Merge branch 'for-chris-4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/fdmanana/linux into for-linus-4.7

Signed-off-by: Chris Mason <clm@fb.com>

34 files changed, 376 insertions, 238 deletions

diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c
index 3315b9a598af..4026f198a734 100644
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -32,10 +32,21 @@
 
 #include "bat_v_elp.h"
 #include "bat_v_ogm.h"
+#include "hard-interface.h"
 #include "hash.h"
 #include "originator.h"
 #include "packet.h"
 
+static void batadv_v_iface_activate(struct batadv_hard_iface *hard_iface)
+{
+        /* B.A.T.M.A.N. V does not use any queuing mechanism, therefore it can
+         * set the interface as ACTIVE right away, without any risk of race
+         * condition
+         */
+        if (hard_iface->if_status == BATADV_IF_TO_BE_ACTIVATED)
+                hard_iface->if_status = BATADV_IF_ACTIVE;
+}
+
 static int batadv_v_iface_enable(struct batadv_hard_iface *hard_iface)
 {
         int ret;
@@ -274,6 +285,7 @@ static bool batadv_v_neigh_is_sob(struct batadv_neigh_node *neigh1,
 
 static struct batadv_algo_ops batadv_batman_v __read_mostly = {
         .name = "BATMAN_V",
+        .bat_iface_activate = batadv_v_iface_activate,
         .bat_iface_enable = batadv_v_iface_enable,
         .bat_iface_disable = batadv_v_iface_disable,
         .bat_iface_update_mac = batadv_v_iface_update_mac,
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index e96d7c745b4a..3e6b2624f980 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -568,6 +568,7 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv,
  * be sent to
  * @bat_priv: the bat priv with all the soft interface information
  * @ip_dst: ipv4 to look up in the DHT
+ * @vid: VLAN identifier
  *
  * An originator O is selected if and only if its DHT_ID value is one of three
  * closest values (from the LEFT, with wrap around if needed) then the hash
@@ -576,7 +577,8 @@ static void batadv_choose_next_candidate(struct batadv_priv *bat_priv,
  * Return: the candidate array of size BATADV_DAT_CANDIDATE_NUM.
  */
 static struct batadv_dat_candidate *
-batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst)
+batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst,
+                             unsigned short vid)
 {
         int select;
         batadv_dat_addr_t last_max = BATADV_DAT_ADDR_MAX, ip_key;
@@ -592,7 +594,7 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst)
                 return NULL;
 
         dat.ip = ip_dst;
-        dat.vid = 0;
+        dat.vid = vid;
         ip_key = (batadv_dat_addr_t)batadv_hash_dat(&dat,
                                                     BATADV_DAT_ADDR_MAX);
 
@@ -612,6 +614,7 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst)
  * @bat_priv: the bat priv with all the soft interface information
  * @skb: payload to send
  * @ip: the DHT key
+ * @vid: VLAN identifier
  * @packet_subtype: unicast4addr packet subtype to use
  *
  * This function copies the skb with pskb_copy() and is sent as unicast packet
@@ -622,7 +625,7 @@ batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst)
  */
 static bool batadv_dat_send_data(struct batadv_priv *bat_priv,
                                  struct sk_buff *skb, __be32 ip,
-                                 int packet_subtype)
+                                 unsigned short vid, int packet_subtype)
 {
         int i;
         bool ret = false;
@@ -631,7 +634,7 @@ static bool batadv_dat_send_data(struct batadv_priv *bat_priv,
         struct sk_buff *tmp_skb;
         struct batadv_dat_candidate *cand;
 
-        cand = batadv_dat_select_candidates(bat_priv, ip);
+        cand = batadv_dat_select_candidates(bat_priv, ip, vid);
         if (!cand)
                 goto out;
 
@@ -1022,7 +1025,7 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
                 ret = true;
         } else {
                 /* Send the request to the DHT */
-                ret = batadv_dat_send_data(bat_priv, skb, ip_dst,
+                ret = batadv_dat_send_data(bat_priv, skb, ip_dst, vid,
                                            BATADV_P_DAT_DHT_GET);
         }
 out:
@@ -1150,8 +1153,8 @@ void batadv_dat_snoop_outgoing_arp_reply(struct batadv_priv *bat_priv,
         /* Send the ARP reply to the candidates for both the IP addresses that
          * the node obtained from the ARP reply
          */
-        batadv_dat_send_data(bat_priv, skb, ip_src, BATADV_P_DAT_DHT_PUT);
-        batadv_dat_send_data(bat_priv, skb, ip_dst, BATADV_P_DAT_DHT_PUT);
+        batadv_dat_send_data(bat_priv, skb, ip_src, vid, BATADV_P_DAT_DHT_PUT);
+        batadv_dat_send_data(bat_priv, skb, ip_dst, vid, BATADV_P_DAT_DHT_PUT);
 }
 
 /**
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index b22b2775a0a5..0a7deaf2670a 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -407,6 +407,9 @@ batadv_hardif_activate_interface(struct batadv_hard_iface *hard_iface)
 
         batadv_update_min_mtu(hard_iface->soft_iface);
 
+        if (bat_priv->bat_algo_ops->bat_iface_activate)
+                bat_priv->bat_algo_ops->bat_iface_activate(hard_iface);
+
 out:
         if (primary_if)
                 batadv_hardif_put(primary_if);
@@ -572,8 +575,7 @@ void batadv_hardif_disable_interface(struct batadv_hard_iface *hard_iface,
         struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
         struct batadv_hard_iface *primary_if = NULL;
 
-        if (hard_iface->if_status == BATADV_IF_ACTIVE)
-                batadv_hardif_deactivate_interface(hard_iface);
+        batadv_hardif_deactivate_interface(hard_iface);
 
         if (hard_iface->if_status != BATADV_IF_INACTIVE)
                 goto out;
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index e4cbb0753e37..c355a824713c 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -250,7 +250,6 @@ static void batadv_neigh_node_release(struct kref *ref)
 {
         struct hlist_node *node_tmp;
         struct batadv_neigh_node *neigh_node;
-        struct batadv_hardif_neigh_node *hardif_neigh;
         struct batadv_neigh_ifinfo *neigh_ifinfo;
         struct batadv_algo_ops *bao;
 
@@ -262,13 +261,7 @@ static void batadv_neigh_node_release(struct kref *ref)
                 batadv_neigh_ifinfo_put(neigh_ifinfo);
         }
 
-        hardif_neigh = batadv_hardif_neigh_get(neigh_node->if_incoming,
-                                               neigh_node->addr);
-        if (hardif_neigh) {
-                /* batadv_hardif_neigh_get() increases refcount too */
-                batadv_hardif_neigh_put(hardif_neigh);
-                batadv_hardif_neigh_put(hardif_neigh);
-        }
+        batadv_hardif_neigh_put(neigh_node->hardif_neigh);
 
         if (bao->bat_neigh_free)
                 bao->bat_neigh_free(neigh_node);
@@ -663,6 +656,11 @@ batadv_neigh_node_new(struct batadv_orig_node *orig_node,
         ether_addr_copy(neigh_node->addr, neigh_addr);
         neigh_node->if_incoming = hard_iface;
         neigh_node->orig_node = orig_node;
+        neigh_node->last_seen = jiffies;
+
+        /* increment unique neighbor refcount */
+        kref_get(&hardif_neigh->refcount);
+        neigh_node->hardif_neigh = hardif_neigh;
 
         /* extra reference for return */
         kref_init(&neigh_node->refcount);
@@ -672,9 +670,6 @@ batadv_neigh_node_new(struct batadv_orig_node *orig_node,
         hlist_add_head_rcu(&neigh_node->list, &orig_node->neigh_list);
         spin_unlock_bh(&orig_node->neigh_list_lock);
 
-        /* increment unique neighbor refcount */
-        kref_get(&hardif_neigh->refcount);
-
         batadv_dbg(BATADV_DBG_BATMAN, orig_node->bat_priv,
                    "Creating new neighbor %pM for orig_node %pM on interface %s\n",
                    neigh_addr, orig_node->orig, hard_iface->net_dev->name);
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 4dd646a52f1a..b781bf753250 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -105,6 +105,15 @@ static void _batadv_update_route(struct batadv_priv *bat_priv,
                 neigh_node = NULL;
 
         spin_lock_bh(&orig_node->neigh_list_lock);
+        /* curr_router used earlier may not be the current orig_ifinfo->router
+         * anymore because it was dereferenced outside of the neigh_list_lock
+         * protected region. After the new best neighbor has replace the current
+         * best neighbor the reference counter needs to decrease. Consequently,
+         * the code needs to ensure the curr_router variable contains a pointer
+         * to the replaced best neighbor.
+         */
+        curr_router = rcu_dereference_protected(orig_ifinfo->router, true);
+
         rcu_assign_pointer(orig_ifinfo->router, neigh_node);
         spin_unlock_bh(&orig_node->neigh_list_lock);
         batadv_orig_ifinfo_put(orig_ifinfo);
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 3ce06e0a91b1..76417850d3fc 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -675,6 +675,9 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
 
                 if (pending) {
                         hlist_del(&forw_packet->list);
+                        if (!forw_packet->own)
+                                atomic_inc(&bat_priv->bcast_queue_left);
+
                         batadv_forw_packet_free(forw_packet);
                 }
         }
@@ -702,6 +705,9 @@ batadv_purge_outstanding_packets(struct batadv_priv *bat_priv,
 
                 if (pending) {
                         hlist_del(&forw_packet->list);
+                        if (!forw_packet->own)
+                                atomic_inc(&bat_priv->batman_queue_left);
+
                         batadv_forw_packet_free(forw_packet);
                 }
         }
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 0710379491bf..8a136b6a1ff0 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -408,11 +408,17 @@ void batadv_interface_rx(struct net_device *soft_iface,
          */
         nf_reset(skb);
 
+        if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
+                goto dropped;
+
         vid = batadv_get_vid(skb, 0);
         ethhdr = eth_hdr(skb);
 
         switch (ntohs(ethhdr->h_proto)) {
         case ETH_P_8021Q:
+                if (!pskb_may_pull(skb, VLAN_ETH_HLEN))
+                        goto dropped;
+
                 vhdr = (struct vlan_ethhdr *)skb->data;
 
                 if (vhdr->h_vlan_encapsulated_proto != ethertype)
@@ -424,8 +430,6 @@ void batadv_interface_rx(struct net_device *soft_iface,
         }
 
         /* skb->dev & skb->pkt_type are set here */
-        if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
-                goto dropped;
         skb->protocol = eth_type_trans(skb, soft_iface);
 
         /* should not be necessary anymore as we use skb_pull_rcsum()
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 0b43e86328a5..9b4551a86535 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -215,6 +215,8 @@ static void batadv_tt_local_entry_release(struct kref *ref)
         tt_local_entry = container_of(ref, struct batadv_tt_local_entry,
                                       common.refcount);
 
+        batadv_softif_vlan_put(tt_local_entry->vlan);
+
         kfree_rcu(tt_local_entry, common.rcu);
 }
 
@@ -673,6 +675,7 @@ bool batadv_tt_local_add(struct net_device *soft_iface, const u8 *addr,
         kref_get(&tt_local->common.refcount);
         tt_local->last_seen = jiffies;
         tt_local->common.added_at = tt_local->last_seen;
+        tt_local->vlan = vlan;
 
         /* the batman interface mac and multicast addresses should never be
          * purged
@@ -991,7 +994,6 @@ int batadv_tt_local_seq_print_text(struct seq_file *seq, void *offset)
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_local_entry *tt_local;
         struct batadv_hard_iface *primary_if;
-        struct batadv_softif_vlan *vlan;
         struct hlist_head *head;
         unsigned short vid;
         u32 i;
@@ -1027,14 +1029,6 @@ int batadv_tt_local_seq_print_text(struct seq_file *seq, void *offset)
                         last_seen_msecs = last_seen_msecs % 1000;
 
                         no_purge = tt_common_entry->flags & np_flag;
-
-                        vlan = batadv_softif_vlan_get(bat_priv, vid);
-                        if (!vlan) {
-                                seq_printf(seq, "Cannot retrieve VLAN %d\n",
-                                           BATADV_PRINT_VID(vid));
-                                continue;
-                        }
-
                         seq_printf(seq,
                                    " * %pM %4i [%c%c%c%c%c%c] %3u.%03u   (%#.8x)\n",
                                    tt_common_entry->addr,
@@ -1052,9 +1046,7 @@ int batadv_tt_local_seq_print_text(struct seq_file *seq, void *offset)
                                      BATADV_TT_CLIENT_ISOLA) ? 'I' : '.'),
                                    no_purge ? 0 : last_seen_secs,
                                    no_purge ? 0 : last_seen_msecs,
-                                   vlan->tt.crc);
-
-                        batadv_softif_vlan_put(vlan);
+                                   tt_local->vlan->tt.crc);
                 }
                 rcu_read_unlock();
         }
@@ -1099,7 +1091,6 @@ u16 batadv_tt_local_remove(struct batadv_priv *bat_priv, const u8 *addr,
 {
         struct batadv_tt_local_entry *tt_local_entry;
         u16 flags, curr_flags = BATADV_NO_FLAGS;
-        struct batadv_softif_vlan *vlan;
         void *tt_entry_exists;
 
         tt_local_entry = batadv_tt_local_hash_find(bat_priv, addr, vid);
@@ -1139,14 +1130,6 @@ u16 batadv_tt_local_remove(struct batadv_priv *bat_priv, const u8 *addr,
         /* extra call to free the local tt entry */
         batadv_tt_local_entry_put(tt_local_entry);
 
-        /* decrease the reference held for this vlan */
-        vlan = batadv_softif_vlan_get(bat_priv, vid);
-        if (!vlan)
-                goto out;
-
-        batadv_softif_vlan_put(vlan);
-        batadv_softif_vlan_put(vlan);
-
 out:
         if (tt_local_entry)
                 batadv_tt_local_entry_put(tt_local_entry);
@@ -1219,7 +1202,6 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
         spinlock_t *list_lock; /* protects write access to the hash lists */
         struct batadv_tt_common_entry *tt_common_entry;
         struct batadv_tt_local_entry *tt_local;
-        struct batadv_softif_vlan *vlan;
         struct hlist_node *node_tmp;
         struct hlist_head *head;
         u32 i;
@@ -1241,14 +1223,6 @@ static void batadv_tt_local_table_free(struct batadv_priv *bat_priv)
                                                 struct batadv_tt_local_entry,
                                                 common);
 
-                        /* decrease the reference held for this vlan */
-                        vlan = batadv_softif_vlan_get(bat_priv,
-                                                      tt_common_entry->vid);
-                        if (vlan) {
-                                batadv_softif_vlan_put(vlan);
-                                batadv_softif_vlan_put(vlan);
-                        }
-
                         batadv_tt_local_entry_put(tt_local);
                 }
                 spin_unlock_bh(list_lock);
@@ -3309,7 +3283,6 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
         struct batadv_hashtable *hash = bat_priv->tt.local_hash;
         struct batadv_tt_common_entry *tt_common;
         struct batadv_tt_local_entry *tt_local;
-        struct batadv_softif_vlan *vlan;
         struct hlist_node *node_tmp;
         struct hlist_head *head;
         spinlock_t *list_lock; /* protects write access to the hash lists */
@@ -3339,13 +3312,6 @@ static void batadv_tt_local_purge_pending_clients(struct batadv_priv *bat_priv)
                                                 struct batadv_tt_local_entry,
                                                 common);
 
-                        /* decrease the reference held for this vlan */
-                        vlan = batadv_softif_vlan_get(bat_priv, tt_common->vid);
-                        if (vlan) {
-                                batadv_softif_vlan_put(vlan);
-                                batadv_softif_vlan_put(vlan);
-                        }
-
                         batadv_tt_local_entry_put(tt_local);
                 }
                 spin_unlock_bh(list_lock);
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 9abfb3e73c34..1e47fbe8bb7b 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -433,6 +433,7 @@ struct batadv_hardif_neigh_node {
  * @ifinfo_lock: lock protecting private ifinfo members and list
  * @if_incoming: pointer to incoming hard-interface
  * @last_seen: when last packet via this neighbor was received
+ * @hardif_neigh: hardif_neigh of this neighbor
  * @refcount: number of contexts the object is used
  * @rcu: struct used for freeing in an RCU-safe manner
  */
@@ -444,6 +445,7 @@ struct batadv_neigh_node {
         spinlock_t ifinfo_lock; /* protects ifinfo_list and its members */
         struct batadv_hard_iface *if_incoming;
         unsigned long last_seen;
+        struct batadv_hardif_neigh_node *hardif_neigh;
         struct kref refcount;
         struct rcu_head rcu;
 };
@@ -1073,10 +1075,12 @@ struct batadv_tt_common_entry {
  * struct batadv_tt_local_entry - translation table local entry data
  * @common: general translation table data
  * @last_seen: timestamp used for purging stale tt local entries
+ * @vlan: soft-interface vlan of the entry
  */
 struct batadv_tt_local_entry {
         struct batadv_tt_common_entry common;
         unsigned long last_seen;
+        struct batadv_softif_vlan *vlan;
 };
 
 /**
@@ -1250,6 +1254,8 @@ struct batadv_forw_packet {
  * struct batadv_algo_ops - mesh algorithm callbacks
  * @list: list node for the batadv_algo_list
  * @name: name of the algorithm
+ * @bat_iface_activate: start routing mechanisms when hard-interface is brought
+ *  up
  * @bat_iface_enable: init routing info when hard-interface is enabled
  * @bat_iface_disable: de-init routing info when hard-interface is disabled
  * @bat_iface_update_mac: (re-)init mac addresses of the protocol information
@@ -1277,6 +1283,7 @@ struct batadv_forw_packet {
 struct batadv_algo_ops {
         struct hlist_node list;
         char *name;
+        void (*bat_iface_activate)(struct batadv_hard_iface *hard_iface);
         int (*bat_iface_enable)(struct batadv_hard_iface *hard_iface);
         void (*bat_iface_disable)(struct batadv_hard_iface *hard_iface);
         void (*bat_iface_update_mac)(struct batadv_hard_iface *hard_iface);
diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index 253bc77eda3b..7dbc80d01eb0 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -61,6 +61,19 @@ static void __mdb_entry_fill_flags(struct br_mdb_entry *e, unsigned char flags)
                 e->flags |= MDB_FLAGS_OFFLOAD;
 }
 
+static void __mdb_entry_to_br_ip(struct br_mdb_entry *entry, struct br_ip *ip)
+{
+        memset(ip, 0, sizeof(struct br_ip));
+        ip->vid = entry->vid;
+        ip->proto = entry->addr.proto;
+        if (ip->proto == htons(ETH_P_IP))
+                ip->u.ip4 = entry->addr.u.ip4;
+#if IS_ENABLED(CONFIG_IPV6)
+        else
+                ip->u.ip6 = entry->addr.u.ip6;
+#endif
+}
+
 static int br_mdb_fill_info(struct sk_buff *skb, struct netlink_callback *cb,
                             struct net_device *dev)
 {
@@ -243,9 +256,45 @@ static inline size_t rtnl_mdb_nlmsg_size(void)
                 + nla_total_size(sizeof(struct br_mdb_entry));
 }
 
-static void __br_mdb_notify(struct net_device *dev, struct br_mdb_entry *entry,
-                            int type, struct net_bridge_port_group *pg)
+struct br_mdb_complete_info {
+        struct net_bridge_port *port;
+        struct br_ip ip;
+};
+
+static void br_mdb_complete(struct net_device *dev, int err, void *priv)
 {
+        struct br_mdb_complete_info *data = priv;
+        struct net_bridge_port_group __rcu **pp;
+        struct net_bridge_port_group *p;
+        struct net_bridge_mdb_htable *mdb;
+        struct net_bridge_mdb_entry *mp;
+        struct net_bridge_port *port = data->port;
+        struct net_bridge *br = port->br;
+
+        if (err)
+                goto err;
+
+        spin_lock_bh(&br->multicast_lock);
+        mdb = mlock_dereference(br->mdb, br);
+        mp = br_mdb_ip_get(mdb, &data->ip);
+        if (!mp)
+                goto out;
+        for (pp = &mp->ports; (p = mlock_dereference(*pp, br)) != NULL;
+             pp = &p->next) {
+                if (p->port != port)
+                        continue;
+                p->flags |= MDB_PG_FLAGS_OFFLOAD;
+        }
+out:
+        spin_unlock_bh(&br->multicast_lock);
+err:
+        kfree(priv);
+}
+
+static void __br_mdb_notify(struct net_device *dev, struct net_bridge_port *p,
+                            struct br_mdb_entry *entry, int type)
+{
+        struct br_mdb_complete_info *complete_info;
         struct switchdev_obj_port_mdb mdb = {
                 .obj = {
                         .id = SWITCHDEV_OBJ_ID_PORT_MDB,
@@ -268,9 +317,14 @@ static void __br_mdb_notify(struct net_device *dev, struct br_mdb_entry *entry,
 
         mdb.obj.orig_dev = port_dev;
         if (port_dev && type == RTM_NEWMDB) {
-                err = switchdev_port_obj_add(port_dev, &mdb.obj);
-                if (!err && pg)
-                        pg->flags |= MDB_PG_FLAGS_OFFLOAD;
+                complete_info = kmalloc(sizeof(*complete_info), GFP_ATOMIC);
+                if (complete_info) {
+                        complete_info->port = p;
+                        __mdb_entry_to_br_ip(entry, &complete_info->ip);
+                        mdb.obj.complete_priv = complete_info;
+                        mdb.obj.complete = br_mdb_complete;
+                        switchdev_port_obj_add(port_dev, &mdb.obj);
+                }
         } else if (port_dev && type == RTM_DELMDB) {
                 switchdev_port_obj_del(port_dev, &mdb.obj);
         }
@@ -291,21 +345,21 @@ errout:
         rtnl_set_sk_err(net, RTNLGRP_MDB, err);
 }
 
-void br_mdb_notify(struct net_device *dev, struct net_bridge_port_group *pg,
-                   int type)
+void br_mdb_notify(struct net_device *dev, struct net_bridge_port *port,
+                   struct br_ip *group, int type, u8 flags)
 {
         struct br_mdb_entry entry;
 
         memset(&entry, 0, sizeof(entry));
-        entry.ifindex = pg->port->dev->ifindex;
-        entry.addr.proto = pg->addr.proto;
-        entry.addr.u.ip4 = pg->addr.u.ip4;
+        entry.ifindex = port->dev->ifindex;
+        entry.addr.proto = group->proto;
+        entry.addr.u.ip4 = group->u.ip4;
 #if IS_ENABLED(CONFIG_IPV6)
-        entry.addr.u.ip6 = pg->addr.u.ip6;
+        entry.addr.u.ip6 = group->u.ip6;
 #endif
-        entry.vid = pg->addr.vid;
-        __mdb_entry_fill_flags(&entry, pg->flags);
-        __br_mdb_notify(dev, &entry, type, pg);
+        entry.vid = group->vid;
+        __mdb_entry_fill_flags(&entry, flags);
+        __br_mdb_notify(dev, port, &entry, type);
 }
 
 static int nlmsg_populate_rtr_fill(struct sk_buff *skb,
@@ -450,8 +504,7 @@ static int br_mdb_parse(struct sk_buff *skb, struct nlmsghdr *nlh,
 }
 
 static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
-                            struct br_ip *group, unsigned char state,
-                            struct net_bridge_port_group **pg)
+                            struct br_ip *group, unsigned char state)
 {
         struct net_bridge_mdb_entry *mp;
         struct net_bridge_port_group *p;
@@ -482,7 +535,6 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
         if (unlikely(!p))
                 return -ENOMEM;
         rcu_assign_pointer(*pp, p);
-        *pg = p;
         if (state == MDB_TEMPORARY)
                 mod_timer(&p->timer, now + br->multicast_membership_interval);
 
@@ -490,8 +542,7 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
 }
 
 static int __br_mdb_add(struct net *net, struct net_bridge *br,
-                        struct br_mdb_entry *entry,
-                        struct net_bridge_port_group **pg)
+                        struct br_mdb_entry *entry)
 {
         struct br_ip ip;
         struct net_device *dev;
@@ -509,18 +560,10 @@ static int __br_mdb_add(struct net *net, struct net_bridge *br,
         if (!p || p->br != br || p->state == BR_STATE_DISABLED)
                 return -EINVAL;
 
-        memset(&ip, 0, sizeof(ip));
-        ip.vid = entry->vid;
-        ip.proto = entry->addr.proto;
-        if (ip.proto == htons(ETH_P_IP))
-                ip.u.ip4 = entry->addr.u.ip4;
-#if IS_ENABLED(CONFIG_IPV6)
-        else
-                ip.u.ip6 = entry->addr.u.ip6;
-#endif
+        __mdb_entry_to_br_ip(entry, &ip);
 
         spin_lock_bh(&br->multicast_lock);
-        ret = br_mdb_add_group(br, p, &ip, entry->state, pg);
+        ret = br_mdb_add_group(br, p, &ip, entry->state);
         spin_unlock_bh(&br->multicast_lock);
         return ret;
 }
@@ -528,7 +571,6 @@ static int __br_mdb_add(struct net *net, struct net_bridge *br,
 static int br_mdb_add(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         struct net *net = sock_net(skb->sk);
-        struct net_bridge_port_group *pg;
         struct net_bridge_vlan_group *vg;
         struct net_device *dev, *pdev;
         struct br_mdb_entry *entry;
@@ -558,15 +600,15 @@ static int br_mdb_add(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (br_vlan_enabled(br) && vg && entry->vid == 0) {
                 list_for_each_entry(v, &vg->vlan_list, vlist) {
                         entry->vid = v->vid;
-                        err = __br_mdb_add(net, br, entry, &pg);
+                        err = __br_mdb_add(net, br, entry);
                         if (err)
                                 break;
-                        __br_mdb_notify(dev, entry, RTM_NEWMDB, pg);
+                        __br_mdb_notify(dev, p, entry, RTM_NEWMDB);
                 }
         } else {
-                err = __br_mdb_add(net, br, entry, &pg);
+                err = __br_mdb_add(net, br, entry);
                 if (!err)
-                        __br_mdb_notify(dev, entry, RTM_NEWMDB, pg);
+                        __br_mdb_notify(dev, p, entry, RTM_NEWMDB);
         }
 
         return err;
@@ -584,15 +626,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
         if (!netif_running(br->dev) || br->multicast_disabled)
                 return -EINVAL;
 
-        memset(&ip, 0, sizeof(ip));
-        ip.vid = entry->vid;
-        ip.proto = entry->addr.proto;
-        if (ip.proto == htons(ETH_P_IP))
-                ip.u.ip4 = entry->addr.u.ip4;
-#if IS_ENABLED(CONFIG_IPV6)
-        else
-                ip.u.ip6 = entry->addr.u.ip6;
-#endif
+        __mdb_entry_to_br_ip(entry, &ip);
 
         spin_lock_bh(&br->multicast_lock);
         mdb = mlock_dereference(br->mdb, br);
@@ -662,12 +696,12 @@ static int br_mdb_del(struct sk_buff *skb, struct nlmsghdr *nlh)
                         entry->vid = v->vid;
                         err = __br_mdb_del(br, entry);
                         if (!err)
-                                __br_mdb_notify(dev, entry, RTM_DELMDB, NULL);
+                                __br_mdb_notify(dev, p, entry, RTM_DELMDB);
                 }
         } else {
                 err = __br_mdb_del(br, entry);
                 if (!err)
-                        __br_mdb_notify(dev, entry, RTM_DELMDB, NULL);
+                        __br_mdb_notify(dev, p, entry, RTM_DELMDB);
         }
 
         return err;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index a4c15df2b792..191ea66e4d92 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -283,7 +283,8 @@ static void br_multicast_del_pg(struct net_bridge *br,
                 rcu_assign_pointer(*pp, p->next);
                 hlist_del_init(&p->mglist);
                 del_timer(&p->timer);
-                br_mdb_notify(br->dev, p, RTM_DELMDB);
+                br_mdb_notify(br->dev, p->port, &pg->addr, RTM_DELMDB,
+                              p->flags);
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
 
                 if (!mp->ports && !mp->mglist &&
@@ -705,7 +706,7 @@ static int br_multicast_add_group(struct net_bridge *br,
         if (unlikely(!p))
                 goto err;
         rcu_assign_pointer(*pp, p);
-        br_mdb_notify(br->dev, p, RTM_NEWMDB);
+        br_mdb_notify(br->dev, port, group, RTM_NEWMDB, 0);
 
 found:
         mod_timer(&p->timer, now + br->multicast_membership_interval);
@@ -1461,7 +1462,8 @@ br_multicast_leave_group(struct net_bridge *br,
                         hlist_del_init(&p->mglist);
                         del_timer(&p->timer);
                         call_rcu_bh(&p->rcu, br_multicast_free_pg);
-                        br_mdb_notify(br->dev, p, RTM_DELMDB);
+                        br_mdb_notify(br->dev, port, group, RTM_DELMDB,
+                                      p->flags);
 
                         if (!mp->ports && !mp->mglist &&
                             netif_running(br->dev))
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 1b5d145dfcbf..d9da857182ef 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -560,8 +560,8 @@ br_multicast_new_port_group(struct net_bridge_port *port, struct br_ip *group,
                             unsigned char flags);
 void br_mdb_init(void);
 void br_mdb_uninit(void);
-void br_mdb_notify(struct net_device *dev, struct net_bridge_port_group *pg,
-                   int type);
+void br_mdb_notify(struct net_device *dev, struct net_bridge_port *port,
+                   struct br_ip *group, int type, u8 flags);
 void br_rtr_notify(struct net_device *dev, struct net_bridge_port *port,
                    int type);
 
diff --git a/net/ceph/auth.c b/net/ceph/auth.c
index 6b923bcaa2a4..2bc5965fdd1e 100644
--- a/net/ceph/auth.c
+++ b/net/ceph/auth.c
@@ -293,13 +293,9 @@ int ceph_auth_create_authorizer(struct ceph_auth_client *ac,
 }
 EXPORT_SYMBOL(ceph_auth_create_authorizer);
 
-void ceph_auth_destroy_authorizer(struct ceph_auth_client *ac,
-                                  struct ceph_authorizer *a)
+void ceph_auth_destroy_authorizer(struct ceph_authorizer *a)
 {
-        mutex_lock(&ac->mutex);
-        if (ac->ops && ac->ops->destroy_authorizer)
-                ac->ops->destroy_authorizer(ac, a);
-        mutex_unlock(&ac->mutex);
+        a->destroy(a);
 }
 EXPORT_SYMBOL(ceph_auth_destroy_authorizer);
 
diff --git a/net/ceph/auth_none.c b/net/ceph/auth_none.c
index 8c93fa8d81bc..5f836f02ae36 100644
--- a/net/ceph/auth_none.c
+++ b/net/ceph/auth_none.c
@@ -16,7 +16,6 @@ static void reset(struct ceph_auth_client *ac)
         struct ceph_auth_none_info *xi = ac->private;
 
         xi->starting = true;
-        xi->built_authorizer = false;
 }
 
 static void destroy(struct ceph_auth_client *ac)
@@ -39,6 +38,27 @@ static int should_authenticate(struct ceph_auth_client *ac)
         return xi->starting;
 }
 
+static int ceph_auth_none_build_authorizer(struct ceph_auth_client *ac,
+                                           struct ceph_none_authorizer *au)
+{
+        void *p = au->buf;
+        void *const end = p + sizeof(au->buf);
+        int ret;
+
+        ceph_encode_8_safe(&p, end, 1, e_range);
+        ret = ceph_entity_name_encode(ac->name, &p, end);
+        if (ret < 0)
+                return ret;
+
+        ceph_encode_64_safe(&p, end, ac->global_id, e_range);
+        au->buf_len = p - (void *)au->buf;
+        dout("%s built authorizer len %d\n", __func__, au->buf_len);
+        return 0;
+
+e_range:
+        return -ERANGE;
+}
+
 static int build_request(struct ceph_auth_client *ac, void *buf, void *end)
 {
         return 0;
@@ -57,32 +77,32 @@ static int handle_reply(struct ceph_auth_client *ac, int result,
         return result;
 }
 
+static void ceph_auth_none_destroy_authorizer(struct ceph_authorizer *a)
+{
+        kfree(a);
+}
+
 /*
- * build an 'authorizer' with our entity_name and global_id.  we can
- * reuse a single static copy since it is identical for all services
- * we connect to.
+ * build an 'authorizer' with our entity_name and global_id.  it is
+ * identical for all services we connect to.
  */
 static int ceph_auth_none_create_authorizer(
         struct ceph_auth_client *ac, int peer_type,
         struct ceph_auth_handshake *auth)
 {
-        struct ceph_auth_none_info *ai = ac->private;
-        struct ceph_none_authorizer *au = &ai->au;
-        void *p, *end;
+        struct ceph_none_authorizer *au;
         int ret;
 
-        if (!ai->built_authorizer) {
-                p = au->buf;
-                end = p + sizeof(au->buf);
-                ceph_encode_8(&p, 1);
-                ret = ceph_entity_name_encode(ac->name, &p, end - 8);
-                if (ret < 0)
-                        goto bad;
-                ceph_decode_need(&p, end, sizeof(u64), bad2);
-                ceph_encode_64(&p, ac->global_id);
-                au->buf_len = p - (void *)au->buf;
-                ai->built_authorizer = true;
-                dout("built authorizer len %d\n", au->buf_len);
+        au = kmalloc(sizeof(*au), GFP_NOFS);
+        if (!au)
+                return -ENOMEM;
+
+        au->base.destroy = ceph_auth_none_destroy_authorizer;
+
+        ret = ceph_auth_none_build_authorizer(ac, au);
+        if (ret) {
+                kfree(au);
+                return ret;
         }
 
         auth->authorizer = (struct ceph_authorizer *) au;
@@ -92,17 +112,6 @@ static int ceph_auth_none_create_authorizer(
         auth->authorizer_reply_buf_len = sizeof (au->reply_buf);
 
         return 0;
-
-bad2:
-        ret = -ERANGE;
-bad:
-        return ret;
-}
-
-static void ceph_auth_none_destroy_authorizer(struct ceph_auth_client *ac,
-                                      struct ceph_authorizer *a)
-{
-        /* nothing to do */
 }
 
 static const struct ceph_auth_client_ops ceph_auth_none_ops = {
@@ -114,7 +123,6 @@ static const struct ceph_auth_client_ops ceph_auth_none_ops = {
         .build_request = build_request,
         .handle_reply = handle_reply,
         .create_authorizer = ceph_auth_none_create_authorizer,
-        .destroy_authorizer = ceph_auth_none_destroy_authorizer,
 };
 
 int ceph_auth_none_init(struct ceph_auth_client *ac)
@@ -127,7 +135,6 @@ int ceph_auth_none_init(struct ceph_auth_client *ac)
                 return -ENOMEM;
 
         xi->starting = true;
-        xi->built_authorizer = false;
 
         ac->protocol = CEPH_AUTH_NONE;
         ac->private = xi;
diff --git a/net/ceph/auth_none.h b/net/ceph/auth_none.h
index 059a3ce4b53f..62021535ae4a 100644
--- a/net/ceph/auth_none.h
+++ b/net/ceph/auth_none.h
@@ -12,6 +12,7 @@
  */
 
 struct ceph_none_authorizer {
+        struct ceph_authorizer base;
         char buf[128];
         int buf_len;
         char reply_buf[0];
@@ -19,8 +20,6 @@ struct ceph_none_authorizer {
 
 struct ceph_auth_none_info {
         bool starting;
-        bool built_authorizer;
-        struct ceph_none_authorizer au;   /* we only need one; it's static */
 };
 
 int ceph_auth_none_init(struct ceph_auth_client *ac);
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 9e43a315e662..a0905f04bd13 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -565,6 +565,14 @@ static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result,
         return -EAGAIN;
 }
 
+static void ceph_x_destroy_authorizer(struct ceph_authorizer *a)
+{
+        struct ceph_x_authorizer *au = (void *)a;
+
+        ceph_x_authorizer_cleanup(au);
+        kfree(au);
+}
+
 static int ceph_x_create_authorizer(
         struct ceph_auth_client *ac, int peer_type,
         struct ceph_auth_handshake *auth)
@@ -581,6 +589,8 @@ static int ceph_x_create_authorizer(
         if (!au)
                 return -ENOMEM;
 
+        au->base.destroy = ceph_x_destroy_authorizer;
+
         ret = ceph_x_build_authorizer(ac, th, au);
         if (ret) {
                 kfree(au);
@@ -643,16 +653,6 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
         return ret;
 }
 
-static void ceph_x_destroy_authorizer(struct ceph_auth_client *ac,
-                                      struct ceph_authorizer *a)
-{
-        struct ceph_x_authorizer *au = (void *)a;
-
-        ceph_x_authorizer_cleanup(au);
-        kfree(au);
-}
-
-
 static void ceph_x_reset(struct ceph_auth_client *ac)
 {
         struct ceph_x_info *xi = ac->private;
@@ -770,7 +770,6 @@ static const struct ceph_auth_client_ops ceph_x_ops = {
         .create_authorizer = ceph_x_create_authorizer,
         .update_authorizer = ceph_x_update_authorizer,
         .verify_authorizer_reply = ceph_x_verify_authorizer_reply,
-        .destroy_authorizer = ceph_x_destroy_authorizer,
         .invalidate_authorizer = ceph_x_invalidate_authorizer,
         .reset =  ceph_x_reset,
         .destroy = ceph_x_destroy,
diff --git a/net/ceph/auth_x.h b/net/ceph/auth_x.h
index 40b1a3cf7397..21a5af904bae 100644
--- a/net/ceph/auth_x.h
+++ b/net/ceph/auth_x.h
@@ -26,6 +26,7 @@ struct ceph_x_ticket_handler {
 
 
 struct ceph_x_authorizer {
+        struct ceph_authorizer base;
         struct ceph_crypto_key session_key;
         struct ceph_buffer *buf;
         unsigned int service;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 32355d9d0103..40a53a70efdf 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1087,10 +1087,8 @@ static void put_osd(struct ceph_osd *osd)
         dout("put_osd %p %d -> %d\n", osd, atomic_read(&osd->o_ref),
              atomic_read(&osd->o_ref) - 1);
         if (atomic_dec_and_test(&osd->o_ref)) {
-                struct ceph_auth_client *ac = osd->o_osdc->client->monc.auth;
-
                 if (osd->o_auth.authorizer)
-                        ceph_auth_destroy_authorizer(ac, osd->o_auth.authorizer);
+                        ceph_auth_destroy_authorizer(osd->o_auth.authorizer);
                 kfree(osd);
         }
 }
@@ -2984,7 +2982,7 @@ static struct ceph_auth_handshake *get_authorizer(struct ceph_connection *con,
         struct ceph_auth_handshake *auth = &o->o_auth;
 
         if (force_new && auth->authorizer) {
-                ceph_auth_destroy_authorizer(ac, auth->authorizer);
+                ceph_auth_destroy_authorizer(auth->authorizer);
                 auth->authorizer = NULL;
         }
         if (!auth->authorizer) {
diff --git a/net/core/dev.c b/net/core/dev.c
index 77a71cd68535..5c925ac50b95 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2802,7 +2802,7 @@ static netdev_features_t harmonize_features(struct sk_buff *skb,
 
         if (skb->ip_summed != CHECKSUM_NONE &&
             !can_checksum_protocol(features, type)) {
-                features &= ~NETIF_F_CSUM_MASK;
+                features &= ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
         } else if (illegal_highdma(skb->dev, skb)) {
                 features &= ~NETIF_F_SG;
         }
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 8a9246deccfe..63566ec54794 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -904,7 +904,11 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
         if (ifa->ifa_flags & IFA_F_SECONDARY) {
                 prim = inet_ifa_byprefix(in_dev, any, ifa->ifa_mask);
                 if (!prim) {
-                        pr_warn("%s: bug: prim == NULL\n", __func__);
+                        /* if the device has been deleted, we don't perform
+                         * address promotion
+                         */
+                        if (!in_dev->dead)
+                                pr_warn("%s: bug: prim == NULL\n", __func__);
                         return;
                 }
                 if (iprim && iprim != prim) {
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index bc68eced0105..0d9e9d7bb029 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -470,6 +470,7 @@ static int inet_reuseport_add_sock(struct sock *sk,
                                                      const struct sock *sk2,
                                                      bool match_wildcard))
 {
+        struct inet_bind_bucket *tb = inet_csk(sk)->icsk_bind_hash;
         struct sock *sk2;
         struct hlist_nulls_node *node;
         kuid_t uid = sock_i_uid(sk);
@@ -479,6 +480,7 @@ static int inet_reuseport_add_sock(struct sock *sk,
                     sk2->sk_family == sk->sk_family &&
                     ipv6_only_sock(sk2) == ipv6_only_sock(sk) &&
                     sk2->sk_bound_dev_if == sk->sk_bound_dev_if &&
+                    inet_csk(sk2)->icsk_bind_hash == tb &&
                     sk2->sk_reuseport && uid_eq(uid, sock_i_uid(sk2)) &&
                     saddr_same(sk, sk2, false))
                         return reuseport_add_sock(sk, sk2);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index af5d1f38217f..205a2b8a5a84 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -179,6 +179,7 @@ static __be16 tnl_flags_to_gre_flags(__be16 tflags)
         return flags;
 }
 
+/* Fills in tpi and returns header length to be pulled. */
 static int parse_gre_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                             bool *csum_err)
 {
@@ -238,7 +239,7 @@ static int parse_gre_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                                 return -EINVAL;
                 }
         }
-        return iptunnel_pull_header(skb, hdr_len, tpi->proto, false);
+        return hdr_len;
 }
 
 static void ipgre_err(struct sk_buff *skb, u32 info,
@@ -341,7 +342,7 @@ static void gre_err(struct sk_buff *skb, u32 info)
         struct tnl_ptk_info tpi;
         bool csum_err = false;
 
-        if (parse_gre_header(skb, &tpi, &csum_err)) {
+        if (parse_gre_header(skb, &tpi, &csum_err) < 0) {
                 if (!csum_err)          /* ignore csum errors. */
                         return;
         }
@@ -419,6 +420,7 @@ static int gre_rcv(struct sk_buff *skb)
 {
         struct tnl_ptk_info tpi;
         bool csum_err = false;
+        int hdr_len;
 
 #ifdef CONFIG_NET_IPGRE_BROADCAST
         if (ipv4_is_multicast(ip_hdr(skb)->daddr)) {
@@ -428,7 +430,10 @@ static int gre_rcv(struct sk_buff *skb)
         }
 #endif
 
-        if (parse_gre_header(skb, &tpi, &csum_err) < 0)
+        hdr_len = parse_gre_header(skb, &tpi, &csum_err);
+        if (hdr_len < 0)
+                goto drop;
+        if (iptunnel_pull_header(skb, hdr_len, tpi.proto, false) < 0)
                 goto drop;
 
         if (ipgre_rcv(skb, &tpi) == PACKET_RCVD)
@@ -523,7 +528,8 @@ static struct rtable *gre_get_rt(struct sk_buff *skb,
         return ip_route_output_key(net, fl);
 }
 
-static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev)
+static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev,
+                        __be16 proto)
 {
         struct ip_tunnel_info *tun_info;
         const struct ip_tunnel_key *key;
@@ -575,7 +581,7 @@ static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         flags = tun_info->key.tun_flags & (TUNNEL_CSUM | TUNNEL_KEY);
-        build_header(skb, tunnel_hlen, flags, htons(ETH_P_TEB),
+        build_header(skb, tunnel_hlen, flags, proto,
                      tunnel_id_to_key(tun_info->key.tun_id), 0);
 
         df = key->tun_flags & TUNNEL_DONT_FRAGMENT ?  htons(IP_DF) : 0;
@@ -616,7 +622,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
         const struct iphdr *tnl_params;
 
         if (tunnel->collect_md) {
-                gre_fb_xmit(skb, dev);
+                gre_fb_xmit(skb, dev, skb->protocol);
                 return NETDEV_TX_OK;
         }
 
@@ -660,7 +666,7 @@ static netdev_tx_t gre_tap_xmit(struct sk_buff *skb,
         struct ip_tunnel *tunnel = netdev_priv(dev);
 
         if (tunnel->collect_md) {
-                gre_fb_xmit(skb, dev);
+                gre_fb_xmit(skb, dev, htons(ETH_P_TEB));
                 return NETDEV_TX_OK;
         }
 
@@ -893,7 +899,7 @@ static int ipgre_tunnel_init(struct net_device *dev)
         netif_keep_dst(dev);
         dev->addr_len           = 4;
 
-        if (iph->daddr) {
+        if (iph->daddr && !tunnel->collect_md) {
 #ifdef CONFIG_NET_IPGRE_BROADCAST
                 if (ipv4_is_multicast(iph->daddr)) {
                         if (!iph->saddr)
@@ -902,8 +908,9 @@ static int ipgre_tunnel_init(struct net_device *dev)
                         dev->header_ops = &ipgre_header_ops;
                 }
 #endif
-        } else
+        } else if (!tunnel->collect_md) {
                 dev->header_ops = &ipgre_header_ops;
+        }
 
         return ip_tunnel_init(dev);
 }
@@ -946,6 +953,11 @@ static int ipgre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
         if (flags & (GRE_VERSION|GRE_ROUTING))
                 return -EINVAL;
 
+        if (data[IFLA_GRE_COLLECT_METADATA] &&
+            data[IFLA_GRE_ENCAP_TYPE] &&
+            nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]) != TUNNEL_ENCAP_NONE)
+                return -EINVAL;
+
         return 0;
 }
 
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 6aad0192443d..a69ed94bda1b 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -326,12 +326,12 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
 
                 if (!IS_ERR(rt)) {
                         tdev = rt->dst.dev;
-                        dst_cache_set_ip4(&tunnel->dst_cache, &rt->dst,
-                                          fl4.saddr);
                         ip_rt_put(rt);
                 }
                 if (dev->type != ARPHRD_ETHER)
                         dev->flags |= IFF_POINTOPOINT;
+
+                dst_cache_reset(&tunnel->dst_cache);
         }
 
         if (!tdev && tunnel->parms.link)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 23cec53b568a..8ec4b3089e20 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3176,35 +3176,9 @@ static void addrconf_gre_config(struct net_device *dev)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
-/* If the host route is cached on the addr struct make sure it is associated
- * with the proper table. e.g., enslavement can change and if so the cached
- * host route needs to move to the new table.
- */
-static void l3mdev_check_host_rt(struct inet6_dev *idev,
-                                  struct inet6_ifaddr *ifp)
-{
-        if (ifp->rt) {
-                u32 tb_id = l3mdev_fib_table(idev->dev) ? : RT6_TABLE_LOCAL;
-
-                if (tb_id != ifp->rt->rt6i_table->tb6_id) {
-                        ip6_del_rt(ifp->rt);
-                        ifp->rt = NULL;
-                }
-        }
-}
-#else
-static void l3mdev_check_host_rt(struct inet6_dev *idev,
-                                  struct inet6_ifaddr *ifp)
-{
-}
-#endif
-
 static int fixup_permanent_addr(struct inet6_dev *idev,
                                 struct inet6_ifaddr *ifp)
 {
-        l3mdev_check_host_rt(idev, ifp);
-
         if (!ifp->rt) {
                 struct rt6_info *rt;
 
@@ -3304,6 +3278,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                         break;
 
                 if (event == NETDEV_UP) {
+                        /* restore routes for permanent addresses */
+                        addrconf_permanent_addr(dev);
+
                         if (!addrconf_qdisc_ok(dev)) {
                                 /* device is not ready yet. */
                                 pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
@@ -3337,9 +3314,6 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                         run_pending = 1;
                 }
 
-                /* restore routes for permanent addresses */
-                addrconf_permanent_addr(dev);
-
                 switch (dev->type) {
 #if IS_ENABLED(CONFIG_IPV6_SIT)
                 case ARPHRD_SIT:
@@ -3556,6 +3530,8 @@ restart:
 
         INIT_LIST_HEAD(&del_list);
         list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
+                struct rt6_info *rt = NULL;
+
                 addrconf_del_dad_work(ifa);
 
                 write_unlock_bh(&idev->lock);
@@ -3568,6 +3544,9 @@ restart:
                         ifa->state = 0;
                         if (!(ifa->flags & IFA_F_NODAD))
                                 ifa->flags |= IFA_F_TENTATIVE;
+
+                        rt = ifa->rt;
+                        ifa->rt = NULL;
                 } else {
                         state = ifa->state;
                         ifa->state = INET6_IFADDR_STATE_DEAD;
@@ -3578,6 +3557,9 @@ restart:
 
                 spin_unlock_bh(&ifa->lock);
 
+                if (rt)
+                        ip6_del_rt(rt);
+
                 if (state != INET6_IFADDR_STATE_DEAD) {
                         __ipv6_ifa_notify(RTM_DELADDR, ifa);
                         inet6addr_notifier_call_chain(NETDEV_DOWN, ifa);
@@ -5343,10 +5325,10 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                         if (rt)
                                 ip6_del_rt(rt);
                 }
-                dst_hold(&ifp->rt->dst);
-
-                ip6_del_rt(ifp->rt);
-
+                if (ifp->rt) {
+                        dst_hold(&ifp->rt->dst);
+                        ip6_del_rt(ifp->rt);
+                }
                 rt_genid_bump_ipv6(net);
                 break;
         }
diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c
index 2ae3c4fd8aab..41f18de5dcc2 100644
--- a/net/ipv6/ila/ila_lwt.c
+++ b/net/ipv6/ila/ila_lwt.c
@@ -120,8 +120,7 @@ nla_put_failure:
 
 static int ila_encap_nlsize(struct lwtunnel_state *lwtstate)
 {
-        /* No encapsulation overhead */
-        return 0;
+        return nla_total_size(sizeof(u64)); /* ILA_ATTR_LOCATOR */
 }
 
 static int ila_encap_cmp(struct lwtunnel_state *a, struct lwtunnel_state *b)
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index afca2eb4dfa7..6edfa9980314 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1376,9 +1376,9 @@ static int l2tp_tunnel_sock_create(struct net *net,
                         memcpy(&udp_conf.peer_ip6, cfg->peer_ip6,
                                sizeof(udp_conf.peer_ip6));
                         udp_conf.use_udp6_tx_checksums =
-                            cfg->udp6_zero_tx_checksums;
+                          ! cfg->udp6_zero_tx_checksums;
                         udp_conf.use_udp6_rx_checksums =
-                            cfg->udp6_zero_rx_checksums;
+                          ! cfg->udp6_zero_rx_checksums;
                 } else
 #endif
                 {
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 453b4e741780..e1cb22c16530 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1761,7 +1761,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
                 ret = dev_alloc_name(ndev, ndev->name);
                 if (ret < 0) {
-                        free_netdev(ndev);
+                        ieee80211_if_free(ndev);
                         return ret;
                 }
 
@@ -1847,7 +1847,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
                 ret = register_netdevice(ndev);
                 if (ret) {
-                        free_netdev(ndev);
+                        ieee80211_if_free(ndev);
                         return ret;
                 }
         }
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 61ed2a8764ba..86187dad1440 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -127,7 +127,7 @@ void rds_tcp_restore_callbacks(struct socket *sock,
 
 /*
  * This is the only path that sets tc->t_sock.  Send and receive trust that
- * it is set.  The RDS_CONN_CONNECTED bit protects those paths from being
+ * it is set.  The RDS_CONN_UP bit protects those paths from being
  * called while it isn't set.
  */
 void rds_tcp_set_callbacks(struct socket *sock, struct rds_connection *conn)
@@ -216,6 +216,7 @@ static int rds_tcp_conn_alloc(struct rds_connection *conn, gfp_t gfp)
         if (!tc)
                 return -ENOMEM;
 
+        mutex_init(&tc->t_conn_lock);
         tc->t_sock = NULL;
         tc->t_tinc = NULL;
         tc->t_tinc_hdr_rem = sizeof(struct rds_header);
diff --git a/net/rds/tcp.h b/net/rds/tcp.h
index 64f873c0c6b6..41c228300525 100644
--- a/net/rds/tcp.h
+++ b/net/rds/tcp.h
@@ -12,6 +12,10 @@ struct rds_tcp_connection {
 
         struct list_head        t_tcp_node;
         struct rds_connection   *conn;
+        /* t_conn_lock synchronizes the connection establishment between
+         * rds_tcp_accept_one and rds_tcp_conn_connect
+         */
+        struct mutex            t_conn_lock;
         struct socket           *t_sock;
         void                    *t_orig_write_space;
         void                    *t_orig_data_ready;
diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
index 5cb16875c460..49a3fcfed360 100644
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -78,7 +78,14 @@ int rds_tcp_conn_connect(struct rds_connection *conn)
         struct socket *sock = NULL;
         struct sockaddr_in src, dest;
         int ret;
+        struct rds_tcp_connection *tc = conn->c_transport_data;
+
+        mutex_lock(&tc->t_conn_lock);
 
+        if (rds_conn_up(conn)) {
+                mutex_unlock(&tc->t_conn_lock);
+                return 0;
+        }
         ret = sock_create_kern(rds_conn_net(conn), PF_INET,
                                SOCK_STREAM, IPPROTO_TCP, &sock);
         if (ret < 0)
@@ -120,6 +127,7 @@ int rds_tcp_conn_connect(struct rds_connection *conn)
         }
 
 out:
+        mutex_unlock(&tc->t_conn_lock);
         if (sock)
                 sock_release(sock);
         return ret;
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 0936a4a32b47..be263cdf268b 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -76,7 +76,9 @@ int rds_tcp_accept_one(struct socket *sock)
         struct rds_connection *conn;
         int ret;
         struct inet_sock *inet;
-        struct rds_tcp_connection *rs_tcp;
+        struct rds_tcp_connection *rs_tcp = NULL;
+        int conn_state;
+        struct sock *nsk;
 
         ret = sock_create_kern(sock_net(sock->sk), sock->sk->sk_family,
                                sock->sk->sk_type, sock->sk->sk_protocol,
@@ -115,28 +117,44 @@ int rds_tcp_accept_one(struct socket *sock)
          * rds_tcp_state_change() will do that cleanup
          */
         rs_tcp = (struct rds_tcp_connection *)conn->c_transport_data;
-        if (rs_tcp->t_sock &&
-            ntohl(inet->inet_saddr) < ntohl(inet->inet_daddr)) {
-                struct sock *nsk = new_sock->sk;
-
-                nsk->sk_user_data = NULL;
-                nsk->sk_prot->disconnect(nsk, 0);
-                tcp_done(nsk);
-                new_sock = NULL;
-                ret = 0;
-                goto out;
-        } else if (rs_tcp->t_sock) {
-                rds_tcp_restore_callbacks(rs_tcp->t_sock, rs_tcp);
-                conn->c_outgoing = 0;
-        }
-
         rds_conn_transition(conn, RDS_CONN_DOWN, RDS_CONN_CONNECTING);
+        mutex_lock(&rs_tcp->t_conn_lock);
+        conn_state = rds_conn_state(conn);
+        if (conn_state != RDS_CONN_CONNECTING && conn_state != RDS_CONN_UP)
+                goto rst_nsk;
+        if (rs_tcp->t_sock) {
+                /* Need to resolve a duelling SYN between peers.
+                 * We have an outstanding SYN to this peer, which may
+                 * potentially have transitioned to the RDS_CONN_UP state,
+                 * so we must quiesce any send threads before resetting
+                 * c_transport_data.
+                 */
+                wait_event(conn->c_waitq,
+                           !test_bit(RDS_IN_XMIT, &conn->c_flags));
+                if (ntohl(inet->inet_saddr) < ntohl(inet->inet_daddr)) {
+                        goto rst_nsk;
+                } else if (rs_tcp->t_sock) {
+                        rds_tcp_restore_callbacks(rs_tcp->t_sock, rs_tcp);
+                        conn->c_outgoing = 0;
+                }
+        }
         rds_tcp_set_callbacks(new_sock, conn);
-        rds_connect_complete(conn);
+        rds_connect_complete(conn); /* marks RDS_CONN_UP */
+        new_sock = NULL;
+        ret = 0;
+        goto out;
+rst_nsk:
+        /* reset the newly returned accept sock and bail */
+        nsk = new_sock->sk;
+        rds_tcp_stats_inc(s_tcp_listen_closed_stale);
+        nsk->sk_user_data = NULL;
+        nsk->sk_prot->disconnect(nsk, 0);
+        tcp_done(nsk);
         new_sock = NULL;
         ret = 0;
-
 out:
+        if (rs_tcp)
+                mutex_unlock(&rs_tcp->t_conn_lock);
         if (new_sock)
                 sock_release(new_sock);
         return ret;
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 9640bb39a5d2..4befe97a9034 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -395,6 +395,25 @@ static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
         sch->q.qlen++;
 }
 
+/* netem can't properly corrupt a megapacket (like we get from GSO), so instead
+ * when we statistically choose to corrupt one, we instead segment it, returning
+ * the first packet to be corrupted, and re-enqueue the remaining frames
+ */
+static struct sk_buff *netem_segment(struct sk_buff *skb, struct Qdisc *sch)
+{
+        struct sk_buff *segs;
+        netdev_features_t features = netif_skb_features(skb);
+
+        segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
+
+        if (IS_ERR_OR_NULL(segs)) {
+                qdisc_reshape_fail(skb, sch);
+                return NULL;
+        }
+        consume_skb(skb);
+        return segs;
+}
+
 /*
  * Insert one skb into qdisc.
  * Note: parent depends on return value to account for queue length.
@@ -407,7 +426,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         /* We don't fill cb now as skb_unshare() may invalidate it */
         struct netem_skb_cb *cb;
         struct sk_buff *skb2;
+        struct sk_buff *segs = NULL;
+        unsigned int len = 0, last_len, prev_len = qdisc_pkt_len(skb);
+        int nb = 0;
         int count = 1;
+        int rc = NET_XMIT_SUCCESS;
 
         /* Random duplication */
         if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor))
@@ -453,10 +476,23 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
          * do it now in software before we mangle it.
          */
         if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
+                if (skb_is_gso(skb)) {
+                        segs = netem_segment(skb, sch);
+                        if (!segs)
+                                return NET_XMIT_DROP;
+                } else {
+                        segs = skb;
+                }
+
+                skb = segs;
+                segs = segs->next;
+
                 if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
                     (skb->ip_summed == CHECKSUM_PARTIAL &&
-                     skb_checksum_help(skb)))
-                        return qdisc_drop(skb, sch);
+                     skb_checksum_help(skb))) {
+                        rc = qdisc_drop(skb, sch);
+                        goto finish_segs;
+                }
 
                 skb->data[prandom_u32() % skb_headlen(skb)] ^=
                         1<<(prandom_u32() % 8);
@@ -516,6 +552,27 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 sch->qstats.requeues++;
         }
 
+finish_segs:
+        if (segs) {
+                while (segs) {
+                        skb2 = segs->next;
+                        segs->next = NULL;
+                        qdisc_skb_cb(segs)->pkt_len = segs->len;
+                        last_len = segs->len;
+                        rc = qdisc_enqueue(segs, sch);
+                        if (rc != NET_XMIT_SUCCESS) {
+                                if (net_xmit_drop_count(rc))
+                                        qdisc_qstats_drop(sch);
+                        } else {
+                                nb++;
+                                len += last_len;
+                        }
+                        segs = skb2;
+                }
+                sch->q.qlen += nb;
+                if (nb > 1)
+                        qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
+        }
         return NET_XMIT_SUCCESS;
 }
 
diff --git a/net/switchdev/switchdev.c b/net/switchdev/switchdev.c
index 2b9b98f1c2ff..b7e01d88bdc5 100644
--- a/net/switchdev/switchdev.c
+++ b/net/switchdev/switchdev.c
@@ -305,6 +305,8 @@ static void switchdev_port_attr_set_deferred(struct net_device *dev,
         if (err && err != -EOPNOTSUPP)
                 netdev_err(dev, "failed (err=%d) to set attribute (id=%d)\n",
                            err, attr->id);
+        if (attr->complete)
+                attr->complete(dev, err, attr->complete_priv);
 }
 
 static int switchdev_port_attr_set_defer(struct net_device *dev,
@@ -434,6 +436,8 @@ static void switchdev_port_obj_add_deferred(struct net_device *dev,
         if (err && err != -EOPNOTSUPP)
                 netdev_err(dev, "failed (err=%d) to add object (id=%d)\n",
                            err, obj->id);
+        if (obj->complete)
+                obj->complete(dev, err, obj->complete_priv);
 }
 
 static int switchdev_port_obj_add_defer(struct net_device *dev,
@@ -502,6 +506,8 @@ static void switchdev_port_obj_del_deferred(struct net_device *dev,
         if (err && err != -EOPNOTSUPP)
                 netdev_err(dev, "failed (err=%d) to del object (id=%d)\n",
                            err, obj->id);
+        if (obj->complete)
+                obj->complete(dev, err, obj->complete_priv);
 }
 
 static int switchdev_port_obj_del_defer(struct net_device *dev,
diff --git a/net/tipc/node.c b/net/tipc/node.c
index ace178fd3850..9aaa1bc566ae 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1444,6 +1444,7 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b)
         int bearer_id = b->identity;
         struct tipc_link_entry *le;
         u16 bc_ack = msg_bcast_ack(hdr);
+        u32 self = tipc_own_addr(net);
         int rc = 0;
 
         __skb_queue_head_init(&xmitq);
@@ -1460,6 +1461,10 @@ void tipc_rcv(struct net *net, struct sk_buff *skb, struct tipc_bearer *b)
                         return tipc_node_bc_rcv(net, skb, bearer_id);
         }
 
+        /* Discard unicast link messages destined for another node */
+        if (unlikely(!msg_short(hdr) && (msg_destnode(hdr) != self)))
+                goto discard;
+
         /* Locate neighboring node that sent packet */
         n = tipc_node_find(net, msg_prevnode(hdr));
         if (unlikely(!n))