Merge 4.16-rc7 into char-misc-next

We want the hyperv fix in here for merging and testing.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

118 files changed, 925 insertions, 625 deletions

diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 64aa9f755e1d..45c9bf5ff3a0 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -48,8 +48,8 @@ bool vlan_do_receive(struct sk_buff **skbp)
                  * original position later
                  */
                 skb_push(skb, offset);
-                skb = *skbp = vlan_insert_tag(skb, skb->vlan_proto,
-                                              skb->vlan_tci);
+                skb = *skbp = vlan_insert_inner_tag(skb, skb->vlan_proto,
+                                                    skb->vlan_tci, skb->mac_len);
                 if (!skb)
                         return false;
                 skb_pull(skb, offset + VLAN_HLEN);
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 79e326383726..99abeadf416e 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -157,7 +157,7 @@ static void batadv_iv_ogm_orig_free(struct batadv_orig_node *orig_node)
  * Return: 0 on success, a negative error code otherwise.
  */
 static int batadv_iv_ogm_orig_add_if(struct batadv_orig_node *orig_node,
-                                     int max_if_num)
+                                     unsigned int max_if_num)
 {
         void *data_ptr;
         size_t old_size;
@@ -201,7 +201,8 @@ unlock:
  */
 static void
 batadv_iv_ogm_drop_bcast_own_entry(struct batadv_orig_node *orig_node,
-                                   int max_if_num, int del_if_num)
+                                   unsigned int max_if_num,
+                                   unsigned int del_if_num)
 {
         size_t chunk_size;
         size_t if_offset;
@@ -239,7 +240,8 @@ batadv_iv_ogm_drop_bcast_own_entry(struct batadv_orig_node *orig_node,
  */
 static void
 batadv_iv_ogm_drop_bcast_own_sum_entry(struct batadv_orig_node *orig_node,
-                                       int max_if_num, int del_if_num)
+                                       unsigned int max_if_num,
+                                       unsigned int del_if_num)
 {
         size_t if_offset;
         void *data_ptr;
@@ -276,7 +278,8 @@ batadv_iv_ogm_drop_bcast_own_sum_entry(struct batadv_orig_node *orig_node,
  * Return: 0 on success, a negative error code otherwise.
  */
 static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node,
-                                     int max_if_num, int del_if_num)
+                                     unsigned int max_if_num,
+                                     unsigned int del_if_num)
 {
         spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock);
 
@@ -311,7 +314,8 @@ static struct batadv_orig_node *
 batadv_iv_ogm_orig_get(struct batadv_priv *bat_priv, const u8 *addr)
 {
         struct batadv_orig_node *orig_node;
-        int size, hash_added;
+        int hash_added;
+        size_t size;
 
         orig_node = batadv_orig_hash_find(bat_priv, addr);
         if (orig_node)
@@ -893,7 +897,7 @@ batadv_iv_ogm_slide_own_bcast_window(struct batadv_hard_iface *hard_iface)
         u32 i;
         size_t word_index;
         u8 *w;
-        int if_num;
+        unsigned int if_num;
 
         for (i = 0; i < hash->size; i++) {
                 head = &hash->table[i];
@@ -1023,7 +1027,7 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         struct batadv_neigh_node *tmp_neigh_node = NULL;
         struct batadv_neigh_node *router = NULL;
         struct batadv_orig_node *orig_node_tmp;
-        int if_num;
+        unsigned int if_num;
         u8 sum_orig, sum_neigh;
         u8 *neigh_addr;
         u8 tq_avg;
@@ -1182,7 +1186,7 @@ static bool batadv_iv_ogm_calc_tq(struct batadv_orig_node *orig_node,
         u8 total_count;
         u8 orig_eq_count, neigh_rq_count, neigh_rq_inv, tq_own;
         unsigned int neigh_rq_inv_cube, neigh_rq_max_cube;
-        int if_num;
+        unsigned int if_num;
         unsigned int tq_asym_penalty, inv_asym_penalty;
         unsigned int combined_tq;
         unsigned int tq_iface_penalty;
@@ -1702,9 +1706,9 @@ static void batadv_iv_ogm_process(const struct sk_buff *skb, int ogm_offset,
 
         if (is_my_orig) {
                 unsigned long *word;
-                int offset;
+                size_t offset;
                 s32 bit_pos;
-                s16 if_num;
+                unsigned int if_num;
                 u8 *weight;
 
                 orig_neigh_node = batadv_iv_ogm_orig_get(bat_priv,
@@ -2729,7 +2733,7 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
         struct batadv_neigh_ifinfo *router_ifinfo = NULL;
         struct batadv_neigh_node *router;
         struct batadv_gw_node *curr_gw;
-        int ret = -EINVAL;
+        int ret = 0;
         void *hdr;
 
         router = batadv_orig_router_get(gw_node->orig_node, BATADV_IF_DEFAULT);
diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
index 27e165ac9302..c74f81341dab 100644
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -928,7 +928,7 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq,
         struct batadv_neigh_ifinfo *router_ifinfo = NULL;
         struct batadv_neigh_node *router;
         struct batadv_gw_node *curr_gw;
-        int ret = -EINVAL;
+        int ret = 0;
         void *hdr;
 
         router = batadv_orig_router_get(gw_node->orig_node, BATADV_IF_DEFAULT);
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index fad47853ad3c..b1a08374088b 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -2161,22 +2161,25 @@ batadv_bla_claim_dump_bucket(struct sk_buff *msg, u32 portid, u32 seq,
 {
         struct batadv_bla_claim *claim;
         int idx = 0;
+        int ret = 0;
 
         rcu_read_lock();
         hlist_for_each_entry_rcu(claim, head, hash_entry) {
                 if (idx++ < *idx_skip)
                         continue;
-                if (batadv_bla_claim_dump_entry(msg, portid, seq,
-                                                primary_if, claim)) {
+
+                ret = batadv_bla_claim_dump_entry(msg, portid, seq,
+                                                  primary_if, claim);
+                if (ret) {
                         *idx_skip = idx - 1;
                         goto unlock;
                 }
         }
 
-        *idx_skip = idx;
+        *idx_skip = 0;
 unlock:
         rcu_read_unlock();
-        return 0;
+        return ret;
 }
 
 /**
@@ -2391,22 +2394,25 @@ batadv_bla_backbone_dump_bucket(struct sk_buff *msg, u32 portid, u32 seq,
 {
         struct batadv_bla_backbone_gw *backbone_gw;
         int idx = 0;
+        int ret = 0;
 
         rcu_read_lock();
         hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) {
                 if (idx++ < *idx_skip)
                         continue;
-                if (batadv_bla_backbone_dump_entry(msg, portid, seq,
-                                                   primary_if, backbone_gw)) {
+
+                ret = batadv_bla_backbone_dump_entry(msg, portid, seq,
+                                                     primary_if, backbone_gw);
+                if (ret) {
                         *idx_skip = idx - 1;
                         goto unlock;
                 }
         }
 
-        *idx_skip = idx;
+        *idx_skip = 0;
 unlock:
         rcu_read_unlock();
-        return 0;
+        return ret;
 }
 
 /**
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 9703c791ffc5..87cd962d28d5 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -393,7 +393,7 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
                    batadv_arp_hw_src(skb, hdr_size), &ip_src,
                    batadv_arp_hw_dst(skb, hdr_size), &ip_dst);
 
-        if (hdr_size == 0)
+        if (hdr_size < sizeof(struct batadv_unicast_packet))
                 return;
 
         unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 22dde42fd80e..5afe641ee4b0 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -288,7 +288,8 @@ batadv_frag_merge_packets(struct hlist_head *chain)
         /* Move the existing MAC header to just before the payload. (Override
          * the fragment header.)
          */
-        skb_pull_rcsum(skb_out, hdr_size);
+        skb_pull(skb_out, hdr_size);
+        skb_out->ip_summed = CHECKSUM_NONE;
         memmove(skb_out->data - ETH_HLEN, skb_mac_header(skb_out), ETH_HLEN);
         skb_set_mac_header(skb_out, -ETH_HLEN);
         skb_reset_network_header(skb_out);
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index 5f186bff284a..68b54a39c51d 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -763,6 +763,11 @@ int batadv_hardif_enable_interface(struct batadv_hard_iface *hard_iface,
         hard_iface->soft_iface = soft_iface;
         bat_priv = netdev_priv(hard_iface->soft_iface);
 
+        if (bat_priv->num_ifaces >= UINT_MAX) {
+                ret = -ENOSPC;
+                goto err_dev;
+        }
+
         ret = netdev_master_upper_dev_link(hard_iface->net_dev,
                                            soft_iface, NULL, NULL, NULL);
         if (ret)
@@ -876,7 +881,7 @@ void batadv_hardif_disable_interface(struct batadv_hard_iface *hard_iface,
         batadv_hardif_recalc_extra_skbroom(hard_iface->soft_iface);
 
         /* nobody uses this interface anymore */
-        if (!bat_priv->num_ifaces) {
+        if (bat_priv->num_ifaces == 0) {
                 batadv_gw_check_client_stop(bat_priv);
 
                 if (autodel == BATADV_IF_CLEANUP_AUTO)
@@ -912,7 +917,7 @@ batadv_hardif_add_interface(struct net_device *net_dev)
         if (ret)
                 goto free_if;
 
-        hard_iface->if_num = -1;
+        hard_iface->if_num = 0;
         hard_iface->net_dev = net_dev;
         hard_iface->soft_iface = NULL;
         hard_iface->if_status = BATADV_IF_NOT_IN_USE;
diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c
index e91f29c7c638..5daa3d50da17 100644
--- a/net/batman-adv/icmp_socket.c
+++ b/net/batman-adv/icmp_socket.c
@@ -24,6 +24,7 @@
 #include <linux/debugfs.h>
 #include <linux/errno.h>
 #include <linux/etherdevice.h>
+#include <linux/eventpoll.h>
 #include <linux/export.h>
 #include <linux/fcntl.h>
 #include <linux/fs.h>
diff --git a/net/batman-adv/log.c b/net/batman-adv/log.c
index dc9fa37ddd14..cdbe0e5e208b 100644
--- a/net/batman-adv/log.c
+++ b/net/batman-adv/log.c
@@ -22,6 +22,7 @@
 #include <linux/compiler.h>
 #include <linux/debugfs.h>
 #include <linux/errno.h>
+#include <linux/eventpoll.h>
 #include <linux/export.h>
 #include <linux/fcntl.h>
 #include <linux/fs.h>
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index cbdeb47ec3f6..d70640135e3a 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -543,8 +543,8 @@ update:
                 bat_priv->mcast.enabled = true;
         }
 
-        return !(mcast_data.flags &
-                 (BATADV_MCAST_WANT_ALL_IPV4 | BATADV_MCAST_WANT_ALL_IPV6));
+        return !(mcast_data.flags & BATADV_MCAST_WANT_ALL_IPV4 &&
+                 mcast_data.flags & BATADV_MCAST_WANT_ALL_IPV6);
 }
 
 /**
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 58a7d9274435..74782426bb77 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -1569,7 +1569,7 @@ int batadv_orig_dump(struct sk_buff *msg, struct netlink_callback *cb)
  * Return: 0 on success or negative error number in case of failure
  */
 int batadv_orig_hash_add_if(struct batadv_hard_iface *hard_iface,
-                            int max_if_num)
+                            unsigned int max_if_num)
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batadv_algo_ops *bao = bat_priv->algo_ops;
@@ -1611,7 +1611,7 @@ err:
  * Return: 0 on success or negative error number in case of failure
  */
 int batadv_orig_hash_del_if(struct batadv_hard_iface *hard_iface,
-                            int max_if_num)
+                            unsigned int max_if_num)
 {
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batadv_hashtable *hash = bat_priv->orig_hash;
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 8e543a3cdc6c..15d896b2de6f 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -73,9 +73,9 @@ int batadv_orig_seq_print_text(struct seq_file *seq, void *offset);
 int batadv_orig_dump(struct sk_buff *msg, struct netlink_callback *cb);
 int batadv_orig_hardif_seq_print_text(struct seq_file *seq, void *offset);
 int batadv_orig_hash_add_if(struct batadv_hard_iface *hard_iface,
-                            int max_if_num);
+                            unsigned int max_if_num);
 int batadv_orig_hash_del_if(struct batadv_hard_iface *hard_iface,
-                            int max_if_num);
+                            unsigned int max_if_num);
 struct batadv_orig_node_vlan *
 batadv_orig_node_vlan_new(struct batadv_orig_node *orig_node,
                           unsigned short vid);
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index b6891e8b741c..e61dc1293bb5 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -759,6 +759,7 @@ free_skb:
 /**
  * batadv_reroute_unicast_packet() - update the unicast header for re-routing
  * @bat_priv: the bat priv with all the soft interface information
+ * @skb: unicast packet to process
  * @unicast_packet: the unicast header to be updated
  * @dst_addr: the payload destination
  * @vid: VLAN identifier
@@ -770,7 +771,7 @@ free_skb:
  * Return: true if the packet header has been updated, false otherwise
  */
 static bool
-batadv_reroute_unicast_packet(struct batadv_priv *bat_priv,
+batadv_reroute_unicast_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
                               struct batadv_unicast_packet *unicast_packet,
                               u8 *dst_addr, unsigned short vid)
 {
@@ -799,8 +800,10 @@ batadv_reroute_unicast_packet(struct batadv_priv *bat_priv,
         }
 
         /* update the packet header */
+        skb_postpull_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
         ether_addr_copy(unicast_packet->dest, orig_addr);
         unicast_packet->ttvn = orig_ttvn;
+        skb_postpush_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
 
         ret = true;
 out:
@@ -841,7 +844,7 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
          * the packet to
          */
         if (batadv_tt_local_client_is_roaming(bat_priv, ethhdr->h_dest, vid)) {
-                if (batadv_reroute_unicast_packet(bat_priv, unicast_packet,
+                if (batadv_reroute_unicast_packet(bat_priv, skb, unicast_packet,
                                                   ethhdr->h_dest, vid))
                         batadv_dbg_ratelimited(BATADV_DBG_TT,
                                                bat_priv,
@@ -887,7 +890,7 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
          * destination can possibly be updated and forwarded towards the new
          * target host
          */
-        if (batadv_reroute_unicast_packet(bat_priv, unicast_packet,
+        if (batadv_reroute_unicast_packet(bat_priv, skb, unicast_packet,
                                           ethhdr->h_dest, vid)) {
                 batadv_dbg_ratelimited(BATADV_DBG_TT, bat_priv,
                                        "Rerouting unicast packet to %pM (dst=%pM): TTVN mismatch old_ttvn=%u new_ttvn=%u\n",
@@ -910,12 +913,14 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
         if (!primary_if)
                 return false;
 
+        /* update the packet header */
+        skb_postpull_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
         ether_addr_copy(unicast_packet->dest, primary_if->net_dev->dev_addr);
+        unicast_packet->ttvn = curr_ttvn;
+        skb_postpush_rcsum(skb, unicast_packet, sizeof(*unicast_packet));
 
         batadv_hardif_put(primary_if);
 
-        unicast_packet->ttvn = curr_ttvn;
-
         return true;
 }
 
@@ -968,14 +973,10 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
         struct batadv_orig_node *orig_node = NULL, *orig_node_gw = NULL;
         int check, hdr_size = sizeof(*unicast_packet);
         enum batadv_subtype subtype;
-        struct ethhdr *ethhdr;
         int ret = NET_RX_DROP;
         bool is4addr, is_gw;
 
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
-        unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
-        ethhdr = eth_hdr(skb);
-
         is4addr = unicast_packet->packet_type == BATADV_UNICAST_4ADDR;
         /* the caller function should have already pulled 2 bytes */
         if (is4addr)
@@ -995,12 +996,14 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
         if (!batadv_check_unicast_ttvn(bat_priv, skb, hdr_size))
                 goto free_skb;
 
+        unicast_packet = (struct batadv_unicast_packet *)skb->data;
+
         /* packet for me */
         if (batadv_is_my_mac(bat_priv, unicast_packet->dest)) {
                 /* If this is a unicast packet from another backgone gw,
                  * drop it.
                  */
-                orig_addr_gw = ethhdr->h_source;
+                orig_addr_gw = eth_hdr(skb)->h_source;
                 orig_node_gw = batadv_orig_hash_find(bat_priv, orig_addr_gw);
                 if (orig_node_gw) {
                         is_gw = batadv_bla_is_backbone_gw(skb, orig_node_gw,
@@ -1015,6 +1018,8 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
                 }
 
                 if (is4addr) {
+                        unicast_4addr_packet =
+                                (struct batadv_unicast_4addr_packet *)skb->data;
                         subtype = unicast_4addr_packet->subtype;
                         batadv_dat_inc_counter(bat_priv, subtype);
 
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 900c5ce21cd4..367a81fb785f 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -459,13 +459,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
 
         /* skb->dev & skb->pkt_type are set here */
         skb->protocol = eth_type_trans(skb, soft_iface);
-
-        /* should not be necessary anymore as we use skb_pull_rcsum()
-         * TODO: please verify this and remove this TODO
-         * -- Dec 21st 2009, Simon Wunderlich
-         */
-
-        /* skb->ip_summed = CHECKSUM_UNNECESSARY; */
+        skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
 
         batadv_inc_counter(bat_priv, BATADV_CNT_RX);
         batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index bb1578410e0c..a5aa6d61f4e2 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -167,7 +167,7 @@ struct batadv_hard_iface {
         struct list_head list;
 
         /** @if_num: identificator of the interface */
-        s16 if_num;
+        unsigned int if_num;
 
         /** @if_status: status of the interface for batman-adv */
         char if_status;
@@ -1596,7 +1596,7 @@ struct batadv_priv {
         atomic_t batman_queue_left;
 
         /** @num_ifaces: number of interfaces assigned to this mesh interface */
-        char num_ifaces;
+        unsigned int num_ifaces;
 
         /** @mesh_obj: kobject for sysfs mesh subdirectory */
         struct kobject *mesh_obj;
@@ -2186,15 +2186,16 @@ struct batadv_algo_orig_ops {
          *  orig_node due to a new hard-interface being added into the mesh
          *  (optional)
          */
-        int (*add_if)(struct batadv_orig_node *orig_node, int max_if_num);
+        int (*add_if)(struct batadv_orig_node *orig_node,
+                      unsigned int max_if_num);
 
         /**
          * @del_if: ask the routing algorithm to apply the needed changes to the
          *  orig_node due to an hard-interface being removed from the mesh
          *  (optional)
          */
-        int (*del_if)(struct batadv_orig_node *orig_node, int max_if_num,
-                      int del_if_num);
+        int (*del_if)(struct batadv_orig_node *orig_node,
+                      unsigned int max_if_num, unsigned int del_if_num);
 
 #ifdef CONFIG_BATMAN_ADV_DEBUGFS
         /** @print: print the originator table (optional) */
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 01117ae84f1d..a2ddae2f37d7 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2296,8 +2296,14 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
         else
                 sec_level = authreq_to_seclevel(auth);
 
-        if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
+        if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) {
+                /* If link is already encrypted with sufficient security we
+                 * still need refresh encryption as per Core Spec 5.0 Vol 3,
+                 * Part H 2.4.6
+                 */
+                smp_ltk_encrypt(conn, hcon->sec_level);
                 return 0;
+        }
 
         if (sec_level > hcon->pending_sec_level)
                 hcon->pending_sec_level = sec_level;
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 27f1d4f2114a..9b16eaf33819 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -214,7 +214,7 @@ static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
 
         iph = ip_hdr(skb);
         if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
-                goto inhdr_error;
+                goto csum_error;
 
         len = ntohs(iph->tot_len);
         if (skb->len < len) {
@@ -236,6 +236,8 @@ static int br_validate_ipv4(struct net *net, struct sk_buff *skb)
          */
         return 0;
 
+csum_error:
+        __IP_INC_STATS(net, IPSTATS_MIB_CSUMERRORS);
 inhdr_error:
         __IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
 drop:
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 51935270c651..9896f4975353 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -168,6 +168,8 @@ static struct net_bridge_vlan *br_vlan_get_master(struct net_bridge *br, u16 vid
                 masterv = br_vlan_find(vg, vid);
                 if (WARN_ON(!masterv))
                         return NULL;
+                refcount_set(&masterv->refcnt, 1);
+                return masterv;
         }
         refcount_inc(&masterv->refcnt);
 
diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index ce7152a12bd8..620e54f08296 100644
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -172,18 +172,69 @@ ebt_among_mt(const struct sk_buff *skb, struct xt_action_param *par)
         return true;
 }
 
+static bool poolsize_invalid(const struct ebt_mac_wormhash *w)
+{
+        return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple));
+}
+
+static bool wormhash_offset_invalid(int off, unsigned int len)
+{
+        if (off == 0) /* not present */
+                return false;
+
+        if (off < (int)sizeof(struct ebt_among_info) ||
+            off % __alignof__(struct ebt_mac_wormhash))
+                return true;
+
+        off += sizeof(struct ebt_mac_wormhash);
+
+        return off > len;
+}
+
+static bool wormhash_sizes_valid(const struct ebt_mac_wormhash *wh, int a, int b)
+{
+        if (a == 0)
+                a = sizeof(struct ebt_among_info);
+
+        return ebt_mac_wormhash_size(wh) + a == b;
+}
+
 static int ebt_among_mt_check(const struct xt_mtchk_param *par)
 {
         const struct ebt_among_info *info = par->matchinfo;
         const struct ebt_entry_match *em =
                 container_of(par->matchinfo, const struct ebt_entry_match, data);
-        int expected_length = sizeof(struct ebt_among_info);
+        unsigned int expected_length = sizeof(struct ebt_among_info);
         const struct ebt_mac_wormhash *wh_dst, *wh_src;
         int err;
 
+        if (expected_length > em->match_size)
+                return -EINVAL;
+
+        if (wormhash_offset_invalid(info->wh_dst_ofs, em->match_size) ||
+            wormhash_offset_invalid(info->wh_src_ofs, em->match_size))
+                return -EINVAL;
+
         wh_dst = ebt_among_wh_dst(info);
-        wh_src = ebt_among_wh_src(info);
+        if (poolsize_invalid(wh_dst))
+                return -EINVAL;
+
         expected_length += ebt_mac_wormhash_size(wh_dst);
+        if (expected_length > em->match_size)
+                return -EINVAL;
+
+        wh_src = ebt_among_wh_src(info);
+        if (poolsize_invalid(wh_src))
+                return -EINVAL;
+
+        if (info->wh_src_ofs < info->wh_dst_ofs) {
+                if (!wormhash_sizes_valid(wh_src, info->wh_src_ofs, info->wh_dst_ofs))
+                        return -EINVAL;
+        } else {
+                if (!wormhash_sizes_valid(wh_dst, info->wh_dst_ofs, info->wh_src_ofs))
+                        return -EINVAL;
+        }
+
         expected_length += ebt_mac_wormhash_size(wh_src);
 
         if (em->match_size != EBT_ALIGN(expected_length)) {
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 02c4b409d317..a94d23b0a9af 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1641,7 +1641,8 @@ static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
         int off = ebt_compat_match_offset(match, m->match_size);
         compat_uint_t msize = m->match_size - off;
 
-        BUG_ON(off >= m->match_size);
+        if (WARN_ON(off >= m->match_size))
+                return -EINVAL;
 
         if (copy_to_user(cm->u.name, match->name,
             strlen(match->name) + 1) || put_user(msize, &cm->match_size))
@@ -1671,7 +1672,8 @@ static int compat_target_to_user(struct ebt_entry_target *t,
         int off = xt_compat_target_offset(target);
         compat_uint_t tsize = t->target_size - off;
 
-        BUG_ON(off >= t->target_size);
+        if (WARN_ON(off >= t->target_size))
+                return -EINVAL;
 
         if (copy_to_user(cm->u.name, target->name,
             strlen(target->name) + 1) || put_user(tsize, &cm->match_size))
@@ -1902,7 +1904,8 @@ static int ebt_buf_add(struct ebt_entries_buf_state *state,
         if (state->buf_kern_start == NULL)
                 goto count_only;
 
-        BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len);
+        if (WARN_ON(state->buf_kern_offset + sz > state->buf_kern_len))
+                return -EINVAL;
 
         memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz);
 
@@ -1915,7 +1918,8 @@ static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz)
 {
         char *b = state->buf_kern_start;
 
-        BUG_ON(b && state->buf_kern_offset > state->buf_kern_len);
+        if (WARN_ON(b && state->buf_kern_offset > state->buf_kern_len))
+                return -EINVAL;
 
         if (b != NULL && sz > 0)
                 memset(b + state->buf_kern_offset, 0, sz);
@@ -1992,8 +1996,10 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
         pad = XT_ALIGN(size_kern) - size_kern;
 
         if (pad > 0 && dst) {
-                BUG_ON(state->buf_kern_len <= pad);
-                BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad);
+                if (WARN_ON(state->buf_kern_len <= pad))
+                        return -EINVAL;
+                if (WARN_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad))
+                        return -EINVAL;
                 memset(dst + size_kern, 0, pad);
         }
         return off + match_size;
@@ -2043,7 +2049,8 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
                 if (ret < 0)
                         return ret;
 
-                BUG_ON(ret < match32->match_size);
+                if (WARN_ON(ret < match32->match_size))
+                        return -EINVAL;
                 growth += ret - match32->match_size;
                 growth += ebt_compat_entry_padsize();
 
@@ -2053,7 +2060,9 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
                 if (match_kern)
                         match_kern->match_size = ret;
 
-                WARN_ON(type == EBT_COMPAT_TARGET && size_left);
+                if (WARN_ON(type == EBT_COMPAT_TARGET && size_left))
+                        return -EINVAL;
+
                 match32 = (struct compat_ebt_entry_mwt *) buf;
         }
 
@@ -2109,6 +2118,19 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
          *
          * offsets are relative to beginning of struct ebt_entry (i.e., 0).
          */
+        for (i = 0; i < 4 ; ++i) {
+                if (offsets[i] > *total)
+                        return -EINVAL;
+
+                if (i < 3 && offsets[i] == *total)
+                        return -EINVAL;
+
+                if (i == 0)
+                        continue;
+                if (offsets[i-1] > offsets[i])
+                        return -EINVAL;
+        }
+
         for (i = 0, j = 1 ; j < 4 ; j++, i++) {
                 struct compat_ebt_entry_mwt *match32;
                 unsigned int size;
@@ -2140,7 +2162,8 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
 
         startoff = state->buf_user_offset - startoff;
 
-        BUG_ON(*total < startoff);
+        if (WARN_ON(*total < startoff))
+                return -EINVAL;
         *total -= startoff;
         return 0;
 }
@@ -2267,7 +2290,8 @@ static int compat_do_replace(struct net *net, void __user *user,
         state.buf_kern_len = size64;
 
         ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
-        BUG_ON(ret < 0);        /* parses same data again */
+        if (WARN_ON(ret < 0))
+                goto out_unlock;
 
         vfree(entries_tmp);
         tmp.entries_size = size64;
diff --git a/net/core/dev.c b/net/core/dev.c
index d4362befe7e2..12be20535714 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3278,15 +3278,23 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q,
 #if IS_ENABLED(CONFIG_CGROUP_NET_PRIO)
 static void skb_update_prio(struct sk_buff *skb)
 {
-        struct netprio_map *map = rcu_dereference_bh(skb->dev->priomap);
+        const struct netprio_map *map;
+        const struct sock *sk;
+        unsigned int prioidx;
 
-        if (!skb->priority && skb->sk && map) {
-                unsigned int prioidx =
-                        sock_cgroup_prioidx(&skb->sk->sk_cgrp_data);
+        if (skb->priority)
+                return;
+        map = rcu_dereference_bh(skb->dev->priomap);
+        if (!map)
+                return;
+        sk = skb_to_full_sk(skb);
+        if (!sk)
+                return;
 
-                if (prioidx < map->priomap_len)
-                        skb->priority = map->priomap[prioidx];
-        }
+        prioidx = sock_cgroup_prioidx(&sk->sk_cgrp_data);
+
+        if (prioidx < map->priomap_len)
+                skb->priority = map->priomap[prioidx];
 }
 #else
 #define skb_update_prio(skb)
@@ -6396,6 +6404,7 @@ static int __netdev_upper_dev_link(struct net_device *dev,
                 .linking = true,
                 .upper_info = upper_info,
         };
+        struct net_device *master_dev;
         int ret = 0;
 
         ASSERT_RTNL();
@@ -6407,11 +6416,14 @@ static int __netdev_upper_dev_link(struct net_device *dev,
         if (netdev_has_upper_dev(upper_dev, dev))
                 return -EBUSY;
 
-        if (netdev_has_upper_dev(dev, upper_dev))
-                return -EEXIST;
-
-        if (master && netdev_master_upper_dev_get(dev))
-                return -EBUSY;
+        if (!master) {
+                if (netdev_has_upper_dev(dev, upper_dev))
+                        return -EEXIST;
+        } else {
+                master_dev = netdev_master_upper_dev_get(dev);
+                if (master_dev)
+                        return master_dev == upper_dev ? -EEXIST : -EBUSY;
+        }
 
         ret = call_netdevice_notifiers_info(NETDEV_PRECHANGEUPPER,
                                             &changeupper_info.info);
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 0ab1af04296c..a04e1e88bf3a 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -402,8 +402,6 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
         if (colon)
                 *colon = 0;
 
-        dev_load(net, ifr->ifr_name);
-
         /*
          *      See which interface the caller is talking about.
          */
@@ -423,6 +421,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
         case SIOCGIFMAP:
         case SIOCGIFINDEX:
         case SIOCGIFTXQLEN:
+                dev_load(net, ifr->ifr_name);
                 rcu_read_lock();
                 ret = dev_ifsioc_locked(net, ifr, cmd);
                 rcu_read_unlock();
@@ -431,6 +430,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
                 return ret;
 
         case SIOCETHTOOL:
+                dev_load(net, ifr->ifr_name);
                 rtnl_lock();
                 ret = dev_ethtool(net, ifr);
                 rtnl_unlock();
@@ -447,6 +447,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
         case SIOCGMIIPHY:
         case SIOCGMIIREG:
         case SIOCSIFNAME:
+                dev_load(net, ifr->ifr_name);
                 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
                         return -EPERM;
                 rtnl_lock();
@@ -494,6 +495,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
                 /* fall through */
         case SIOCBONDSLAVEINFOQUERY:
         case SIOCBONDINFOQUERY:
+                dev_load(net, ifr->ifr_name);
                 rtnl_lock();
                 ret = dev_ifsioc(net, ifr, cmd);
                 rtnl_unlock();
@@ -518,6 +520,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
                     cmd == SIOCGHWTSTAMP ||
                     (cmd >= SIOCDEVPRIVATE &&
                      cmd <= SIOCDEVPRIVATE + 15)) {
+                        dev_load(net, ifr->ifr_name);
                         rtnl_lock();
                         ret = dev_ifsioc(net, ifr, cmd);
                         rtnl_unlock();
diff --git a/net/core/devlink.c b/net/core/devlink.c
index 18d385ed8237..effd4848c2b4 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1695,10 +1695,11 @@ static int devlink_dpipe_table_put(struct sk_buff *skb,
                 goto nla_put_failure;
 
         if (table->resource_valid) {
-                nla_put_u64_64bit(skb, DEVLINK_ATTR_DPIPE_TABLE_RESOURCE_ID,
-                                  table->resource_id, DEVLINK_ATTR_PAD);
-                nla_put_u64_64bit(skb, DEVLINK_ATTR_DPIPE_TABLE_RESOURCE_UNITS,
-                                  table->resource_units, DEVLINK_ATTR_PAD);
+                if (nla_put_u64_64bit(skb, DEVLINK_ATTR_DPIPE_TABLE_RESOURCE_ID,
+                                      table->resource_id, DEVLINK_ATTR_PAD) ||
+                    nla_put_u64_64bit(skb, DEVLINK_ATTR_DPIPE_TABLE_RESOURCE_UNITS,
+                                      table->resource_units, DEVLINK_ATTR_PAD))
+                        goto nla_put_failure;
         }
         if (devlink_dpipe_matches_put(table, skb))
                 goto nla_put_failure;
@@ -1797,7 +1798,7 @@ send_done:
         if (!nlh) {
                 err = devlink_dpipe_send_and_alloc_skb(&skb, info);
                 if (err)
-                        goto err_skb_send_alloc;
+                        return err;
                 goto send_done;
         }
 
@@ -1806,7 +1807,6 @@ send_done:
 nla_put_failure:
         err = -EMSGSIZE;
 err_table_put:
-err_skb_send_alloc:
         genlmsg_cancel(skb, hdr);
         nlmsg_free(skb);
         return err;
@@ -2072,7 +2072,7 @@ static int devlink_dpipe_entries_fill(struct genl_info *info,
                                              table->counters_enabled,
                                              &dump_ctx);
         if (err)
-                goto err_entries_dump;
+                return err;
 
 send_done:
         nlh = nlmsg_put(dump_ctx.skb, info->snd_portid, info->snd_seq,
@@ -2080,16 +2080,10 @@ send_done:
         if (!nlh) {
                 err = devlink_dpipe_send_and_alloc_skb(&dump_ctx.skb, info);
                 if (err)
-                        goto err_skb_send_alloc;
+                        return err;
                 goto send_done;
         }
         return genlmsg_reply(dump_ctx.skb, info);
-
-err_entries_dump:
-err_skb_send_alloc:
-        genlmsg_cancel(dump_ctx.skb, dump_ctx.hdr);
-        nlmsg_free(dump_ctx.skb);
-        return err;
 }
 
 static int devlink_nl_cmd_dpipe_entries_get(struct sk_buff *skb,
@@ -2228,7 +2222,7 @@ send_done:
         if (!nlh) {
                 err = devlink_dpipe_send_and_alloc_skb(&skb, info);
                 if (err)
-                        goto err_skb_send_alloc;
+                        return err;
                 goto send_done;
         }
         return genlmsg_reply(skb, info);
@@ -2236,7 +2230,6 @@ send_done:
 nla_put_failure:
         err = -EMSGSIZE;
 err_table_put:
-err_skb_send_alloc:
         genlmsg_cancel(skb, hdr);
         nlmsg_free(skb);
         return err;
@@ -2332,7 +2325,7 @@ devlink_resource_validate_children(struct devlink_resource *resource)
         list_for_each_entry(child_resource, &resource->resource_list, list)
                 parts_size += child_resource->size_new;
 
-        if (parts_size > resource->size)
+        if (parts_size > resource->size_new)
                 size_valid = false;
 out:
         resource->size_valid = size_valid;
@@ -2372,20 +2365,22 @@ static int devlink_nl_cmd_resource_set(struct sk_buff *skb,
         return 0;
 }
 
-static void
+static int
 devlink_resource_size_params_put(struct devlink_resource *resource,
                                  struct sk_buff *skb)
 {
         struct devlink_resource_size_params *size_params;
 
-        size_params = resource->size_params;
-        nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_GRAN,
-                          size_params->size_granularity, DEVLINK_ATTR_PAD);
-        nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_MAX,
-                          size_params->size_max, DEVLINK_ATTR_PAD);
-        nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_MIN,
-                          size_params->size_min, DEVLINK_ATTR_PAD);
-        nla_put_u8(skb, DEVLINK_ATTR_RESOURCE_UNIT, size_params->unit);
+        size_params = &resource->size_params;
+        if (nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_GRAN,
+                              size_params->size_granularity, DEVLINK_ATTR_PAD) ||
+            nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_MAX,
+                              size_params->size_max, DEVLINK_ATTR_PAD) ||
+            nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_MIN,
+                              size_params->size_min, DEVLINK_ATTR_PAD) ||
+            nla_put_u8(skb, DEVLINK_ATTR_RESOURCE_UNIT, size_params->unit))
+                return -EMSGSIZE;
+        return 0;
 }
 
 static int devlink_resource_put(struct devlink *devlink, struct sk_buff *skb,
@@ -2409,10 +2404,12 @@ static int devlink_resource_put(struct devlink *devlink, struct sk_buff *skb,
                 nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_SIZE_NEW,
                                   resource->size_new, DEVLINK_ATTR_PAD);
         if (resource->resource_ops && resource->resource_ops->occ_get)
-                nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_OCC,
-                                  resource->resource_ops->occ_get(devlink),
-                                  DEVLINK_ATTR_PAD);
-        devlink_resource_size_params_put(resource, skb);
+                if (nla_put_u64_64bit(skb, DEVLINK_ATTR_RESOURCE_OCC,
+                                      resource->resource_ops->occ_get(devlink),
+                                      DEVLINK_ATTR_PAD))
+                        goto nla_put_failure;
+        if (devlink_resource_size_params_put(resource, skb))
+                goto nla_put_failure;
         if (list_empty(&resource->resource_list))
                 goto out;
 
@@ -3151,7 +3148,7 @@ int devlink_resource_register(struct devlink *devlink,
                               u64 resource_size,
                               u64 resource_id,
                               u64 parent_resource_id,
-                              struct devlink_resource_size_params *size_params,
+                              const struct devlink_resource_size_params *size_params,
                               const struct devlink_resource_ops *resource_ops)
 {
         struct devlink_resource *resource;
@@ -3194,7 +3191,8 @@ int devlink_resource_register(struct devlink *devlink,
         resource->id = resource_id;
         resource->resource_ops = resource_ops;
         resource->size_valid = true;
-        resource->size_params = size_params;
+        memcpy(&resource->size_params, size_params,
+               sizeof(resource->size_params));
         INIT_LIST_HEAD(&resource->resource_list);
         list_add_tail(&resource->list, resource_list);
 out:
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 494e6a5d7306..3f89c76d5c24 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -2520,11 +2520,14 @@ static int set_phy_tunable(struct net_device *dev, void __user *useraddr)
 static int ethtool_get_fecparam(struct net_device *dev, void __user *useraddr)
 {
         struct ethtool_fecparam fecparam = { ETHTOOL_GFECPARAM };
+        int rc;
 
         if (!dev->ethtool_ops->get_fecparam)
                 return -EOPNOTSUPP;
 
-        dev->ethtool_ops->get_fecparam(dev, &fecparam);
+        rc = dev->ethtool_ops->get_fecparam(dev, &fecparam);
+        if (rc)
+                return rc;
 
         if (copy_to_user(useraddr, &fecparam, sizeof(fecparam)))
                 return -EFAULT;
diff --git a/net/core/filter.c b/net/core/filter.c
index 0c121adbdbaa..48aa7c7320db 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2087,6 +2087,10 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
         u32 off = skb_mac_header_len(skb);
         int ret;
 
+        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+                return -ENOTSUPP;
+
         ret = skb_cow(skb, len_diff);
         if (unlikely(ret < 0))
                 return ret;
@@ -2096,19 +2100,21 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
                 return ret;
 
         if (skb_is_gso(skb)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
+
                 /* SKB_GSO_TCPV4 needs to be changed into
                  * SKB_GSO_TCPV6.
                  */
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) {
-                        skb_shinfo(skb)->gso_type &= ~SKB_GSO_TCPV4;
-                        skb_shinfo(skb)->gso_type |=  SKB_GSO_TCPV6;
+                if (shinfo->gso_type & SKB_GSO_TCPV4) {
+                        shinfo->gso_type &= ~SKB_GSO_TCPV4;
+                        shinfo->gso_type |=  SKB_GSO_TCPV6;
                 }
 
                 /* Due to IPv6 header, MSS needs to be downgraded. */
-                skb_shinfo(skb)->gso_size -= len_diff;
+                skb_decrease_gso_size(shinfo, len_diff);
                 /* Header must be checked, and gso_segs recomputed. */
-                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
-                skb_shinfo(skb)->gso_segs = 0;
+                shinfo->gso_type |= SKB_GSO_DODGY;
+                shinfo->gso_segs = 0;
         }
 
         skb->protocol = htons(ETH_P_IPV6);
@@ -2123,6 +2129,10 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
         u32 off = skb_mac_header_len(skb);
         int ret;
 
+        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+                return -ENOTSUPP;
+
         ret = skb_unclone(skb, GFP_ATOMIC);
         if (unlikely(ret < 0))
                 return ret;
@@ -2132,19 +2142,21 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
                 return ret;
 
         if (skb_is_gso(skb)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
+
                 /* SKB_GSO_TCPV6 needs to be changed into
                  * SKB_GSO_TCPV4.
                  */
-                if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
-                        skb_shinfo(skb)->gso_type &= ~SKB_GSO_TCPV6;
-                        skb_shinfo(skb)->gso_type |=  SKB_GSO_TCPV4;
+                if (shinfo->gso_type & SKB_GSO_TCPV6) {
+                        shinfo->gso_type &= ~SKB_GSO_TCPV6;
+                        shinfo->gso_type |=  SKB_GSO_TCPV4;
                 }
 
                 /* Due to IPv4 header, MSS can be upgraded. */
-                skb_shinfo(skb)->gso_size += len_diff;
+                skb_increase_gso_size(shinfo, len_diff);
                 /* Header must be checked, and gso_segs recomputed. */
-                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
-                skb_shinfo(skb)->gso_segs = 0;
+                shinfo->gso_type |= SKB_GSO_DODGY;
+                shinfo->gso_segs = 0;
         }
 
         skb->protocol = htons(ETH_P_IP);
@@ -2243,6 +2255,10 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff)
         u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
         int ret;
 
+        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+                return -ENOTSUPP;
+
         ret = skb_cow(skb, len_diff);
         if (unlikely(ret < 0))
                 return ret;
@@ -2252,11 +2268,13 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff)
                 return ret;
 
         if (skb_is_gso(skb)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
+
                 /* Due to header grow, MSS needs to be downgraded. */
-                skb_shinfo(skb)->gso_size -= len_diff;
+                skb_decrease_gso_size(shinfo, len_diff);
                 /* Header must be checked, and gso_segs recomputed. */
-                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
-                skb_shinfo(skb)->gso_segs = 0;
+                shinfo->gso_type |= SKB_GSO_DODGY;
+                shinfo->gso_segs = 0;
         }
 
         return 0;
@@ -2267,6 +2285,10 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
         u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
         int ret;
 
+        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+                return -ENOTSUPP;
+
         ret = skb_unclone(skb, GFP_ATOMIC);
         if (unlikely(ret < 0))
                 return ret;
@@ -2276,11 +2298,13 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
                 return ret;
 
         if (skb_is_gso(skb)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
+
                 /* Due to header shrink, MSS can be upgraded. */
-                skb_shinfo(skb)->gso_size += len_diff;
+                skb_increase_gso_size(shinfo, len_diff);
                 /* Header must be checked, and gso_segs recomputed. */
-                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
-                skb_shinfo(skb)->gso_segs = 0;
+                shinfo->gso_type |= SKB_GSO_DODGY;
+                shinfo->gso_segs = 0;
         }
 
         return 0;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 09bd89c90a71..1e7acdc30732 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4179,7 +4179,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
 
         skb_queue_tail(&sk->sk_error_queue, skb);
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk);
+                sk->sk_error_report(sk);
         return 0;
 }
 EXPORT_SYMBOL(sock_queue_err_skb);
@@ -4891,7 +4891,7 @@ EXPORT_SYMBOL_GPL(skb_scrub_packet);
  *
  * The MAC/L2 or network (IP, IPv6) headers are not accounted for.
  */
-unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
+static unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
 {
         const struct skb_shared_info *shinfo = skb_shinfo(skb);
         unsigned int thlen = 0;
@@ -4904,7 +4904,7 @@ unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
                         thlen += inner_tcp_hdrlen(skb);
         } else if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) {
                 thlen = tcp_hdrlen(skb);
-        } else if (unlikely(shinfo->gso_type & SKB_GSO_SCTP)) {
+        } else if (unlikely(skb_is_gso_sctp(skb))) {
                 thlen = sizeof(struct sctphdr);
         }
         /* UFO sets gso_size to the size of the fragmentation
@@ -4913,7 +4913,40 @@ unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
          */
         return thlen + shinfo->gso_size;
 }
-EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);
+
+/**
+ * skb_gso_network_seglen - Return length of individual segments of a gso packet
+ *
+ * @skb: GSO skb
+ *
+ * skb_gso_network_seglen is used to determine the real size of the
+ * individual segments, including Layer3 (IP, IPv6) and L4 headers (TCP/UDP).
+ *
+ * The MAC/L2 header is not accounted for.
+ */
+static unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
+{
+        unsigned int hdr_len = skb_transport_header(skb) -
+                               skb_network_header(skb);
+
+        return hdr_len + skb_gso_transport_seglen(skb);
+}
+
+/**
+ * skb_gso_mac_seglen - Return length of individual segments of a gso packet
+ *
+ * @skb: GSO skb
+ *
+ * skb_gso_mac_seglen is used to determine the real size of the
+ * individual segments, including MAC/L2, Layer3 (IP, IPv6) and L4
+ * headers (TCP/UDP).
+ */
+static unsigned int skb_gso_mac_seglen(const struct sk_buff *skb)
+{
+        unsigned int hdr_len = skb_transport_header(skb) - skb_mac_header(skb);
+
+        return hdr_len + skb_gso_transport_seglen(skb);
+}
 
 /**
  * skb_gso_size_check - check the skb size, considering GSO_BY_FRAGS
@@ -4955,19 +4988,20 @@ static inline bool skb_gso_size_check(const struct sk_buff *skb,
 }
 
 /**
- * skb_gso_validate_mtu - Return in case such skb fits a given MTU
+ * skb_gso_validate_network_len - Will a split GSO skb fit into a given MTU?
  *
  * @skb: GSO skb
  * @mtu: MTU to validate against
  *
- * skb_gso_validate_mtu validates if a given skb will fit a wanted MTU
- * once split.
+ * skb_gso_validate_network_len validates if a given skb will fit a
+ * wanted MTU once split. It considers L3 headers, L4 headers, and the
+ * payload.
  */
-bool skb_gso_validate_mtu(const struct sk_buff *skb, unsigned int mtu)
+bool skb_gso_validate_network_len(const struct sk_buff *skb, unsigned int mtu)
 {
         return skb_gso_size_check(skb, skb_gso_network_seglen(skb), mtu);
 }
-EXPORT_SYMBOL_GPL(skb_gso_validate_mtu);
+EXPORT_SYMBOL_GPL(skb_gso_validate_network_len);
 
 /**
  * skb_gso_validate_mac_len - Will a split GSO skb fit in a given length?
@@ -4986,13 +5020,16 @@ EXPORT_SYMBOL_GPL(skb_gso_validate_mac_len);
 
 static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
 {
+        int mac_len;
+
         if (skb_cow(skb, skb_headroom(skb)) < 0) {
                 kfree_skb(skb);
                 return NULL;
         }
 
-        memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len - VLAN_HLEN,
-                2 * ETH_ALEN);
+        mac_len = skb->data - skb_mac_header(skb);
+        memmove(skb_mac_header(skb) + VLAN_HLEN, skb_mac_header(skb),
+                mac_len - VLAN_HLEN - ETH_TLEN);
         skb->mac_header += VLAN_HLEN;
         return skb;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index c501499a04fe..85b0b64e7f9d 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3261,6 +3261,27 @@ void proto_unregister(struct proto *prot)
 }
 EXPORT_SYMBOL(proto_unregister);
 
+int sock_load_diag_module(int family, int protocol)
+{
+        if (!protocol) {
+                if (!sock_is_registered(family))
+                        return -ENOENT;
+
+                return request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+                                      NETLINK_SOCK_DIAG, family);
+        }
+
+#ifdef CONFIG_INET
+        if (family == AF_INET &&
+            !rcu_access_pointer(inet_protos[protocol]))
+                return -ENOENT;
+#endif
+
+        return request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
+                              NETLINK_SOCK_DIAG, family, protocol);
+}
+EXPORT_SYMBOL(sock_load_diag_module);
+
 #ifdef CONFIG_PROC_FS
 static void *proto_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(proto_list_mutex)
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index 146b50e30659..c37b5be7c5e4 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -220,8 +220,7 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh)
                 return -EINVAL;
 
         if (sock_diag_handlers[req->sdiag_family] == NULL)
-                request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-                                NETLINK_SOCK_DIAG, req->sdiag_family);
+                sock_load_diag_module(req->sdiag_family, 0);
 
         mutex_lock(&sock_diag_table_mutex);
         hndl = sock_diag_handlers[req->sdiag_family];
@@ -247,8 +246,7 @@ static int sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
         case TCPDIAG_GETSOCK:
         case DCCPDIAG_GETSOCK:
                 if (inet_rcv_compat == NULL)
-                        request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-                                        NETLINK_SOCK_DIAG, AF_INET);
+                        sock_load_diag_module(AF_INET, 0);
 
                 mutex_lock(&sock_diag_table_mutex);
                 if (inet_rcv_compat != NULL)
@@ -281,14 +279,12 @@ static int sock_diag_bind(struct net *net, int group)
         case SKNLGRP_INET_TCP_DESTROY:
         case SKNLGRP_INET_UDP_DESTROY:
                 if (!sock_diag_handlers[AF_INET])
-                        request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-                                       NETLINK_SOCK_DIAG, AF_INET);
+                        sock_load_diag_module(AF_INET, 0);
                 break;
         case SKNLGRP_INET6_TCP_DESTROY:
         case SKNLGRP_INET6_UDP_DESTROY:
                 if (!sock_diag_handlers[AF_INET6])
-                        request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
-                                       NETLINK_SOCK_DIAG, AF_INET6);
+                        sock_load_diag_module(AF_INET6, 0);
                 break;
         }
         return 0;
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 15bdc002d90c..84cd4e3fd01b 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -794,6 +794,11 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         if (skb == NULL)
                 goto out_release;
 
+        if (sk->sk_state == DCCP_CLOSED) {
+                rc = -ENOTCONN;
+                goto out_discard;
+        }
+
         skb_reserve(skb, sk->sk_prot->max_header);
         rc = memcpy_from_msg(skb_put(skb, len), msg, len);
         if (rc != 0)
diff --git a/net/dsa/legacy.c b/net/dsa/legacy.c
index cb54b81d0bd9..42a7b85b84e1 100644
--- a/net/dsa/legacy.c
+++ b/net/dsa/legacy.c
@@ -194,7 +194,7 @@ static int dsa_switch_setup_one(struct dsa_switch *ds,
                 ds->ports[i].dn = cd->port_dn[i];
                 ds->ports[i].cpu_dp = dst->cpu_dp;
 
-                if (dsa_is_user_port(ds, i))
+                if (!dsa_is_user_port(ds, i))
                         continue;
 
                 ret = dsa_slave_create(&ds->ports[i]);
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index 974765b7d92a..e9f0489e4229 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -206,9 +206,13 @@ static inline void lowpan_netlink_fini(void)
 static int lowpan_device_event(struct notifier_block *unused,
                                unsigned long event, void *ptr)
 {
-        struct net_device *wdev = netdev_notifier_info_to_dev(ptr);
+        struct net_device *ndev = netdev_notifier_info_to_dev(ptr);
+        struct wpan_dev *wpan_dev;
 
-        if (wdev->type != ARPHRD_IEEE802154)
+        if (ndev->type != ARPHRD_IEEE802154)
+                return NOTIFY_DONE;
+        wpan_dev = ndev->ieee802154_ptr;
+        if (!wpan_dev)
                 return NOTIFY_DONE;
 
         switch (event) {
@@ -217,8 +221,8 @@ static int lowpan_device_event(struct notifier_block *unused,
                  * also delete possible lowpan interfaces which belongs
                  * to the wpan interface.
                  */
-                if (wdev->ieee802154_ptr->lowpan_dev)
-                        lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL);
+                if (wpan_dev->lowpan_dev)
+                        lowpan_dellink(wpan_dev->lowpan_dev, NULL);
                 break;
         default:
                 return NOTIFY_DONE;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index a383f299ce24..4e5bc4b2f14e 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -53,8 +53,7 @@ static DEFINE_MUTEX(inet_diag_table_mutex);
 static const struct inet_diag_handler *inet_diag_lock_handler(int proto)
 {
         if (!inet_diag_table[proto])
-                request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
-                               NETLINK_SOCK_DIAG, AF_INET, proto);
+                sock_load_diag_module(AF_INET, proto);
 
         mutex_lock(&inet_diag_table_mutex);
         if (!inet_diag_table[proto])
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 26a3d0315728..e8ec28999f5c 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -119,6 +119,9 @@ out:
 
 static bool inet_fragq_should_evict(const struct inet_frag_queue *q)
 {
+        if (!hlist_unhashed(&q->list_evictor))
+                return false;
+
         return q->net->low_thresh == 0 ||
                frag_mem_limit(q->net) >= q->net->low_thresh;
 }
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 2dd21c3281a1..b54b948b0596 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -55,7 +55,7 @@ static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
         if (skb->ignore_df)
                 return false;
 
-        if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
+        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
                 return false;
 
         return true;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 45d97e9b2759..0901de42ed85 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -970,9 +970,6 @@ static void __gre_tunnel_init(struct net_device *dev)
 
         t_hlen = tunnel->hlen + sizeof(struct iphdr);
 
-        dev->needed_headroom    = LL_MAX_HEADER + t_hlen + 4;
-        dev->mtu                = ETH_DATA_LEN - t_hlen - 4;
-
         dev->features           |= GRE_FEATURES;
         dev->hw_features        |= GRE_FEATURES;
 
@@ -1290,8 +1287,6 @@ static int erspan_tunnel_init(struct net_device *dev)
                        erspan_hdr_len(tunnel->erspan_ver);
         t_hlen = tunnel->hlen + sizeof(struct iphdr);
 
-        dev->needed_headroom = LL_MAX_HEADER + t_hlen + 4;
-        dev->mtu = ETH_DATA_LEN - t_hlen - 4;
         dev->features           |= GRE_FEATURES;
         dev->hw_features        |= GRE_FEATURES;
         dev->priv_flags         |= IFF_LIVE_ADDR_CHANGE;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index e8e675be60ec..66340ab750e6 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -248,7 +248,7 @@ static int ip_finish_output_gso(struct net *net, struct sock *sk,
 
         /* common case: seglen is <= mtu
          */
-        if (skb_gso_validate_mtu(skb, mtu))
+        if (skb_gso_validate_network_len(skb, mtu))
                 return ip_finish_output2(net, sk, skb);
 
         /* Slowpath -  GSO segment length exceeds the egress MTU.
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 9c41a0cef1a5..74c962b9b09c 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -258,7 +258,8 @@ int ip_cmsg_send(struct sock *sk, struct msghdr *msg, struct ipcm_cookie *ipc,
                         src_info = (struct in6_pktinfo *)CMSG_DATA(cmsg);
                         if (!ipv6_addr_v4mapped(&src_info->ipi6_addr))
                                 return -EINVAL;
-                        ipc->oif = src_info->ipi6_ifindex;
+                        if (src_info->ipi6_ifindex)
+                                ipc->oif = src_info->ipi6_ifindex;
                         ipc->addr = src_info->ipi6_addr.s6_addr32[3];
                         continue;
                 }
@@ -288,7 +289,8 @@ int ip_cmsg_send(struct sock *sk, struct msghdr *msg, struct ipcm_cookie *ipc,
                         if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct in_pktinfo)))
                                 return -EINVAL;
                         info = (struct in_pktinfo *)CMSG_DATA(cmsg);
-                        ipc->oif = info->ipi_ifindex;
+                        if (info->ipi_ifindex)
+                                ipc->oif = info->ipi_ifindex;
                         ipc->addr = info->ipi_spec_dst.s_addr;
                         break;
                 }
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index d786a8441bce..6d21068f9b55 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -710,16 +710,9 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                 }
         }
 
-        if (tunnel->fwmark) {
-                init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr,
-                                 tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link,
-                                 tunnel->fwmark);
-        }
-        else {
-                init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr,
-                                 tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link,
-                                 skb->mark);
-        }
+        init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr,
+                         tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link,
+                         tunnel->fwmark);
 
         if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0)
                 goto tx_error;
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 4b02ab39ebc5..8a8ae61cea71 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -232,7 +232,6 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i,
         c->hash_mode = i->hash_mode;
         c->hash_initval = i->hash_initval;
         refcount_set(&c->refcount, 1);
-        refcount_set(&c->entries, 1);
 
         spin_lock_bh(&cn->lock);
         if (__clusterip_config_find(net, ip)) {
@@ -263,8 +262,10 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i,
 
         c->notifier.notifier_call = clusterip_netdev_event;
         err = register_netdevice_notifier(&c->notifier);
-        if (!err)
+        if (!err) {
+                refcount_set(&c->entries, 1);
                 return c;
+        }
 
 #ifdef CONFIG_PROC_FS
         proc_remove(c->pde);
@@ -273,7 +274,7 @@ err:
         spin_lock_bh(&cn->lock);
         list_del_rcu(&c->list);
         spin_unlock_bh(&cn->lock);
-        kfree(c);
+        clusterip_config_put(c);
 
         return ERR_PTR(err);
 }
@@ -496,12 +497,15 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
                                 return PTR_ERR(config);
                 }
         }
-        cipinfo->config = config;
 
         ret = nf_ct_netns_get(par->net, par->family);
-        if (ret < 0)
+        if (ret < 0) {
                 pr_info("cannot load conntrack support for proto=%u\n",
                         par->family);
+                clusterip_config_entry_put(par->net, config);
+                clusterip_config_put(config);
+                return ret;
+        }
 
         if (!par->net->xt.clusterip_deprecated_warning) {
                 pr_info("ipt_CLUSTERIP is deprecated and it will removed soon, "
@@ -509,6 +513,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
                 par->net->xt.clusterip_deprecated_warning = true;
         }
 
+        cipinfo->config = config;
         return ret;
 }
 
diff --git a/net/ipv4/netfilter/nf_flow_table_ipv4.c b/net/ipv4/netfilter/nf_flow_table_ipv4.c
index 25d2975da156..0cd46bffa469 100644
--- a/net/ipv4/netfilter/nf_flow_table_ipv4.c
+++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c
@@ -111,6 +111,7 @@ static int nf_flow_dnat_ip(const struct flow_offload *flow, struct sk_buff *skb,
         default:
                 return -1;
         }
+        csum_replace4(&iph->check, addr, new_addr);
 
         return nf_flow_nat_ip_l4proto(skb, iph, thoff, addr, new_addr);
 }
@@ -185,7 +186,7 @@ static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
         if ((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0)
                 return false;
 
-        if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
+        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
                 return false;
 
         return true;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a4f44d815a61..299e247b2032 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -128,10 +128,11 @@ static int ip_rt_redirect_silence __read_mostly	= ((HZ / 50) << (9 + 1));
 static int ip_rt_error_cost __read_mostly       = HZ;
 static int ip_rt_error_burst __read_mostly      = 5 * HZ;
 static int ip_rt_mtu_expires __read_mostly      = 10 * 60 * HZ;
-static int ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
+static u32 ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly       = 256;
 
 static int ip_rt_gc_timeout __read_mostly       = RT_GC_TIMEOUT;
+
 /*
  *      Interface to generic destination cache.
  */
@@ -633,6 +634,7 @@ static inline u32 fnhe_hashfun(__be32 daddr)
 static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
 {
         rt->rt_pmtu = fnhe->fnhe_pmtu;
+        rt->rt_mtu_locked = fnhe->fnhe_mtu_locked;
         rt->dst.expires = fnhe->fnhe_expires;
 
         if (fnhe->fnhe_gw) {
@@ -643,7 +645,7 @@ static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnh
 }
 
 static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
-                                  u32 pmtu, unsigned long expires)
+                                  u32 pmtu, bool lock, unsigned long expires)
 {
         struct fnhe_hash_bucket *hash;
         struct fib_nh_exception *fnhe;
@@ -680,8 +682,10 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                         fnhe->fnhe_genid = genid;
                 if (gw)
                         fnhe->fnhe_gw = gw;
-                if (pmtu)
+                if (pmtu) {
                         fnhe->fnhe_pmtu = pmtu;
+                        fnhe->fnhe_mtu_locked = lock;
+                }
                 fnhe->fnhe_expires = max(1UL, expires);
                 /* Update all cached dsts too */
                 rt = rcu_dereference(fnhe->fnhe_rth_input);
@@ -705,6 +709,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                 fnhe->fnhe_daddr = daddr;
                 fnhe->fnhe_gw = gw;
                 fnhe->fnhe_pmtu = pmtu;
+                fnhe->fnhe_mtu_locked = lock;
                 fnhe->fnhe_expires = expires;
 
                 /* Exception created; mark the cached routes for the nexthop
@@ -786,7 +791,8 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow
                                 struct fib_nh *nh = &FIB_RES_NH(res);
 
                                 update_or_create_fnhe(nh, fl4->daddr, new_gw,
-                                                0, jiffies + ip_rt_gc_timeout);
+                                                0, false,
+                                                jiffies + ip_rt_gc_timeout);
                         }
                         if (kill_route)
                                 rt->dst.obsolete = DST_OBSOLETE_KILL;
@@ -930,14 +936,23 @@ out_put_peer:
 
 static int ip_error(struct sk_buff *skb)
 {
-        struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
         struct rtable *rt = skb_rtable(skb);
+        struct net_device *dev = skb->dev;
+        struct in_device *in_dev;
         struct inet_peer *peer;
         unsigned long now;
         struct net *net;
         bool send;
         int code;
 
+        if (netif_is_l3_master(skb->dev)) {
+                dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
+                if (!dev)
+                        goto out;
+        }
+
+        in_dev = __in_dev_get_rcu(dev);
+
         /* IP on this device is disabled. */
         if (!in_dev)
                 goto out;
@@ -999,15 +1014,18 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
 {
         struct dst_entry *dst = &rt->dst;
         struct fib_result res;
+        bool lock = false;
 
-        if (dst_metric_locked(dst, RTAX_MTU))
+        if (ip_mtu_locked(dst))
                 return;
 
         if (ipv4_mtu(dst) < mtu)
                 return;
 
-        if (mtu < ip_rt_min_pmtu)
+        if (mtu < ip_rt_min_pmtu) {
+                lock = true;
                 mtu = ip_rt_min_pmtu;
+        }
 
         if (rt->rt_pmtu == mtu &&
             time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2))
@@ -1017,7 +1035,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
         if (fib_lookup(dev_net(dst->dev), fl4, &res, 0) == 0) {
                 struct fib_nh *nh = &FIB_RES_NH(res);
 
-                update_or_create_fnhe(nh, fl4->daddr, 0, mtu,
+                update_or_create_fnhe(nh, fl4->daddr, 0, mtu, lock,
                                       jiffies + ip_rt_mtu_expires);
         }
         rcu_read_unlock();
@@ -1270,7 +1288,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
 
         mtu = READ_ONCE(dst->dev->mtu);
 
-        if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
+        if (unlikely(ip_mtu_locked(dst))) {
                 if (rt->rt_uses_gateway && mtu > 576)
                         mtu = 576;
         }
@@ -1383,7 +1401,7 @@ struct uncached_list {
 
 static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt_uncached_list);
 
-static void rt_add_uncached_list(struct rtable *rt)
+void rt_add_uncached_list(struct rtable *rt)
 {
         struct uncached_list *ul = raw_cpu_ptr(&rt_uncached_list);
 
@@ -1394,14 +1412,8 @@ static void rt_add_uncached_list(struct rtable *rt)
         spin_unlock_bh(&ul->lock);
 }
 
-static void ipv4_dst_destroy(struct dst_entry *dst)
+void rt_del_uncached_list(struct rtable *rt)
 {
-        struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);
-        struct rtable *rt = (struct rtable *) dst;
-
-        if (p != &dst_default_metrics && refcount_dec_and_test(&p->refcnt))
-                kfree(p);
-
         if (!list_empty(&rt->rt_uncached)) {
                 struct uncached_list *ul = rt->rt_uncached_list;
 
@@ -1411,6 +1423,17 @@ static void ipv4_dst_destroy(struct dst_entry *dst)
         }
 }
 
+static void ipv4_dst_destroy(struct dst_entry *dst)
+{
+        struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);
+        struct rtable *rt = (struct rtable *)dst;
+
+        if (p != &dst_default_metrics && refcount_dec_and_test(&p->refcnt))
+                kfree(p);
+
+        rt_del_uncached_list(rt);
+}
+
 void rt_flush_dev(struct net_device *dev)
 {
         struct net *net = dev_net(dev);
@@ -1506,6 +1529,7 @@ struct rtable *rt_dst_alloc(struct net_device *dev,
                 rt->rt_is_input = 0;
                 rt->rt_iif = 0;
                 rt->rt_pmtu = 0;
+                rt->rt_mtu_locked = 0;
                 rt->rt_gateway = 0;
                 rt->rt_uses_gateway = 0;
                 rt->rt_table_id = 0;
@@ -2531,6 +2555,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
                 rt->rt_is_input = ort->rt_is_input;
                 rt->rt_iif = ort->rt_iif;
                 rt->rt_pmtu = ort->rt_pmtu;
+                rt->rt_mtu_locked = ort->rt_mtu_locked;
 
                 rt->rt_genid = rt_genid_ipv4(net);
                 rt->rt_flags = ort->rt_flags;
@@ -2633,6 +2658,8 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src, u32 table_id,
         memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
         if (rt->rt_pmtu && expires)
                 metrics[RTAX_MTU - 1] = rt->rt_pmtu;
+        if (rt->rt_mtu_locked && expires)
+                metrics[RTAX_LOCK - 1] |= BIT(RTAX_MTU);
         if (rtnetlink_put_metrics(skb, metrics) < 0)
                 goto nla_put_failure;
 
@@ -2818,6 +2845,7 @@ void ip_rt_multicast_event(struct in_device *in_dev)
 static int ip_rt_gc_interval __read_mostly  = 60 * HZ;
 static int ip_rt_gc_min_interval __read_mostly  = HZ / 2;
 static int ip_rt_gc_elasticity __read_mostly    = 8;
+static int ip_min_valid_pmtu __read_mostly      = IPV4_MIN_MTU;
 
 static int ipv4_sysctl_rtcache_flush(struct ctl_table *__ctl, int write,
                                         void __user *buffer,
@@ -2933,7 +2961,8 @@ static struct ctl_table ipv4_route_table[] = {
                 .data           = &ip_rt_min_pmtu,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &ip_min_valid_pmtu,
         },
         {
                 .procname       = "min_adv_mss",
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 48636aee23c3..8b8059b7af4d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3566,6 +3566,7 @@ int tcp_abort(struct sock *sk, int err)
 
         bh_unlock_sock(sk);
         local_bh_enable();
+        tcp_write_queue_purge(sk);
         release_sock(sk);
         return 0;
 }
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
index 7c843578f233..faddf4f9a707 100644
--- a/net/ipv4/tcp_illinois.c
+++ b/net/ipv4/tcp_illinois.c
@@ -6,7 +6,7 @@
  * The algorithm is described in:
  * "TCP-Illinois: A Loss and Delay-Based Congestion Control Algorithm
  *  for High-Speed Networks"
- * http://www.ifp.illinois.edu/~srikant/Papers/liubassri06perf.pdf
+ * http://tamerbasar.csl.illinois.edu/LiuBasarSrikantPerfEvalArtJun2008.pdf
  *
  * Implemented from description in paper and ns-2 simulation.
  * Copyright (C) 2007 Stephen Hemminger <shemminger@linux-foundation.org>
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 575d3c1fb6e8..9a1b3c1c1c14 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1971,11 +1971,6 @@ void tcp_enter_loss(struct sock *sk)
         /* F-RTO RFC5682 sec 3.1 step 1: retransmit SND.UNA if no previous
          * loss recovery is underway except recurring timeout(s) on
          * the same SND.UNA (sec 3.2). Disable F-RTO on path MTU probing
-         *
-         * In theory F-RTO can be used repeatedly during loss recovery.
-         * In practice this interacts badly with broken middle-boxes that
-         * falsely raise the receive window, which results in repeated
-         * timeouts and stop-and-go behavior.
          */
         tp->frto = net->ipv4.sysctl_tcp_frto &&
                    (new_recovery || icsk->icsk_retransmits) &&
@@ -2631,18 +2626,14 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack,
             tcp_try_undo_loss(sk, false))
                 return;
 
-        /* The ACK (s)acks some never-retransmitted data meaning not all
-         * the data packets before the timeout were lost. Therefore we
-         * undo the congestion window and state. This is essentially
-         * the operation in F-RTO (RFC5682 section 3.1 step 3.b). Since
-         * a retransmitted skb is permantly marked, we can apply such an
-         * operation even if F-RTO was not used.
-         */
-        if ((flag & FLAG_ORIG_SACK_ACKED) &&
-            tcp_try_undo_loss(sk, tp->undo_marker))
-                return;
-
         if (tp->frto) { /* F-RTO RFC5682 sec 3.1 (sack enhanced version). */
+                /* Step 3.b. A timeout is spurious if not all data are
+                 * lost, i.e., never-retransmitted data are (s)acked.
+                 */
+                if ((flag & FLAG_ORIG_SACK_ACKED) &&
+                    tcp_try_undo_loss(sk, true))
+                        return;
+
                 if (after(tp->snd_nxt, tp->high_seq)) {
                         if (flag & FLAG_DATA_SACKED || is_dupack)
                                 tp->frto = 0; /* Step 3.a. loss was real */
@@ -4001,6 +3992,7 @@ void tcp_reset(struct sock *sk)
         /* This barrier is coupled with smp_rmb() in tcp_poll() */
         smp_wmb();
 
+        tcp_write_queue_purge(sk);
         tcp_done(sk);
 
         if (!sock_flag(sk, SOCK_DEAD))
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 71fc60f1b326..f7d944855f8e 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -34,6 +34,7 @@ static void tcp_write_err(struct sock *sk)
         sk->sk_err = sk->sk_err_soft ? : ETIMEDOUT;
         sk->sk_error_report(sk);
 
+        tcp_write_queue_purge(sk);
         tcp_done(sk);
         __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONTIMEOUT);
 }
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 63faeee989a9..2a9764bd1719 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -92,7 +92,8 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_reset_network_header(skb);
         skb_mac_header_rebuild(skb);
-        eth_hdr(skb)->h_proto = skb->protocol;
+        if (skb->mac_len)
+                eth_hdr(skb)->h_proto = skb->protocol;
 
         err = 0;
 
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index 94b8702603bc..be980c195fc5 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -30,7 +30,8 @@ static int xfrm4_tunnel_check_size(struct sk_buff *skb)
 
         mtu = dst_mtu(skb_dst(skb));
         if ((!skb_is_gso(skb) && skb->len > mtu) ||
-            (skb_is_gso(skb) && skb_gso_network_seglen(skb) > ip_skb_dst_mtu(skb->sk, skb))) {
+            (skb_is_gso(skb) &&
+             !skb_gso_validate_network_len(skb, ip_skb_dst_mtu(skb->sk, skb)))) {
                 skb->protocol = htons(ETH_P_IP);
 
                 if (skb->sk)
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 05017e2c849c..fbebda67ac1b 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -100,8 +100,10 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         xdst->u.rt.rt_gateway = rt->rt_gateway;
         xdst->u.rt.rt_uses_gateway = rt->rt_uses_gateway;
         xdst->u.rt.rt_pmtu = rt->rt_pmtu;
+        xdst->u.rt.rt_mtu_locked = rt->rt_mtu_locked;
         xdst->u.rt.rt_table_id = rt->rt_table_id;
         INIT_LIST_HEAD(&xdst->u.rt.rt_uncached);
+        rt_add_uncached_list(&xdst->u.rt);
 
         return 0;
 }
@@ -241,7 +243,8 @@ static void xfrm4_dst_destroy(struct dst_entry *dst)
         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
 
         dst_destroy_metrics_generic(dst);
-
+        if (xdst->u.rt.rt_uncached_list)
+                rt_del_uncached_list(&xdst->u.rt);
         xfrm_dst_destroy(xdst);
 }
 
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index fbf08ce3f5ab..a9f7eca0b6a3 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -146,10 +146,12 @@ int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr,
         struct sockaddr_in6     *usin = (struct sockaddr_in6 *) uaddr;
         struct inet_sock        *inet = inet_sk(sk);
         struct ipv6_pinfo       *np = inet6_sk(sk);
-        struct in6_addr         *daddr;
+        struct in6_addr         *daddr, old_daddr;
+        __be32                  fl6_flowlabel = 0;
+        __be32                  old_fl6_flowlabel;
+        __be16                  old_dport;
         int                     addr_type;
         int                     err;
-        __be32                  fl6_flowlabel = 0;
 
         if (usin->sin6_family == AF_INET) {
                 if (__ipv6_only_sock(sk))
@@ -238,9 +240,13 @@ ipv4_connected:
                 }
         }
 
+        /* save the current peer information before updating it */
+        old_daddr = sk->sk_v6_daddr;
+        old_fl6_flowlabel = np->flow_label;
+        old_dport = inet->inet_dport;
+
         sk->sk_v6_daddr = *daddr;
         np->flow_label = fl6_flowlabel;
-
         inet->inet_dport = usin->sin6_port;
 
         /*
@@ -250,11 +256,12 @@ ipv4_connected:
 
         err = ip6_datagram_dst_update(sk, true);
         if (err) {
-                /* Reset daddr and dport so that udp_v6_early_demux()
-                 * fails to find this socket
+                /* Restore the socket peer info, to keep it consistent with
+                 * the old socket state
                  */
-                memset(&sk->sk_v6_daddr, 0, sizeof(sk->sk_v6_daddr));
-                inet->inet_dport = 0;
+                sk->sk_v6_daddr = old_daddr;
+                np->flow_label = old_fl6_flowlabel;
+                inet->inet_dport = old_dport;
                 goto out;
         }
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 3c353125546d..1bbd0930063e 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -126,7 +126,8 @@ static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
         struct ip6_tnl *t, *cand = NULL;
         struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
         int dev_type = (gre_proto == htons(ETH_P_TEB) ||
-                        gre_proto == htons(ETH_P_ERSPAN)) ?
+                        gre_proto == htons(ETH_P_ERSPAN) ||
+                        gre_proto == htons(ETH_P_ERSPAN2)) ?
                        ARPHRD_ETHER : ARPHRD_IP6GRE;
         int score, cand_score = 4;
 
@@ -902,6 +903,9 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                 truncate = true;
         }
 
+        if (skb_cow_head(skb, dev->needed_headroom))
+                goto tx_err;
+
         t->parms.o_flags &= ~TUNNEL_KEY;
         IPCB(skb)->flags = 0;
 
@@ -944,6 +948,8 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
                                                md->u.md2.dir,
                                                get_hwid(&md->u.md2),
                                                truncate, false);
+                } else {
+                        goto tx_err;
                 }
         } else {
                 switch (skb->protocol) {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 997c7f19ad62..a8a919520090 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -412,7 +412,7 @@ static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
         if (skb->ignore_df)
                 return false;
 
-        if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
+        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
                 return false;
 
         return true;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 4b15fe928278..6e0f21eed88a 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1982,14 +1982,14 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
 {
         struct net *net = dev_net(dev);
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-        struct ip6_tnl *nt, *t;
         struct ip_tunnel_encap ipencap;
+        struct ip6_tnl *nt, *t;
+        int err;
 
         nt = netdev_priv(dev);
 
         if (ip6_tnl_netlink_encap_parms(data, &ipencap)) {
-                int err = ip6_tnl_encap_setup(nt, &ipencap);
-
+                err = ip6_tnl_encap_setup(nt, &ipencap);
                 if (err < 0)
                         return err;
         }
@@ -2005,7 +2005,11 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
                         return -EEXIST;
         }
 
-        return ip6_tnl_create2(dev);
+        err = ip6_tnl_create2(dev);
+        if (!err && tb[IFLA_MTU])
+                ip6_tnl_change_mtu(dev, nla_get_u32(tb[IFLA_MTU]));
+
+        return err;
 }
 
 static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index f61a5b613b52..ba5e04c6ae17 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1554,7 +1554,8 @@ static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb,
         *(opt++) = (rd_len >> 3);
         opt += 6;
 
-        memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8);
+        skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt,
+                      rd_len - 8);
 }
 
 void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index d95ceca7ff8f..531d6957af36 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -21,18 +21,19 @@
 int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
 {
         const struct ipv6hdr *iph = ipv6_hdr(skb);
+        struct sock *sk = sk_to_full_sk(skb->sk);
         unsigned int hh_len;
         struct dst_entry *dst;
         struct flowi6 fl6 = {
-                .flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
+                .flowi6_oif = sk ? sk->sk_bound_dev_if : 0,
                 .flowi6_mark = skb->mark,
-                .flowi6_uid = sock_net_uid(net, skb->sk),
+                .flowi6_uid = sock_net_uid(net, sk),
                 .daddr = iph->daddr,
                 .saddr = iph->saddr,
         };
         int err;
 
-        dst = ip6_route_output(net, skb->sk, &fl6);
+        dst = ip6_route_output(net, sk, &fl6);
         err = dst->error;
         if (err) {
                 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
@@ -50,7 +51,7 @@ int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
         if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
             xfrm_decode_session(skb, flowi6_to_flowi(&fl6), AF_INET6) == 0) {
                 skb_dst_set(skb, NULL);
-                dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), skb->sk, 0);
+                dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
                 if (IS_ERR(dst))
                         return PTR_ERR(dst);
                 skb_dst_set(skb, dst);
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index 94deb69bbbda..91ed25a24b79 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -48,10 +48,6 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb,
         }
 
         fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
-        if ((flags & XT_RPFILTER_LOOSE) == 0) {
-                fl6.flowi6_oif = dev->ifindex;
-                lookup_flags |= RT6_LOOKUP_F_IFACE;
-        }
 
         rt = (void *) ip6_route_lookup(net, &fl6, lookup_flags);
         if (rt->dst.error)
diff --git a/net/ipv6/netfilter/nf_flow_table_ipv6.c b/net/ipv6/netfilter/nf_flow_table_ipv6.c
index d346705d6ee6..207cb35569b1 100644
--- a/net/ipv6/netfilter/nf_flow_table_ipv6.c
+++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c
@@ -178,7 +178,7 @@ static bool __nf_flow_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
         if (skb->len <= mtu)
                 return false;
 
-        if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
+        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
                 return false;
 
         return true;
diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
index bed57ee65f7b..6b7f075f811f 100644
--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
@@ -99,6 +99,10 @@ static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb,
             !l4proto->manip_pkt(skb, &nf_nat_l3proto_ipv6, iphdroff, hdroff,
                                 target, maniptype))
                 return false;
+
+        /* must reload, offset might have changed */
+        ipv6h = (void *)skb->data + iphdroff;
+
 manip_addr:
         if (maniptype == NF_NAT_MANIP_SRC)
                 ipv6h->saddr = target->src.u3.in6;
diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c
index cc5174c7254c..62fc84d7bdff 100644
--- a/net/ipv6/netfilter/nft_fib_ipv6.c
+++ b/net/ipv6/netfilter/nft_fib_ipv6.c
@@ -180,7 +180,6 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
         }
 
         *dest = 0;
- again:
         rt = (void *)ip6_route_lookup(nft_net(pkt), &fl6, lookup_flags);
         if (rt->dst.error)
                 goto put_rt_err;
@@ -189,15 +188,8 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs,
         if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL))
                 goto put_rt_err;
 
-        if (oif && oif != rt->rt6i_idev->dev) {
-                /* multipath route? Try again with F_IFACE */
-                if ((lookup_flags & RT6_LOOKUP_F_IFACE) == 0) {
-                        lookup_flags |= RT6_LOOKUP_F_IFACE;
-                        fl6.flowi6_oif = oif->ifindex;
-                        ip6_rt_put(rt);
-                        goto again;
-                }
-        }
+        if (oif && oif != rt->rt6i_idev->dev)
+                goto put_rt_err;
 
         switch (priv->result) {
         case NFT_FIB_RESULT_OIF:
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 9dcfadddd800..b0d5c64e1978 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -128,7 +128,7 @@ struct uncached_list {
 
 static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt6_uncached_list);
 
-static void rt6_uncached_list_add(struct rt6_info *rt)
+void rt6_uncached_list_add(struct rt6_info *rt)
 {
         struct uncached_list *ul = raw_cpu_ptr(&rt6_uncached_list);
 
@@ -139,7 +139,7 @@ static void rt6_uncached_list_add(struct rt6_info *rt)
         spin_unlock_bh(&ul->lock);
 }
 
-static void rt6_uncached_list_del(struct rt6_info *rt)
+void rt6_uncached_list_del(struct rt6_info *rt)
 {
         if (!list_empty(&rt->rt6i_uncached)) {
                 struct uncached_list *ul = rt->rt6i_uncached_list;
@@ -1509,7 +1509,30 @@ static void rt6_exceptions_remove_prefsrc(struct rt6_info *rt)
         }
 }
 
-static void rt6_exceptions_update_pmtu(struct rt6_info *rt, int mtu)
+static bool rt6_mtu_change_route_allowed(struct inet6_dev *idev,
+                                         struct rt6_info *rt, int mtu)
+{
+        /* If the new MTU is lower than the route PMTU, this new MTU will be the
+         * lowest MTU in the path: always allow updating the route PMTU to
+         * reflect PMTU decreases.
+         *
+         * If the new MTU is higher, and the route PMTU is equal to the local
+         * MTU, this means the old MTU is the lowest in the path, so allow
+         * updating it: if other nodes now have lower MTUs, PMTU discovery will
+         * handle this.
+         */
+
+        if (dst_mtu(&rt->dst) >= mtu)
+                return true;
+
+        if (dst_mtu(&rt->dst) == idev->cnf.mtu6)
+                return true;
+
+        return false;
+}
+
+static void rt6_exceptions_update_pmtu(struct inet6_dev *idev,
+                                       struct rt6_info *rt, int mtu)
 {
         struct rt6_exception_bucket *bucket;
         struct rt6_exception *rt6_ex;
@@ -1518,20 +1541,22 @@ static void rt6_exceptions_update_pmtu(struct rt6_info *rt, int mtu)
         bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
                                         lockdep_is_held(&rt6_exception_lock));
 
-        if (bucket) {
-                for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
-                        hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
-                                struct rt6_info *entry = rt6_ex->rt6i;
-                                /* For RTF_CACHE with rt6i_pmtu == 0
-                                 * (i.e. a redirected route),
-                                 * the metrics of its rt->dst.from has already
-                                 * been updated.
-                                 */
-                                if (entry->rt6i_pmtu && entry->rt6i_pmtu > mtu)
-                                        entry->rt6i_pmtu = mtu;
-                        }
-                        bucket++;
+        if (!bucket)
+                return;
+
+        for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
+                hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
+                        struct rt6_info *entry = rt6_ex->rt6i;
+
+                        /* For RTF_CACHE with rt6i_pmtu == 0 (i.e. a redirected
+                         * route), the metrics of its rt->dst.from have already
+                         * been updated.
+                         */
+                        if (entry->rt6i_pmtu &&
+                            rt6_mtu_change_route_allowed(idev, entry, mtu))
+                                entry->rt6i_pmtu = mtu;
                 }
+                bucket++;
         }
 }
 
@@ -3809,25 +3834,13 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
            Since RFC 1981 doesn't include administrative MTU increase
            update PMTU increase is a MUST. (i.e. jumbo frame)
          */
-        /*
-           If new MTU is less than route PMTU, this new MTU will be the
-           lowest MTU in the path, update the route PMTU to reflect PMTU
-           decreases; if new MTU is greater than route PMTU, and the
-           old MTU is the lowest MTU in the path, update the route PMTU
-           to reflect the increase. In this case if the other nodes' MTU
-           also have the lowest MTU, TOO BIG MESSAGE will be lead to
-           PMTU discovery.
-         */
         if (rt->dst.dev == arg->dev &&
-            dst_metric_raw(&rt->dst, RTAX_MTU) &&
             !dst_metric_locked(&rt->dst, RTAX_MTU)) {
                 spin_lock_bh(&rt6_exception_lock);
-                if (dst_mtu(&rt->dst) >= arg->mtu ||
-                    (dst_mtu(&rt->dst) < arg->mtu &&
-                     dst_mtu(&rt->dst) == idev->cnf.mtu6)) {
+                if (dst_metric_raw(&rt->dst, RTAX_MTU) &&
+                    rt6_mtu_change_route_allowed(idev, rt, arg->mtu))
                         dst_metric_set(&rt->dst, RTAX_MTU, arg->mtu);
-                }
-                rt6_exceptions_update_pmtu(rt, arg->mtu);
+                rt6_exceptions_update_pmtu(idev, rt, arg->mtu);
                 spin_unlock_bh(&rt6_exception_lock);
         }
         return 0;
@@ -4099,6 +4112,7 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
                                 r_cfg.fc_encap_type = nla_get_u16(nla);
                 }
 
+                r_cfg.fc_flags |= (rtnh->rtnh_flags & RTNH_F_ONLINK);
                 rt = ip6_route_info_create(&r_cfg, extack);
                 if (IS_ERR(rt)) {
                         err = PTR_ERR(rt);
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index bd6cc688bd19..7a78dcfda68a 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -93,7 +93,8 @@ static void set_tun_src(struct net *net, struct net_device *dev,
 /* encapsulate an IPv6 packet within an outer IPv6 header with a given SRH */
 int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
 {
-        struct net *net = dev_net(skb_dst(skb)->dev);
+        struct dst_entry *dst = skb_dst(skb);
+        struct net *net = dev_net(dst->dev);
         struct ipv6hdr *hdr, *inner_hdr;
         struct ipv6_sr_hdr *isrh;
         int hdrlen, tot_len, err;
@@ -134,7 +135,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
         isrh->nexthdr = proto;
 
         hdr->daddr = isrh->segments[isrh->first_segment];
-        set_tun_src(net, skb->dev, &hdr->daddr, &hdr->saddr);
+        set_tun_src(net, ip6_dst_idev(dst)->dev, &hdr->daddr, &hdr->saddr);
 
 #ifdef CONFIG_IPV6_SEG6_HMAC
         if (sr_has_hmac(isrh)) {
@@ -418,7 +419,7 @@ static int seg6_build_state(struct nlattr *nla,
 
         slwt = seg6_lwt_lwtunnel(newts);
 
-        err = dst_cache_init(&slwt->cache, GFP_KERNEL);
+        err = dst_cache_init(&slwt->cache, GFP_ATOMIC);
         if (err) {
                 kfree(newts);
                 return err;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 3a1775a62973..0195598f7bb5 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1578,6 +1578,13 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev,
         if (err < 0)
                 return err;
 
+        if (tb[IFLA_MTU]) {
+                u32 mtu = nla_get_u32(tb[IFLA_MTU]);
+
+                if (mtu >= IPV6_MIN_MTU && mtu <= 0xFFF8 - dev->hard_header_len)
+                        dev->mtu = mtu;
+        }
+
 #ifdef CONFIG_IPV6_SIT_6RD
         if (ipip6_netlink_6rd_parms(data, &ip6rd))
                 err = ipip6_tunnel_update_6rd(nt, &ip6rd);
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index bb935a3b7fea..de1b0b8c53b0 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -92,7 +92,8 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_reset_network_header(skb);
         skb_mac_header_rebuild(skb);
-        eth_hdr(skb)->h_proto = skb->protocol;
+        if (skb->mac_len)
+                eth_hdr(skb)->h_proto = skb->protocol;
 
         err = 0;
 
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 8ae87d4ec5ff..5959ce9620eb 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -82,7 +82,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
 
         if ((!skb_is_gso(skb) && skb->len > mtu) ||
             (skb_is_gso(skb) &&
-             skb_gso_network_seglen(skb) > ip6_skb_dst_mtu(skb))) {
+             !skb_gso_validate_network_len(skb, ip6_skb_dst_mtu(skb)))) {
                 skb->dev = dst->dev;
                 skb->protocol = htons(ETH_P_IPV6);
 
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 09fb44ee3b45..416fe67271a9 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -113,6 +113,9 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway;
         xdst->u.rt6.rt6i_dst = rt->rt6i_dst;
         xdst->u.rt6.rt6i_src = rt->rt6i_src;
+        INIT_LIST_HEAD(&xdst->u.rt6.rt6i_uncached);
+        rt6_uncached_list_add(&xdst->u.rt6);
+        atomic_inc(&dev_net(dev)->ipv6.rt6_stats->fib_rt_uncache);
 
         return 0;
 }
@@ -244,6 +247,8 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
         if (likely(xdst->u.rt6.rt6i_idev))
                 in6_dev_put(xdst->u.rt6.rt6i_idev);
         dst_destroy_metrics_generic(dst);
+        if (xdst->u.rt6.rt6i_uncached_list)
+                rt6_uncached_list_del(&xdst->u.rt6);
         xfrm_dst_destroy(xdst);
 }
 
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 1e8cc7bcbca3..9e2643ab4ccb 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -2433,9 +2433,11 @@ static int afiucv_iucv_init(void)
         af_iucv_dev->driver = &af_iucv_driver;
         err = device_register(af_iucv_dev);
         if (err)
-                goto out_driver;
+                goto out_iucv_dev;
         return 0;
 
+out_iucv_dev:
+        put_device(af_iucv_dev);
 out_driver:
         driver_unregister(&af_iucv_driver);
 out_iucv:
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index f297d53a11aa..34355fd19f27 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1381,24 +1381,32 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
                 .parse_msg = kcm_parse_func_strparser,
                 .read_sock_done = kcm_read_sock_done,
         };
-        int err;
+        int err = 0;
 
         csk = csock->sk;
         if (!csk)
                 return -EINVAL;
 
+        lock_sock(csk);
+
         /* Only allow TCP sockets to be attached for now */
         if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) ||
-            csk->sk_protocol != IPPROTO_TCP)
-                return -EOPNOTSUPP;
+            csk->sk_protocol != IPPROTO_TCP) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
 
         /* Don't allow listeners or closed sockets */
-        if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE)
-                return -EOPNOTSUPP;
+        if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
 
         psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL);
-        if (!psock)
-                return -ENOMEM;
+        if (!psock) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         psock->mux = mux;
         psock->sk = csk;
@@ -1407,7 +1415,7 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
         err = strp_init(&psock->strp, csk, &cb);
         if (err) {
                 kmem_cache_free(kcm_psockp, psock);
-                return err;
+                goto out;
         }
 
         write_lock_bh(&csk->sk_callback_lock);
@@ -1419,7 +1427,8 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
                 write_unlock_bh(&csk->sk_callback_lock);
                 strp_done(&psock->strp);
                 kmem_cache_free(kcm_psockp, psock);
-                return -EALREADY;
+                err = -EALREADY;
+                goto out;
         }
 
         psock->save_data_ready = csk->sk_data_ready;
@@ -1455,7 +1464,10 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
         /* Schedule RX work in case there are already bytes queued */
         strp_check_rcv(&psock->strp);
 
-        return 0;
+out:
+        release_sock(csk);
+
+        return err;
 }
 
 static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info)
@@ -1507,6 +1519,7 @@ static void kcm_unattach(struct kcm_psock *psock)
 
         if (WARN_ON(psock->rx_kcm)) {
                 write_unlock_bh(&csk->sk_callback_lock);
+                release_sock(csk);
                 return;
         }
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 194a7483bb93..14b67dfacc4b 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -111,6 +111,13 @@ struct l2tp_net {
         spinlock_t l2tp_session_hlist_lock;
 };
 
+#if IS_ENABLED(CONFIG_IPV6)
+static bool l2tp_sk_is_v6(struct sock *sk)
+{
+        return sk->sk_family == PF_INET6 &&
+               !ipv6_addr_v4mapped(&sk->sk_v6_daddr);
+}
+#endif
 
 static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
 {
@@ -136,51 +143,6 @@ l2tp_session_id_hash_2(struct l2tp_net *pn, u32 session_id)
 
 }
 
-/* Lookup the tunnel socket, possibly involving the fs code if the socket is
- * owned by userspace.  A struct sock returned from this function must be
- * released using l2tp_tunnel_sock_put once you're done with it.
- */
-static struct sock *l2tp_tunnel_sock_lookup(struct l2tp_tunnel *tunnel)
-{
-        int err = 0;
-        struct socket *sock = NULL;
-        struct sock *sk = NULL;
-
-        if (!tunnel)
-                goto out;
-
-        if (tunnel->fd >= 0) {
-                /* Socket is owned by userspace, who might be in the process
-                 * of closing it.  Look the socket up using the fd to ensure
-                 * consistency.
-                 */
-                sock = sockfd_lookup(tunnel->fd, &err);
-                if (sock)
-                        sk = sock->sk;
-        } else {
-                /* Socket is owned by kernelspace */
-                sk = tunnel->sock;
-                sock_hold(sk);
-        }
-
-out:
-        return sk;
-}
-
-/* Drop a reference to a tunnel socket obtained via. l2tp_tunnel_sock_put */
-static void l2tp_tunnel_sock_put(struct sock *sk)
-{
-        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
-        if (tunnel) {
-                if (tunnel->fd >= 0) {
-                        /* Socket is owned by userspace */
-                        sockfd_put(sk->sk_socket);
-                }
-                sock_put(sk);
-        }
-        sock_put(sk);
-}
-
 /* Session hash list.
  * The session_id SHOULD be random according to RFC2661, but several
  * L2TP implementations (Cisco and Microsoft) use incrementing
@@ -193,6 +155,13 @@ l2tp_session_id_hash(struct l2tp_tunnel *tunnel, u32 session_id)
         return &tunnel->session_hlist[hash_32(session_id, L2TP_HASH_BITS)];
 }
 
+void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
+{
+        sock_put(tunnel->sock);
+        /* the tunnel is freed in the socket destructor */
+}
+EXPORT_SYMBOL(l2tp_tunnel_free);
+
 /* Lookup a tunnel. A new reference is held on the returned tunnel. */
 struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
 {
@@ -345,13 +314,11 @@ int l2tp_session_register(struct l2tp_session *session,
                         }
 
                 l2tp_tunnel_inc_refcount(tunnel);
-                sock_hold(tunnel->sock);
                 hlist_add_head_rcu(&session->global_hlist, g_head);
 
                 spin_unlock_bh(&pn->l2tp_session_hlist_lock);
         } else {
                 l2tp_tunnel_inc_refcount(tunnel);
-                sock_hold(tunnel->sock);
         }
 
         hlist_add_head(&session->hlist, head);
@@ -969,7 +936,7 @@ int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 {
         struct l2tp_tunnel *tunnel;
 
-        tunnel = l2tp_sock_to_tunnel(sk);
+        tunnel = l2tp_tunnel(sk);
         if (tunnel == NULL)
                 goto pass_up;
 
@@ -977,13 +944,10 @@ int l2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                  tunnel->name, skb->len);
 
         if (l2tp_udp_recv_core(tunnel, skb, tunnel->recv_payload_hook))
-                goto pass_up_put;
+                goto pass_up;
 
-        sock_put(sk);
         return 0;
 
-pass_up_put:
-        sock_put(sk);
 pass_up:
         return 1;
 }
@@ -1092,7 +1056,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
         /* Queue the packet to IP for output */
         skb->ignore_df = 1;
 #if IS_ENABLED(CONFIG_IPV6)
-        if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped)
+        if (l2tp_sk_is_v6(tunnel->sock))
                 error = inet6_csk_xmit(tunnel->sock, skb, NULL);
         else
 #endif
@@ -1155,6 +1119,15 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
                 goto out_unlock;
         }
 
+        /* The user-space may change the connection status for the user-space
+         * provided socket at run time: we must check it under the socket lock
+         */
+        if (tunnel->fd >= 0 && sk->sk_state != TCP_ESTABLISHED) {
+                kfree_skb(skb);
+                ret = NET_XMIT_DROP;
+                goto out_unlock;
+        }
+
         /* Get routing info from the tunnel socket */
         skb_dst_drop(skb);
         skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
@@ -1174,7 +1147,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
 
                 /* Calculate UDP checksum if configured to do so */
 #if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
+                if (l2tp_sk_is_v6(sk))
                         udp6_set_csum(udp_get_no_check6_tx(sk),
                                       skb, &inet6_sk(sk)->saddr,
                                       &sk->sk_v6_daddr, udp_len);
@@ -1207,14 +1180,12 @@ EXPORT_SYMBOL_GPL(l2tp_xmit_skb);
 static void l2tp_tunnel_destruct(struct sock *sk)
 {
         struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
-        struct l2tp_net *pn;
 
         if (tunnel == NULL)
                 goto end;
 
         l2tp_info(tunnel, L2TP_MSG_CONTROL, "%s: closing...\n", tunnel->name);
 
-
         /* Disable udp encapsulation */
         switch (tunnel->encap) {
         case L2TP_ENCAPTYPE_UDP:
@@ -1231,18 +1202,11 @@ static void l2tp_tunnel_destruct(struct sock *sk)
         sk->sk_destruct = tunnel->old_sk_destruct;
         sk->sk_user_data = NULL;
 
-        /* Remove the tunnel struct from the tunnel list */
-        pn = l2tp_pernet(tunnel->l2tp_net);
-        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
-        list_del_rcu(&tunnel->list);
-        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
-
-        tunnel->sock = NULL;
-        l2tp_tunnel_dec_refcount(tunnel);
-
         /* Call the original destructor */
         if (sk->sk_destruct)
                 (*sk->sk_destruct)(sk);
+
+        kfree_rcu(tunnel, rcu);
 end:
         return;
 }
@@ -1303,49 +1267,43 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_closeall);
 /* Tunnel socket destroy hook for UDP encapsulation */
 static void l2tp_udp_encap_destroy(struct sock *sk)
 {
-        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
-        if (tunnel) {
-                l2tp_tunnel_closeall(tunnel);
-                sock_put(sk);
-        }
+        struct l2tp_tunnel *tunnel = l2tp_tunnel(sk);
+
+        if (tunnel)
+                l2tp_tunnel_delete(tunnel);
 }
 
 /* Workqueue tunnel deletion function */
 static void l2tp_tunnel_del_work(struct work_struct *work)
 {
-        struct l2tp_tunnel *tunnel = NULL;
-        struct socket *sock = NULL;
-        struct sock *sk = NULL;
-
-        tunnel = container_of(work, struct l2tp_tunnel, del_work);
+        struct l2tp_tunnel *tunnel = container_of(work, struct l2tp_tunnel,
+                                                  del_work);
+        struct sock *sk = tunnel->sock;
+        struct socket *sock = sk->sk_socket;
+        struct l2tp_net *pn;
 
         l2tp_tunnel_closeall(tunnel);
 
-        sk = l2tp_tunnel_sock_lookup(tunnel);
-        if (!sk)
-                goto out;
-
-        sock = sk->sk_socket;
-
-        /* If the tunnel socket was created by userspace, then go through the
-         * inet layer to shut the socket down, and let userspace close it.
-         * Otherwise, if we created the socket directly within the kernel, use
+        /* If the tunnel socket was created within the kernel, use
          * the sk API to release it here.
-         * In either case the tunnel resources are freed in the socket
-         * destructor when the tunnel socket goes away.
          */
-        if (tunnel->fd >= 0) {
-                if (sock)
-                        inet_shutdown(sock, 2);
-        } else {
+        if (tunnel->fd < 0) {
                 if (sock) {
                         kernel_sock_shutdown(sock, SHUT_RDWR);
                         sock_release(sock);
                 }
         }
 
-        l2tp_tunnel_sock_put(sk);
-out:
+        /* Remove the tunnel struct from the tunnel list */
+        pn = l2tp_pernet(tunnel->l2tp_net);
+        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
+        list_del_rcu(&tunnel->list);
+        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
+
+        /* drop initial ref */
+        l2tp_tunnel_dec_refcount(tunnel);
+
+        /* drop workqueue ref */
         l2tp_tunnel_dec_refcount(tunnel);
 }
 
@@ -1515,9 +1473,14 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                 encap = cfg->encap;
 
         /* Quick sanity checks */
+        err = -EPROTONOSUPPORT;
+        if (sk->sk_type != SOCK_DGRAM) {
+                pr_debug("tunl %hu: fd %d wrong socket type\n",
+                         tunnel_id, fd);
+                goto err;
+        }
         switch (encap) {
         case L2TP_ENCAPTYPE_UDP:
-                err = -EPROTONOSUPPORT;
                 if (sk->sk_protocol != IPPROTO_UDP) {
                         pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
                                tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
@@ -1525,7 +1488,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                 }
                 break;
         case L2TP_ENCAPTYPE_IP:
-                err = -EPROTONOSUPPORT;
                 if (sk->sk_protocol != IPPROTO_L2TP) {
                         pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
                                tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
@@ -1565,24 +1527,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         if (cfg != NULL)
                 tunnel->debug = cfg->debug;
 
-#if IS_ENABLED(CONFIG_IPV6)
-        if (sk->sk_family == PF_INET6) {
-                struct ipv6_pinfo *np = inet6_sk(sk);
-
-                if (ipv6_addr_v4mapped(&np->saddr) &&
-                    ipv6_addr_v4mapped(&sk->sk_v6_daddr)) {
-                        struct inet_sock *inet = inet_sk(sk);
-
-                        tunnel->v4mapped = true;
-                        inet->inet_saddr = np->saddr.s6_addr32[3];
-                        inet->inet_rcv_saddr = sk->sk_v6_rcv_saddr.s6_addr32[3];
-                        inet->inet_daddr = sk->sk_v6_daddr.s6_addr32[3];
-                } else {
-                        tunnel->v4mapped = false;
-                }
-        }
-#endif
-
         /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
         tunnel->encap = encap;
         if (encap == L2TP_ENCAPTYPE_UDP) {
@@ -1598,13 +1542,22 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                 sk->sk_user_data = tunnel;
         }
 
+        /* Bump the reference count. The tunnel context is deleted
+         * only when this drops to zero. A reference is also held on
+         * the tunnel socket to ensure that it is not released while
+         * the tunnel is extant. Must be done before sk_destruct is
+         * set.
+         */
+        refcount_set(&tunnel->ref_count, 1);
+        sock_hold(sk);
+        tunnel->sock = sk;
+        tunnel->fd = fd;
+
         /* Hook on the tunnel socket destructor so that we can cleanup
          * if the tunnel socket goes away.
          */
         tunnel->old_sk_destruct = sk->sk_destruct;
         sk->sk_destruct = &l2tp_tunnel_destruct;
-        tunnel->sock = sk;
-        tunnel->fd = fd;
         lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
 
         sk->sk_allocation = GFP_ATOMIC;
@@ -1614,11 +1567,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
 
         /* Add tunnel to our list */
         INIT_LIST_HEAD(&tunnel->list);
-
-        /* Bump the reference count. The tunnel context is deleted
-         * only when this drops to zero. Must be done before list insertion
-         */
-        refcount_set(&tunnel->ref_count, 1);
         spin_lock_bh(&pn->l2tp_tunnel_list_lock);
         list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
         spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
@@ -1659,8 +1607,6 @@ void l2tp_session_free(struct l2tp_session *session)
 
         if (tunnel) {
                 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
-                sock_put(tunnel->sock);
-                session->tunnel = NULL;
                 l2tp_tunnel_dec_refcount(tunnel);
         }
 
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 9bbee90e9963..2718d0b284d0 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -188,9 +188,6 @@ struct l2tp_tunnel {
         struct sock             *sock;          /* Parent socket */
         int                     fd;             /* Parent fd, if tunnel socket
                                                  * was created by userspace */
-#if IS_ENABLED(CONFIG_IPV6)
-        bool                    v4mapped;
-#endif
 
         struct work_struct      del_work;
 
@@ -214,27 +211,8 @@ static inline void *l2tp_session_priv(struct l2tp_session *session)
         return &session->priv[0];
 }
 
-static inline struct l2tp_tunnel *l2tp_sock_to_tunnel(struct sock *sk)
-{
-        struct l2tp_tunnel *tunnel;
-
-        if (sk == NULL)
-                return NULL;
-
-        sock_hold(sk);
-        tunnel = (struct l2tp_tunnel *)(sk->sk_user_data);
-        if (tunnel == NULL) {
-                sock_put(sk);
-                goto out;
-        }
-
-        BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
-
-out:
-        return tunnel;
-}
-
 struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id);
+void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
 
 struct l2tp_session *l2tp_session_get(const struct net *net,
                                       struct l2tp_tunnel *tunnel,
@@ -283,7 +261,7 @@ static inline void l2tp_tunnel_inc_refcount(struct l2tp_tunnel *tunnel)
 static inline void l2tp_tunnel_dec_refcount(struct l2tp_tunnel *tunnel)
 {
         if (refcount_dec_and_test(&tunnel->ref_count))
-                kfree_rcu(tunnel, rcu);
+                l2tp_tunnel_free(tunnel);
 }
 
 /* Session reference counts. Incremented when code obtains a reference
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index ff61124fdf59..3428fba6f2b7 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -234,17 +234,13 @@ static void l2tp_ip_close(struct sock *sk, long timeout)
 static void l2tp_ip_destroy_sock(struct sock *sk)
 {
         struct sk_buff *skb;
-        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+        struct l2tp_tunnel *tunnel = sk->sk_user_data;
 
         while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL)
                 kfree_skb(skb);
 
-        if (tunnel) {
-                l2tp_tunnel_closeall(tunnel);
-                sock_put(sk);
-        }
-
-        sk_refcnt_debug_dec(sk);
+        if (tunnel)
+                l2tp_tunnel_delete(tunnel);
 }
 
 static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 192344688c06..6f009eaa5fbe 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -248,16 +248,14 @@ static void l2tp_ip6_close(struct sock *sk, long timeout)
 
 static void l2tp_ip6_destroy_sock(struct sock *sk)
 {
-        struct l2tp_tunnel *tunnel = l2tp_sock_to_tunnel(sk);
+        struct l2tp_tunnel *tunnel = sk->sk_user_data;
 
         lock_sock(sk);
         ip6_flush_pending_frames(sk);
         release_sock(sk);
 
-        if (tunnel) {
-                l2tp_tunnel_closeall(tunnel);
-                sock_put(sk);
-        }
+        if (tunnel)
+                l2tp_tunnel_delete(tunnel);
 
         inet6_destroy_sock(sk);
 }
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 59f246d7b290..3b02f24ea9ec 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -416,20 +416,28 @@ abort:
  * Session (and tunnel control) socket create/destroy.
  *****************************************************************************/
 
+static void pppol2tp_put_sk(struct rcu_head *head)
+{
+        struct pppol2tp_session *ps;
+
+        ps = container_of(head, typeof(*ps), rcu);
+        sock_put(ps->__sk);
+}
+
 /* Called by l2tp_core when a session socket is being closed.
  */
 static void pppol2tp_session_close(struct l2tp_session *session)
 {
-        struct sock *sk;
-
-        BUG_ON(session->magic != L2TP_SESSION_MAGIC);
+        struct pppol2tp_session *ps;
 
-        sk = pppol2tp_session_get_sock(session);
-        if (sk) {
-                if (sk->sk_socket)
-                        inet_shutdown(sk->sk_socket, SEND_SHUTDOWN);
-                sock_put(sk);
-        }
+        ps = l2tp_session_priv(session);
+        mutex_lock(&ps->sk_lock);
+        ps->__sk = rcu_dereference_protected(ps->sk,
+                                             lockdep_is_held(&ps->sk_lock));
+        RCU_INIT_POINTER(ps->sk, NULL);
+        if (ps->__sk)
+                call_rcu(&ps->rcu, pppol2tp_put_sk);
+        mutex_unlock(&ps->sk_lock);
 }
 
 /* Really kill the session socket. (Called from sock_put() if
@@ -449,14 +457,6 @@ static void pppol2tp_session_destruct(struct sock *sk)
         }
 }
 
-static void pppol2tp_put_sk(struct rcu_head *head)
-{
-        struct pppol2tp_session *ps;
-
-        ps = container_of(head, typeof(*ps), rcu);
-        sock_put(ps->__sk);
-}
-
 /* Called when the PPPoX socket (session) is closed.
  */
 static int pppol2tp_release(struct socket *sock)
@@ -480,26 +480,17 @@ static int pppol2tp_release(struct socket *sock)
         sock_orphan(sk);
         sock->sk = NULL;
 
+        /* If the socket is associated with a session,
+         * l2tp_session_delete will call pppol2tp_session_close which
+         * will drop the session's ref on the socket.
+         */
         session = pppol2tp_sock_to_session(sk);
-
-        if (session != NULL) {
-                struct pppol2tp_session *ps;
-
+        if (session) {
                 l2tp_session_delete(session);
-
-                ps = l2tp_session_priv(session);
-                mutex_lock(&ps->sk_lock);
-                ps->__sk = rcu_dereference_protected(ps->sk,
-                                                     lockdep_is_held(&ps->sk_lock));
-                RCU_INIT_POINTER(ps->sk, NULL);
-                mutex_unlock(&ps->sk_lock);
-                call_rcu(&ps->rcu, pppol2tp_put_sk);
-
-                /* Rely on the sock_put() call at the end of the function for
-                 * dropping the reference held by pppol2tp_sock_to_session().
-                 * The last reference will be dropped by pppol2tp_put_sk().
-                 */
+                /* drop the ref obtained by pppol2tp_sock_to_session */
+                sock_put(sk);
         }
+
         release_sock(sk);
 
         /* This will delete the session context via
@@ -796,6 +787,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
 
 out_no_ppp:
         /* This is how we get the session context from the socket. */
+        sock_hold(sk);
         sk->sk_user_data = session;
         rcu_assign_pointer(ps->sk, sk);
         mutex_unlock(&ps->sk_lock);
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 1f466d12a6bc..94c7ee9df33b 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -212,6 +212,7 @@ static const char *hw_flag_names[] = {
         FLAG(REPORTS_LOW_ACK),
         FLAG(SUPPORTS_TX_FRAG),
         FLAG(SUPPORTS_TDLS_BUFFER_STA),
+        FLAG(DOESNT_SUPPORT_QOS_NDP),
 #undef FLAG
 };
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 39b660b9a908..5f303abac5ad 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -896,7 +896,8 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
         struct ieee80211_hdr_3addr *nullfunc;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif, true);
+        skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif,
+                !ieee80211_hw_check(&local->hw, DOESNT_SUPPORT_QOS_NDP));
         if (!skb)
                 return;
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fd580614085b..56fe16b07538 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3921,7 +3921,7 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
         if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
                                               IEEE80211_FCTL_TODS)) !=
             fast_rx->expected_ds_bits)
-                goto drop;
+                return false;
 
         /* assign the key to drop unencrypted frames (later)
          * and strip the IV/MIC if necessary
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 25904af38839..69722504e3e1 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3574,6 +3574,14 @@ void __ieee80211_subif_start_xmit(struct sk_buff *skb,
         if (!IS_ERR_OR_NULL(sta)) {
                 struct ieee80211_fast_tx *fast_tx;
 
+                /* We need a bit of data queued to build aggregates properly, so
+                 * instruct the TCP stack to allow more than a single ms of data
+                 * to be queued in the stack. The value is a bit-shift of 1
+                 * second, so 8 is ~4ms of queued data. Only affects local TCP
+                 * sockets.
+                 */
+                sk_pacing_shift_update(skb->sk, 8);
+
                 fast_tx = rcu_dereference(sta->fast_tx);
 
                 if (fast_tx &&
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index e545a3c9365f..7a4de6d618b1 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -122,7 +122,7 @@ bool mpls_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
         if (skb->len <= mtu)
                 return false;
 
-        if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
+        if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
                 return false;
 
         return true;
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 3e17d32b629d..58d5d05aec24 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -260,7 +260,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                 buf_len = strlen(buf);
 
                 ct = nf_ct_get(skb, &ctinfo);
-                if (ct && (ct->status & IPS_NAT_MASK)) {
+                if (ct) {
                         bool mangled;
 
                         /* If mangling fails this function will return 0
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 8b9fe30de0cd..c4acc7340eb1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5037,9 +5037,9 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
 {
         const struct nfgenmsg *nfmsg = nlmsg_data(nlh);
         const struct nf_flowtable_type *type;
+        struct nft_flowtable *flowtable, *ft;
         u8 genmask = nft_genmask_next(net);
         int family = nfmsg->nfgen_family;
-        struct nft_flowtable *flowtable;
         struct nft_table *table;
         struct nft_ctx ctx;
         int err, i, k;
@@ -5099,6 +5099,22 @@ static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
                 goto err3;
 
         for (i = 0; i < flowtable->ops_len; i++) {
+                if (!flowtable->ops[i].dev)
+                        continue;
+
+                list_for_each_entry(ft, &table->flowtables, list) {
+                        for (k = 0; k < ft->ops_len; k++) {
+                                if (!ft->ops[k].dev)
+                                        continue;
+
+                                if (flowtable->ops[i].dev == ft->ops[k].dev &&
+                                    flowtable->ops[i].pf == ft->ops[k].pf) {
+                                        err = -EBUSY;
+                                        goto err4;
+                                }
+                        }
+                }
+
                 err = nf_register_net_hook(net, &flowtable->ops[i]);
                 if (err < 0)
                         goto err4;
@@ -5120,7 +5136,7 @@ err5:
         i = flowtable->ops_len;
 err4:
         for (k = i - 1; k >= 0; k--)
-                nf_unregister_net_hook(net, &flowtable->ops[i]);
+                nf_unregister_net_hook(net, &flowtable->ops[k]);
 
         kfree(flowtable->ops);
 err3:
@@ -5145,6 +5161,11 @@ static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
         struct nft_table *table;
         struct nft_ctx ctx;
 
+        if (!nla[NFTA_FLOWTABLE_TABLE] ||
+            (!nla[NFTA_FLOWTABLE_NAME] &&
+             !nla[NFTA_FLOWTABLE_HANDLE]))
+                return -EINVAL;
+
         table = nf_tables_table_lookup(net, nla[NFTA_FLOWTABLE_TABLE],
                                        family, genmask);
         if (IS_ERR(table))
@@ -5402,6 +5423,7 @@ err:
 static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
 {
         cancel_delayed_work_sync(&flowtable->data.gc_work);
+        kfree(flowtable->ops);
         kfree(flowtable->name);
         flowtable->data.type->free(&flowtable->data);
         rhashtable_destroy(&flowtable->data.rhashtable);
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 3f1624ee056f..d40591fe1b2f 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -674,7 +674,7 @@ static const struct nft_set_ops *
 nft_hash_select_ops(const struct nft_ctx *ctx, const struct nft_set_desc *desc,
                     u32 flags)
 {
-        if (desc->size) {
+        if (desc->size && !(flags & NFT_SET_TIMEOUT)) {
                 switch (desc->klen) {
                 case 4:
                         return &nft_hash_fast_ops;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index fa1655aff8d3..4aa01c90e9d1 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -423,6 +423,36 @@ textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto)
         return buf;
 }
 
+/**
+ * xt_check_proc_name - check that name is suitable for /proc file creation
+ *
+ * @name: file name candidate
+ * @size: length of buffer
+ *
+ * some x_tables modules wish to create a file in /proc.
+ * This function makes sure that the name is suitable for this
+ * purpose, it checks that name is NUL terminated and isn't a 'special'
+ * name, like "..".
+ *
+ * returns negative number on error or 0 if name is useable.
+ */
+int xt_check_proc_name(const char *name, unsigned int size)
+{
+        if (name[0] == '\0')
+                return -EINVAL;
+
+        if (strnlen(name, size) == size)
+                return -ENAMETOOLONG;
+
+        if (strcmp(name, ".") == 0 ||
+            strcmp(name, "..") == 0 ||
+            strchr(name, '/'))
+                return -EINVAL;
+
+        return 0;
+}
+EXPORT_SYMBOL(xt_check_proc_name);
+
 int xt_check_match(struct xt_mtchk_param *par,
                    unsigned int size, u_int8_t proto, bool inv_proto)
 {
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 66f5aca62a08..3360f13dc208 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -917,8 +917,9 @@ static int hashlimit_mt_check_v1(const struct xt_mtchk_param *par)
         struct hashlimit_cfg3 cfg = {};
         int ret;
 
-        if (info->name[sizeof(info->name) - 1] != '\0')
-                return -EINVAL;
+        ret = xt_check_proc_name(info->name, sizeof(info->name));
+        if (ret)
+                return ret;
 
         ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
 
@@ -935,8 +936,9 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
         struct hashlimit_cfg3 cfg = {};
         int ret;
 
-        if (info->name[sizeof(info->name) - 1] != '\0')
-                return -EINVAL;
+        ret = xt_check_proc_name(info->name, sizeof(info->name));
+        if (ret)
+                return ret;
 
         ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
 
@@ -950,9 +952,11 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
 static int hashlimit_mt_check(const struct xt_mtchk_param *par)
 {
         struct xt_hashlimit_mtinfo3 *info = par->matchinfo;
+        int ret;
 
-        if (info->name[sizeof(info->name) - 1] != '\0')
-                return -EINVAL;
+        ret = xt_check_proc_name(info->name, sizeof(info->name));
+        if (ret)
+                return ret;
 
         return hashlimit_mt_check_common(par, &info->hinfo, &info->cfg,
                                          info->name, 3);
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 6d232d18faff..81ee1d6543b2 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -361,9 +361,9 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
                                     info->hit_count, XT_RECENT_MAX_NSTAMPS - 1);
                 return -EINVAL;
         }
-        if (info->name[0] == '\0' ||
-            strnlen(info->name, XT_RECENT_NAME_LEN) == XT_RECENT_NAME_LEN)
-                return -EINVAL;
+        ret = xt_check_proc_name(info->name, sizeof(info->name));
+        if (ret)
+                return ret;
 
         if (ip_pkt_list_tot && info->hit_count < ip_pkt_list_tot)
                 nstamp_mask = roundup_pow_of_two(ip_pkt_list_tot) - 1;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 6f02499ef007..b9ce82c9440f 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1106,7 +1106,7 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
         if (!err)
                 delivered = true;
         else if (err != -ESRCH)
-                goto error;
+                return err;
         return delivered ? 0 : -ESRCH;
  error:
         kfree_skb(skb);
diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c
index 04b94281a30b..b891a91577f8 100644
--- a/net/openvswitch/meter.c
+++ b/net/openvswitch/meter.c
@@ -242,14 +242,20 @@ static struct dp_meter *dp_meter_create(struct nlattr **a)
 
                 band->type = nla_get_u32(attr[OVS_BAND_ATTR_TYPE]);
                 band->rate = nla_get_u32(attr[OVS_BAND_ATTR_RATE]);
+                if (band->rate == 0) {
+                        err = -EINVAL;
+                        goto exit_free_meter;
+                }
+
                 band->burst_size = nla_get_u32(attr[OVS_BAND_ATTR_BURST]);
                 /* Figure out max delta_t that is enough to fill any bucket.
                  * Keep max_delta_t size to the bucket units:
                  * pkts => 1/1000 packets, kilobits => bits.
+                 *
+                 * Start with a full bucket.
                  */
-                band_max_delta_t = (band->burst_size + band->rate) * 1000;
-                /* Start with a full bucket. */
-                band->bucket = band_max_delta_t;
+                band->bucket = (band->burst_size + band->rate) * 1000;
+                band_max_delta_t = band->bucket / band->rate;
                 if (band_max_delta_t > meter->max_delta_t)
                         meter->max_delta_t = band_max_delta_t;
                 band++;
diff --git a/net/qrtr/smd.c b/net/qrtr/smd.c
index 50615d5efac1..9cf089b9754e 100644
--- a/net/qrtr/smd.c
+++ b/net/qrtr/smd.c
@@ -114,5 +114,6 @@ static struct rpmsg_driver qcom_smd_qrtr_driver = {
 
 module_rpmsg_driver(qcom_smd_qrtr_driver);
 
+MODULE_ALIAS("rpmsg:IPCRTR");
 MODULE_DESCRIPTION("Qualcomm IPC-Router SMD interface driver");
 MODULE_LICENSE("GPL v2");
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index c061d6eb465d..22571189f21e 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 Oracle.  All rights reserved.
+ * Copyright (c) 2006, 2018 Oracle.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -142,12 +142,20 @@ int rds_tcp_accept_one(struct socket *sock)
         if (ret)
                 goto out;
 
-        new_sock->type = sock->type;
-        new_sock->ops = sock->ops;
         ret = sock->ops->accept(sock, new_sock, O_NONBLOCK, true);
         if (ret < 0)
                 goto out;
 
+        /* sock_create_lite() does not get a hold on the owner module so we
+         * need to do it here.  Note that sock_release() uses sock->ops to
+         * determine if it needs to decrement the reference count.  So set
+         * sock->ops after calling accept() in case that fails.  And there's
+         * no need to do try_module_get() as the listener should have a hold
+         * already.
+         */
+        new_sock->ops = sock->ops;
+        __module_get(new_sock->ops->owner);
+
         ret = rds_tcp_keepalive(new_sock);
         if (ret < 0)
                 goto out;
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index b3f2c15affa7..9d2cabf1dc7e 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -352,7 +352,7 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla,
         return res;
 out:
         if (res == ACT_P_CREATED)
-                tcf_idr_cleanup(*act, est);
+                tcf_idr_release(*act, bind);
 
         return ret;
 }
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index b7ba9b06b147..2a5c8fd860cf 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -350,7 +350,7 @@ static int tcf_csum_sctp(struct sk_buff *skb, unsigned int ihl,
 {
         struct sctphdr *sctph;
 
-        if (skb_is_gso(skb) && skb_shinfo(skb)->gso_type & SKB_GSO_SCTP)
+        if (skb_is_gso(skb) && skb_is_gso_sctp(skb))
                 return 1;
 
         sctph = tcf_csum_skb_nextlayer(skb, ihl, ipl, sizeof(*sctph));
@@ -626,7 +626,8 @@ static void tcf_csum_cleanup(struct tc_action *a)
         struct tcf_csum_params *params;
 
         params = rcu_dereference_protected(p->params, 1);
-        kfree_rcu(params, rcu);
+        if (params)
+                kfree_rcu(params, rcu);
 }
 
 static int tcf_csum_walker(struct net *net, struct sk_buff *skb,
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 06e380ae0928..7e06b9b62613 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -80,9 +80,12 @@ static void ipt_destroy_target(struct xt_entry_target *t)
 static void tcf_ipt_release(struct tc_action *a)
 {
         struct tcf_ipt *ipt = to_ipt(a);
-        ipt_destroy_target(ipt->tcfi_t);
+
+        if (ipt->tcfi_t) {
+                ipt_destroy_target(ipt->tcfi_t);
+                kfree(ipt->tcfi_t);
+        }
         kfree(ipt->tcfi_tname);
-        kfree(ipt->tcfi_t);
 }
 
 static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = {
@@ -187,7 +190,7 @@ err2:
         kfree(tname);
 err1:
         if (ret == ACT_P_CREATED)
-                tcf_idr_cleanup(*a, est);
+                tcf_idr_release(*a, bind);
         return err;
 }
 
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 349beaffb29e..fef08835f26d 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -176,7 +176,7 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
                 p = to_pedit(*a);
                 keys = kmalloc(ksize, GFP_KERNEL);
                 if (keys == NULL) {
-                        tcf_idr_cleanup(*a, est);
+                        tcf_idr_release(*a, bind);
                         kfree(keys_ex);
                         return -ENOMEM;
                 }
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 95d3c9097b25..faebf82b99f1 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -194,7 +194,7 @@ failure:
         qdisc_put_rtab(P_tab);
         qdisc_put_rtab(R_tab);
         if (ret == ACT_P_CREATED)
-                tcf_idr_cleanup(*a, est);
+                tcf_idr_release(*a, bind);
         return err;
 }
 
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 1ba0df238756..74c5d7e6a0fa 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -103,7 +103,8 @@ static void tcf_sample_cleanup(struct tc_action *a)
 
         psample_group = rtnl_dereference(s->psample_group);
         RCU_INIT_POINTER(s->psample_group, NULL);
-        psample_group_put(psample_group);
+        if (psample_group)
+                psample_group_put(psample_group);
 }
 
 static bool tcf_sample_dev_ok_push(struct net_device *dev)
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 425eac11f6da..b1f38063ada0 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -121,7 +121,7 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
                 d = to_defact(*a);
                 ret = alloc_defdata(d, defdata);
                 if (ret < 0) {
-                        tcf_idr_cleanup(*a, est);
+                        tcf_idr_release(*a, bind);
                         return ret;
                 }
                 d->tcf_action = parm->action;
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index fa975262dbac..7b0700f52b50 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -152,7 +152,7 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla,
         ASSERT_RTNL();
         p = kzalloc(sizeof(struct tcf_skbmod_params), GFP_KERNEL);
         if (unlikely(!p)) {
-                if (ovr)
+                if (ret == ACT_P_CREATED)
                         tcf_idr_release(*a, bind);
                 return -ENOMEM;
         }
@@ -190,7 +190,8 @@ static void tcf_skbmod_cleanup(struct tc_action *a)
         struct tcf_skbmod_params  *p;
 
         p = rcu_dereference_protected(d->skbmod_p, 1);
-        kfree_rcu(p, rcu);
+        if (p)
+                kfree_rcu(p, rcu);
 }
 
 static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a,
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 0e23aac09ad6..1281ca463727 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -153,6 +153,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla,
                 metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX;
                 break;
         default:
+                ret = -EINVAL;
                 goto err_out;
         }
 
@@ -207,11 +208,12 @@ static void tunnel_key_release(struct tc_action *a)
         struct tcf_tunnel_key_params *params;
 
         params = rcu_dereference_protected(t->params, 1);
+        if (params) {
+                if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
+                        dst_release(&params->tcft_enc_metadata->dst);
 
-        if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
-                dst_release(&params->tcft_enc_metadata->dst);
-
-        kfree_rcu(params, rcu);
+                kfree_rcu(params, rcu);
+        }
 }
 
 static int tunnel_key_dump_addresses(struct sk_buff *skb,
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index e1a1b3f3983a..c49cb61adedf 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -195,7 +195,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
         ASSERT_RTNL();
         p = kzalloc(sizeof(*p), GFP_KERNEL);
         if (!p) {
-                if (ovr)
+                if (ret == ACT_P_CREATED)
                         tcf_idr_release(*a, bind);
                 return -ENOMEM;
         }
@@ -225,7 +225,8 @@ static void tcf_vlan_cleanup(struct tc_action *a)
         struct tcf_vlan_params *p;
 
         p = rcu_dereference_protected(v->vlan_p, 1);
-        kfree_rcu(p, rcu);
+        if (p)
+                kfree_rcu(p, rcu);
 }
 
 static int tcf_vlan_dump(struct sk_buff *skb, struct tc_action *a,
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 190570f21b20..7e3fbe9cc936 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -106,6 +106,14 @@ static inline void qdisc_enqueue_skb_bad_txq(struct Qdisc *q,
 
         __skb_queue_tail(&q->skb_bad_txq, skb);
 
+        if (qdisc_is_percpu_stats(q)) {
+                qdisc_qstats_cpu_backlog_inc(q, skb);
+                qdisc_qstats_cpu_qlen_inc(q);
+        } else {
+                qdisc_qstats_backlog_inc(q, skb);
+                q->q.qlen++;
+        }
+
         if (lock)
                 spin_unlock(lock);
 }
@@ -196,14 +204,6 @@ static void try_bulk_dequeue_skb_slow(struct Qdisc *q,
                         break;
                 if (unlikely(skb_get_queue_mapping(nskb) != mapping)) {
                         qdisc_enqueue_skb_bad_txq(q, nskb);
-
-                        if (qdisc_is_percpu_stats(q)) {
-                                qdisc_qstats_cpu_backlog_inc(q, nskb);
-                                qdisc_qstats_cpu_qlen_inc(q);
-                        } else {
-                                qdisc_qstats_backlog_inc(q, nskb);
-                                q->q.qlen++;
-                        }
                         break;
                 }
                 skb->next = nskb;
@@ -628,6 +628,7 @@ static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc *qdisc,
         int band = prio2band[skb->priority & TC_PRIO_MAX];
         struct pfifo_fast_priv *priv = qdisc_priv(qdisc);
         struct skb_array *q = band2list(priv, band);
+        unsigned int pkt_len = qdisc_pkt_len(skb);
         int err;
 
         err = skb_array_produce(q, skb);
@@ -636,7 +637,10 @@ static int pfifo_fast_enqueue(struct sk_buff *skb, struct Qdisc *qdisc,
                 return qdisc_drop_cpu(skb, qdisc, to_free);
 
         qdisc_qstats_cpu_qlen_inc(qdisc);
-        qdisc_qstats_cpu_backlog_inc(qdisc, skb);
+        /* Note: skb can not be used after skb_array_produce(),
+         * so we better not use qdisc_qstats_cpu_backlog_inc()
+         */
+        this_cpu_add(qdisc->cpu_qstats->backlog, pkt_len);
         return NET_XMIT_SUCCESS;
 }
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 7c179addebcd..7d6801fc5340 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -509,7 +509,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
         }
 
         if (unlikely(sch->q.qlen >= sch->limit))
-                return qdisc_drop(skb, sch, to_free);
+                return qdisc_drop_all(skb, sch, to_free);
 
         qdisc_qstats_backlog_inc(sch, skb);
 
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 229172d509cc..03225a8df973 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -188,7 +188,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch,
         int ret;
 
         if (qdisc_pkt_len(skb) > q->max_size) {
-                if (skb_is_gso(skb) && skb_gso_mac_seglen(skb) <= q->max_size)
+                if (skb_is_gso(skb) &&
+                    skb_gso_validate_mac_len(skb, q->max_size))
                         return tbf_segment(skb, sch, to_free);
                 return qdisc_drop(skb, sch, to_free);
         }
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 0247cc432e02..b381d78548ac 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -106,6 +106,7 @@ int sctp_rcv(struct sk_buff *skb)
         int family;
         struct sctp_af *af;
         struct net *net = dev_net(skb->dev);
+        bool is_gso = skb_is_gso(skb) && skb_is_gso_sctp(skb);
 
         if (skb->pkt_type != PACKET_HOST)
                 goto discard_it;
@@ -123,8 +124,7 @@ int sctp_rcv(struct sk_buff *skb)
          * it's better to just linearize it otherwise crc computing
          * takes longer.
          */
-        if ((!(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) &&
-             skb_linearize(skb)) ||
+        if ((!is_gso && skb_linearize(skb)) ||
             !pskb_may_pull(skb, sizeof(struct sctphdr)))
                 goto discard_it;
 
@@ -135,7 +135,7 @@ int sctp_rcv(struct sk_buff *skb)
         if (skb_csum_unnecessary(skb))
                 __skb_decr_checksum_unnecessary(skb);
         else if (!sctp_checksum_disable &&
-                 !(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) &&
+                 !is_gso &&
                  sctp_rcv_checksum(net, skb) < 0)
                 goto discard_it;
         skb->csum_valid = 1;
@@ -1218,7 +1218,7 @@ static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net,
          * issue as packets hitting this are mostly INIT or INIT-ACK and
          * those cannot be on GSO-style anyway.
          */
-        if ((skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) == SKB_GSO_SCTP)
+        if (skb_is_gso(skb) && skb_is_gso_sctp(skb))
                 return NULL;
 
         ch = (struct sctp_chunkhdr *)skb->data;
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 48392552ee7c..23ebc5318edc 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -170,7 +170,7 @@ next_chunk:
 
                 chunk = list_entry(entry, struct sctp_chunk, list);
 
-                if ((skb_shinfo(chunk->skb)->gso_type & SKB_GSO_SCTP) == SKB_GSO_SCTP) {
+                if (skb_is_gso(chunk->skb) && skb_is_gso_sctp(chunk->skb)) {
                         /* GSO-marked skbs but without frags, handle
                          * them normally
                          */
diff --git a/net/sctp/offload.c b/net/sctp/offload.c
index 35bc7106d182..123e9f2dc226 100644
--- a/net/sctp/offload.c
+++ b/net/sctp/offload.c
@@ -45,7 +45,7 @@ static struct sk_buff *sctp_gso_segment(struct sk_buff *skb,
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         struct sctphdr *sh;
 
-        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP))
+        if (!skb_is_gso_sctp(skb))
                 goto out;
 
         sh = sctp_hdr(skb);
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index da1a5cdefd13..1e0d780855c3 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -978,10 +978,6 @@ out:
                 lsmc->clcsock = NULL;
         }
         release_sock(lsk);
-        /* no more listening, wake up smc_close_wait_listen_clcsock and
-         * accept
-         */
-        lsk->sk_state_change(lsk);
         sock_put(&lsmc->sk); /* sock_hold in smc_listen */
 }
 
@@ -1406,8 +1402,10 @@ static int smc_create(struct net *net, struct socket *sock, int protocol,
         smc->use_fallback = false; /* assume rdma capability first */
         rc = sock_create_kern(net, PF_INET, SOCK_STREAM,
                               IPPROTO_TCP, &smc->clcsock);
-        if (rc)
+        if (rc) {
                 sk_common_release(sk);
+                goto out;
+        }
         smc->sk.sk_sndbuf = max(smc->clcsock->sk->sk_sndbuf, SMC_BUF_MIN_SIZE);
         smc->sk.sk_rcvbuf = max(smc->clcsock->sk->sk_rcvbuf, SMC_BUF_MIN_SIZE);
 
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index 3cd086e5bd28..b42395d24cba 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -269,7 +269,7 @@ static void smc_cdc_rx_handler(struct ib_wc *wc, void *buf)
 
         if (wc->byte_len < offsetof(struct smc_cdc_msg, reserved))
                 return; /* short message */
-        if (cdc->len != sizeof(*cdc))
+        if (cdc->len != SMC_WR_TX_SIZE)
                 return; /* invalid message */
         smc_cdc_msg_recv(cdc, link, wc->wr_id);
 }
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index e339c0186dcf..fa41d9881741 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -30,27 +30,6 @@ static void smc_close_cleanup_listen(struct sock *parent)
                 smc_close_non_accepted(sk);
 }
 
-static void smc_close_wait_listen_clcsock(struct smc_sock *smc)
-{
-        DEFINE_WAIT_FUNC(wait, woken_wake_function);
-        struct sock *sk = &smc->sk;
-        signed long timeout;
-
-        timeout = SMC_CLOSE_WAIT_LISTEN_CLCSOCK_TIME;
-        add_wait_queue(sk_sleep(sk), &wait);
-        do {
-                release_sock(sk);
-                if (smc->clcsock)
-                        timeout = wait_woken(&wait, TASK_UNINTERRUPTIBLE,
-                                             timeout);
-                sched_annotate_sleep();
-                lock_sock(sk);
-                if (!smc->clcsock)
-                        break;
-        } while (timeout);
-        remove_wait_queue(sk_sleep(sk), &wait);
-}
-
 /* wait for sndbuf data being transmitted */
 static void smc_close_stream_wait(struct smc_sock *smc, long timeout)
 {
@@ -204,9 +183,11 @@ again:
                         rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR);
                         /* wake up kernel_accept of smc_tcp_listen_worker */
                         smc->clcsock->sk->sk_data_ready(smc->clcsock->sk);
-                        smc_close_wait_listen_clcsock(smc);
                 }
                 smc_close_cleanup_listen(sk);
+                release_sock(sk);
+                flush_work(&smc->tcp_listen_work);
+                lock_sock(sk);
                 break;
         case SMC_ACTIVE:
                 smc_close_stream_wait(smc, timeout);
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 2424c7100aaf..645dd226177b 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -177,6 +177,7 @@ static int smc_lgr_create(struct smc_sock *smc, __be32 peer_in_addr,
 
         lnk = &lgr->lnk[SMC_SINGLE_LINK];
         /* initialize link */
+        lnk->link_id = SMC_SINGLE_LINK;
         lnk->smcibdev = smcibdev;
         lnk->ibport = ibport;
         lnk->path_mtu = smcibdev->pattr[ibport - 1].active_mtu;
@@ -465,7 +466,7 @@ create:
                 rc = smc_link_determine_gid(conn->lgr);
         }
         conn->local_tx_ctrl.common.type = SMC_CDC_MSG_TYPE;
-        conn->local_tx_ctrl.len = sizeof(struct smc_cdc_msg);
+        conn->local_tx_ctrl.len = SMC_WR_TX_SIZE;
 #ifndef KERNEL_HAS_ATOMIC64
         spin_lock_init(&conn->acurs_lock);
 #endif
diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c
index 92fe4cc8c82c..b4aa4fcedb96 100644
--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -92,7 +92,7 @@ int smc_llc_send_confirm_link(struct smc_link *link, u8 mac[],
         memcpy(confllc->sender_mac, mac, ETH_ALEN);
         memcpy(confllc->sender_gid, gid, SMC_GID_SIZE);
         hton24(confllc->sender_qp_num, link->roce_qp->qp_num);
-        /* confllc->link_num = SMC_SINGLE_LINK; already done by memset above */
+        confllc->link_num = link->link_id;
         memcpy(confllc->link_uid, lgr->id, SMC_LGR_ID_SIZE);
         confllc->max_links = SMC_LINKS_PER_LGR_MAX;
         /* send llc message */
diff --git a/net/socket.c b/net/socket.c
index a93c99b518ca..08847c3b8c39 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2587,6 +2587,11 @@ void sock_unregister(int family)
 }
 EXPORT_SYMBOL(sock_unregister);
 
+bool sock_is_registered(int family)
+{
+        return family < NPROTO && rcu_access_pointer(net_families[family]);
+}
+
 static int __init sock_init(void)
 {
         int err;
diff --git a/net/tipc/group.c b/net/tipc/group.c
index 122162a31816..04e516d18054 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -189,6 +189,7 @@ struct tipc_group *tipc_group_create(struct net *net, u32 portid,
         grp->loopback = mreq->flags & TIPC_GROUP_LOOPBACK;
         grp->events = mreq->flags & TIPC_GROUP_MEMBER_EVTS;
         grp->open = group_is_open;
+        *grp->open = false;
         filter |= global ? TIPC_SUB_CLUSTER_SCOPE : TIPC_SUB_NODE_SCOPE;
         if (tipc_topsrv_kern_subscr(net, portid, type, 0, ~0,
                                     filter, &grp->subid))
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index b0323ec7971e..7dfa9fc99ec3 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -473,6 +473,7 @@ static int tipc_sk_create(struct net *net, struct socket *sock,
         sk->sk_write_space = tipc_write_space;
         sk->sk_destruct = tipc_sock_destruct;
         tsk->conn_timeout = CONN_TIMEOUT_DEFAULT;
+        tsk->group_is_open = true;
         atomic_set(&tsk->dupl_rcvcnt, 0);
 
         /* Start out with safe limits until we receive an advertised window */
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index e9b4b53ab53e..d824d548447e 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -46,16 +46,26 @@ MODULE_DESCRIPTION("Transport Layer Security Support");
 MODULE_LICENSE("Dual BSD/GPL");
 
 enum {
+        TLSV4,
+        TLSV6,
+        TLS_NUM_PROTS,
+};
+
+enum {
         TLS_BASE_TX,
         TLS_SW_TX,
         TLS_NUM_CONFIG,
 };
 
-static struct proto tls_prots[TLS_NUM_CONFIG];
+static struct proto *saved_tcpv6_prot;
+static DEFINE_MUTEX(tcpv6_prot_mutex);
+static struct proto tls_prots[TLS_NUM_PROTS][TLS_NUM_CONFIG];
 
 static inline void update_sk_prot(struct sock *sk, struct tls_context *ctx)
 {
-        sk->sk_prot = &tls_prots[ctx->tx_conf];
+        int ip_ver = sk->sk_family == AF_INET6 ? TLSV6 : TLSV4;
+
+        sk->sk_prot = &tls_prots[ip_ver][ctx->tx_conf];
 }
 
 int wait_on_pending_writer(struct sock *sk, long *timeo)
@@ -453,8 +463,21 @@ static int tls_setsockopt(struct sock *sk, int level, int optname,
         return do_tls_setsockopt(sk, optname, optval, optlen);
 }
 
+static void build_protos(struct proto *prot, struct proto *base)
+{
+        prot[TLS_BASE_TX] = *base;
+        prot[TLS_BASE_TX].setsockopt    = tls_setsockopt;
+        prot[TLS_BASE_TX].getsockopt    = tls_getsockopt;
+        prot[TLS_BASE_TX].close         = tls_sk_proto_close;
+
+        prot[TLS_SW_TX] = prot[TLS_BASE_TX];
+        prot[TLS_SW_TX].sendmsg         = tls_sw_sendmsg;
+        prot[TLS_SW_TX].sendpage        = tls_sw_sendpage;
+}
+
 static int tls_init(struct sock *sk)
 {
+        int ip_ver = sk->sk_family == AF_INET6 ? TLSV6 : TLSV4;
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tls_context *ctx;
         int rc = 0;
@@ -479,6 +502,17 @@ static int tls_init(struct sock *sk)
         ctx->getsockopt = sk->sk_prot->getsockopt;
         ctx->sk_proto_close = sk->sk_prot->close;
 
+        /* Build IPv6 TLS whenever the address of tcpv6_prot changes */
+        if (ip_ver == TLSV6 &&
+            unlikely(sk->sk_prot != smp_load_acquire(&saved_tcpv6_prot))) {
+                mutex_lock(&tcpv6_prot_mutex);
+                if (likely(sk->sk_prot != saved_tcpv6_prot)) {
+                        build_protos(tls_prots[TLSV6], sk->sk_prot);
+                        smp_store_release(&saved_tcpv6_prot, sk->sk_prot);
+                }
+                mutex_unlock(&tcpv6_prot_mutex);
+        }
+
         ctx->tx_conf = TLS_BASE_TX;
         update_sk_prot(sk, ctx);
 out:
@@ -493,21 +527,9 @@ static struct tcp_ulp_ops tcp_tls_ulp_ops __read_mostly = {
         .init                   = tls_init,
 };
 
-static void build_protos(struct proto *prot, struct proto *base)
-{
-        prot[TLS_BASE_TX] = *base;
-        prot[TLS_BASE_TX].setsockopt    = tls_setsockopt;
-        prot[TLS_BASE_TX].getsockopt    = tls_getsockopt;
-        prot[TLS_BASE_TX].close         = tls_sk_proto_close;
-
-        prot[TLS_SW_TX] = prot[TLS_BASE_TX];
-        prot[TLS_SW_TX].sendmsg         = tls_sw_sendmsg;
-        prot[TLS_SW_TX].sendpage        = tls_sw_sendpage;
-}
-
 static int __init tls_register(void)
 {
-        build_protos(tls_prots, &tcp_prot);
+        build_protos(tls_prots[TLSV4], &tcp_prot);
 
         tcp_register_ulp(&tcp_tls_ulp_ops);
 
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 1abcc4fc4df1..41722046b937 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -34,9 +34,10 @@ config CFG80211
 
           When built as a module it will be called cfg80211.
 
+if CFG80211
+
 config NL80211_TESTMODE
         bool "nl80211 testmode command"
-        depends on CFG80211
         help
           The nl80211 testmode command helps implementing things like
           factory calibration or validation tools for wireless chips.
@@ -51,7 +52,6 @@ config NL80211_TESTMODE
 
 config CFG80211_DEVELOPER_WARNINGS
         bool "enable developer warnings"
-        depends on CFG80211
         default n
         help
           This option enables some additional warnings that help
@@ -68,7 +68,7 @@ config CFG80211_DEVELOPER_WARNINGS
 
 config CFG80211_CERTIFICATION_ONUS
         bool "cfg80211 certification onus"
-        depends on CFG80211 && EXPERT
+        depends on EXPERT
         default n
         ---help---
           You should disable this option unless you are both capable
@@ -159,7 +159,6 @@ config CFG80211_REG_RELAX_NO_IR
 
 config CFG80211_DEFAULT_PS
         bool "enable powersave by default"
-        depends on CFG80211
         default y
         help
           This option enables powersave mode by default.
@@ -170,7 +169,6 @@ config CFG80211_DEFAULT_PS
 
 config CFG80211_DEBUGFS
         bool "cfg80211 DebugFS entries"
-        depends on CFG80211
         depends on DEBUG_FS
         ---help---
           You can enable this if you want debugfs entries for cfg80211.
@@ -180,7 +178,6 @@ config CFG80211_DEBUGFS
 config CFG80211_CRDA_SUPPORT
         bool "support CRDA" if EXPERT
         default y
-        depends on CFG80211
         help
           You should enable this option unless you know for sure you have no
           need for it, for example when using internal regdb (above) or the
@@ -190,7 +187,6 @@ config CFG80211_CRDA_SUPPORT
 
 config CFG80211_WEXT
         bool "cfg80211 wireless extensions compatibility" if !CFG80211_WEXT_EXPORT
-        depends on CFG80211
         select WEXT_CORE
         default y if CFG80211_WEXT_EXPORT
         help
@@ -199,11 +195,12 @@ config CFG80211_WEXT
 
 config CFG80211_WEXT_EXPORT
         bool
-        depends on CFG80211
         help
           Drivers should select this option if they require cfg80211's
           wext compatibility symbols to be exported.
 
+endif # CFG80211
+
 config LIB80211
         tristate
         default n
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index 8e70291e586a..e87d6c4dd5b6 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -217,7 +217,7 @@ bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
                 if (skb->len <= mtu)
                         goto ok;
 
-                if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
+                if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
                         goto ok;
         }
 
diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
index ccfdc7115a83..a00ec715aa46 100644
--- a/net/xfrm/xfrm_ipcomp.c
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -283,7 +283,7 @@ static struct crypto_comp * __percpu *ipcomp_alloc_tfms(const char *alg_name)
                 struct crypto_comp *tfm;
 
                 /* This can be any valid CPU ID so we don't need locking. */
-                tfm = __this_cpu_read(*pos->tfms);
+                tfm = this_cpu_read(*pos->tfms);
 
                 if (!strcmp(crypto_comp_name(tfm), alg_name)) {
                         pos->users++;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 7a23078132cf..625b3fca5704 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1458,10 +1458,13 @@ xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, const struct flowi *fl,
 static int xfrm_get_tos(const struct flowi *fl, int family)
 {
         const struct xfrm_policy_afinfo *afinfo;
-        int tos = 0;
+        int tos;
 
         afinfo = xfrm_policy_get_afinfo(family);
-        tos = afinfo ? afinfo->get_tos(fl) : 0;
+        if (!afinfo)
+                return 0;
+
+        tos = afinfo->get_tos(fl);
 
         rcu_read_unlock();
 
@@ -1891,7 +1894,7 @@ static void xfrm_policy_queue_process(struct timer_list *t)
         spin_unlock(&pq->hold_queue.lock);
 
         dst_hold(xfrm_dst_path(dst));
-        dst = xfrm_lookup(net, xfrm_dst_path(dst), &fl, sk, 0);
+        dst = xfrm_lookup(net, xfrm_dst_path(dst), &fl, sk, XFRM_LOOKUP_QUEUE);
         if (IS_ERR(dst))
                 goto purge_queue;
 
@@ -2729,14 +2732,14 @@ static const void *xfrm_get_dst_nexthop(const struct dst_entry *dst,
         while (dst->xfrm) {
                 const struct xfrm_state *xfrm = dst->xfrm;
 
+                dst = xfrm_dst_child(dst);
+
                 if (xfrm->props.mode == XFRM_MODE_TRANSPORT)
                         continue;
                 if (xfrm->type->flags & XFRM_TYPE_REMOTE_COADDR)
                         daddr = xfrm->coaddr;
                 else if (!(xfrm->type->flags & XFRM_TYPE_LOCAL_COADDR))
                         daddr = &xfrm->id.daddr;
-
-                dst = xfrm_dst_child(dst);
         }
         return daddr;
 }
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 1d38c6acf8af..9e3a5e85f828 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -660,7 +660,7 @@ static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff
                 } else {
                         XFRM_SKB_CB(skb)->seq.output.low = oseq + 1;
                         XFRM_SKB_CB(skb)->seq.output.hi = oseq_hi;
-                        xo->seq.low = oseq = oseq + 1;
+                        xo->seq.low = oseq + 1;
                         xo->seq.hi = oseq_hi;
                         oseq += skb_shinfo(skb)->gso_segs;
                 }
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 54e21f19d722..f9d2f2233f09 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2056,6 +2056,11 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen
         struct xfrm_mgr *km;
         struct xfrm_policy *pol = NULL;
 
+#ifdef CONFIG_COMPAT
+        if (in_compat_syscall())
+                return -EOPNOTSUPP;
+#endif
+
         if (!optval && !optlen) {
                 xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL);
                 xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 7f52b8eb177d..080035f056d9 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -121,22 +121,17 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
         struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
         struct xfrm_replay_state_esn *rs;
 
-        if (p->flags & XFRM_STATE_ESN) {
-                if (!rt)
-                        return -EINVAL;
+        if (!rt)
+                return (p->flags & XFRM_STATE_ESN) ? -EINVAL : 0;
 
-                rs = nla_data(rt);
+        rs = nla_data(rt);
 
-                if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
-                        return -EINVAL;
-
-                if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
-                    nla_len(rt) != sizeof(*rs))
-                        return -EINVAL;
-        }
+        if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
+                return -EINVAL;
 
-        if (!rt)
-                return 0;
+        if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
+            nla_len(rt) != sizeof(*rs))
+                return -EINVAL;
 
         /* As only ESP and AH support ESN feature. */
         if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH))