30 files changed, 92 insertions, 65 deletions

diff --git a/Documentation/networking/segmentation-offloads.txt b/Documentation/networking/segmentation-offloads.txt
index f200467ade38..2f09455a993a 100644
--- a/Documentation/networking/segmentation-offloads.txt
+++ b/Documentation/networking/segmentation-offloads.txt
@@ -55,7 +55,7 @@ IPIP, SIT, GRE, UDP Tunnel, and Remote Checksum Offloads
 In addition to the offloads described above it is possible for a frame to
 contain additional headers such as an outer tunnel.  In order to account
 for such instances an additional set of segmentation offload types were
-introduced including SKB_GSO_IPIP, SKB_GSO_SIT, SKB_GSO_GRE, and
+introduced including SKB_GSO_IPXIP4, SKB_GSO_IPXIP6, SKB_GSO_GRE, and
 SKB_GSO_UDP_TUNNEL.  These extra segmentation types are used to identify
 cases where there are more than just 1 set of headers.  For example in the
 case of IPIP and SIT we should have the network and transport headers moved
diff --git a/MAINTAINERS b/MAINTAINERS
index 71d438072d57..154bf8fbf683 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9129,9 +9129,7 @@ F:	lib/random32.c
 NETWORKING [IPv4/IPv6]
 M:      "David S. Miller" <davem@davemloft.net>
 M:      Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
-M:      James Morris <jmorris@namei.org>
 M:      Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
-M:      Patrick McHardy <kaber@trash.net>
 L:      netdev@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
 S:      Maintained
diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
index 2d956cb59d06..01cab9548785 100644
--- a/drivers/net/arcnet/com20020-pci.c
+++ b/drivers/net/arcnet/com20020-pci.c
@@ -225,8 +225,10 @@ static int com20020pci_probe(struct pci_dev *pdev,
 
                 card = devm_kzalloc(&pdev->dev, sizeof(struct com20020_dev),
                                     GFP_KERNEL);
-                if (!card)
-                        return -ENOMEM;
+                if (!card) {
+                        ret = -ENOMEM;
+                        goto out_port;
+                }
 
                 card->index = i;
                 card->pci_priv = priv;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2865f31c6076..14ff622190a5 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1820,7 +1820,7 @@ err_undo_flags:
  */
 static int __bond_release_one(struct net_device *bond_dev,
                               struct net_device *slave_dev,
-                              bool all)
+                              bool all, bool unregister)
 {
         struct bonding *bond = netdev_priv(bond_dev);
         struct slave *slave, *oldcurrent;
@@ -1965,7 +1965,10 @@ static int __bond_release_one(struct net_device *bond_dev,
                 dev_set_mac_address(slave_dev, (struct sockaddr *)&ss);
         }
 
-        dev_set_mtu(slave_dev, slave->original_mtu);
+        if (unregister)
+                __dev_set_mtu(slave_dev, slave->original_mtu);
+        else
+                dev_set_mtu(slave_dev, slave->original_mtu);
 
         slave_dev->priv_flags &= ~IFF_BONDING;
 
@@ -1977,7 +1980,7 @@ static int __bond_release_one(struct net_device *bond_dev,
 /* A wrapper used because of ndo_del_link */
 int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
 {
-        return __bond_release_one(bond_dev, slave_dev, false);
+        return __bond_release_one(bond_dev, slave_dev, false, false);
 }
 
 /* First release a slave and then destroy the bond if no more slaves are left.
@@ -1989,7 +1992,7 @@ static int  bond_release_and_destroy(struct net_device *bond_dev,
         struct bonding *bond = netdev_priv(bond_dev);
         int ret;
 
-        ret = bond_release(bond_dev, slave_dev);
+        ret = __bond_release_one(bond_dev, slave_dev, false, true);
         if (ret == 0 && !bond_has_slaves(bond)) {
                 bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
                 netdev_info(bond_dev, "Destroying bond %s\n",
@@ -3060,7 +3063,7 @@ static int bond_slave_netdev_event(unsigned long event,
                 if (bond_dev->type != ARPHRD_ETHER)
                         bond_release_and_destroy(bond_dev, slave_dev);
                 else
-                        bond_release(bond_dev, slave_dev);
+                        __bond_release_one(bond_dev, slave_dev, false, true);
                 break;
         case NETDEV_UP:
         case NETDEV_CHANGE:
@@ -4252,7 +4255,7 @@ static void bond_uninit(struct net_device *bond_dev)
 
         /* Release the bonded slaves */
         bond_for_each_slave(bond, slave, iter)
-                __bond_release_one(bond_dev, slave->dev, true);
+                __bond_release_one(bond_dev, slave->dev, true, true);
         netdev_info(bond_dev, "Released all slaves\n");
 
         arr = rtnl_dereference(bond->slave_arr);
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index e69ebdd65658..26d25749c3e4 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -3314,10 +3314,11 @@ static const struct macb_config sama5d2_config = {
 
 static const struct macb_config sama5d3_config = {
         .caps = MACB_CAPS_SG_DISABLED | MACB_CAPS_GIGABIT_MODE_AVAILABLE
-              | MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII,
+              | MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII | MACB_CAPS_JUMBO,
         .dma_burst_length = 16,
         .clk_init = macb_clk_init,
         .init = macb_init,
+        .jumbo_max_len = 10240,
 };
 
 static const struct macb_config sama5d4_config = {
diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
index 6081c3132135..4b0ca9fb2cb4 100644
--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
@@ -221,7 +221,7 @@ static int cn23xx_pf_soft_reset(struct octeon_device *oct)
         /* Wait for 100ms as Octeon resets. */
         mdelay(100);
 
-        if (octeon_read_csr64(oct, CN23XX_SLI_SCRATCH1) == 0x1234ULL) {
+        if (octeon_read_csr64(oct, CN23XX_SLI_SCRATCH1)) {
                 dev_err(&oct->pci_dev->dev, "OCTEON[%d]: Soft reset failed\n",
                         oct->octeon_id);
                 return 1;
diff --git a/drivers/net/ethernet/cavium/liquidio/cn66xx_device.c b/drivers/net/ethernet/cavium/liquidio/cn66xx_device.c
index b28253c96d97..2df7440f58df 100644
--- a/drivers/net/ethernet/cavium/liquidio/cn66xx_device.c
+++ b/drivers/net/ethernet/cavium/liquidio/cn66xx_device.c
@@ -44,7 +44,7 @@ int lio_cn6xxx_soft_reset(struct octeon_device *oct)
         /* Wait for 10ms as Octeon resets. */
         mdelay(100);
 
-        if (octeon_read_csr64(oct, CN6XXX_SLI_SCRATCH1) == 0x1234ULL) {
+        if (octeon_read_csr64(oct, CN6XXX_SLI_SCRATCH1)) {
                 dev_err(&oct->pci_dev->dev, "Soft reset failed\n");
                 return 1;
         }
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
index c6700b91a2df..fe166e0f6781 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
@@ -300,9 +300,9 @@ static void fill_tso_desc(struct hnae_ring *ring, void *priv,
                              mtu);
 }
 
-int hns_nic_net_xmit_hw(struct net_device *ndev,
-                        struct sk_buff *skb,
-                        struct hns_nic_ring_data *ring_data)
+netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
+                                struct sk_buff *skb,
+                                struct hns_nic_ring_data *ring_data)
 {
         struct hns_nic_priv *priv = netdev_priv(ndev);
         struct hnae_ring *ring = ring_data->ring;
@@ -361,6 +361,10 @@ int hns_nic_net_xmit_hw(struct net_device *ndev,
         dev_queue = netdev_get_tx_queue(ndev, skb->queue_mapping);
         netdev_tx_sent_queue(dev_queue, skb->len);
 
+        netif_trans_update(ndev);
+        ndev->stats.tx_bytes += skb->len;
+        ndev->stats.tx_packets++;
+
         wmb(); /* commit all data before submit */
         assert(skb->queue_mapping < priv->ae_handle->q_num);
         hnae_queue_xmit(priv->ae_handle->qs[skb->queue_mapping], buf_num);
@@ -1469,17 +1473,11 @@ static netdev_tx_t hns_nic_net_xmit(struct sk_buff *skb,
                                     struct net_device *ndev)
 {
         struct hns_nic_priv *priv = netdev_priv(ndev);
-        int ret;
 
         assert(skb->queue_mapping < ndev->ae_handle->q_num);
-        ret = hns_nic_net_xmit_hw(ndev, skb,
-                                  &tx_ring_data(priv, skb->queue_mapping));
-        if (ret == NETDEV_TX_OK) {
-                netif_trans_update(ndev);
-                ndev->stats.tx_bytes += skb->len;
-                ndev->stats.tx_packets++;
-        }
-        return (netdev_tx_t)ret;
+
+        return hns_nic_net_xmit_hw(ndev, skb,
+                                   &tx_ring_data(priv, skb->queue_mapping));
 }
 
 static void hns_nic_drop_rx_fetch(struct hns_nic_ring_data *ring_data,
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.h b/drivers/net/ethernet/hisilicon/hns/hns_enet.h
index 1b83232082b2..9cb4c7884201 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.h
@@ -92,8 +92,8 @@ void hns_ethtool_set_ops(struct net_device *ndev);
 void hns_nic_net_reset(struct net_device *ndev);
 void hns_nic_net_reinit(struct net_device *netdev);
 int hns_nic_init_phy(struct net_device *ndev, struct hnae_handle *h);
-int hns_nic_net_xmit_hw(struct net_device *ndev,
-                        struct sk_buff *skb,
-                        struct hns_nic_ring_data *ring_data);
+netdev_tx_t hns_nic_net_xmit_hw(struct net_device *ndev,
+                                struct sk_buff *skb,
+                                struct hns_nic_ring_data *ring_data);
 
 #endif  /**__HNS_ENET_H */
diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
index e5221d95afe1..017e08452d8c 100644
--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
@@ -261,7 +261,7 @@ static int hns_mdio_write(struct mii_bus *bus,
 
                 /* config the data needed writing */
                 cmd_reg_cfg = devad;
-                op = MDIO_C45_WRITE_ADDR;
+                op = MDIO_C45_WRITE_DATA;
         }
 
         MDIO_SET_REG_FIELD(mdio_dev, MDIO_WDATA_REG, MDIO_WDATA_DATA_M,
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 41a5c5d2ac89..b3d0c2e6347a 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -2401,15 +2401,10 @@ static int mtk_probe(struct platform_device *pdev)
 {
         struct resource *res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         struct device_node *mac_np;
-        const struct of_device_id *match;
-        struct mtk_soc_data *soc;
         struct mtk_eth *eth;
         int err;
         int i;
 
-        match = of_match_device(of_mtk_match, &pdev->dev);
-        soc = (struct mtk_soc_data *)match->data;
-
         eth = devm_kzalloc(&pdev->dev, sizeof(*eth), GFP_KERNEL);
         if (!eth)
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
index fc10f27e0a0c..6a65c8b33807 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
@@ -356,6 +356,7 @@ err_free_app_priv:
 
 static void nfp_flower_clean(struct nfp_app *app)
 {
+        nfp_flower_metadata_cleanup(app);
         vfree(app->priv);
         app->priv = NULL;
 }
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 2e69bcdc5b07..99a26a9efec1 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2229,6 +2229,7 @@ static int virtnet_find_vqs(struct virtnet_info *vi)
         kfree(names);
         kfree(callbacks);
         kfree(vqs);
+        kfree(ctx);
 
         return 0;
 
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index f4d0054981c6..8a1eaf3c302a 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -922,15 +922,10 @@ static int vrf_del_slave(struct net_device *dev, struct net_device *port_dev)
 static void vrf_dev_uninit(struct net_device *dev)
 {
         struct net_vrf *vrf = netdev_priv(dev);
-        struct net_device *port_dev;
-        struct list_head *iter;
 
         vrf_rtable_release(dev, vrf);
         vrf_rt6_release(dev, vrf);
 
-        netdev_for_each_lower_dev(dev, port_dev, iter)
-                vrf_del_slave(dev, port_dev);
-
         free_percpu(dev->dstats);
         dev->dstats = NULL;
 }
@@ -1386,6 +1381,12 @@ static int vrf_validate(struct nlattr *tb[], struct nlattr *data[],
 
 static void vrf_dellink(struct net_device *dev, struct list_head *head)
 {
+        struct net_device *port_dev;
+        struct list_head *iter;
+
+        netdev_for_each_lower_dev(dev, port_dev, iter)
+                vrf_del_slave(dev, port_dev);
+
         unregister_netdevice_queue(dev, head);
 }
 
diff --git a/drivers/ptp/ptp_dte.c b/drivers/ptp/ptp_dte.c
index 00145a3f1e70..faf6f7a83713 100644
--- a/drivers/ptp/ptp_dte.c
+++ b/drivers/ptp/ptp_dte.c
@@ -40,7 +40,7 @@
 #define DTE_WRAP_AROUND_NSEC_SHIFT 44
 
 /* 44 bits NCO */
-#define DTE_NCO_MAX_NS  0xFFFFFFFFFFF
+#define DTE_NCO_MAX_NS  0xFFFFFFFFFFFLL
 
 /* 125MHz with 3.29 reg cfg */
 #define DTE_PPB_ADJ(ppb) (u32)(div64_u64((((u64)abs(ppb) * BIT(28)) +\
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index e48ee2eaaa3e..779b23595596 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3284,6 +3284,7 @@ void __dev_notify_flags(struct net_device *, unsigned int old_flags,
 int dev_change_name(struct net_device *, const char *);
 int dev_set_alias(struct net_device *, const char *, size_t);
 int dev_change_net_namespace(struct net_device *, struct net *, const char *);
+int __dev_set_mtu(struct net_device *, int);
 int dev_set_mtu(struct net_device *, int);
 void dev_set_group(struct net_device *, int);
 int dev_set_mac_address(struct net_device *, struct sockaddr *);
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 0fbf73dd531a..199056933dcb 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -22,6 +22,7 @@ struct route_info {
 #include <net/flow.h>
 #include <net/ip6_fib.h>
 #include <net/sock.h>
+#include <net/lwtunnel.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/route.h>
@@ -232,4 +233,11 @@ static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt,
                 return daddr;
 }
 
+static inline bool rt6_duplicate_nexthop(struct rt6_info *a, struct rt6_info *b)
+{
+        return a->dst.dev == b->dst.dev &&
+               a->rt6i_idev == b->rt6i_idev &&
+               ipv6_addr_equal(&a->rt6i_gateway, &b->rt6i_gateway) &&
+               !lwtunnel_cmp_encap(a->dst.lwtstate, b->dst.lwtstate);
+}
 #endif
diff --git a/include/net/sock.h b/include/net/sock.h
index 48e4d5c38f85..8c85791fc196 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1697,6 +1697,7 @@ static inline void sock_orphan(struct sock *sk)
 
 static inline void sock_graft(struct sock *sk, struct socket *parent)
 {
+        WARN_ON(parent->sk);
         write_lock_bh(&sk->sk_callback_lock);
         sk->sk_wq = parent->wq;
         parent->sk = sk;
diff --git a/net/bridge/netfilter/ebt_nflog.c b/net/bridge/netfilter/ebt_nflog.c
index c1dc48686200..da1c2fdc08c8 100644
--- a/net/bridge/netfilter/ebt_nflog.c
+++ b/net/bridge/netfilter/ebt_nflog.c
@@ -30,6 +30,7 @@ ebt_nflog_tg(struct sk_buff *skb, const struct xt_action_param *par)
         li.u.ulog.copy_len = info->len;
         li.u.ulog.group = info->group;
         li.u.ulog.qthreshold = info->threshold;
+        li.u.ulog.flags = 0;
 
         nf_log_packet(net, PF_BRIDGE, xt_hooknum(par), skb, xt_in(par),
                       xt_out(par), &li, "%s", info->prefix);
diff --git a/net/core/dev.c b/net/core/dev.c
index 7098fba52be1..02440518dd69 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6765,7 +6765,7 @@ int dev_change_flags(struct net_device *dev, unsigned int flags)
 }
 EXPORT_SYMBOL(dev_change_flags);
 
-static int __dev_set_mtu(struct net_device *dev, int new_mtu)
+int __dev_set_mtu(struct net_device *dev, int new_mtu)
 {
         const struct net_device_ops *ops = dev->netdev_ops;
 
@@ -6775,6 +6775,7 @@ static int __dev_set_mtu(struct net_device *dev, int new_mtu)
         dev->mtu = new_mtu;
         return 0;
 }
+EXPORT_SYMBOL(__dev_set_mtu);
 
 /**
  *      dev_set_mtu - Change maximum transfer unit
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 6ec6900eb300..a20e7f03d5f7 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -943,9 +943,9 @@ struct tcp_md5sig_key *tcp_md5_do_lookup(const struct sock *sk,
 }
 EXPORT_SYMBOL(tcp_md5_do_lookup);
 
-struct tcp_md5sig_key *tcp_md5_do_lookup_exact(const struct sock *sk,
-                                               const union tcp_md5_addr *addr,
-                                               int family, u8 prefixlen)
+static struct tcp_md5sig_key *tcp_md5_do_lookup_exact(const struct sock *sk,
+                                                      const union tcp_md5_addr *addr,
+                                                      int family, u8 prefixlen)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_md5sig_key *key;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 5477ba729c36..ebb299cf72b7 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -786,10 +786,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                                 goto next_iter;
                         }
 
-                        if (iter->dst.dev == rt->dst.dev &&
-                            iter->rt6i_idev == rt->rt6i_idev &&
-                            ipv6_addr_equal(&iter->rt6i_gateway,
-                                            &rt->rt6i_gateway)) {
+                        if (rt6_duplicate_nexthop(iter, rt)) {
                                 if (rt->rt6i_nsiblings)
                                         rt->rt6i_nsiblings = 0;
                                 if (!(iter->rt6i_flags & RTF_EXPIRES))
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0488a24c2a44..4d30c96a819d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3036,17 +3036,11 @@ static int ip6_route_info_append(struct list_head *rt6_nh_list,
                                  struct rt6_info *rt, struct fib6_config *r_cfg)
 {
         struct rt6_nh *nh;
-        struct rt6_info *rtnh;
         int err = -EEXIST;
 
         list_for_each_entry(nh, rt6_nh_list, next) {
                 /* check if rt6_info already exists */
-                rtnh = nh->rt6_info;
-
-                if (rtnh->dst.dev == rt->dst.dev &&
-                    rtnh->rt6i_idev == rt->rt6i_idev &&
-                    ipv6_addr_equal(&rtnh->rt6i_gateway,
-                                    &rt->rt6i_gateway))
+                if (rt6_duplicate_nexthop(nh->rt6_info, rt))
                         return err;
         }
 
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index bdcfb2d04cd2..ea4f481839dd 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -2076,6 +2076,7 @@ static int mpls_getroute(struct sk_buff *in_skb, struct nlmsghdr *in_nlh,
 {
         struct net *net = sock_net(in_skb->sk);
         u32 portid = NETLINK_CB(in_skb).portid;
+        u32 in_label = LABEL_NOT_SPECIFIED;
         struct nlattr *tb[RTA_MAX + 1];
         u32 labels[MAX_NEW_LABELS];
         struct mpls_shim_hdr *hdr;
@@ -2086,9 +2087,8 @@ static int mpls_getroute(struct sk_buff *in_skb, struct nlmsghdr *in_nlh,
         struct nlmsghdr *nlh;
         struct sk_buff *skb;
         struct mpls_nh *nh;
-        int err = -EINVAL;
-        u32 in_label;
         u8 n_labels;
+        int err;
 
         err = nlmsg_parse(in_nlh, sizeof(*rtm), tb, RTA_MAX,
                           rtm_mpls_policy, extack);
@@ -2101,11 +2101,15 @@ static int mpls_getroute(struct sk_buff *in_skb, struct nlmsghdr *in_nlh,
                 u8 label_count;
 
                 if (nla_get_labels(tb[RTA_DST], 1, &label_count,
-                                   &in_label, extack))
+                                   &in_label, extack)) {
+                        err = -EINVAL;
                         goto errout;
+                }
 
-                if (in_label < MPLS_LABEL_FIRST_UNRESERVED)
+                if (!mpls_label_ok(net, in_label, extack)) {
+                        err = -EINVAL;
                         goto errout;
+                }
         }
 
         rt = mpls_route_input_rcu(net, in_label);
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index b553fdd68816..4707d997558a 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -872,6 +872,11 @@ static int dccp_init_net(struct net *net, u_int16_t proto)
         return dccp_kmemdup_sysctl_table(net, pn, dn);
 }
 
+static struct nf_proto_net *dccp_get_net_proto(struct net *net)
+{
+        return &net->ct.nf_ct_proto.dccp.pn;
+}
+
 struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4 __read_mostly = {
         .l3proto                = AF_INET,
         .l4proto                = IPPROTO_DCCP,
@@ -904,6 +909,7 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp4 __read_mostly = {
         },
 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
         .init_net               = dccp_init_net,
+        .get_net_proto          = dccp_get_net_proto,
 };
 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_dccp4);
 
@@ -939,5 +945,6 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_dccp6 __read_mostly = {
         },
 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
         .init_net               = dccp_init_net,
+        .get_net_proto          = dccp_get_net_proto,
 };
 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_dccp6);
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 31c6c8ee9d5d..6eef29d2eec4 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -783,6 +783,11 @@ static int sctp_init_net(struct net *net, u_int16_t proto)
         return sctp_kmemdup_sysctl_table(pn, sn);
 }
 
+static struct nf_proto_net *sctp_get_net_proto(struct net *net)
+{
+        return &net->ct.nf_ct_proto.sctp.pn;
+}
+
 struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = {
         .l3proto                = PF_INET,
         .l4proto                = IPPROTO_SCTP,
@@ -816,6 +821,7 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp4 __read_mostly = {
         },
 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
         .init_net               = sctp_init_net,
+        .get_net_proto          = sctp_get_net_proto,
 };
 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_sctp4);
 
@@ -852,5 +858,6 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
 #endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
 #endif
         .init_net               = sctp_init_net,
+        .get_net_proto          = sctp_get_net_proto,
 };
 EXPORT_SYMBOL_GPL(nf_conntrack_l4proto_sctp6);
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index c6dc8caaf5ca..c061d6eb465d 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -136,7 +136,7 @@ int rds_tcp_accept_one(struct socket *sock)
         if (!sock) /* module unload or netns delete in progress */
                 return -ENETUNREACH;
 
-        ret = sock_create_kern(sock_net(sock->sk), sock->sk->sk_family,
+        ret = sock_create_lite(sock->sk->sk_family,
                                sock->sk->sk_type, sock->sk->sk_protocol,
                                &new_sock);
         if (ret)
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index f5b45b8b8b16..2a186b201ad2 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -252,6 +252,8 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
         fl6->flowi6_proto = IPPROTO_SCTP;
         if (ipv6_addr_type(&daddr->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL)
                 fl6->flowi6_oif = daddr->v6.sin6_scope_id;
+        else if (asoc)
+                fl6->flowi6_oif = asoc->base.sk->sk_bound_dev_if;
 
         pr_debug("%s: dst=%pI6 ", __func__, &fl6->daddr);
 
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index a03130a47b85..60aff60e30ad 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -272,7 +272,7 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
                 goto out;
         }
 
-        if (len == sizeof(crypto_info)) {
+        if (len == sizeof(*crypto_info)) {
                 if (copy_to_user(optval, crypto_info, sizeof(*crypto_info)))
                         rc = -EFAULT;
                 goto out;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 45ba3d0872cc..8ce85420ecb0 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -291,8 +291,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
         [NL80211_ATTR_PID] = { .type = NLA_U32 },
         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
-        [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
-                                 .len = WLAN_PMKID_LEN },
+        [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
@@ -348,6 +347,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
+        [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
@@ -520,7 +520,7 @@ nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 static const struct nla_policy
 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
-        [NL80211_NAN_FUNC_SERVICE_ID] = { .type = NLA_BINARY,
+        [NL80211_NAN_FUNC_SERVICE_ID] = {
                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
@@ -6469,6 +6469,10 @@ static int validate_scan_freqs(struct nlattr *freqs)
         struct nlattr *attr1, *attr2;
         int n_channels = 0, tmp1, tmp2;
 
+        nla_for_each_nested(attr1, freqs, tmp1)
+                if (nla_len(attr1) != sizeof(u32))
+                        return 0;
+
         nla_for_each_nested(attr1, freqs, tmp1) {
                 n_channels++;
                 /*