Merge tag 'kvm-s390-master-4.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux

KVM: s390: Fixes for 4.19

- Fallout from the hugetlbfs support: pfmf interpretion and locking
- VSIE: fix keywrapping for nested guests

31 files changed, 142 insertions, 266 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 325fc5088370..82114e1111e6 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -93,7 +93,6 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/ethtool.h>
-#include <linux/notifier.h>
 #include <linux/skbuff.h>
 #include <linux/bpf.h>
 #include <linux/bpf_trace.h>
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 962c4fd338ba..1c45c1d6d241 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -767,7 +767,6 @@ static int dsa_slave_add_cls_matchall(struct net_device *dev,
         const struct tc_action *a;
         struct dsa_port *to_dp;
         int err = -EOPNOTSUPP;
-        LIST_HEAD(actions);
 
         if (!ds->ops->port_mirror_add)
                 return err;
@@ -775,8 +774,7 @@ static int dsa_slave_add_cls_matchall(struct net_device *dev,
         if (!tcf_exts_has_one_action(cls->exts))
                 return err;
 
-        tcf_exts_to_list(cls->exts, &actions);
-        a = list_first_entry(&actions, struct tc_action, list);
+        a = tcf_exts_first_action(cls->exts);
 
         if (is_tcf_mirred_egress_mirror(a) && protocol == htons(ETH_P_ALL)) {
                 struct dsa_mall_mirror_tc_entry *mirror;
diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
index 13d34427ca3d..02ff2dde9609 100644
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -95,11 +95,10 @@ struct bbr {
         u32     mode:3,              /* current bbr_mode in state machine */
                 prev_ca_state:3,     /* CA state on previous ACK */
                 packet_conservation:1,  /* use packet conservation? */
-                restore_cwnd:1,      /* decided to revert cwnd to old value */
                 round_start:1,       /* start of packet-timed tx->ack round? */
                 idle_restart:1,      /* restarting after idle? */
                 probe_rtt_round_done:1,  /* a BBR_PROBE_RTT round at 4 pkts? */
-                unused:12,
+                unused:13,
                 lt_is_sampling:1,    /* taking long-term ("LT") samples now? */
                 lt_rtt_cnt:7,        /* round trips in long-term interval */
                 lt_use_bw:1;         /* use lt_bw as our bw estimate? */
@@ -175,6 +174,8 @@ static const u32 bbr_lt_bw_diff = 4000 / 8;
 /* If we estimate we're policed, use lt_bw for this many round trips: */
 static const u32 bbr_lt_bw_max_rtts = 48;
 
+static void bbr_check_probe_rtt_done(struct sock *sk);
+
 /* Do we estimate that STARTUP filled the pipe? */
 static bool bbr_full_bw_reached(const struct sock *sk)
 {
@@ -309,6 +310,8 @@ static void bbr_cwnd_event(struct sock *sk, enum tcp_ca_event event)
                  */
                 if (bbr->mode == BBR_PROBE_BW)
                         bbr_set_pacing_rate(sk, bbr_bw(sk), BBR_UNIT);
+                else if (bbr->mode == BBR_PROBE_RTT)
+                        bbr_check_probe_rtt_done(sk);
         }
 }
 
@@ -396,17 +399,11 @@ static bool bbr_set_cwnd_to_recover_or_restore(
                 cwnd = tcp_packets_in_flight(tp) + acked;
         } else if (prev_state >= TCP_CA_Recovery && state < TCP_CA_Recovery) {
                 /* Exiting loss recovery; restore cwnd saved before recovery. */
-                bbr->restore_cwnd = 1;
+                cwnd = max(cwnd, bbr->prior_cwnd);
                 bbr->packet_conservation = 0;
         }
         bbr->prev_ca_state = state;
 
-        if (bbr->restore_cwnd) {
-                /* Restore cwnd after exiting loss recovery or PROBE_RTT. */
-                cwnd = max(cwnd, bbr->prior_cwnd);
-                bbr->restore_cwnd = 0;
-        }
-
         if (bbr->packet_conservation) {
                 *new_cwnd = max(cwnd, tcp_packets_in_flight(tp) + acked);
                 return true;    /* yes, using packet conservation */
@@ -423,10 +420,10 @@ static void bbr_set_cwnd(struct sock *sk, const struct rate_sample *rs,
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct bbr *bbr = inet_csk_ca(sk);
-        u32 cwnd = 0, target_cwnd = 0;
+        u32 cwnd = tp->snd_cwnd, target_cwnd = 0;
 
         if (!acked)
-                return;
+                goto done;  /* no packet fully ACKed; just apply caps */
 
         if (bbr_set_cwnd_to_recover_or_restore(sk, rs, acked, &cwnd))
                 goto done;
@@ -748,6 +745,20 @@ static void bbr_check_drain(struct sock *sk, const struct rate_sample *rs)
                 bbr_reset_probe_bw_mode(sk);  /* we estimate queue is drained */
 }
 
+static void bbr_check_probe_rtt_done(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct bbr *bbr = inet_csk_ca(sk);
+
+        if (!(bbr->probe_rtt_done_stamp &&
+              after(tcp_jiffies32, bbr->probe_rtt_done_stamp)))
+                return;
+
+        bbr->min_rtt_stamp = tcp_jiffies32;  /* wait a while until PROBE_RTT */
+        tp->snd_cwnd = max(tp->snd_cwnd, bbr->prior_cwnd);
+        bbr_reset_mode(sk);
+}
+
 /* The goal of PROBE_RTT mode is to have BBR flows cooperatively and
  * periodically drain the bottleneck queue, to converge to measure the true
  * min_rtt (unloaded propagation delay). This allows the flows to keep queues
@@ -806,12 +817,8 @@ static void bbr_update_min_rtt(struct sock *sk, const struct rate_sample *rs)
                 } else if (bbr->probe_rtt_done_stamp) {
                         if (bbr->round_start)
                                 bbr->probe_rtt_round_done = 1;
-                        if (bbr->probe_rtt_round_done &&
-                            after(tcp_jiffies32, bbr->probe_rtt_done_stamp)) {
-                                bbr->min_rtt_stamp = tcp_jiffies32;
-                                bbr->restore_cwnd = 1;  /* snap to prior_cwnd */
-                                bbr_reset_mode(sk);
-                        }
+                        if (bbr->probe_rtt_round_done)
+                                bbr_check_probe_rtt_done(sk);
                 }
         }
         /* Restart after idle ends only once we process a new S/ACK for data */
@@ -862,7 +869,6 @@ static void bbr_init(struct sock *sk)
         bbr->has_seen_rtt = 0;
         bbr_init_pacing_rate_from_rtt(sk);
 
-        bbr->restore_cwnd = 0;
         bbr->round_start = 0;
         bbr->idle_restart = 0;
         bbr->full_bw_reached = 0;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 9e041fa5c545..44c09eddbb78 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2517,6 +2517,12 @@ static int __net_init tcp_sk_init(struct net *net)
                 if (res)
                         goto fail;
                 sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
+
+                /* Please enforce IP_DF and IPID==0 for RST and
+                 * ACK sent in SYN-RECV and TIME-WAIT state.
+                 */
+                inet_sk(sk)->pmtudisc = IP_PMTUDISC_DO;
+
                 *per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk;
         }
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 2fac4ad74867..d51a8c0b3372 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2398,7 +2398,7 @@ static void addrconf_add_mroute(struct net_device *dev)
 
         ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
 
-        ip6_route_add(&cfg, GFP_ATOMIC, NULL);
+        ip6_route_add(&cfg, GFP_KERNEL, NULL);
 }
 
 static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
@@ -3062,7 +3062,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
         if (addr.s6_addr32[3]) {
                 add_addr(idev, &addr, plen, scope);
                 addrconf_prefix_route(&addr, plen, 0, idev->dev, 0, pflags,
-                                      GFP_ATOMIC);
+                                      GFP_KERNEL);
                 return;
         }
 
@@ -3087,7 +3087,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
 
                                 add_addr(idev, &addr, plen, flag);
                                 addrconf_prefix_route(&addr, plen, 0, idev->dev,
-                                                      0, pflags, GFP_ATOMIC);
+                                                      0, pflags, GFP_KERNEL);
                         }
                 }
         }
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index d212738e9d10..c861a6d4671d 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -198,6 +198,8 @@ void fib6_info_destroy_rcu(struct rcu_head *head)
                 }
         }
 
+        lwtstate_put(f6i->fib6_nh.nh_lwtstate);
+
         if (f6i->fib6_nh.nh_dev)
                 dev_put(f6i->fib6_nh.nh_dev);
 
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 38dec9da90d3..5095367c7204 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -1094,7 +1094,8 @@ static void __net_exit vti6_destroy_tunnels(struct vti6_net *ip6n,
         }
 
         t = rtnl_dereference(ip6n->tnls_wc[0]);
-        unregister_netdevice_queue(t->dev, list);
+        if (t)
+                unregister_netdevice_queue(t->dev, list);
 }
 
 static int __net_init vti6_init_net(struct net *net)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7208c16302f6..c4ea13e8360b 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -956,7 +956,7 @@ static void ip6_rt_init_dst(struct rt6_info *rt, struct fib6_info *ort)
         rt->dst.error = 0;
         rt->dst.output = ip6_output;
 
-        if (ort->fib6_type == RTN_LOCAL) {
+        if (ort->fib6_type == RTN_LOCAL || ort->fib6_type == RTN_ANYCAST) {
                 rt->dst.input = ip6_input;
         } else if (ipv6_addr_type(&ort->fib6_dst.addr) & IPV6_ADDR_MULTICAST) {
                 rt->dst.input = ip6_mc_input;
diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c
index 82e6edf9c5d9..45f33d6dedf7 100644
--- a/net/ncsi/ncsi-netlink.c
+++ b/net/ncsi/ncsi-netlink.c
@@ -100,7 +100,7 @@ static int ncsi_write_package_info(struct sk_buff *skb,
         bool found;
         int rc;
 
-        if (id > ndp->package_num) {
+        if (id > ndp->package_num - 1) {
                 netdev_info(ndp->ndev.dev, "NCSI: No package with id %u\n", id);
                 return -ENODEV;
         }
@@ -240,7 +240,7 @@ static int ncsi_pkg_info_all_nl(struct sk_buff *skb,
                 return 0; /* done */
 
         hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
-                          &ncsi_genl_family, 0,  NCSI_CMD_PKG_INFO);
+                          &ncsi_genl_family, NLM_F_MULTI,  NCSI_CMD_PKG_INFO);
         if (!hdr) {
                 rc = -EMSGSIZE;
                 goto err;
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 2c7b7c352d3e..b9bbcf3d6c63 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -37,7 +37,6 @@
 #include <net/tcp.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
-#include <net/tcp.h>
 #include <net/addrconf.h>
 
 #include "rds.h"
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 229d63c99be2..db83dac1e7f4 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -300,21 +300,17 @@ int tcf_generic_walker(struct tc_action_net *tn, struct sk_buff *skb,
 }
 EXPORT_SYMBOL(tcf_generic_walker);
 
-static bool __tcf_idr_check(struct tc_action_net *tn, u32 index,
-                            struct tc_action **a, int bind)
+int tcf_idr_search(struct tc_action_net *tn, struct tc_action **a, u32 index)
 {
         struct tcf_idrinfo *idrinfo = tn->idrinfo;
         struct tc_action *p;
 
         spin_lock(&idrinfo->lock);
         p = idr_find(&idrinfo->action_idr, index);
-        if (IS_ERR(p)) {
+        if (IS_ERR(p))
                 p = NULL;
-        } else if (p) {
+        else if (p)
                 refcount_inc(&p->tcfa_refcnt);
-                if (bind)
-                        atomic_inc(&p->tcfa_bindcnt);
-        }
         spin_unlock(&idrinfo->lock);
 
         if (p) {
@@ -323,23 +319,10 @@ static bool __tcf_idr_check(struct tc_action_net *tn, u32 index,
         }
         return false;
 }
-
-int tcf_idr_search(struct tc_action_net *tn, struct tc_action **a, u32 index)
-{
-        return __tcf_idr_check(tn, index, a, 0);
-}
 EXPORT_SYMBOL(tcf_idr_search);
 
-bool tcf_idr_check(struct tc_action_net *tn, u32 index, struct tc_action **a,
-                   int bind)
+static int tcf_idr_delete_index(struct tcf_idrinfo *idrinfo, u32 index)
 {
-        return __tcf_idr_check(tn, index, a, bind);
-}
-EXPORT_SYMBOL(tcf_idr_check);
-
-int tcf_idr_delete_index(struct tc_action_net *tn, u32 index)
-{
-        struct tcf_idrinfo *idrinfo = tn->idrinfo;
         struct tc_action *p;
         int ret = 0;
 
@@ -370,7 +353,6 @@ int tcf_idr_delete_index(struct tc_action_net *tn, u32 index)
         spin_unlock(&idrinfo->lock);
         return ret;
 }
-EXPORT_SYMBOL(tcf_idr_delete_index);
 
 int tcf_idr_create(struct tc_action_net *tn, u32 index, struct nlattr *est,
                    struct tc_action **a, const struct tc_action_ops *ops,
@@ -409,7 +391,6 @@ int tcf_idr_create(struct tc_action_net *tn, u32 index, struct nlattr *est,
 
         p->idrinfo = idrinfo;
         p->ops = ops;
-        INIT_LIST_HEAD(&p->list);
         *a = p;
         return 0;
 err3:
@@ -686,14 +667,18 @@ static int tcf_action_put(struct tc_action *p)
         return __tcf_action_put(p, false);
 }
 
+/* Put all actions in this array, skip those NULL's. */
 static void tcf_action_put_many(struct tc_action *actions[])
 {
         int i;
 
-        for (i = 0; i < TCA_ACT_MAX_PRIO && actions[i]; i++) {
+        for (i = 0; i < TCA_ACT_MAX_PRIO; i++) {
                 struct tc_action *a = actions[i];
-                const struct tc_action_ops *ops = a->ops;
+                const struct tc_action_ops *ops;
 
+                if (!a)
+                        continue;
+                ops = a->ops;
                 if (tcf_action_put(a))
                         module_put(ops->owner);
         }
@@ -1175,41 +1160,38 @@ err_out:
         return err;
 }
 
-static int tcf_action_delete(struct net *net, struct tc_action *actions[],
-                             int *acts_deleted, struct netlink_ext_ack *extack)
+static int tcf_action_delete(struct net *net, struct tc_action *actions[])
 {
-        u32 act_index;
-        int ret, i;
+        int i;
 
         for (i = 0; i < TCA_ACT_MAX_PRIO && actions[i]; i++) {
                 struct tc_action *a = actions[i];
                 const struct tc_action_ops *ops = a->ops;
-
                 /* Actions can be deleted concurrently so we must save their
                  * type and id to search again after reference is released.
                  */
-                act_index = a->tcfa_index;
+                struct tcf_idrinfo *idrinfo = a->idrinfo;
+                u32 act_index = a->tcfa_index;
 
                 if (tcf_action_put(a)) {
                         /* last reference, action was deleted concurrently */
                         module_put(ops->owner);
                 } else  {
+                        int ret;
+
                         /* now do the delete */
-                        ret = ops->delete(net, act_index);
-                        if (ret < 0) {
-                                *acts_deleted = i + 1;
+                        ret = tcf_idr_delete_index(idrinfo, act_index);
+                        if (ret < 0)
                                 return ret;
-                        }
                 }
+                actions[i] = NULL;
         }
-        *acts_deleted = i;
         return 0;
 }
 
 static int
 tcf_del_notify(struct net *net, struct nlmsghdr *n, struct tc_action *actions[],
-               int *acts_deleted, u32 portid, size_t attr_size,
-               struct netlink_ext_ack *extack)
+               u32 portid, size_t attr_size, struct netlink_ext_ack *extack)
 {
         int ret;
         struct sk_buff *skb;
@@ -1227,7 +1209,7 @@ tcf_del_notify(struct net *net, struct nlmsghdr *n, struct tc_action *actions[],
         }
 
         /* now do the delete */
-        ret = tcf_action_delete(net, actions, acts_deleted, extack);
+        ret = tcf_action_delete(net, actions);
         if (ret < 0) {
                 NL_SET_ERR_MSG(extack, "Failed to delete TC action");
                 kfree_skb(skb);
@@ -1249,8 +1231,7 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
         struct nlattr *tb[TCA_ACT_MAX_PRIO + 1];
         struct tc_action *act;
         size_t attr_size = 0;
-        struct tc_action *actions[TCA_ACT_MAX_PRIO + 1] = {};
-        int acts_deleted = 0;
+        struct tc_action *actions[TCA_ACT_MAX_PRIO] = {};
 
         ret = nla_parse_nested(tb, TCA_ACT_MAX_PRIO, nla, NULL, extack);
         if (ret < 0)
@@ -1280,14 +1261,13 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
         if (event == RTM_GETACTION)
                 ret = tcf_get_notify(net, portid, n, actions, event, extack);
         else { /* delete */
-                ret = tcf_del_notify(net, n, actions, &acts_deleted, portid,
-                                     attr_size, extack);
+                ret = tcf_del_notify(net, n, actions, portid, attr_size, extack);
                 if (ret)
                         goto err;
-                return ret;
+                return 0;
         }
 err:
-        tcf_action_put_many(&actions[acts_deleted]);
+        tcf_action_put_many(actions);
         return ret;
 }
 
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index d30b23e42436..0c68bc9cf0b4 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -395,13 +395,6 @@ static int tcf_bpf_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_bpf_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, bpf_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_bpf_ops __read_mostly = {
         .kind           =       "bpf",
         .type           =       TCA_ACT_BPF,
@@ -412,7 +405,6 @@ static struct tc_action_ops act_bpf_ops __read_mostly = {
         .init           =       tcf_bpf_init,
         .walk           =       tcf_bpf_walker,
         .lookup         =       tcf_bpf_search,
-        .delete         =       tcf_bpf_delete,
         .size           =       sizeof(struct tcf_bpf),
 };
 
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index 54c0bf54f2ac..6f0f273f1139 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -198,13 +198,6 @@ static int tcf_connmark_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_connmark_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, connmark_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_connmark_ops = {
         .kind           =       "connmark",
         .type           =       TCA_ACT_CONNMARK,
@@ -214,7 +207,6 @@ static struct tc_action_ops act_connmark_ops = {
         .init           =       tcf_connmark_init,
         .walk           =       tcf_connmark_walker,
         .lookup         =       tcf_connmark_search,
-        .delete         =       tcf_connmark_delete,
         .size           =       sizeof(struct tcf_connmark_info),
 };
 
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index e698d3fe2080..b8a67ae3105a 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -659,13 +659,6 @@ static size_t tcf_csum_get_fill_size(const struct tc_action *act)
         return nla_total_size(sizeof(struct tc_csum));
 }
 
-static int tcf_csum_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, csum_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_csum_ops = {
         .kind           = "csum",
         .type           = TCA_ACT_CSUM,
@@ -677,7 +670,6 @@ static struct tc_action_ops act_csum_ops = {
         .walk           = tcf_csum_walker,
         .lookup         = tcf_csum_search,
         .get_fill_size  = tcf_csum_get_fill_size,
-        .delete         = tcf_csum_delete,
         .size           = sizeof(struct tcf_csum),
 };
 
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index 6a3f25a8ffb3..cd1d9bd32ef9 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -243,13 +243,6 @@ static size_t tcf_gact_get_fill_size(const struct tc_action *act)
         return sz;
 }
 
-static int tcf_gact_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, gact_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_gact_ops = {
         .kind           =       "gact",
         .type           =       TCA_ACT_GACT,
@@ -261,7 +254,6 @@ static struct tc_action_ops act_gact_ops = {
         .walk           =       tcf_gact_walker,
         .lookup         =       tcf_gact_search,
         .get_fill_size  =       tcf_gact_get_fill_size,
-        .delete         =       tcf_gact_delete,
         .size           =       sizeof(struct tcf_gact),
 };
 
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index d1081bdf1bdb..196430aefe87 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -167,16 +167,16 @@ static struct tcf_meta_ops *find_ife_oplist(u16 metaid)
 {
         struct tcf_meta_ops *o;
 
-        read_lock_bh(&ife_mod_lock);
+        read_lock(&ife_mod_lock);
         list_for_each_entry(o, &ifeoplist, list) {
                 if (o->metaid == metaid) {
                         if (!try_module_get(o->owner))
                                 o = NULL;
-                        read_unlock_bh(&ife_mod_lock);
+                        read_unlock(&ife_mod_lock);
                         return o;
                 }
         }
-        read_unlock_bh(&ife_mod_lock);
+        read_unlock(&ife_mod_lock);
 
         return NULL;
 }
@@ -190,12 +190,12 @@ int register_ife_op(struct tcf_meta_ops *mops)
             !mops->get || !mops->alloc)
                 return -EINVAL;
 
-        write_lock_bh(&ife_mod_lock);
+        write_lock(&ife_mod_lock);
 
         list_for_each_entry(m, &ifeoplist, list) {
                 if (m->metaid == mops->metaid ||
                     (strcmp(mops->name, m->name) == 0)) {
-                        write_unlock_bh(&ife_mod_lock);
+                        write_unlock(&ife_mod_lock);
                         return -EEXIST;
                 }
         }
@@ -204,7 +204,7 @@ int register_ife_op(struct tcf_meta_ops *mops)
                 mops->release = ife_release_meta_gen;
 
         list_add_tail(&mops->list, &ifeoplist);
-        write_unlock_bh(&ife_mod_lock);
+        write_unlock(&ife_mod_lock);
         return 0;
 }
 EXPORT_SYMBOL_GPL(unregister_ife_op);
@@ -214,7 +214,7 @@ int unregister_ife_op(struct tcf_meta_ops *mops)
         struct tcf_meta_ops *m;
         int err = -ENOENT;
 
-        write_lock_bh(&ife_mod_lock);
+        write_lock(&ife_mod_lock);
         list_for_each_entry(m, &ifeoplist, list) {
                 if (m->metaid == mops->metaid) {
                         list_del(&mops->list);
@@ -222,7 +222,7 @@ int unregister_ife_op(struct tcf_meta_ops *mops)
                         break;
                 }
         }
-        write_unlock_bh(&ife_mod_lock);
+        write_unlock(&ife_mod_lock);
 
         return err;
 }
@@ -265,11 +265,8 @@ static const char *ife_meta_id2name(u32 metaid)
 #endif
 
 /* called when adding new meta information
- * under ife->tcf_lock for existing action
 */
-static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
-                                void *val, int len, bool exists,
-                                bool rtnl_held)
+static int load_metaops_and_vet(u32 metaid, void *val, int len, bool rtnl_held)
 {
         struct tcf_meta_ops *ops = find_ife_oplist(metaid);
         int ret = 0;
@@ -277,15 +274,11 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
         if (!ops) {
                 ret = -ENOENT;
 #ifdef CONFIG_MODULES
-                if (exists)
-                        spin_unlock_bh(&ife->tcf_lock);
                 if (rtnl_held)
                         rtnl_unlock();
                 request_module("ife-meta-%s", ife_meta_id2name(metaid));
                 if (rtnl_held)
                         rtnl_lock();
-                if (exists)
-                        spin_lock_bh(&ife->tcf_lock);
                 ops = find_ife_oplist(metaid);
 #endif
         }
@@ -302,24 +295,17 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid,
 }
 
 /* called when adding new meta information
- * under ife->tcf_lock for existing action
 */
-static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
-                        int len, bool atomic)
+static int __add_metainfo(const struct tcf_meta_ops *ops,
+                          struct tcf_ife_info *ife, u32 metaid, void *metaval,
+                          int len, bool atomic, bool exists)
 {
         struct tcf_meta_info *mi = NULL;
-        struct tcf_meta_ops *ops = find_ife_oplist(metaid);
         int ret = 0;
 
-        if (!ops)
-                return -ENOENT;
-
         mi = kzalloc(sizeof(*mi), atomic ? GFP_ATOMIC : GFP_KERNEL);
-        if (!mi) {
-                /*put back what find_ife_oplist took */
-                module_put(ops->owner);
+        if (!mi)
                 return -ENOMEM;
-        }
 
         mi->metaid = metaid;
         mi->ops = ops;
@@ -327,29 +313,47 @@ static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
                 ret = ops->alloc(mi, metaval, atomic ? GFP_ATOMIC : GFP_KERNEL);
                 if (ret != 0) {
                         kfree(mi);
-                        module_put(ops->owner);
                         return ret;
                 }
         }
 
+        if (exists)
+                spin_lock_bh(&ife->tcf_lock);
         list_add_tail(&mi->metalist, &ife->metalist);
+        if (exists)
+                spin_unlock_bh(&ife->tcf_lock);
+
+        return ret;
+}
+
+static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval,
+                        int len, bool exists)
+{
+        const struct tcf_meta_ops *ops = find_ife_oplist(metaid);
+        int ret;
 
+        if (!ops)
+                return -ENOENT;
+        ret = __add_metainfo(ops, ife, metaid, metaval, len, false, exists);
+        if (ret)
+                /*put back what find_ife_oplist took */
+                module_put(ops->owner);
         return ret;
 }
 
-static int use_all_metadata(struct tcf_ife_info *ife)
+static int use_all_metadata(struct tcf_ife_info *ife, bool exists)
 {
         struct tcf_meta_ops *o;
         int rc = 0;
         int installed = 0;
 
-        read_lock_bh(&ife_mod_lock);
+        read_lock(&ife_mod_lock);
         list_for_each_entry(o, &ifeoplist, list) {
-                rc = add_metainfo(ife, o->metaid, NULL, 0, true);
+                rc = __add_metainfo(o, ife, o->metaid, NULL, 0, true, exists);
                 if (rc == 0)
                         installed += 1;
         }
-        read_unlock_bh(&ife_mod_lock);
+        read_unlock(&ife_mod_lock);
 
         if (installed)
                 return 0;
@@ -422,7 +426,6 @@ static void tcf_ife_cleanup(struct tc_action *a)
                 kfree_rcu(p, rcu);
 }
 
-/* under ife->tcf_lock for existing action */
 static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb,
                              bool exists, bool rtnl_held)
 {
@@ -436,8 +439,7 @@ static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb,
                         val = nla_data(tb[i]);
                         len = nla_len(tb[i]);
 
-                        rc = load_metaops_and_vet(ife, i, val, len, exists,
-                                                  rtnl_held);
+                        rc = load_metaops_and_vet(i, val, len, rtnl_held);
                         if (rc != 0)
                                 return rc;
 
@@ -540,8 +542,6 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
                 p->eth_type = ife_type;
         }
 
-        if (exists)
-                spin_lock_bh(&ife->tcf_lock);
 
         if (ret == ACT_P_CREATED)
                 INIT_LIST_HEAD(&ife->metalist);
@@ -551,10 +551,7 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla,
                                        NULL, NULL);
                 if (err) {
 metadata_parse_err:
-                        if (exists)
-                                spin_unlock_bh(&ife->tcf_lock);
                         tcf_idr_release(*a, bind);
-
                         kfree(p);
                         return err;
                 }
@@ -569,17 +566,16 @@ metadata_parse_err:
                  * as we can. You better have at least one else we are
                  * going to bail out
                  */
-                err = use_all_metadata(ife);
+                err = use_all_metadata(ife, exists);
                 if (err) {
-                        if (exists)
-                                spin_unlock_bh(&ife->tcf_lock);
                         tcf_idr_release(*a, bind);
-
                         kfree(p);
                         return err;
                 }
         }
 
+        if (exists)
+                spin_lock_bh(&ife->tcf_lock);
         ife->tcf_action = parm->action;
         /* protected by tcf_lock when modifying existing action */
         rcu_swap_protected(ife->params, p, 1);
@@ -853,13 +849,6 @@ static int tcf_ife_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_ife_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, ife_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_ife_ops = {
         .kind = "ife",
         .type = TCA_ACT_IFE,
@@ -870,7 +859,6 @@ static struct tc_action_ops act_ife_ops = {
         .init = tcf_ife_init,
         .walk = tcf_ife_walker,
         .lookup = tcf_ife_search,
-        .delete = tcf_ife_delete,
         .size = sizeof(struct tcf_ife_info),
 };
 
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 51f235bbeb5b..23273b5303fd 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -337,13 +337,6 @@ static int tcf_ipt_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_ipt_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, ipt_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_ipt_ops = {
         .kind           =       "ipt",
         .type           =       TCA_ACT_IPT,
@@ -354,7 +347,6 @@ static struct tc_action_ops act_ipt_ops = {
         .init           =       tcf_ipt_init,
         .walk           =       tcf_ipt_walker,
         .lookup         =       tcf_ipt_search,
-        .delete         =       tcf_ipt_delete,
         .size           =       sizeof(struct tcf_ipt),
 };
 
@@ -395,13 +387,6 @@ static int tcf_xt_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_xt_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, xt_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_xt_ops = {
         .kind           =       "xt",
         .type           =       TCA_ACT_XT,
@@ -412,7 +397,6 @@ static struct tc_action_ops act_xt_ops = {
         .init           =       tcf_xt_init,
         .walk           =       tcf_xt_walker,
         .lookup         =       tcf_xt_search,
-        .delete         =       tcf_xt_delete,
         .size           =       sizeof(struct tcf_ipt),
 };
 
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 38fd20f10f67..8bf66d0a6800 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -395,13 +395,6 @@ static void tcf_mirred_put_dev(struct net_device *dev)
         dev_put(dev);
 }
 
-static int tcf_mirred_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, mirred_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_mirred_ops = {
         .kind           =       "mirred",
         .type           =       TCA_ACT_MIRRED,
@@ -416,7 +409,6 @@ static struct tc_action_ops act_mirred_ops = {
         .size           =       sizeof(struct tcf_mirred),
         .get_dev        =       tcf_mirred_get_dev,
         .put_dev        =       tcf_mirred_put_dev,
-        .delete         =       tcf_mirred_delete,
 };
 
 static __net_init int mirred_init_net(struct net *net)
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 822e903bfc25..4313aa102440 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -300,13 +300,6 @@ static int tcf_nat_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_nat_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, nat_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_nat_ops = {
         .kind           =       "nat",
         .type           =       TCA_ACT_NAT,
@@ -316,7 +309,6 @@ static struct tc_action_ops act_nat_ops = {
         .init           =       tcf_nat_init,
         .walk           =       tcf_nat_walker,
         .lookup         =       tcf_nat_search,
-        .delete         =       tcf_nat_delete,
         .size           =       sizeof(struct tcf_nat),
 };
 
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 8a7a7cb94e83..107034070019 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -460,13 +460,6 @@ static int tcf_pedit_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_pedit_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, pedit_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_pedit_ops = {
         .kind           =       "pedit",
         .type           =       TCA_ACT_PEDIT,
@@ -477,7 +470,6 @@ static struct tc_action_ops act_pedit_ops = {
         .init           =       tcf_pedit_init,
         .walk           =       tcf_pedit_walker,
         .lookup         =       tcf_pedit_search,
-        .delete         =       tcf_pedit_delete,
         .size           =       sizeof(struct tcf_pedit),
 };
 
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 06f0742db593..5d8bfa878477 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -320,13 +320,6 @@ static int tcf_police_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_police_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, police_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 MODULE_AUTHOR("Alexey Kuznetsov");
 MODULE_DESCRIPTION("Policing actions");
 MODULE_LICENSE("GPL");
@@ -340,7 +333,6 @@ static struct tc_action_ops act_police_ops = {
         .init           =       tcf_police_init,
         .walk           =       tcf_police_walker,
         .lookup         =       tcf_police_search,
-        .delete         =       tcf_police_delete,
         .size           =       sizeof(struct tcf_police),
 };
 
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 207b4132d1b0..44e9c00657bc 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -232,13 +232,6 @@ static int tcf_sample_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_sample_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, sample_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_sample_ops = {
         .kind     = "sample",
         .type     = TCA_ACT_SAMPLE,
@@ -249,7 +242,6 @@ static struct tc_action_ops act_sample_ops = {
         .cleanup  = tcf_sample_cleanup,
         .walk     = tcf_sample_walker,
         .lookup   = tcf_sample_search,
-        .delete   = tcf_sample_delete,
         .size     = sizeof(struct tcf_sample),
 };
 
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index e616523ba3c1..52400d49f81f 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -196,13 +196,6 @@ static int tcf_simp_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_simp_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, simp_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_simp_ops = {
         .kind           =       "simple",
         .type           =       TCA_ACT_SIMP,
@@ -213,7 +206,6 @@ static struct tc_action_ops act_simp_ops = {
         .init           =       tcf_simp_init,
         .walk           =       tcf_simp_walker,
         .lookup         =       tcf_simp_search,
-        .delete         =       tcf_simp_delete,
         .size           =       sizeof(struct tcf_defact),
 };
 
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 926d7bc4a89d..73e44ce2a883 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -299,13 +299,6 @@ static int tcf_skbedit_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_skbedit_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, skbedit_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_skbedit_ops = {
         .kind           =       "skbedit",
         .type           =       TCA_ACT_SKBEDIT,
@@ -316,7 +309,6 @@ static struct tc_action_ops act_skbedit_ops = {
         .cleanup        =       tcf_skbedit_cleanup,
         .walk           =       tcf_skbedit_walker,
         .lookup         =       tcf_skbedit_search,
-        .delete         =       tcf_skbedit_delete,
         .size           =       sizeof(struct tcf_skbedit),
 };
 
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index d6a1af0c4171..588077fafd6c 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -259,13 +259,6 @@ static int tcf_skbmod_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_skbmod_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, skbmod_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_skbmod_ops = {
         .kind           =       "skbmod",
         .type           =       TCA_ACT_SKBMOD,
@@ -276,7 +269,6 @@ static struct tc_action_ops act_skbmod_ops = {
         .cleanup        =       tcf_skbmod_cleanup,
         .walk           =       tcf_skbmod_walker,
         .lookup         =       tcf_skbmod_search,
-        .delete         =       tcf_skbmod_delete,
         .size           =       sizeof(struct tcf_skbmod),
 };
 
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 8f09cf08d8fe..420759153d5f 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -548,13 +548,6 @@ static int tunnel_key_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tunnel_key_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_tunnel_key_ops = {
         .kind           =       "tunnel_key",
         .type           =       TCA_ACT_TUNNEL_KEY,
@@ -565,7 +558,6 @@ static struct tc_action_ops act_tunnel_key_ops = {
         .cleanup        =       tunnel_key_release,
         .walk           =       tunnel_key_walker,
         .lookup         =       tunnel_key_search,
-        .delete         =       tunnel_key_delete,
         .size           =       sizeof(struct tcf_tunnel_key),
 };
 
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index 209e70ad2c09..033d273afe50 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -296,13 +296,6 @@ static int tcf_vlan_search(struct net *net, struct tc_action **a, u32 index,
         return tcf_idr_search(tn, a, index);
 }
 
-static int tcf_vlan_delete(struct net *net, u32 index)
-{
-        struct tc_action_net *tn = net_generic(net, vlan_net_id);
-
-        return tcf_idr_delete_index(tn, index);
-}
-
 static struct tc_action_ops act_vlan_ops = {
         .kind           =       "vlan",
         .type           =       TCA_ACT_VLAN,
@@ -313,7 +306,6 @@ static struct tc_action_ops act_vlan_ops = {
         .cleanup        =       tcf_vlan_cleanup,
         .walk           =       tcf_vlan_walker,
         .lookup         =       tcf_vlan_search,
-        .delete         =       tcf_vlan_delete,
         .size           =       sizeof(struct tcf_vlan),
 };
 
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index d5d2a6dc3921..f218ccf1e2d9 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -914,6 +914,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
         struct nlattr *opt = tca[TCA_OPTIONS];
         struct nlattr *tb[TCA_U32_MAX + 1];
         u32 htid, flags = 0;
+        size_t sel_size;
         int err;
 #ifdef CONFIG_CLS_U32_PERF
         size_t size;
@@ -1076,8 +1077,13 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
         }
 
         s = nla_data(tb[TCA_U32_SEL]);
+        sel_size = struct_size(s, keys, s->nkeys);
+        if (nla_len(tb[TCA_U32_SEL]) < sel_size) {
+                err = -EINVAL;
+                goto erridr;
+        }
 
-        n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL);
+        n = kzalloc(offsetof(typeof(*n), sel) + sel_size, GFP_KERNEL);
         if (n == NULL) {
                 err = -ENOBUFS;
                 goto erridr;
@@ -1092,7 +1098,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,
         }
 #endif
 
-        memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key));
+        memcpy(&n->sel, s, sel_size);
         RCU_INIT_POINTER(n->ht_up, ht);
         n->handle = handle;
         n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0;
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index 35fc7252187c..c07c30b916d5 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -64,7 +64,6 @@
 #include <linux/vmalloc.h>
 #include <linux/reciprocal_div.h>
 #include <net/netlink.h>
-#include <linux/version.h>
 #include <linux/if_vlan.h>
 #include <net/pkt_sched.h>
 #include <net/pkt_cls.h>
@@ -621,15 +620,20 @@ static bool cake_ddst(int flow_mode)
 }
 
 static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb,
-                     int flow_mode)
+                     int flow_mode, u16 flow_override, u16 host_override)
 {
-        u32 flow_hash = 0, srchost_hash, dsthost_hash;
+        u32 flow_hash = 0, srchost_hash = 0, dsthost_hash = 0;
         u16 reduced_hash, srchost_idx, dsthost_idx;
         struct flow_keys keys, host_keys;
 
         if (unlikely(flow_mode == CAKE_FLOW_NONE))
                 return 0;
 
+        /* If both overrides are set we can skip packet dissection entirely */
+        if ((flow_override || !(flow_mode & CAKE_FLOW_FLOWS)) &&
+            (host_override || !(flow_mode & CAKE_FLOW_HOSTS)))
+                goto skip_hash;
+
         skb_flow_dissect_flow_keys(skb, &keys,
                                    FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
 
@@ -676,6 +680,14 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb,
         if (flow_mode & CAKE_FLOW_FLOWS)
                 flow_hash = flow_hash_from_keys(&keys);
 
+skip_hash:
+        if (flow_override)
+                flow_hash = flow_override - 1;
+        if (host_override) {
+                dsthost_hash = host_override - 1;
+                srchost_hash = host_override - 1;
+        }
+
         if (!(flow_mode & CAKE_FLOW_FLOWS)) {
                 if (flow_mode & CAKE_FLOW_SRC_IP)
                         flow_hash ^= srchost_hash;
@@ -1571,7 +1583,7 @@ static u32 cake_classify(struct Qdisc *sch, struct cake_tin_data **t,
         struct cake_sched_data *q = qdisc_priv(sch);
         struct tcf_proto *filter;
         struct tcf_result res;
-        u32 flow = 0;
+        u16 flow = 0, host = 0;
         int result;
 
         filter = rcu_dereference_bh(q->filter_list);
@@ -1595,10 +1607,12 @@ static u32 cake_classify(struct Qdisc *sch, struct cake_tin_data **t,
 #endif
                 if (TC_H_MIN(res.classid) <= CAKE_QUEUES)
                         flow = TC_H_MIN(res.classid);
+                if (TC_H_MAJ(res.classid) <= (CAKE_QUEUES << 16))
+                        host = TC_H_MAJ(res.classid) >> 16;
         }
 hash:
         *t = cake_select_tin(sch, skb);
-        return flow ?: cake_hash(*t, skb, flow_mode) + 1;
+        return cake_hash(*t, skb, flow_mode, flow, host) + 1;
 }
 
 static void cake_reconfigure(struct Qdisc *sch);
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 93c0c225ab34..180b6640e531 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -213,9 +213,14 @@ static void tls_write_space(struct sock *sk)
 {
         struct tls_context *ctx = tls_get_ctx(sk);
 
-        /* We are already sending pages, ignore notification */
-        if (ctx->in_tcp_sendpages)
+        /* If in_tcp_sendpages call lower protocol write space handler
+         * to ensure we wake up any waiting operations there. For example
+         * if do_tcp_sendpages where to call sk_wait_event.
+         */
+        if (ctx->in_tcp_sendpages) {
+                ctx->sk_write_space(sk);
                 return;
+        }
 
         if (!sk->sk_write_pending && tls_is_pending_closed_record(ctx)) {
                 gfp_t sk_allocation = sk->sk_allocation;
diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
index 911ca6d3cb5a..bfe2dbea480b 100644
--- a/net/xdp/xdp_umem.c
+++ b/net/xdp/xdp_umem.c
@@ -74,14 +74,14 @@ int xdp_umem_assign_dev(struct xdp_umem *umem, struct net_device *dev,
                 return 0;
 
         if (!dev->netdev_ops->ndo_bpf || !dev->netdev_ops->ndo_xsk_async_xmit)
-                return force_zc ? -ENOTSUPP : 0; /* fail or fallback */
+                return force_zc ? -EOPNOTSUPP : 0; /* fail or fallback */
 
         bpf.command = XDP_QUERY_XSK_UMEM;
 
         rtnl_lock();
         err = xdp_umem_query(dev, queue_id);
         if (err) {
-                err = err < 0 ? -ENOTSUPP : -EBUSY;
+                err = err < 0 ? -EOPNOTSUPP : -EBUSY;
                 goto err_rtnl_unlock;
         }