Merge tag 'asoc-v4.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Updates for v4.7 part 2

Really sorry about this late pull request.  It looks like at the time I
sent my pull request for v4.7 there was some conflict or other issue
which caused my script to stop merging the ASoC branches at some point
after the HDMI changes.

It's all specific driver updates, including:

 - New drivers for MAX98371 and TAS5720.
 - SPI support for TLV320AIC32x4.
 - TDM support for STI Uniperf IPs.

This code should all have been in -next prior to the merge window apart
from some fixes, it dropped out on the 18th.

27 files changed, 182 insertions, 86 deletions

diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index 263b4de4de57..60a3dbfca8a1 100644
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -21,18 +21,19 @@
 #include <asm/uaccess.h>
 #include "br_private.h"
 
-/* called with RTNL */
 static int get_bridge_ifindices(struct net *net, int *indices, int num)
 {
         struct net_device *dev;
         int i = 0;
 
-        for_each_netdev(net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
                 if (i >= num)
                         break;
                 if (dev->priv_flags & IFF_EBRIDGE)
                         indices[i++] = dev->ifindex;
         }
+        rcu_read_unlock();
 
         return i;
 }
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 191ea66e4d92..6852f3c7009c 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1279,6 +1279,7 @@ static int br_ip4_multicast_query(struct net_bridge *br,
         struct br_ip saddr;
         unsigned long max_delay;
         unsigned long now = jiffies;
+        unsigned int offset = skb_transport_offset(skb);
         __be32 group;
         int err = 0;
 
@@ -1289,14 +1290,14 @@ static int br_ip4_multicast_query(struct net_bridge *br,
 
         group = ih->group;
 
-        if (skb->len == sizeof(*ih)) {
+        if (skb->len == offset + sizeof(*ih)) {
                 max_delay = ih->code * (HZ / IGMP_TIMER_SCALE);
 
                 if (!max_delay) {
                         max_delay = 10 * HZ;
                         group = 0;
                 }
-        } else if (skb->len >= sizeof(*ih3)) {
+        } else if (skb->len >= offset + sizeof(*ih3)) {
                 ih3 = igmpv3_query_hdr(skb);
                 if (ih3->nsrcs)
                         goto out;
@@ -1357,6 +1358,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         struct br_ip saddr;
         unsigned long max_delay;
         unsigned long now = jiffies;
+        unsigned int offset = skb_transport_offset(skb);
         const struct in6_addr *group = NULL;
         bool is_general_query;
         int err = 0;
@@ -1366,8 +1368,8 @@ static int br_ip6_multicast_query(struct net_bridge *br,
             (port && port->state == BR_STATE_DISABLED))
                 goto out;
 
-        if (skb->len == sizeof(*mld)) {
-                if (!pskb_may_pull(skb, sizeof(*mld))) {
+        if (skb->len == offset + sizeof(*mld)) {
+                if (!pskb_may_pull(skb, offset + sizeof(*mld))) {
                         err = -EINVAL;
                         goto out;
                 }
@@ -1376,7 +1378,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 if (max_delay)
                         group = &mld->mld_mca;
         } else {
-                if (!pskb_may_pull(skb, sizeof(*mld2q))) {
+                if (!pskb_may_pull(skb, offset + sizeof(*mld2q))) {
                         err = -EINVAL;
                         goto out;
                 }
diff --git a/net/core/flow.c b/net/core/flow.c
index 1033725be40b..3937b1b68d5b 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -92,8 +92,11 @@ static void flow_cache_gc_task(struct work_struct *work)
         list_splice_tail_init(&xfrm->flow_cache_gc_list, &gc_list);
         spin_unlock_bh(&xfrm->flow_cache_gc_lock);
 
-        list_for_each_entry_safe(fce, n, &gc_list, u.gc_list)
+        list_for_each_entry_safe(fce, n, &gc_list, u.gc_list) {
                 flow_entry_kill(fce, xfrm);
+                atomic_dec(&xfrm->flow_cache_gc_count);
+                WARN_ON(atomic_read(&xfrm->flow_cache_gc_count) < 0);
+        }
 }
 
 static void flow_cache_queue_garbage(struct flow_cache_percpu *fcp,
@@ -101,6 +104,7 @@ static void flow_cache_queue_garbage(struct flow_cache_percpu *fcp,
                                      struct netns_xfrm *xfrm)
 {
         if (deleted) {
+                atomic_add(deleted, &xfrm->flow_cache_gc_count);
                 fcp->hash_count -= deleted;
                 spin_lock_bh(&xfrm->flow_cache_gc_lock);
                 list_splice_tail(gc_list, &xfrm->flow_cache_gc_list);
@@ -232,6 +236,13 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
                 if (fcp->hash_count > fc->high_watermark)
                         flow_cache_shrink(fc, fcp);
 
+                if (fcp->hash_count > 2 * fc->high_watermark ||
+                    atomic_read(&net->xfrm.flow_cache_gc_count) > fc->high_watermark) {
+                        atomic_inc(&net->xfrm.flow_cache_genid);
+                        flo = ERR_PTR(-ENOBUFS);
+                        goto ret_object;
+                }
+
                 fle = kmem_cache_alloc(flow_cachep, GFP_ATOMIC);
                 if (fle) {
                         fle->net = net;
@@ -446,6 +457,7 @@ int flow_cache_init(struct net *net)
         INIT_WORK(&net->xfrm.flow_cache_gc_work, flow_cache_gc_task);
         INIT_WORK(&net->xfrm.flow_cache_flush_work, flow_cache_flush_task);
         mutex_init(&net->xfrm.flow_flush_sem);
+        atomic_set(&net->xfrm.flow_cache_gc_count, 0);
 
         fc->hash_shift = 10;
         fc->low_watermark = 2 * flow_cache_hash_size(fc);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a75f7e94b445..65763c29f845 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1180,14 +1180,16 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
 
 static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev)
 {
-        struct rtnl_link_ifmap map = {
-                .mem_start   = dev->mem_start,
-                .mem_end     = dev->mem_end,
-                .base_addr   = dev->base_addr,
-                .irq         = dev->irq,
-                .dma         = dev->dma,
-                .port        = dev->if_port,
-        };
+        struct rtnl_link_ifmap map;
+
+        memset(&map, 0, sizeof(map));
+        map.mem_start   = dev->mem_start;
+        map.mem_end     = dev->mem_end;
+        map.base_addr   = dev->base_addr;
+        map.irq         = dev->irq;
+        map.dma         = dev->dma;
+        map.port        = dev->if_port;
+
         if (nla_put(skb, IFLA_MAP, sizeof(map), &map))
                 return -EMSGSIZE;
 
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index d97268e8ff10..2b68418c7198 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -975,6 +975,8 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg)
                         val = 65535 - 40;
                 if (type == RTAX_MTU && val > 65535 - 15)
                         val = 65535 - 15;
+                if (type == RTAX_HOPLIMIT && val > 255)
+                        val = 255;
                 if (type == RTAX_FEATURES && (val & ~RTAX_FEATURE_MASK))
                         return -EINVAL;
                 fi->fib_metrics[type - 1] = val;
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index a39068b4a4d9..a6962ccad98a 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -228,8 +228,6 @@ static int fou_gro_complete(struct sk_buff *skb, int nhoff,
         int err = -ENOSYS;
         const struct net_offload **offloads;
 
-        udp_tunnel_gro_complete(skb, nhoff);
-
         rcu_read_lock();
         offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
         ops = rcu_dereference(offloads[proto]);
@@ -238,6 +236,8 @@ static int fou_gro_complete(struct sk_buff *skb, int nhoff,
 
         err = ops->callbacks.gro_complete(skb, nhoff);
 
+        skb_set_inner_mac_header(skb, nhoff);
+
 out_unlock:
         rcu_read_unlock();
 
@@ -414,6 +414,8 @@ static int gue_gro_complete(struct sk_buff *skb, int nhoff,
 
         err = ops->callbacks.gro_complete(skb, nhoff + guehlen);
 
+        skb_set_inner_mac_header(skb, nhoff + guehlen);
+
 out_unlock:
         rcu_read_unlock();
         return err;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 205a2b8a5a84..4cc84212cce1 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -398,7 +398,10 @@ static int ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
                                   iph->saddr, iph->daddr, tpi->key);
 
         if (tunnel) {
-                skb_pop_mac_header(skb);
+                if (tunnel->dev->type != ARPHRD_NONE)
+                        skb_pop_mac_header(skb);
+                else
+                        skb_reset_mac_header(skb);
                 if (tunnel->collect_md) {
                         __be16 flags;
                         __be64 tun_id;
@@ -1031,6 +1034,8 @@ static void ipgre_netlink_parms(struct net_device *dev,
                 struct ip_tunnel *t = netdev_priv(dev);
 
                 t->collect_md = true;
+                if (dev->type == ARPHRD_IPGRE)
+                        dev->type = ARPHRD_NONE;
         }
 }
 
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 5cf10b777b7e..a917903d5e97 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -156,6 +156,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
         struct dst_entry *dst = skb_dst(skb);
         struct net_device *tdev;        /* Device to other host */
         int err;
+        int mtu;
 
         if (!dst) {
                 dev->stats.tx_carrier_errors++;
@@ -192,6 +193,23 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
                         tunnel->err_count = 0;
         }
 
+        mtu = dst_mtu(dst);
+        if (skb->len > mtu) {
+                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+                if (skb->protocol == htons(ETH_P_IP)) {
+                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+                                  htonl(mtu));
+                } else {
+                        if (mtu < IPV6_MIN_MTU)
+                                mtu = IPV6_MIN_MTU;
+
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+                }
+
+                dst_release(dst);
+                goto tx_error;
+        }
+
         skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev)));
         skb_dst_set(skb, dst);
         skb->dev = skb_dst(skb)->dev;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 441ae9da3a23..79a03b87a771 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2640,8 +2640,10 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
          */
         if (unlikely((NET_IP_ALIGN && ((unsigned long)skb->data & 3)) ||
                      skb_headroom(skb) >= 0xFFFF)) {
-                struct sk_buff *nskb = __pskb_copy(skb, MAX_TCP_HEADER,
-                                                   GFP_ATOMIC);
+                struct sk_buff *nskb;
+
+                skb_mstamp_get(&skb->skb_mstamp);
+                nskb = __pskb_copy(skb, MAX_TCP_HEADER, GFP_ATOMIC);
                 err = nskb ? tcp_transmit_skb(sk, nskb, 0, GFP_ATOMIC) :
                              -ENOBUFS;
         } else {
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 0ed2dafb7cc4..e330c0e56b11 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -399,6 +399,11 @@ int udp_gro_complete(struct sk_buff *skb, int nhoff)
 
         uh->len = newlen;
 
+        /* Set encapsulation before calling into inner gro_complete() functions
+         * to make them set up the inner offsets.
+         */
+        skb->encapsulation = 1;
+
         rcu_read_lock();
 
         uo_priv = rcu_dereference(udp_offload_base);
@@ -421,9 +426,6 @@ int udp_gro_complete(struct sk_buff *skb, int nhoff)
         if (skb->remcsum_offload)
                 skb_shinfo(skb)->gso_type |= SKB_GSO_TUNNEL_REMCSUM;
 
-        skb->encapsulation = 1;
-        skb_set_inner_mac_header(skb, nhoff + sizeof(struct udphdr));
-
         return err;
 }
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 0a37ddc7af51..0013cacf7164 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -445,6 +445,8 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
 
         if (__ipv6_addr_needs_scope_id(addr_type))
                 iif = skb->dev->ifindex;
+        else
+                iif = l3mdev_master_ifindex(skb->dev);
 
         /*
          *      Must not send error if the source does not uniquely
@@ -499,9 +501,6 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
         else if (!fl6.flowi6_oif)
                 fl6.flowi6_oif = np->ucast_oif;
 
-        if (!fl6.flowi6_oif)
-                fl6.flowi6_oif = l3mdev_master_ifindex(skb->dev);
-
         dst = icmpv6_route_lookup(net, skb, sk, &fl6);
         if (IS_ERR(dst))
                 goto out;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d916d6ab9ad2..6f32944e0223 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1750,6 +1750,8 @@ static int ip6_convert_metrics(struct mx6_config *mxc,
                 } else {
                         val = nla_get_u32(nla);
                 }
+                if (type == RTAX_HOPLIMIT && val > 255)
+                        val = 255;
                 if (type == RTAX_FEATURES && (val & ~RTAX_FEATURE_MASK))
                         goto err;
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 711d209f9124..f443c6b0ce16 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -810,8 +810,13 @@ static void tcp_v6_send_response(const struct sock *sk, struct sk_buff *skb, u32
         fl6.flowi6_proto = IPPROTO_TCP;
         if (rt6_need_strict(&fl6.daddr) && !oif)
                 fl6.flowi6_oif = tcp_v6_iif(skb);
-        else
+        else {
+                if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
+                        oif = skb->skb_iif;
+
                 fl6.flowi6_oif = oif;
+        }
+
         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
         fl6.fl6_dport = t1->dest;
         fl6.fl6_sport = t1->source;
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index b3c52e3f689a..8ae3ed97d95c 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -626,6 +626,7 @@ static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb)
         if (llc->cmsg_flags & LLC_CMSG_PKTINFO) {
                 struct llc_pktinfo info;
 
+                memset(&info, 0, sizeof(info));
                 info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex;
                 llc_pdu_decode_dsap(skb, &info.lpi_sap);
                 llc_pdu_decode_da(skb, info.lpi_mac);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index afde5f5e728a..e27fd17c6743 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -66,7 +66,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_locks);
 __cacheline_aligned_in_smp DEFINE_SPINLOCK(nf_conntrack_expect_lock);
 EXPORT_SYMBOL_GPL(nf_conntrack_expect_lock);
 
-static __read_mostly spinlock_t nf_conntrack_locks_all_lock;
+static __read_mostly DEFINE_SPINLOCK(nf_conntrack_locks_all_lock);
 static __read_mostly bool nf_conntrack_locks_all;
 
 void nf_conntrack_lock(spinlock_t *lock) __acquires(lock)
@@ -1778,6 +1778,7 @@ void nf_conntrack_init_end(void)
 
 int nf_conntrack_init_net(struct net *net)
 {
+        static atomic64_t unique_id;
         int ret = -ENOMEM;
         int cpu;
 
@@ -1800,7 +1801,8 @@ int nf_conntrack_init_net(struct net *net)
         if (!net->ct.stat)
                 goto err_pcpu_lists;
 
-        net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
+        net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%llu",
+                                (u64)atomic64_inc_return(&unique_id));
         if (!net->ct.slabname)
                 goto err_slabname;
 
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 4c2b4c0c4d5f..dbd0803b1827 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -96,6 +96,8 @@ static int nfnl_acct_new(struct net *net, struct sock *nfnl,
                         return -EINVAL;
                 if (flags & NFACCT_F_OVERQUOTA)
                         return -EINVAL;
+                if ((flags & NFACCT_F_QUOTA) && !tb[NFACCT_QUOTA])
+                        return -EINVAL;
 
                 size += sizeof(u64);
         }
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index 29d2c31f406c..daf45da448fa 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -236,6 +236,7 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par)
 
                 list_del(&info->timer->entry);
                 del_timer_sync(&info->timer->timer);
+                cancel_work_sync(&info->timer->work);
                 sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);
                 kfree(info->timer->attr.attr.name);
                 kfree(info->timer);
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index b5fea1101faa..10c84d882881 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -776,6 +776,19 @@ static int __ovs_ct_lookup(struct net *net, struct sw_flow_key *key,
                         return -EINVAL;
                 }
 
+                /* Userspace may decide to perform a ct lookup without a helper
+                 * specified followed by a (recirculate and) commit with one.
+                 * Therefore, for unconfirmed connections which we will commit,
+                 * we need to attach the helper here.
+                 */
+                if (!nf_ct_is_confirmed(ct) && info->commit &&
+                    info->helper && !nfct_help(ct)) {
+                        int err = __nf_ct_try_assign_helper(ct, info->ct,
+                                                            GFP_ATOMIC);
+                        if (err)
+                                return err;
+                }
+
                 /* Call the helper only if:
                  * - nf_conntrack_in() was executed above ("!cached") for a
                  *   confirmed connection, or
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index c589a9ba506a..343d011aa818 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -423,7 +423,7 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
         u16 ife_type = 0;
         u8 *daddr = NULL;
         u8 *saddr = NULL;
-        int ret = 0;
+        int ret = 0, exists = 0;
         int err;
 
         err = nla_parse_nested(tb, TCA_IFE_MAX, nla, ife_policy);
@@ -435,25 +435,29 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
 
         parm = nla_data(tb[TCA_IFE_PARMS]);
 
+        exists = tcf_hash_check(tn, parm->index, a, bind);
+        if (exists && bind)
+                return 0;
+
         if (parm->flags & IFE_ENCODE) {
                 /* Until we get issued the ethertype, we cant have
                  * a default..
                 **/
                 if (!tb[TCA_IFE_TYPE]) {
+                        if (exists)
+                                tcf_hash_release(a, bind);
                         pr_info("You MUST pass etherype for encoding\n");
                         return -EINVAL;
                 }
         }
 
-        if (!tcf_hash_check(tn, parm->index, a, bind)) {
+        if (!exists) {
                 ret = tcf_hash_create(tn, parm->index, est, a, sizeof(*ife),
                                       bind, false);
                 if (ret)
                         return ret;
                 ret = ACT_P_CREATED;
         } else {
-                if (bind)       /* dont override defaults */
-                        return 0;
                 tcf_hash_release(a, bind);
                 if (!ovr)
                         return -EEXIST;
@@ -495,6 +499,8 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
                                        NULL);
                 if (err) {
 metadata_parse_err:
+                        if (exists)
+                                tcf_hash_release(a, bind);
                         if (ret == ACT_P_CREATED)
                                 _tcf_ife_cleanup(a, bind);
 
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 350e134cffb3..8b5270008a6e 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -96,7 +96,7 @@ static int __tcf_ipt_init(struct tc_action_net *tn, struct nlattr *nla,
         struct tcf_ipt *ipt;
         struct xt_entry_target *td, *t;
         char *tname;
-        int ret = 0, err;
+        int ret = 0, err, exists = 0;
         u32 hook = 0;
         u32 index = 0;
 
@@ -107,18 +107,23 @@ static int __tcf_ipt_init(struct tc_action_net *tn, struct nlattr *nla,
         if (err < 0)
                 return err;
 
-        if (tb[TCA_IPT_HOOK] == NULL)
-                return -EINVAL;
-        if (tb[TCA_IPT_TARG] == NULL)
+        if (tb[TCA_IPT_INDEX] != NULL)
+                index = nla_get_u32(tb[TCA_IPT_INDEX]);
+
+        exists = tcf_hash_check(tn, index, a, bind);
+        if (exists && bind)
+                return 0;
+
+        if (tb[TCA_IPT_HOOK] == NULL || tb[TCA_IPT_TARG] == NULL) {
+                if (exists)
+                        tcf_hash_release(a, bind);
                 return -EINVAL;
+        }
 
         td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]);
         if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size)
                 return -EINVAL;
 
-        if (tb[TCA_IPT_INDEX] != NULL)
-                index = nla_get_u32(tb[TCA_IPT_INDEX]);
-
         if (!tcf_hash_check(tn, index, a, bind)) {
                 ret = tcf_hash_create(tn, index, est, a, sizeof(*ipt), bind,
                                       false);
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index e8a760cf7775..8f3948dd38b8 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -61,7 +61,7 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
         struct tc_mirred *parm;
         struct tcf_mirred *m;
         struct net_device *dev;
-        int ret, ok_push = 0;
+        int ret, ok_push = 0, exists = 0;
 
         if (nla == NULL)
                 return -EINVAL;
@@ -71,17 +71,27 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
         if (tb[TCA_MIRRED_PARMS] == NULL)
                 return -EINVAL;
         parm = nla_data(tb[TCA_MIRRED_PARMS]);
+
+        exists = tcf_hash_check(tn, parm->index, a, bind);
+        if (exists && bind)
+                return 0;
+
         switch (parm->eaction) {
         case TCA_EGRESS_MIRROR:
         case TCA_EGRESS_REDIR:
                 break;
         default:
+                if (exists)
+                        tcf_hash_release(a, bind);
                 return -EINVAL;
         }
         if (parm->ifindex) {
                 dev = __dev_get_by_index(net, parm->ifindex);
-                if (dev == NULL)
+                if (dev == NULL) {
+                        if (exists)
+                                tcf_hash_release(a, bind);
                         return -ENODEV;
+                }
                 switch (dev->type) {
                 case ARPHRD_TUNNEL:
                 case ARPHRD_TUNNEL6:
@@ -99,7 +109,7 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
                 dev = NULL;
         }
 
-        if (!tcf_hash_check(tn, parm->index, a, bind)) {
+        if (!exists) {
                 if (dev == NULL)
                         return -EINVAL;
                 ret = tcf_hash_create(tn, parm->index, est, a,
@@ -108,9 +118,6 @@ static int tcf_mirred_init(struct net *net, struct nlattr *nla,
                         return ret;
                 ret = ACT_P_CREATED;
         } else {
-                if (bind)
-                        return 0;
-
                 tcf_hash_release(a, bind);
                 if (!ovr)
                         return -EEXIST;
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 75b2be13fbcc..3a33fb648a6d 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -87,7 +87,7 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
         struct tc_defact *parm;
         struct tcf_defact *d;
         char *defdata;
-        int ret = 0, err;
+        int ret = 0, err, exists = 0;
 
         if (nla == NULL)
                 return -EINVAL;
@@ -99,13 +99,21 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
         if (tb[TCA_DEF_PARMS] == NULL)
                 return -EINVAL;
 
-        if (tb[TCA_DEF_DATA] == NULL)
-                return -EINVAL;
 
         parm = nla_data(tb[TCA_DEF_PARMS]);
+        exists = tcf_hash_check(tn, parm->index, a, bind);
+        if (exists && bind)
+                return 0;
+
+        if (tb[TCA_DEF_DATA] == NULL) {
+                if (exists)
+                        tcf_hash_release(a, bind);
+                return -EINVAL;
+        }
+
         defdata = nla_data(tb[TCA_DEF_DATA]);
 
-        if (!tcf_hash_check(tn, parm->index, a, bind)) {
+        if (!exists) {
                 ret = tcf_hash_create(tn, parm->index, est, a,
                                       sizeof(*d), bind, false);
                 if (ret)
@@ -122,8 +130,6 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
         } else {
                 d = to_defact(a);
 
-                if (bind)
-                        return 0;
                 tcf_hash_release(a, bind);
                 if (!ovr)
                         return -EEXIST;
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index cfcdbdc00c9b..69da5a8f0034 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -69,7 +69,7 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
         struct tcf_skbedit *d;
         u32 flags = 0, *priority = NULL, *mark = NULL;
         u16 *queue_mapping = NULL;
-        int ret = 0, err;
+        int ret = 0, err, exists = 0;
 
         if (nla == NULL)
                 return -EINVAL;
@@ -96,12 +96,18 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
                 mark = nla_data(tb[TCA_SKBEDIT_MARK]);
         }
 
-        if (!flags)
-                return -EINVAL;
-
         parm = nla_data(tb[TCA_SKBEDIT_PARMS]);
 
-        if (!tcf_hash_check(tn, parm->index, a, bind)) {
+        exists = tcf_hash_check(tn, parm->index, a, bind);
+        if (exists && bind)
+                return 0;
+
+        if (!flags) {
+                tcf_hash_release(a, bind);
+                return -EINVAL;
+        }
+
+        if (!exists) {
                 ret = tcf_hash_create(tn, parm->index, est, a,
                                       sizeof(*d), bind, false);
                 if (ret)
@@ -111,8 +117,6 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
                 ret = ACT_P_CREATED;
         } else {
                 d = to_skbedit(a);
-                if (bind)
-                        return 0;
                 tcf_hash_release(a, bind);
                 if (!ovr)
                         return -EEXIST;
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index bab8ae0cefc0..c45f926dafb9 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -77,7 +77,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
         int action;
         __be16 push_vid = 0;
         __be16 push_proto = 0;
-        int ret = 0;
+        int ret = 0, exists = 0;
         int err;
 
         if (!nla)
@@ -90,15 +90,25 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
         if (!tb[TCA_VLAN_PARMS])
                 return -EINVAL;
         parm = nla_data(tb[TCA_VLAN_PARMS]);
+        exists = tcf_hash_check(tn, parm->index, a, bind);
+        if (exists && bind)
+                return 0;
+
         switch (parm->v_action) {
         case TCA_VLAN_ACT_POP:
                 break;
         case TCA_VLAN_ACT_PUSH:
-                if (!tb[TCA_VLAN_PUSH_VLAN_ID])
+                if (!tb[TCA_VLAN_PUSH_VLAN_ID]) {
+                        if (exists)
+                                tcf_hash_release(a, bind);
                         return -EINVAL;
+                }
                 push_vid = nla_get_u16(tb[TCA_VLAN_PUSH_VLAN_ID]);
-                if (push_vid >= VLAN_VID_MASK)
+                if (push_vid >= VLAN_VID_MASK) {
+                        if (exists)
+                                tcf_hash_release(a, bind);
                         return -ERANGE;
+                }
 
                 if (tb[TCA_VLAN_PUSH_VLAN_PROTOCOL]) {
                         push_proto = nla_get_be16(tb[TCA_VLAN_PUSH_VLAN_PROTOCOL]);
@@ -114,11 +124,13 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
                 }
                 break;
         default:
+                if (exists)
+                        tcf_hash_release(a, bind);
                 return -EINVAL;
         }
         action = parm->v_action;
 
-        if (!tcf_hash_check(tn, parm->index, a, bind)) {
+        if (!exists) {
                 ret = tcf_hash_create(tn, parm->index, est, a,
                                       sizeof(*v), bind, false);
                 if (ret)
@@ -126,8 +138,6 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla,
 
                 ret = ACT_P_CREATED;
         } else {
-                if (bind)
-                        return 0;
                 tcf_hash_release(a, bind);
                 if (!ovr)
                         return -EEXIST;
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 3dce53ebea92..b5f1221f48d4 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1808,27 +1808,8 @@ vsock_stream_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
         else if (sk->sk_shutdown & RCV_SHUTDOWN)
                 err = 0;
 
-        if (copied > 0) {
-                /* We only do these additional bookkeeping/notification steps
-                 * if we actually copied something out of the queue pair
-                 * instead of just peeking ahead.
-                 */
-
-                if (!(flags & MSG_PEEK)) {
-                        /* If the other side has shutdown for sending and there
-                         * is nothing more to read, then modify the socket
-                         * state.
-                         */
-                        if (vsk->peer_shutdown & SEND_SHUTDOWN) {
-                                if (vsock_stream_has_data(vsk) <= 0) {
-                                        sk->sk_state = SS_UNCONNECTED;
-                                        sock_set_flag(sk, SOCK_DONE);
-                                        sk->sk_state_change(sk);
-                                }
-                        }
-                }
+        if (copied > 0)
                 err = copied;
-        }
 
 out:
         release_sock(sk);
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index 7ecd04c21360..997ff7b2509b 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -277,6 +277,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
 
         memset(&theirs, 0, sizeof(theirs));
         memcpy(new, ours, sizeof(*new));
+        memset(dte, 0, sizeof(*dte));
 
         len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask);
         if (len < 0)
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index ff4a91fcab9f..637387bbaaea 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -99,6 +99,9 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
 
                 skb_dst_force(skb);
 
+                /* Inner headers are invalid now. */
+                skb->encapsulation = 0;
+
                 err = x->type->output(x, skb);
                 if (err == -EINPROGRESS)
                         goto out;