * HZ;
                 dn->dccp_timeout[CT_DCCP_CLOSING]       = 64 * HZ;
                 dn->dccp_timeout[CT_DCCP_TIMEWAIT]      = 2 * DCCP_MSL;
+
+                /* timeouts[0] is unused, make it same as SYN_SENT so
+                 * ->timeouts[0] contains 'new' timeout, like udp or icmp.
+                 */
+                dn->dccp_timeout[CT_DCCP_NONE] = dn->dccp_timeout[CT_DCCP_REQUEST];
         }
 
         return dccp_kmemdup_sysctl_table(net, pn, dn);
@@ -856,7 +863,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4 = {
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = dccp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = dccp_timeout_obj_to_nlattr,
@@ -864,7 +871,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4 = {
                 .obj_size       = sizeof(unsigned int) * CT_DCCP_MAX,
                 .nla_policy     = dccp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = dccp_init_net,
         .get_net_proto          = dccp_get_net_proto,
 };
@@ -889,7 +896,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6 = {
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = dccp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = dccp_timeout_obj_to_nlattr,
@@ -897,7 +904,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6 = {
                 .obj_size       = sizeof(unsigned int) * CT_DCCP_MAX,
                 .nla_policy     = dccp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = dccp_init_net,
         .get_net_proto          = dccp_get_net_proto,
 };
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index ac4a0b296dcd..1df3244ecd07 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -70,7 +70,7 @@ static bool generic_new(struct nf_conn *ct, const struct sk_buff *skb,
         return ret;
 }
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -113,7 +113,7 @@ static const struct nla_policy
 generic_timeout_nla_policy[CTA_TIMEOUT_GENERIC_MAX+1] = {
         [CTA_TIMEOUT_GENERIC_TIMEOUT]   = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_table generic_sysctl_table[] = {
@@ -164,7 +164,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =
         .pkt_to_tuple           = generic_pkt_to_tuple,
         .packet                 = generic_packet,
         .new                    = generic_new,
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = generic_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = generic_timeout_obj_to_nlattr,
@@ -172,7 +172,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_generic =
                 .obj_size       = sizeof(unsigned int),
                 .nla_policy     = generic_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = generic_init_net,
         .get_net_proto          = generic_get_net_proto,
 };
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index d1632252bf5b..650eb4fba2c5 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -285,7 +285,7 @@ static void gre_destroy(struct nf_conn *ct)
                 nf_ct_gre_keymap_destroy(master);
 }
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -334,7 +334,7 @@ gre_timeout_nla_policy[CTA_TIMEOUT_GRE_MAX+1] = {
         [CTA_TIMEOUT_GRE_UNREPLIED]     = { .type = NLA_U32 },
         [CTA_TIMEOUT_GRE_REPLIED]       = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 static int gre_init_net(struct net *net, u_int16_t proto)
 {
@@ -367,7 +367,7 @@ static const struct nf_conntrack_l4proto nf_conntrack_l4proto_gre4 = {
         .nlattr_to_tuple = nf_ct_port_nlattr_to_tuple,
         .nla_policy      = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout    = {
                 .nlattr_to_obj  = gre_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = gre_timeout_obj_to_nlattr,
@@ -375,7 +375,7 @@ static const struct nf_conntrack_l4proto nf_conntrack_l4proto_gre4 = {
                 .obj_size       = sizeof(unsigned int) * GRE_CT_MAX,
                 .nla_policy     = gre_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .net_id         = &proto_gre_net_id,
         .init_net       = gre_init_net,
 };
diff --git a/net/netfilter/nf_conntrack_proto_icmp.c b/net/netfilter/nf_conntrack_proto_icmp.c
index 036670b38282..43c7e1a217b9 100644
--- a/net/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/netfilter/nf_conntrack_proto_icmp.c
@@ -273,7 +273,7 @@ static unsigned int icmp_nlattr_tuple_size(void)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -313,7 +313,7 @@ static const struct nla_policy
 icmp_timeout_nla_policy[CTA_TIMEOUT_ICMP_MAX+1] = {
         [CTA_TIMEOUT_ICMP_TIMEOUT]      = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_table icmp_sysctl_table[] = {
@@ -374,7 +374,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp =
         .nlattr_to_tuple        = icmp_nlattr_to_tuple,
         .nla_policy             = icmp_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = icmp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = icmp_timeout_obj_to_nlattr,
@@ -382,7 +382,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp =
                 .obj_size       = sizeof(unsigned int),
                 .nla_policy     = icmp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = icmp_init_net,
         .get_net_proto          = icmp_get_net_proto,
 };
diff --git a/net/netfilter/nf_conntrack_proto_icmpv6.c b/net/netfilter/nf_conntrack_proto_icmpv6.c
index bed07b998a10..97e40f77d678 100644
--- a/net/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/netfilter/nf_conntrack_proto_icmpv6.c
@@ -274,7 +274,7 @@ static unsigned int icmpv6_nlattr_tuple_size(void)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -314,7 +314,7 @@ static const struct nla_policy
 icmpv6_timeout_nla_policy[CTA_TIMEOUT_ICMPV6_MAX+1] = {
         [CTA_TIMEOUT_ICMPV6_TIMEOUT]    = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_table icmpv6_sysctl_table[] = {
@@ -373,7 +373,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 =
         .nlattr_to_tuple        = icmpv6_nlattr_to_tuple,
         .nla_policy             = icmpv6_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = icmpv6_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = icmpv6_timeout_obj_to_nlattr,
@@ -381,7 +381,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 =
                 .obj_size       = sizeof(unsigned int),
                 .nla_policy     = icmpv6_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = icmpv6_init_net,
         .get_net_proto          = icmpv6_get_net_proto,
 };
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 8d1e085fc14a..e4d738d34cd0 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -591,7 +591,7 @@ static int nlattr_to_sctp(struct nlattr *cda[], struct nf_conn *ct)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -613,6 +613,8 @@ static int sctp_timeout_nlattr_to_obj(struct nlattr *tb[],
                         timeouts[i] = ntohl(nla_get_be32(tb[i])) * HZ;
                 }
         }
+
+        timeouts[CTA_TIMEOUT_SCTP_UNSPEC] = timeouts[CTA_TIMEOUT_SCTP_CLOSED];
         return 0;
 }
 
@@ -644,7 +646,7 @@ sctp_timeout_nla_policy[CTA_TIMEOUT_SCTP_MAX+1] = {
         [CTA_TIMEOUT_SCTP_HEARTBEAT_SENT]       = { .type = NLA_U32 },
         [CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED]      = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 
 #ifdef CONFIG_SYSCTL
@@ -743,6 +745,11 @@ static int sctp_init_net(struct net *net, u_int16_t proto)
 
                 for (i = 0; i < SCTP_CONNTRACK_MAX; i++)
                         sn->timeouts[i] = sctp_timeouts[i];
+
+                /* timeouts[0] is unused, init it so ->timeouts[0] contains
+                 * 'new' timeout, like udp or icmp.
+                 */
+                sn->timeouts[0] = sctp_timeouts[SCTP_CONNTRACK_CLOSED];
         }
 
         return sctp_kmemdup_sysctl_table(pn, sn);
@@ -773,7 +780,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 = {
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = sctp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = sctp_timeout_obj_to_nlattr,
@@ -781,7 +788,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 = {
                 .obj_size       = sizeof(unsigned int) * SCTP_CONNTRACK_MAX,
                 .nla_policy     = sctp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = sctp_init_net,
         .get_net_proto          = sctp_get_net_proto,
 };
@@ -806,7 +813,8 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 = {
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nlattr_to_tuple        = nf_ct_port_nlattr_to_tuple,
         .nla_policy             = nf_ct_port_nla_policy,
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#endif
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = sctp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = sctp_timeout_obj_to_nlattr,
@@ -814,8 +822,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 = {
                 .obj_size       = sizeof(unsigned int) * SCTP_CONNTRACK_MAX,
                 .nla_policy     = sctp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
-#endif
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = sctp_init_net,
         .get_net_proto          = sctp_get_net_proto,
 };
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index d80d322b9d8b..b4bdf9eda7b7 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1279,7 +1279,7 @@ static unsigned int tcp_nlattr_tuple_size(void)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -1301,6 +1301,7 @@ static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[],
                 timeouts[TCP_CONNTRACK_SYN_SENT] =
                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_SENT]))*HZ;
         }
+
         if (tb[CTA_TIMEOUT_TCP_SYN_RECV]) {
                 timeouts[TCP_CONNTRACK_SYN_RECV] =
                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_SYN_RECV]))*HZ;
@@ -1341,6 +1342,8 @@ static int tcp_timeout_nlattr_to_obj(struct nlattr *tb[],
                 timeouts[TCP_CONNTRACK_UNACK] =
                         ntohl(nla_get_be32(tb[CTA_TIMEOUT_TCP_UNACK]))*HZ;
         }
+
+        timeouts[CTA_TIMEOUT_TCP_UNSPEC] = timeouts[CTA_TIMEOUT_TCP_SYN_SENT];
         return 0;
 }
 
@@ -1391,7 +1394,7 @@ static const struct nla_policy tcp_timeout_nla_policy[CTA_TIMEOUT_TCP_MAX+1] = {
         [CTA_TIMEOUT_TCP_RETRANS]       = { .type = NLA_U32 },
         [CTA_TIMEOUT_TCP_UNACK]         = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_table tcp_sysctl_table[] = {
@@ -1518,6 +1521,10 @@ static int tcp_init_net(struct net *net, u_int16_t proto)
                 for (i = 0; i < TCP_CONNTRACK_TIMEOUT_MAX; i++)
                         tn->timeouts[i] = tcp_timeouts[i];
 
+                /* timeouts[0] is unused, make it same as SYN_SENT so
+                 * ->timeouts[0] contains 'new' timeout, like udp or icmp.
+                 */
+                tn->timeouts[0] = tcp_timeouts[TCP_CONNTRACK_SYN_SENT];
                 tn->tcp_loose = nf_ct_tcp_loose;
                 tn->tcp_be_liberal = nf_ct_tcp_be_liberal;
                 tn->tcp_max_retrans = nf_ct_tcp_max_retrans;
@@ -1551,7 +1558,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 =
         .nlattr_size            = TCP_NLATTR_SIZE,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = tcp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = tcp_timeout_obj_to_nlattr,
@@ -1560,7 +1567,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 =
                                         TCP_CONNTRACK_TIMEOUT_MAX,
                 .nla_policy     = tcp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = tcp_init_net,
         .get_net_proto          = tcp_get_net_proto,
 };
@@ -1586,7 +1593,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 =
         .nlattr_tuple_size      = tcp_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = tcp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = tcp_timeout_obj_to_nlattr,
@@ -1595,7 +1602,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp6 =
                                         TCP_CONNTRACK_TIMEOUT_MAX,
                 .nla_policy     = tcp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = tcp_init_net,
         .get_net_proto          = tcp_get_net_proto,
 };
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 7a1b8988a931..3065fb8ef91b 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -171,7 +171,7 @@ static int udp_error(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
         return NF_ACCEPT;
 }
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_cttimeout.h>
@@ -221,7 +221,7 @@ udp_timeout_nla_policy[CTA_TIMEOUT_UDP_MAX+1] = {
        [CTA_TIMEOUT_UDP_UNREPLIED]      = { .type = NLA_U32 },
        [CTA_TIMEOUT_UDP_REPLIED]        = { .type = NLA_U32 },
 };
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_table udp_sysctl_table[] = {
@@ -292,7 +292,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udp4 =
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = udp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = udp_timeout_obj_to_nlattr,
@@ -300,7 +300,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udp4 =
                 .obj_size       = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
                 .nla_policy     = udp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = udp_init_net,
         .get_net_proto          = udp_get_net_proto,
 };
@@ -321,7 +321,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 =
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = udp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = udp_timeout_obj_to_nlattr,
@@ -329,7 +329,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite4 =
                 .obj_size       = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
                 .nla_policy     = udp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = udp_init_net,
         .get_net_proto          = udp_get_net_proto,
 };
@@ -350,7 +350,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6 =
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = udp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = udp_timeout_obj_to_nlattr,
@@ -358,7 +358,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udp6 =
                 .obj_size       = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
                 .nla_policy     = udp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = udp_init_net,
         .get_net_proto          = udp_get_net_proto,
 };
@@ -379,7 +379,7 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 =
         .nlattr_tuple_size      = nf_ct_port_nlattr_tuple_size,
         .nla_policy             = nf_ct_port_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         .ctnl_timeout           = {
                 .nlattr_to_obj  = udp_timeout_nlattr_to_obj,
                 .obj_to_nlattr  = udp_timeout_obj_to_nlattr,
@@ -387,10 +387,9 @@ const struct nf_conntrack_l4proto nf_conntrack_l4proto_udplite6 =
                 .obj_size       = sizeof(unsigned int) * CTA_TIMEOUT_UDP_MAX,
                 .nla_policy     = udp_timeout_nla_policy,
         },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
+#endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
         .init_net               = udp_init_net,
         .get_net_proto          = udp_get_net_proto,
 };
 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_udplite6);
 #endif
-#include <net/netfilter/nf_conntrack_timeout.h>
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 1dca5683f59f..2cfb173cd0b2 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4637,6 +4637,7 @@ static int nft_flush_set(const struct nft_ctx *ctx,
         }
         set->ndeact++;
 
+        nft_set_elem_deactivate(ctx->net, set, elem);
         nft_trans_elem_set(trans) = set;
         nft_trans_elem(trans) = *elem;
         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index d46a236cdf31..a30f8ba4b89a 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -489,8 +489,8 @@ err:
         return err;
 }
 
-static struct ctnl_timeout *
-ctnl_timeout_find_get(struct net *net, const char *name)
+static struct nf_ct_timeout *ctnl_timeout_find_get(struct net *net,
+                                                   const char *name)
 {
         struct ctnl_timeout *timeout, *matching = NULL;
 
@@ -509,7 +509,7 @@ ctnl_timeout_find_get(struct net *net, const char *name)
                 break;
         }
 err:
-        return matching;
+        return matching ? &matching->timeout : NULL;
 }
 
 static void ctnl_timeout_put(struct nf_ct_timeout *t)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 5207eb8a5864..43041f087eb3 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -233,6 +233,7 @@ static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict)
         int err;
 
         if (verdict == NF_ACCEPT ||
+            verdict == NF_REPEAT ||
             verdict == NF_STOP) {
                 rcu_read_lock();
                 ct_hook = rcu_dereference(nf_ct_hook);
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 26a8baebd072..5dd87748afa8 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -799,7 +799,7 @@ err:
 }
 
 struct nft_ct_timeout_obj {
-        struct nf_conn          *tmpl;
+        struct nf_ct_timeout    *timeout;
         u8                      l4proto;
 };
 
@@ -809,26 +809,42 @@ static void nft_ct_timeout_obj_eval(struct nft_object *obj,
 {
         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
         struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
-        struct sk_buff *skb = pkt->skb;
+        struct nf_conn_timeout *timeout;
+        const unsigned int *values;
+
+        if (priv->l4proto != pkt->tprot)
+                return;
 
-        if (ct ||
-            priv->l4proto != pkt->tprot)
+        if (!ct || nf_ct_is_template(ct) || nf_ct_is_confirmed(ct))
                 return;
 
-        nf_ct_set(skb, priv->tmpl, IP_CT_NEW);
+        timeout = nf_ct_timeout_find(ct);
+        if (!timeout) {
+                timeout = nf_ct_timeout_ext_add(ct, priv->timeout, GFP_ATOMIC);
+                if (!timeout) {
+                        regs->verdict.code = NF_DROP;
+                        return;
+                }
+        }
+
+        rcu_assign_pointer(timeout->timeout, priv->timeout);
+
+        /* adjust the timeout as per 'new' state. ct is unconfirmed,
+         * so the current timestamp must not be added.
+         */
+        values = nf_ct_timeout_data(timeout);
+        if (values)
+                nf_ct_refresh(ct, pkt->skb, values[0]);
 }
 
 static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
                                    const struct nlattr * const tb[],
                                    struct nft_object *obj)
 {
-        const struct nf_conntrack_zone *zone = &nf_ct_zone_dflt;
         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
         const struct nf_conntrack_l4proto *l4proto;
-        struct nf_conn_timeout *timeout_ext;
         struct nf_ct_timeout *timeout;
         int l3num = ctx->family;
-        struct nf_conn *tmpl;
         __u8 l4num;
         int ret;
 
@@ -863,28 +879,14 @@ static int nft_ct_timeout_obj_init(const struct nft_ctx *ctx,
 
         timeout->l3num = l3num;
         timeout->l4proto = l4proto;
-        tmpl = nf_ct_tmpl_alloc(ctx->net, zone, GFP_ATOMIC);
-        if (!tmpl) {
-                ret = -ENOMEM;
-                goto err_free_timeout;
-        }
-
-        timeout_ext = nf_ct_timeout_ext_add(tmpl, timeout, GFP_ATOMIC);
-        if (!timeout_ext) {
-                ret = -ENOMEM;
-                goto err_free_tmpl;
-        }
 
         ret = nf_ct_netns_get(ctx->net, ctx->family);
         if (ret < 0)
-                goto err_free_tmpl;
-
-        priv->tmpl = tmpl;
+                goto err_free_timeout;
 
+        priv->timeout = timeout;
         return 0;
 
-err_free_tmpl:
-        nf_ct_tmpl_free(tmpl);
 err_free_timeout:
         kfree(timeout);
 err_proto_put:
@@ -896,22 +898,19 @@ static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,
                                        struct nft_object *obj)
 {
         struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
-        struct nf_conn_timeout *t = nf_ct_timeout_find(priv->tmpl);
-        struct nf_ct_timeout *timeout;
+        struct nf_ct_timeout *timeout = priv->timeout;
 
-        timeout = rcu_dereference_raw(t->timeout);
         nf_ct_untimeout(ctx->net, timeout);
         nf_ct_l4proto_put(timeout->l4proto);
         nf_ct_netns_put(ctx->net, ctx->family);
-        nf_ct_tmpl_free(priv->tmpl);
+        kfree(priv->timeout);
 }
 
 static int nft_ct_timeout_obj_dump(struct sk_buff *skb,
                                    struct nft_object *obj, bool reset)
 {
         const struct nft_ct_timeout_obj *priv = nft_obj_data(obj);
-        const struct nf_conn_timeout *t = nf_ct_timeout_find(priv->tmpl);
-        const struct nf_ct_timeout *timeout = rcu_dereference_raw(t->timeout);
+        const struct nf_ct_timeout *timeout = priv->timeout;
         struct nlattr *nest_params;
         int ret;
 
diff --git a/net/netfilter/xt_CHECKSUM.c b/net/netfilter/xt_CHECKSUM.c
index 9f4151ec3e06..6c7aa6a0a0d2 100644
--- a/net/netfilter/xt_CHECKSUM.c
+++ b/net/netfilter/xt_CHECKSUM.c
@@ -16,6 +16,9 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_CHECKSUM.h>
 
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Michael S. Tsirkin <mst@redhat.com>");
 MODULE_DESCRIPTION("Xtables: checksum modification");
@@ -25,7 +28,7 @@ MODULE_ALIAS("ip6t_CHECKSUM");
 static unsigned int
 checksum_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        if (skb->ip_summed == CHECKSUM_PARTIAL)
+        if (skb->ip_summed == CHECKSUM_PARTIAL && !skb_is_gso(skb))
                 skb_checksum_help(skb);
 
         return XT_CONTINUE;
@@ -34,6 +37,8 @@ checksum_tg(struct sk_buff *skb, const struct xt_action_param *par)
 static int checksum_tg_check(const struct xt_tgchk_param *par)
 {
         const struct xt_CHECKSUM_info *einfo = par->targinfo;
+        const struct ip6t_ip6 *i6 = par->entryinfo;
+        const struct ipt_ip *i4 = par->entryinfo;
 
         if (einfo->operation & ~XT_CHECKSUM_OP_FILL) {
                 pr_info_ratelimited("unsupported CHECKSUM operation %x\n",
@@ -43,6 +48,21 @@ static int checksum_tg_check(const struct xt_tgchk_param *par)
         if (!einfo->operation)
                 return -EINVAL;
 
+        switch (par->family) {
+        case NFPROTO_IPV4:
+                if (i4->proto == IPPROTO_UDP &&
+                    (i4->invflags & XT_INV_PROTO) == 0)
+                        return 0;
+                break;
+        case NFPROTO_IPV6:
+                if ((i6->flags & IP6T_F_PROTO) &&
+                    i6->proto == IPPROTO_UDP &&
+                    (i6->invflags & XT_INV_PROTO) == 0)
+                        return 0;
+                break;
+        }
+
+        pr_warn_once("CHECKSUM should be avoided.  If really needed, restrict with \"-p udp\" and only use in OUTPUT\n");
         return 0;
 }
 
diff --git a/net/netfilter/xt_cluster.c b/net/netfilter/xt_cluster.c
index dfbdbb2fc0ed..51d0c257e7a5 100644
--- a/net/netfilter/xt_cluster.c
+++ b/net/netfilter/xt_cluster.c
@@ -125,6 +125,7 @@ xt_cluster_mt(const struct sk_buff *skb, struct xt_action_param *par)
 static int xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
 {
         struct xt_cluster_match_info *info = par->matchinfo;
+        int ret;
 
         if (info->total_nodes > XT_CLUSTER_NODES_MAX) {
                 pr_info_ratelimited("you have exceeded the maximum number of cluster nodes (%u > %u)\n",
@@ -135,7 +136,17 @@ static int xt_cluster_mt_checkentry(const struct xt_mtchk_param *par)
                 pr_info_ratelimited("node mask cannot exceed total number of nodes\n");
                 return -EDOM;
         }
-        return 0;
+
+        ret = nf_ct_netns_get(par->net, par->family);
+        if (ret < 0)
+                pr_info_ratelimited("cannot load conntrack support for proto=%u\n",
+                                    par->family);
+        return ret;
+}
+
+static void xt_cluster_mt_destroy(const struct xt_mtdtor_param *par)
+{
+        nf_ct_netns_put(par->net, par->family);
 }
 
 static struct xt_match xt_cluster_match __read_mostly = {
@@ -144,6 +155,7 @@ static struct xt_match xt_cluster_match __read_mostly = {
         .match          = xt_cluster_mt,
         .checkentry     = xt_cluster_mt_checkentry,
         .matchsize      = sizeof(struct xt_cluster_match_info),
+        .destroy        = xt_cluster_mt_destroy,
         .me             = THIS_MODULE,
 };
 
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 9b16402f29af..3e7d259e5d8d 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -1057,7 +1057,7 @@ static struct xt_match hashlimit_mt_reg[] __read_mostly = {
 static void *dl_seq_start(struct seq_file *s, loff_t *pos)
         __acquires(htable->lock)
 {
-        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->file));
         unsigned int *bucket;
 
         spin_lock_bh(&htable->lock);
@@ -1074,7 +1074,7 @@ static void *dl_seq_start(struct seq_file *s, loff_t *pos)
 
 static void *dl_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
-        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->file));
         unsigned int *bucket = v;
 
         *pos = ++(*bucket);
@@ -1088,7 +1088,7 @@ static void *dl_seq_next(struct seq_file *s, void *v, loff_t *pos)
 static void dl_seq_stop(struct seq_file *s, void *v)
         __releases(htable->lock)
 {
-        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->file));
         unsigned int *bucket = v;
 
         if (!IS_ERR(bucket))
@@ -1130,7 +1130,7 @@ static void dl_seq_print(struct dsthash_ent *ent, u_int8_t family,
 static int dl_seq_real_show_v2(struct dsthash_ent *ent, u_int8_t family,
                                struct seq_file *s)
 {
-        struct xt_hashlimit_htable *ht = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *ht = PDE_DATA(file_inode(s->file));
 
         spin_lock(&ent->lock);
         /* recalculate to show accurate numbers */
@@ -1145,7 +1145,7 @@ static int dl_seq_real_show_v2(struct dsthash_ent *ent, u_int8_t family,
 static int dl_seq_real_show_v1(struct dsthash_ent *ent, u_int8_t family,
                                struct seq_file *s)
 {
-        struct xt_hashlimit_htable *ht = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *ht = PDE_DATA(file_inode(s->file));
 
         spin_lock(&ent->lock);
         /* recalculate to show accurate numbers */
@@ -1160,7 +1160,7 @@ static int dl_seq_real_show_v1(struct dsthash_ent *ent, u_int8_t family,
 static int dl_seq_real_show(struct dsthash_ent *ent, u_int8_t family,
                             struct seq_file *s)
 {
-        struct xt_hashlimit_htable *ht = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *ht = PDE_DATA(file_inode(s->file));
 
         spin_lock(&ent->lock);
         /* recalculate to show accurate numbers */
@@ -1174,7 +1174,7 @@ static int dl_seq_real_show(struct dsthash_ent *ent, u_int8_t family,
 
 static int dl_seq_show_v2(struct seq_file *s, void *v)
 {
-        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->file));
         unsigned int *bucket = (unsigned int *)v;
         struct dsthash_ent *ent;
 
@@ -1188,7 +1188,7 @@ static int dl_seq_show_v2(struct seq_file *s, void *v)
 
 static int dl_seq_show_v1(struct seq_file *s, void *v)
 {
-        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->file));
         unsigned int *bucket = v;
         struct dsthash_ent *ent;
 
@@ -1202,7 +1202,7 @@ static int dl_seq_show_v1(struct seq_file *s, void *v)
 
 static int dl_seq_show(struct seq_file *s, void *v)
 {
-        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->private));
+        struct xt_hashlimit_htable *htable = PDE_DATA(file_inode(s->file));
         unsigned int *bucket = v;
         struct dsthash_ent *ent;
 
diff --git a/net/rds/bind.c b/net/rds/bind.c
index 3ab55784b637..762d2c6788a3 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -76,11 +76,13 @@ struct rds_sock *rds_find_bound(const struct in6_addr *addr, __be16 port,
         struct rds_sock *rs;
 
         __rds_create_bind_key(key, addr, port, scope_id);
-        rs = rhashtable_lookup_fast(&bind_hash_table, key, ht_parms);
+        rcu_read_lock();
+        rs = rhashtable_lookup(&bind_hash_table, key, ht_parms);
         if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD))
                 rds_sock_addref(rs);
         else
                 rs = NULL;
+        rcu_read_unlock();
 
         rdsdebug("returning rs %p for %pI6c:%u\n", rs, addr,
                  ntohs(port));
@@ -235,6 +237,7 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
         }
 
+        sock_set_flag(sk, SOCK_RCU_FREE);
         ret = rds_add_bound(rs, binding_addr, &port, scope_id);
         if (ret)
                 goto out;
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 6d95b6919d9d..4cca8f274662 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -317,7 +317,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
                                                   &metadata->u.tun_info,
                                                   opts_len, extack);
                         if (ret < 0)
-                                goto err_out;
+                                goto release_tun_meta;
                 }
 
                 metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX;
@@ -333,23 +333,24 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
                                      &act_tunnel_key_ops, bind, true);
                 if (ret) {
                         NL_SET_ERR_MSG(extack, "Cannot create TC IDR");
-                        goto err_out;
+                        goto release_tun_meta;
                 }
 
                 ret = ACT_P_CREATED;
         } else if (!ovr) {
-                tcf_idr_release(*a, bind);
                 NL_SET_ERR_MSG(extack, "TC IDR already exists");
-                return -EEXIST;
+                ret = -EEXIST;
+                goto release_tun_meta;
         }
 
         t = to_tunnel_key(*a);
 
         params_new = kzalloc(sizeof(*params_new), GFP_KERNEL);
         if (unlikely(!params_new)) {
-                tcf_idr_release(*a, bind);
                 NL_SET_ERR_MSG(extack, "Cannot allocate tunnel key parameters");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                exists = true;
+                goto release_tun_meta;
         }
         params_new->tcft_action = parm->t_action;
         params_new->tcft_enc_metadata = metadata;
@@ -367,6 +368,9 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
 
         return ret;
 
+release_tun_meta:
+        dst_release(&metadata->dst);
+
 err_out:
         if (exists)
                 tcf_idr_release(*a, bind);
@@ -408,8 +412,10 @@ static int tunnel_key_geneve_opts_dump(struct sk_buff *skb,
                     nla_put_u8(skb, TCA_TUNNEL_KEY_ENC_OPT_GENEVE_TYPE,
                                opt->type) ||
                     nla_put(skb, TCA_TUNNEL_KEY_ENC_OPT_GENEVE_DATA,
-                            opt->length * 4, opt + 1))
+                            opt->length * 4, opt + 1)) {
+                        nla_nest_cancel(skb, start);
                         return -EMSGSIZE;
+                }
 
                 len -= sizeof(struct geneve_opt) + opt->length * 4;
                 src += sizeof(struct geneve_opt) + opt->length * 4;
@@ -423,7 +429,7 @@ static int tunnel_key_opts_dump(struct sk_buff *skb,
                                 const struct ip_tunnel_info *info)
 {
         struct nlattr *start;
-        int err;
+        int err = -EINVAL;
 
         if (!info->options_len)
                 return 0;
@@ -435,9 +441,11 @@ static int tunnel_key_opts_dump(struct sk_buff *skb,
         if (info->key.tun_flags & TUNNEL_GENEVE_OPT) {
                 err = tunnel_key_geneve_opts_dump(skb, info);
                 if (err)
-                        return err;
+                        goto err_out;
         } else {
-                return -EINVAL;
+err_out:
+                nla_nest_cancel(skb, start);
+                return err;
         }
 
         nla_nest_end(skb, start);
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index a2f76743c73a..6376467e78f8 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -185,6 +185,10 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
                 return -ENOMEM;
 
         buf->sk = msg->dst_sk;
+        if (__tipc_dump_start(&cb, msg->net)) {
+                kfree_skb(buf);
+                return -ENOMEM;
+        }
 
         do {
                 int rem;
@@ -216,6 +220,7 @@ static int __tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
         err = 0;
 
 err_out:
+        tipc_dump_done(&cb);
         kfree_skb(buf);
 
         if (err == -EMSGSIZE) {
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index ab7a2a7178f7..3f03ddd0e35b 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -576,6 +576,7 @@ static int tipc_release(struct socket *sock)
         sk_stop_timer(sk, &sk->sk_timer);
         tipc_sk_remove(tsk);
 
+        sock_orphan(sk);
         /* Reject any messages that accumulated in backlog queue */
         release_sock(sk);
         tipc_dest_list_purge(&tsk->cong_links);
@@ -3229,7 +3230,7 @@ int tipc_nl_sk_walk(struct sk_buff *skb, struct netlink_callback *cb,
                                        struct netlink_callback *cb,
                                        struct tipc_sock *tsk))
 {
-        struct rhashtable_iter *iter = (void *)cb->args[0];
+        struct rhashtable_iter *iter = (void *)cb->args[4];
         struct tipc_sock *tsk;
         int err;
 
@@ -3265,8 +3266,14 @@ EXPORT_SYMBOL(tipc_nl_sk_walk);
 
 int tipc_dump_start(struct netlink_callback *cb)
 {
-        struct rhashtable_iter *iter = (void *)cb->args[0];
-        struct net *net = sock_net(cb->skb->sk);
+        return __tipc_dump_start(cb, sock_net(cb->skb->sk));
+}
+EXPORT_SYMBOL(tipc_dump_start);
+
+int __tipc_dump_start(struct netlink_callback *cb, struct net *net)
+{
+        /* tipc_nl_name_table_dump() uses cb->args[0...3]. */
+        struct rhashtable_iter *iter = (void *)cb->args[4];
         struct tipc_net *tn = tipc_net(net);
 
         if (!iter) {
@@ -3274,17 +3281,16 @@ int tipc_dump_start(struct netlink_callback *cb)
                 if (!iter)
                         return -ENOMEM;
 
-                cb->args[0] = (long)iter;
+                cb->args[4] = (long)iter;
         }
 
         rhashtable_walk_enter(&tn->sk_rht, iter);
         return 0;
 }
-EXPORT_SYMBOL(tipc_dump_start);
 
 int tipc_dump_done(struct netlink_callback *cb)
 {
-        struct rhashtable_iter *hti = (void *)cb->args[0];
+        struct rhashtable_iter *hti = (void *)cb->args[4];
 
         rhashtable_walk_exit(hti);
         kfree(hti);
diff --git a/net/tipc/socket.h b/net/tipc/socket.h
index d43032e26532..5e575f205afe 100644
--- a/net/tipc/socket.h
+++ b/net/tipc/socket.h
@@ -69,5 +69,6 @@ int tipc_nl_sk_walk(struct sk_buff *skb, struct netlink_callback *cb,
                                        struct netlink_callback *cb,
                                        struct tipc_sock *tsk));
 int tipc_dump_start(struct netlink_callback *cb);
+int __tipc_dump_start(struct netlink_callback *cb, struct net *net);
 int tipc_dump_done(struct netlink_callback *cb);
 #endif
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index adab598bd6db..8aa4c1dafd6a 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -263,6 +263,9 @@ static int alloc_encrypted_sg(struct sock *sk, int len)
                          &ctx->sg_encrypted_num_elem,
                          &ctx->sg_encrypted_size, 0);
 
+        if (rc == -ENOSPC)
+                ctx->sg_encrypted_num_elem = ARRAY_SIZE(ctx->sg_encrypted_data);
+
         return rc;
 }
 
@@ -276,6 +279,9 @@ static int alloc_plaintext_sg(struct sock *sk, int len)
                          &ctx->sg_plaintext_num_elem, &ctx->sg_plaintext_size,
                          tls_ctx->pending_open_record_frags);
 
+        if (rc == -ENOSPC)
+                ctx->sg_plaintext_num_elem = ARRAY_SIZE(ctx->sg_plaintext_data);
+
         return rc;
 }