121 files changed, 1064 insertions, 450 deletions

diff --git a/Documentation/devicetree/bindings/net/ethernet.txt b/Documentation/devicetree/bindings/net/ethernet.txt
index e1d76812419c..05150957ecfd 100644
--- a/Documentation/devicetree/bindings/net/ethernet.txt
+++ b/Documentation/devicetree/bindings/net/ethernet.txt
@@ -9,10 +9,26 @@ The following properties are common to the Ethernet controllers:
 - max-speed: number, specifies maximum speed in Mbit/s supported by the device;
 - max-frame-size: number, maximum transfer unit (IEEE defined MTU), rather than
   the maximum frame size (there's contradiction in ePAPR).
-- phy-mode: string, operation mode of the PHY interface; supported values are
-  "mii", "gmii", "sgmii", "qsgmii", "tbi", "rev-mii", "rmii", "rgmii", "rgmii-id",
-  "rgmii-rxid", "rgmii-txid", "rtbi", "smii", "xgmii", "trgmii"; this is now a
-  de-facto standard property;
+- phy-mode: string, operation mode of the PHY interface. This is now a de-facto
+  standard property; supported values are:
+  * "mii"
+  * "gmii"
+  * "sgmii"
+  * "qsgmii"
+  * "tbi"
+  * "rev-mii"
+  * "rmii"
+  * "rgmii" (RX and TX delays are added by the MAC when required)
+  * "rgmii-id" (RGMII with internal RX and TX delays provided by the PHY, the
+     MAC should not add the RX or TX delays in this case)
+  * "rgmii-rxid" (RGMII with internal RX delay provided by the PHY, the MAC
+     should not add an RX delay in this case)
+  * "rgmii-txid" (RGMII with internal TX delay provided by the PHY, the MAC
+     should not add an TX delay in this case)
+  * "rtbi"
+  * "smii"
+  * "xgmii"
+  * "trgmii"
 - phy-connection-type: the same as "phy-mode" property but described in ePAPR;
 - phy-handle: phandle, specifies a reference to a node representing a PHY
   device; this property is described in ePAPR and so preferred;
diff --git a/Documentation/networking/nf_conntrack-sysctl.txt b/Documentation/networking/nf_conntrack-sysctl.txt
index 399e4e866a9c..433b6724797a 100644
--- a/Documentation/networking/nf_conntrack-sysctl.txt
+++ b/Documentation/networking/nf_conntrack-sysctl.txt
@@ -62,10 +62,13 @@ nf_conntrack_generic_timeout - INTEGER (seconds)
         protocols.
 
 nf_conntrack_helper - BOOLEAN
-        0 - disabled
-        not 0 - enabled (default)
+        0 - disabled (default)
+        not 0 - enabled
 
         Enable automatic conntrack helper assignment.
+        If disabled it is required to set up iptables rules to assign
+        helpers to connections.  See the CT target description in the
+        iptables-extensions(8) man page for further information.
 
 nf_conntrack_icmp_timeout - INTEGER (seconds)
         default 30
diff --git a/drivers/net/can/usb/peak_usb/pcan_ucan.h b/drivers/net/can/usb/peak_usb/pcan_ucan.h
index e8fc4952c6b0..2147678f0225 100644
--- a/drivers/net/can/usb/peak_usb/pcan_ucan.h
+++ b/drivers/net/can/usb/peak_usb/pcan_ucan.h
@@ -43,11 +43,22 @@ struct __packed pucan_command {
         u16     args[3];
 };
 
+#define PUCAN_TSLOW_BRP_BITS            10
+#define PUCAN_TSLOW_TSGEG1_BITS         8
+#define PUCAN_TSLOW_TSGEG2_BITS         7
+#define PUCAN_TSLOW_SJW_BITS            7
+
+#define PUCAN_TSLOW_BRP_MASK            ((1 << PUCAN_TSLOW_BRP_BITS) - 1)
+#define PUCAN_TSLOW_TSEG1_MASK          ((1 << PUCAN_TSLOW_TSGEG1_BITS) - 1)
+#define PUCAN_TSLOW_TSEG2_MASK          ((1 << PUCAN_TSLOW_TSGEG2_BITS) - 1)
+#define PUCAN_TSLOW_SJW_MASK            ((1 << PUCAN_TSLOW_SJW_BITS) - 1)
+
 /* uCAN TIMING_SLOW command fields */
-#define PUCAN_TSLOW_SJW_T(s, t)         (((s) & 0xf) | ((!!(t)) << 7))
-#define PUCAN_TSLOW_TSEG2(t)            ((t) & 0xf)
-#define PUCAN_TSLOW_TSEG1(t)            ((t) & 0x3f)
-#define PUCAN_TSLOW_BRP(b)              ((b) & 0x3ff)
+#define PUCAN_TSLOW_SJW_T(s, t)         (((s) & PUCAN_TSLOW_SJW_MASK) | \
+                                                                ((!!(t)) << 7))
+#define PUCAN_TSLOW_TSEG2(t)            ((t) & PUCAN_TSLOW_TSEG2_MASK)
+#define PUCAN_TSLOW_TSEG1(t)            ((t) & PUCAN_TSLOW_TSEG1_MASK)
+#define PUCAN_TSLOW_BRP(b)              ((b) & PUCAN_TSLOW_BRP_MASK)
 
 struct __packed pucan_timing_slow {
         __le16  opcode_channel;
@@ -60,11 +71,21 @@ struct __packed pucan_timing_slow {
         __le16  brp;            /* BaudRate Prescaler */
 };
 
+#define PUCAN_TFAST_BRP_BITS            10
+#define PUCAN_TFAST_TSGEG1_BITS         5
+#define PUCAN_TFAST_TSGEG2_BITS         4
+#define PUCAN_TFAST_SJW_BITS            4
+
+#define PUCAN_TFAST_BRP_MASK            ((1 << PUCAN_TFAST_BRP_BITS) - 1)
+#define PUCAN_TFAST_TSEG1_MASK          ((1 << PUCAN_TFAST_TSGEG1_BITS) - 1)
+#define PUCAN_TFAST_TSEG2_MASK          ((1 << PUCAN_TFAST_TSGEG2_BITS) - 1)
+#define PUCAN_TFAST_SJW_MASK            ((1 << PUCAN_TFAST_SJW_BITS) - 1)
+
 /* uCAN TIMING_FAST command fields */
-#define PUCAN_TFAST_SJW(s)              ((s) & 0x3)
-#define PUCAN_TFAST_TSEG2(t)            ((t) & 0x7)
-#define PUCAN_TFAST_TSEG1(t)            ((t) & 0xf)
-#define PUCAN_TFAST_BRP(b)              ((b) & 0x3ff)
+#define PUCAN_TFAST_SJW(s)              ((s) & PUCAN_TFAST_SJW_MASK)
+#define PUCAN_TFAST_TSEG2(t)            ((t) & PUCAN_TFAST_TSEG2_MASK)
+#define PUCAN_TFAST_TSEG1(t)            ((t) & PUCAN_TFAST_TSEG1_MASK)
+#define PUCAN_TFAST_BRP(b)              ((b) & PUCAN_TFAST_BRP_MASK)
 
 struct __packed pucan_timing_fast {
         __le16  opcode_channel;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index c06382cdfdfe..f3141ca56bc3 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -39,6 +39,7 @@ static struct usb_device_id peak_usb_table[] = {
         {USB_DEVICE(PCAN_USB_VENDOR_ID, PCAN_USBPRO_PRODUCT_ID)},
         {USB_DEVICE(PCAN_USB_VENDOR_ID, PCAN_USBFD_PRODUCT_ID)},
         {USB_DEVICE(PCAN_USB_VENDOR_ID, PCAN_USBPROFD_PRODUCT_ID)},
+        {USB_DEVICE(PCAN_USB_VENDOR_ID, PCAN_USBX6_PRODUCT_ID)},
         {} /* Terminating entry */
 };
 
@@ -50,6 +51,7 @@ static const struct peak_usb_adapter *const peak_usb_adapters_list[] = {
         &pcan_usb_pro,
         &pcan_usb_fd,
         &pcan_usb_pro_fd,
+        &pcan_usb_x6,
 };
 
 /*
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.h b/drivers/net/can/usb/peak_usb/pcan_usb_core.h
index 506fe506c9d3..3cbfb069893d 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.h
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.h
@@ -27,6 +27,7 @@
 #define PCAN_USBPRO_PRODUCT_ID          0x000d
 #define PCAN_USBPROFD_PRODUCT_ID        0x0011
 #define PCAN_USBFD_PRODUCT_ID           0x0012
+#define PCAN_USBX6_PRODUCT_ID           0x0014
 
 #define PCAN_USB_DRIVER_NAME            "peak_usb"
 
@@ -90,6 +91,7 @@ extern const struct peak_usb_adapter pcan_usb;
 extern const struct peak_usb_adapter pcan_usb_pro;
 extern const struct peak_usb_adapter pcan_usb_fd;
 extern const struct peak_usb_adapter pcan_usb_pro_fd;
+extern const struct peak_usb_adapter pcan_usb_x6;
 
 struct peak_time_ref {
         struct timeval tv_host_0, tv_host;
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index ce44a033f63b..304732550f0a 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -993,24 +993,24 @@ static void pcan_usb_fd_free(struct peak_usb_device *dev)
 static const struct can_bittiming_const pcan_usb_fd_const = {
         .name = "pcan_usb_fd",
         .tseg1_min = 1,
-        .tseg1_max = 64,
+        .tseg1_max = (1 << PUCAN_TSLOW_TSGEG1_BITS),
         .tseg2_min = 1,
-        .tseg2_max = 16,
-        .sjw_max = 16,
+        .tseg2_max = (1 << PUCAN_TSLOW_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TSLOW_SJW_BITS),
         .brp_min = 1,
-        .brp_max = 1024,
+        .brp_max = (1 << PUCAN_TSLOW_BRP_BITS),
         .brp_inc = 1,
 };
 
 static const struct can_bittiming_const pcan_usb_fd_data_const = {
         .name = "pcan_usb_fd",
         .tseg1_min = 1,
-        .tseg1_max = 16,
+        .tseg1_max = (1 << PUCAN_TFAST_TSGEG1_BITS),
         .tseg2_min = 1,
-        .tseg2_max = 8,
-        .sjw_max = 4,
+        .tseg2_max = (1 << PUCAN_TFAST_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TFAST_SJW_BITS),
         .brp_min = 1,
-        .brp_max = 1024,
+        .brp_max = (1 << PUCAN_TFAST_BRP_BITS),
         .brp_inc = 1,
 };
 
@@ -1065,24 +1065,24 @@ const struct peak_usb_adapter pcan_usb_fd = {
 static const struct can_bittiming_const pcan_usb_pro_fd_const = {
         .name = "pcan_usb_pro_fd",
         .tseg1_min = 1,
-        .tseg1_max = 64,
+        .tseg1_max = (1 << PUCAN_TSLOW_TSGEG1_BITS),
         .tseg2_min = 1,
-        .tseg2_max = 16,
-        .sjw_max = 16,
+        .tseg2_max = (1 << PUCAN_TSLOW_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TSLOW_SJW_BITS),
         .brp_min = 1,
-        .brp_max = 1024,
+        .brp_max = (1 << PUCAN_TSLOW_BRP_BITS),
         .brp_inc = 1,
 };
 
 static const struct can_bittiming_const pcan_usb_pro_fd_data_const = {
         .name = "pcan_usb_pro_fd",
         .tseg1_min = 1,
-        .tseg1_max = 16,
+        .tseg1_max = (1 << PUCAN_TFAST_TSGEG1_BITS),
         .tseg2_min = 1,
-        .tseg2_max = 8,
-        .sjw_max = 4,
+        .tseg2_max = (1 << PUCAN_TFAST_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TFAST_SJW_BITS),
         .brp_min = 1,
-        .brp_max = 1024,
+        .brp_max = (1 << PUCAN_TFAST_BRP_BITS),
         .brp_inc = 1,
 };
 
@@ -1132,3 +1132,75 @@ const struct peak_usb_adapter pcan_usb_pro_fd = {
 
         .do_get_berr_counter = pcan_usb_fd_get_berr_counter,
 };
+
+/* describes the PCAN-USB X6 adapter */
+static const struct can_bittiming_const pcan_usb_x6_const = {
+        .name = "pcan_usb_x6",
+        .tseg1_min = 1,
+        .tseg1_max = (1 << PUCAN_TSLOW_TSGEG1_BITS),
+        .tseg2_min = 1,
+        .tseg2_max = (1 << PUCAN_TSLOW_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TSLOW_SJW_BITS),
+        .brp_min = 1,
+        .brp_max = (1 << PUCAN_TSLOW_BRP_BITS),
+        .brp_inc = 1,
+};
+
+static const struct can_bittiming_const pcan_usb_x6_data_const = {
+        .name = "pcan_usb_x6",
+        .tseg1_min = 1,
+        .tseg1_max = (1 << PUCAN_TFAST_TSGEG1_BITS),
+        .tseg2_min = 1,
+        .tseg2_max = (1 << PUCAN_TFAST_TSGEG2_BITS),
+        .sjw_max = (1 << PUCAN_TFAST_SJW_BITS),
+        .brp_min = 1,
+        .brp_max = (1 << PUCAN_TFAST_BRP_BITS),
+        .brp_inc = 1,
+};
+
+const struct peak_usb_adapter pcan_usb_x6 = {
+        .name = "PCAN-USB X6",
+        .device_id = PCAN_USBX6_PRODUCT_ID,
+        .ctrl_count = PCAN_USBPROFD_CHANNEL_COUNT,
+        .ctrlmode_supported = CAN_CTRLMODE_FD |
+                        CAN_CTRLMODE_3_SAMPLES | CAN_CTRLMODE_LISTENONLY,
+        .clock = {
+                .freq = PCAN_UFD_CRYSTAL_HZ,
+        },
+        .bittiming_const = &pcan_usb_x6_const,
+        .data_bittiming_const = &pcan_usb_x6_data_const,
+
+        /* size of device private data */
+        .sizeof_dev_private = sizeof(struct pcan_usb_fd_device),
+
+        /* timestamps usage */
+        .ts_used_bits = 32,
+        .ts_period = 1000000, /* calibration period in ts. */
+        .us_per_ts_scale = 1, /* us = (ts * scale) >> shift */
+        .us_per_ts_shift = 0,
+
+        /* give here messages in/out endpoints */
+        .ep_msg_in = PCAN_USBPRO_EP_MSGIN,
+        .ep_msg_out = {PCAN_USBPRO_EP_MSGOUT_0, PCAN_USBPRO_EP_MSGOUT_1},
+
+        /* size of rx/tx usb buffers */
+        .rx_buffer_size = PCAN_UFD_RX_BUFFER_SIZE,
+        .tx_buffer_size = PCAN_UFD_TX_BUFFER_SIZE,
+
+        /* device callbacks */
+        .intf_probe = pcan_usb_pro_probe,       /* same as PCAN-USB Pro */
+        .dev_init = pcan_usb_fd_init,
+
+        .dev_exit = pcan_usb_fd_exit,
+        .dev_free = pcan_usb_fd_free,
+        .dev_set_bus = pcan_usb_fd_set_bus,
+        .dev_set_bittiming = pcan_usb_fd_set_bittiming_slow,
+        .dev_set_data_bittiming = pcan_usb_fd_set_bittiming_fast,
+        .dev_decode_buf = pcan_usb_fd_decode_buf,
+        .dev_start = pcan_usb_fd_start,
+        .dev_stop = pcan_usb_fd_stop,
+        .dev_restart_async = pcan_usb_fd_restart_async,
+        .dev_encode_msg = pcan_usb_fd_encode_msg,
+
+        .do_get_berr_counter = pcan_usb_fd_get_berr_counter,
+};
diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c
index bda31f308cc2..a0eee7218695 100644
--- a/drivers/net/ethernet/altera/altera_tse_main.c
+++ b/drivers/net/ethernet/altera/altera_tse_main.c
@@ -400,12 +400,6 @@ static int tse_rx(struct altera_tse_private *priv, int limit)
 
                 skb_put(skb, pktlength);
 
-                /* make cache consistent with receive packet buffer */
-                dma_sync_single_for_cpu(priv->device,
-                                        priv->rx_ring[entry].dma_addr,
-                                        priv->rx_ring[entry].len,
-                                        DMA_FROM_DEVICE);
-
                 dma_unmap_single(priv->device, priv->rx_ring[entry].dma_addr,
                                  priv->rx_ring[entry].len, DMA_FROM_DEVICE);
 
@@ -469,7 +463,6 @@ static int tse_tx_complete(struct altera_tse_private *priv)
 
         if (unlikely(netif_queue_stopped(priv->dev) &&
                      tse_tx_avail(priv) > TSE_TX_THRESH(priv))) {
-                netif_tx_lock(priv->dev);
                 if (netif_queue_stopped(priv->dev) &&
                     tse_tx_avail(priv) > TSE_TX_THRESH(priv)) {
                         if (netif_msg_tx_done(priv))
@@ -477,7 +470,6 @@ static int tse_tx_complete(struct altera_tse_private *priv)
                                            __func__);
                         netif_wake_queue(priv->dev);
                 }
-                netif_tx_unlock(priv->dev);
         }
 
         spin_unlock(&priv->tx_lock);
@@ -592,10 +584,6 @@ static int tse_start_xmit(struct sk_buff *skb, struct net_device *dev)
         buffer->dma_addr = dma_addr;
         buffer->len = nopaged_len;
 
-        /* Push data out of the cache hierarchy into main memory */
-        dma_sync_single_for_device(priv->device, buffer->dma_addr,
-                                   buffer->len, DMA_TO_DEVICE);
-
         priv->dmaops->tx_buffer(priv, buffer);
 
         skb_tx_timestamp(skb);
@@ -819,6 +807,8 @@ static int init_phy(struct net_device *dev)
 
         if (!phydev) {
                 netdev_err(dev, "Could not find the PHY\n");
+                if (fixed_link)
+                        of_phy_deregister_fixed_link(priv->device->of_node);
                 return -ENODEV;
         }
 
@@ -1545,10 +1535,15 @@ err_free_netdev:
 static int altera_tse_remove(struct platform_device *pdev)
 {
         struct net_device *ndev = platform_get_drvdata(pdev);
+        struct altera_tse_private *priv = netdev_priv(ndev);
 
-        if (ndev->phydev)
+        if (ndev->phydev) {
                 phy_disconnect(ndev->phydev);
 
+                if (of_phy_is_fixed_link(priv->device->of_node))
+                        of_phy_deregister_fixed_link(priv->device->of_node);
+        }
+
         platform_set_drvdata(pdev, NULL);
         altera_tse_mdio_destroy(ndev);
         unregister_netdev(ndev);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
index 9de078819aa6..4f7635178200 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
@@ -829,7 +829,7 @@ static int xgbe_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int xgbe_suspend(struct device *dev)
 {
         struct net_device *netdev = dev_get_drvdata(dev);
@@ -874,7 +874,7 @@ static int xgbe_resume(struct device *dev)
 
         return ret;
 }
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 
 #ifdef CONFIG_ACPI
 static const struct acpi_device_id xgbe_acpi_match[] = {
diff --git a/drivers/net/ethernet/aurora/nb8800.c b/drivers/net/ethernet/aurora/nb8800.c
index 00c38bf151e6..e078d8da978c 100644
--- a/drivers/net/ethernet/aurora/nb8800.c
+++ b/drivers/net/ethernet/aurora/nb8800.c
@@ -1466,12 +1466,12 @@ static int nb8800_probe(struct platform_device *pdev)
 
         ret = nb8800_hw_init(dev);
         if (ret)
-                goto err_free_bus;
+                goto err_deregister_fixed_link;
 
         if (ops && ops->init) {
                 ret = ops->init(dev);
                 if (ret)
-                        goto err_free_bus;
+                        goto err_deregister_fixed_link;
         }
 
         dev->netdev_ops = &nb8800_netdev_ops;
@@ -1504,6 +1504,9 @@ static int nb8800_probe(struct platform_device *pdev)
 
 err_free_dma:
         nb8800_dma_free(dev);
+err_deregister_fixed_link:
+        if (of_phy_is_fixed_link(pdev->dev.of_node))
+                of_phy_deregister_fixed_link(pdev->dev.of_node);
 err_free_bus:
         of_node_put(priv->phy_node);
         mdiobus_unregister(bus);
@@ -1521,6 +1524,8 @@ static int nb8800_remove(struct platform_device *pdev)
         struct nb8800_priv *priv = netdev_priv(ndev);
 
         unregister_netdev(ndev);
+        if (of_phy_is_fixed_link(pdev->dev.of_node))
+                of_phy_deregister_fixed_link(pdev->dev.of_node);
         of_node_put(priv->phy_node);
 
         mdiobus_unregister(priv->mii_bus);
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index c3354b9941d1..25d1eb4933d0 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1755,13 +1755,13 @@ static int bcm_sysport_probe(struct platform_device *pdev)
         if (priv->irq0 <= 0 || priv->irq1 <= 0) {
                 dev_err(&pdev->dev, "invalid interrupts\n");
                 ret = -EINVAL;
-                goto err;
+                goto err_free_netdev;
         }
 
         priv->base = devm_ioremap_resource(&pdev->dev, r);
         if (IS_ERR(priv->base)) {
                 ret = PTR_ERR(priv->base);
-                goto err;
+                goto err_free_netdev;
         }
 
         priv->netdev = dev;
@@ -1779,7 +1779,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
                 ret = of_phy_register_fixed_link(dn);
                 if (ret) {
                         dev_err(&pdev->dev, "failed to register fixed PHY\n");
-                        goto err;
+                        goto err_free_netdev;
                 }
 
                 priv->phy_dn = dn;
@@ -1821,7 +1821,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
         ret = register_netdev(dev);
         if (ret) {
                 dev_err(&pdev->dev, "failed to register net_device\n");
-                goto err;
+                goto err_deregister_fixed_link;
         }
 
         priv->rev = topctrl_readl(priv, REV_CNTL) & REV_MASK;
@@ -1832,7 +1832,11 @@ static int bcm_sysport_probe(struct platform_device *pdev)
                  priv->base, priv->irq0, priv->irq1, txq, rxq);
 
         return 0;
-err:
+
+err_deregister_fixed_link:
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
+err_free_netdev:
         free_netdev(dev);
         return ret;
 }
@@ -1840,11 +1844,14 @@ err:
 static int bcm_sysport_remove(struct platform_device *pdev)
 {
         struct net_device *dev = dev_get_drvdata(&pdev->dev);
+        struct device_node *dn = pdev->dev.of_node;
 
         /* Not much to do, ndo_close has been called
          * and we use managed allocations
          */
         unregister_netdev(dev);
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
         free_netdev(dev);
         dev_set_drvdata(&pdev->dev, NULL);
 
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 4464bc5db934..a4e60e56c14f 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1172,6 +1172,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
                                           struct bcmgenet_tx_ring *ring)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
+        struct device *kdev = &priv->pdev->dev;
         struct enet_cb *tx_cb_ptr;
         struct netdev_queue *txq;
         unsigned int pkts_compl = 0;
@@ -1199,13 +1200,13 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
                 if (tx_cb_ptr->skb) {
                         pkts_compl++;
                         bytes_compl += GENET_CB(tx_cb_ptr->skb)->bytes_sent;
-                        dma_unmap_single(&dev->dev,
+                        dma_unmap_single(kdev,
                                          dma_unmap_addr(tx_cb_ptr, dma_addr),
                                          dma_unmap_len(tx_cb_ptr, dma_len),
                                          DMA_TO_DEVICE);
                         bcmgenet_free_cb(tx_cb_ptr);
                 } else if (dma_unmap_addr(tx_cb_ptr, dma_addr)) {
-                        dma_unmap_page(&dev->dev,
+                        dma_unmap_page(kdev,
                                        dma_unmap_addr(tx_cb_ptr, dma_addr),
                                        dma_unmap_len(tx_cb_ptr, dma_len),
                                        DMA_TO_DEVICE);
@@ -1775,6 +1776,7 @@ static int bcmgenet_alloc_rx_buffers(struct bcmgenet_priv *priv,
 
 static void bcmgenet_free_rx_buffers(struct bcmgenet_priv *priv)
 {
+        struct device *kdev = &priv->pdev->dev;
         struct enet_cb *cb;
         int i;
 
@@ -1782,7 +1784,7 @@ static void bcmgenet_free_rx_buffers(struct bcmgenet_priv *priv)
                 cb = &priv->rx_cbs[i];
 
                 if (dma_unmap_addr(cb, dma_addr)) {
-                        dma_unmap_single(&priv->dev->dev,
+                        dma_unmap_single(kdev,
                                          dma_unmap_addr(cb, dma_addr),
                                          priv->rx_buf_len, DMA_FROM_DEVICE);
                         dma_unmap_addr_set(cb, dma_addr, 0);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 457c3bc8cfff..e87607621e62 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -542,8 +542,10 @@ static int bcmgenet_mii_of_init(struct bcmgenet_priv *priv)
         /* Make sure we initialize MoCA PHYs with a link down */
         if (phy_mode == PHY_INTERFACE_MODE_MOCA) {
                 phydev = of_phy_find_device(dn);
-                if (phydev)
+                if (phydev) {
                         phydev->link = 0;
+                        put_device(&phydev->mdio.dev);
+                }
         }
 
         return 0;
@@ -625,6 +627,7 @@ static int bcmgenet_mii_bus_init(struct bcmgenet_priv *priv)
 int bcmgenet_mii_init(struct net_device *dev)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
+        struct device_node *dn = priv->pdev->dev.of_node;
         int ret;
 
         ret = bcmgenet_mii_alloc(priv);
@@ -638,6 +641,8 @@ int bcmgenet_mii_init(struct net_device *dev)
         return 0;
 
 out:
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
         of_node_put(priv->phy_dn);
         mdiobus_unregister(priv->mii_bus);
         mdiobus_free(priv->mii_bus);
@@ -647,7 +652,10 @@ out:
 void bcmgenet_mii_exit(struct net_device *dev)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
+        struct device_node *dn = priv->pdev->dev.of_node;
 
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
         of_node_put(priv->phy_dn);
         mdiobus_unregister(priv->mii_bus);
         mdiobus_free(priv->mii_bus);
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 533653bd7aec..ec09fcece711 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -975,6 +975,7 @@ static inline void macb_init_rx_ring(struct macb *bp)
                 addr += bp->rx_buffer_size;
         }
         bp->rx_ring[RX_RING_SIZE - 1].addr |= MACB_BIT(RX_WRAP);
+        bp->rx_tail = 0;
 }
 
 static int macb_rx(struct macb *bp, int budget)
@@ -1156,6 +1157,7 @@ static irqreturn_t macb_interrupt(int irq, void *dev_id)
                 if (status & MACB_BIT(RXUBR)) {
                         ctrl = macb_readl(bp, NCR);
                         macb_writel(bp, NCR, ctrl & ~MACB_BIT(RE));
+                        wmb();
                         macb_writel(bp, NCR, ctrl | MACB_BIT(RE));
 
                         if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
@@ -1616,8 +1618,6 @@ static void macb_init_rings(struct macb *bp)
         bp->queues[0].tx_head = 0;
         bp->queues[0].tx_tail = 0;
         bp->queues[0].tx_ring[TX_RING_SIZE - 1].ctrl |= MACB_BIT(TX_WRAP);
-
-        bp->rx_tail = 0;
 }
 
 static void macb_reset_hw(struct macb *bp)
@@ -2770,6 +2770,7 @@ static irqreturn_t at91ether_interrupt(int irq, void *dev_id)
         if (intstatus & MACB_BIT(RXUBR)) {
                 ctl = macb_readl(lp, NCR);
                 macb_writel(lp, NCR, ctl & ~MACB_BIT(RE));
+                wmb();
                 macb_writel(lp, NCR, ctl | MACB_BIT(RE));
         }
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
index df1573c4a659..ecf3ccc257bc 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_pci_id_tbl.h
@@ -168,6 +168,7 @@ CH_PCI_DEVICE_ID_TABLE_DEFINE_BEGIN
         CH_PCI_ID_TABLE_FENTRY(0x509a), /* Custom T520-CR */
         CH_PCI_ID_TABLE_FENTRY(0x509b), /* Custom T540-CR LOM */
         CH_PCI_ID_TABLE_FENTRY(0x509c), /* Custom T520-CR*/
+        CH_PCI_ID_TABLE_FENTRY(0x509d), /* Custom T540-CR*/
 
         /* T6 adapters:
          */
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index c865135f3cb9..5ea740b4cf14 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -574,6 +574,8 @@ struct fec_enet_private {
         unsigned int reload_period;
         int pps_enable;
         unsigned int next_counter;
+
+        u64 ethtool_stats[0];
 };
 
 void fec_ptp_init(struct platform_device *pdev);
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 5aa9d4ded214..5f77caa59534 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -2313,14 +2313,24 @@ static const struct fec_stat {
         { "IEEE_rx_octets_ok", IEEE_R_OCTETS_OK },
 };
 
-static void fec_enet_get_ethtool_stats(struct net_device *dev,
-        struct ethtool_stats *stats, u64 *data)
+static void fec_enet_update_ethtool_stats(struct net_device *dev)
 {
         struct fec_enet_private *fep = netdev_priv(dev);
         int i;
 
         for (i = 0; i < ARRAY_SIZE(fec_stats); i++)
-                data[i] = readl(fep->hwp + fec_stats[i].offset);
+                fep->ethtool_stats[i] = readl(fep->hwp + fec_stats[i].offset);
+}
+
+static void fec_enet_get_ethtool_stats(struct net_device *dev,
+                                       struct ethtool_stats *stats, u64 *data)
+{
+        struct fec_enet_private *fep = netdev_priv(dev);
+
+        if (netif_running(dev))
+                fec_enet_update_ethtool_stats(dev);
+
+        memcpy(data, fep->ethtool_stats, ARRAY_SIZE(fec_stats) * sizeof(u64));
 }
 
 static void fec_enet_get_strings(struct net_device *netdev,
@@ -2874,6 +2884,8 @@ fec_enet_close(struct net_device *ndev)
         if (fep->quirks & FEC_QUIRK_ERR006687)
                 imx6q_cpuidle_fec_irqs_unused();
 
+        fec_enet_update_ethtool_stats(ndev);
+
         fec_enet_clk_enable(ndev, false);
         pinctrl_pm_select_sleep_state(&fep->pdev->dev);
         pm_runtime_mark_last_busy(&fep->pdev->dev);
@@ -3180,6 +3192,8 @@ static int fec_enet_init(struct net_device *ndev)
 
         fec_restart(ndev);
 
+        fec_enet_update_ethtool_stats(ndev);
+
         return 0;
 }
 
@@ -3278,7 +3292,8 @@ fec_probe(struct platform_device *pdev)
         fec_enet_get_queue_num(pdev, &num_tx_qs, &num_rx_qs);
 
         /* Init network device */
-        ndev = alloc_etherdev_mqs(sizeof(struct fec_enet_private),
+        ndev = alloc_etherdev_mqs(sizeof(struct fec_enet_private) +
+                                  ARRAY_SIZE(fec_stats) * sizeof(u64),
                                   num_tx_qs, num_rx_qs);
         if (!ndev)
                 return -ENOMEM;
@@ -3475,6 +3490,8 @@ failed_regulator:
 failed_clk_ipg:
         fec_enet_clk_enable(ndev, false);
 failed_clk:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
 failed_phy:
         of_node_put(phy_node);
 failed_ioremap:
@@ -3488,6 +3505,7 @@ fec_drv_remove(struct platform_device *pdev)
 {
         struct net_device *ndev = platform_get_drvdata(pdev);
         struct fec_enet_private *fep = netdev_priv(ndev);
+        struct device_node *np = pdev->dev.of_node;
 
         cancel_work_sync(&fep->tx_timeout_work);
         fec_ptp_stop(pdev);
@@ -3495,6 +3513,8 @@ fec_drv_remove(struct platform_device *pdev)
         fec_enet_mii_remove(fep);
         if (fep->reg_phy)
                 regulator_disable(fep->reg_phy);
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
         of_node_put(fep->phy_node);
         free_netdev(ndev);
 
diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
index 53ef51e3bd9e..71a5ded9d1de 100644
--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
+++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
@@ -1107,6 +1107,9 @@ int memac_free(struct fman_mac *memac)
 {
         free_init_resources(memac);
 
+        if (memac->pcsphy)
+                put_device(&memac->pcsphy->mdio.dev);
+
         kfree(memac->memac_drv_param);
         kfree(memac);
 
diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c
index 8fe6b3e253fa..736db9d9b0ad 100644
--- a/drivers/net/ethernet/freescale/fman/mac.c
+++ b/drivers/net/ethernet/freescale/fman/mac.c
@@ -892,6 +892,8 @@ static int mac_probe(struct platform_device *_of_dev)
                 priv->fixed_link->duplex = phy->duplex;
                 priv->fixed_link->pause = phy->pause;
                 priv->fixed_link->asym_pause = phy->asym_pause;
+
+                put_device(&phy->mdio.dev);
         }
 
         err = mac_dev->init(mac_dev);
diff --git a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
index dc120c148d97..4b86260584a0 100644
--- a/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
+++ b/drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c
@@ -980,7 +980,7 @@ static int fs_enet_probe(struct platform_device *ofdev)
                 err = clk_prepare_enable(clk);
                 if (err) {
                         ret = err;
-                        goto out_free_fpi;
+                        goto out_deregister_fixed_link;
                 }
                 fpi->clk_per = clk;
         }
@@ -1061,6 +1061,9 @@ out_put:
         of_node_put(fpi->phy_node);
         if (fpi->clk_per)
                 clk_disable_unprepare(fpi->clk_per);
+out_deregister_fixed_link:
+        if (of_phy_is_fixed_link(ofdev->dev.of_node))
+                of_phy_deregister_fixed_link(ofdev->dev.of_node);
 out_free_fpi:
         kfree(fpi);
         return ret;
@@ -1079,6 +1082,8 @@ static int fs_enet_remove(struct platform_device *ofdev)
         of_node_put(fep->fpi->phy_node);
         if (fep->fpi->clk_per)
                 clk_disable_unprepare(fep->fpi->clk_per);
+        if (of_phy_is_fixed_link(ofdev->dev.of_node))
+                of_phy_deregister_fixed_link(ofdev->dev.of_node);
         free_netdev(ndev);
         return 0;
 }
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 4b4f5bc0e279..9061c2f82b9c 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -1312,6 +1312,7 @@ static void gfar_init_addr_hash_table(struct gfar_private *priv)
  */
 static int gfar_probe(struct platform_device *ofdev)
 {
+        struct device_node *np = ofdev->dev.of_node;
         struct net_device *dev = NULL;
         struct gfar_private *priv = NULL;
         int err = 0, i;
@@ -1462,6 +1463,8 @@ static int gfar_probe(struct platform_device *ofdev)
         return 0;
 
 register_fail:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
         unmap_group_regs(priv);
         gfar_free_rx_queues(priv);
         gfar_free_tx_queues(priv);
@@ -1474,11 +1477,16 @@ register_fail:
 static int gfar_remove(struct platform_device *ofdev)
 {
         struct gfar_private *priv = platform_get_drvdata(ofdev);
+        struct device_node *np = ofdev->dev.of_node;
 
         of_node_put(priv->phy_node);
         of_node_put(priv->tbi_node);
 
         unregister_netdev(priv->ndev);
+
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+
         unmap_group_regs(priv);
         gfar_free_rx_queues(priv);
         gfar_free_tx_queues(priv);
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index 186ef8f16c80..f76d33279454 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -3868,9 +3868,8 @@ static int ucc_geth_probe(struct platform_device* ofdev)
         dev = alloc_etherdev(sizeof(*ugeth));
 
         if (dev == NULL) {
-                of_node_put(ug_info->tbi_node);
-                of_node_put(ug_info->phy_node);
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto err_deregister_fixed_link;
         }
 
         ugeth = netdev_priv(dev);
@@ -3907,10 +3906,7 @@ static int ucc_geth_probe(struct platform_device* ofdev)
                 if (netif_msg_probe(ugeth))
                         pr_err("%s: Cannot register net device, aborting\n",
                                dev->name);
-                free_netdev(dev);
-                of_node_put(ug_info->tbi_node);
-                of_node_put(ug_info->phy_node);
-                return err;
+                goto err_free_netdev;
         }
 
         mac_addr = of_get_mac_address(np);
@@ -3923,16 +3919,29 @@ static int ucc_geth_probe(struct platform_device* ofdev)
         ugeth->node = np;
 
         return 0;
+
+err_free_netdev:
+        free_netdev(dev);
+err_deregister_fixed_link:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+        of_node_put(ug_info->tbi_node);
+        of_node_put(ug_info->phy_node);
+
+        return err;
 }
 
 static int ucc_geth_remove(struct platform_device* ofdev)
 {
         struct net_device *dev = platform_get_drvdata(ofdev);
         struct ucc_geth_private *ugeth = netdev_priv(dev);
+        struct device_node *np = ofdev->dev.of_node;
 
         unregister_netdev(dev);
         free_netdev(dev);
         ucc_geth_memclean(ugeth);
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
         of_node_put(ugeth->ug_info->tbi_node);
         of_node_put(ugeth->ug_info->phy_node);
 
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index edc9a6ac5169..9affd7c198bd 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -4931,11 +4931,15 @@ static int igb_tso(struct igb_ring *tx_ring,
 
         /* initialize outer IP header fields */
         if (ip.v4->version == 4) {
+                unsigned char *csum_start = skb_checksum_start(skb);
+                unsigned char *trans_start = ip.hdr + (ip.v4->ihl * 4);
+
                 /* IP header will have to cancel out any data that
                  * is not a part of the outer IP header
                  */
-                ip.v4->check = csum_fold(csum_add(lco_csum(skb),
-                                                  csum_unfold(l4.tcp->check)));
+                ip.v4->check = csum_fold(csum_partial(trans_start,
+                                                      csum_start - trans_start,
+                                                      0));
                 type_tucmd |= E1000_ADVTXD_TUCMD_IPV4;
 
                 ip.v4->tot_len = 0;
diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
index 12bb877df860..7dff7f6239cd 100644
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -1965,11 +1965,15 @@ static int igbvf_tso(struct igbvf_ring *tx_ring,
 
         /* initialize outer IP header fields */
         if (ip.v4->version == 4) {
+                unsigned char *csum_start = skb_checksum_start(skb);
+                unsigned char *trans_start = ip.hdr + (ip.v4->ihl * 4);
+
                 /* IP header will have to cancel out any data that
                  * is not a part of the outer IP header
                  */
-                ip.v4->check = csum_fold(csum_add(lco_csum(skb),
-                                                  csum_unfold(l4.tcp->check)));
+                ip.v4->check = csum_fold(csum_partial(trans_start,
+                                                      csum_start - trans_start,
+                                                      0));
                 type_tucmd |= E1000_ADVTXD_TUCMD_IPV4;
 
                 ip.v4->tot_len = 0;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index bd93d823cc25..fee1f2918ead 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -7277,11 +7277,15 @@ static int ixgbe_tso(struct ixgbe_ring *tx_ring,
 
         /* initialize outer IP header fields */
         if (ip.v4->version == 4) {
+                unsigned char *csum_start = skb_checksum_start(skb);
+                unsigned char *trans_start = ip.hdr + (ip.v4->ihl * 4);
+
                 /* IP header will have to cancel out any data that
                  * is not a part of the outer IP header
                  */
-                ip.v4->check = csum_fold(csum_add(lco_csum(skb),
-                                                  csum_unfold(l4.tcp->check)));
+                ip.v4->check = csum_fold(csum_partial(trans_start,
+                                                      csum_start - trans_start,
+                                                      0));
                 type_tucmd |= IXGBE_ADVTXD_TUCMD_IPV4;
 
                 ip.v4->tot_len = 0;
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index 7eaac3234049..cbf70fe4028a 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -3329,11 +3329,15 @@ static int ixgbevf_tso(struct ixgbevf_ring *tx_ring,
 
         /* initialize outer IP header fields */
         if (ip.v4->version == 4) {
+                unsigned char *csum_start = skb_checksum_start(skb);
+                unsigned char *trans_start = ip.hdr + (ip.v4->ihl * 4);
+
                 /* IP header will have to cancel out any data that
                  * is not a part of the outer IP header
                  */
-                ip.v4->check = csum_fold(csum_add(lco_csum(skb),
-                                                  csum_unfold(l4.tcp->check)));
+                ip.v4->check = csum_fold(csum_partial(trans_start,
+                                                      csum_start - trans_start,
+                                                      0));
                 type_tucmd |= IXGBE_ADVTXD_TUCMD_IPV4;
 
                 ip.v4->tot_len = 0;
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 0c0a45af950f..707bc4680b9b 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -4191,6 +4191,8 @@ err_clk:
         clk_disable_unprepare(pp->clk);
 err_put_phy_node:
         of_node_put(phy_node);
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
 err_free_irq:
         irq_dispose_mapping(dev->irq);
 err_free_netdev:
@@ -4202,6 +4204,7 @@ err_free_netdev:
 static int mvneta_remove(struct platform_device *pdev)
 {
         struct net_device  *dev = platform_get_drvdata(pdev);
+        struct device_node *dn = pdev->dev.of_node;
         struct mvneta_port *pp = netdev_priv(dev);
 
         unregister_netdev(dev);
@@ -4209,6 +4212,8 @@ static int mvneta_remove(struct platform_device *pdev)
         clk_disable_unprepare(pp->clk);
         free_percpu(pp->ports);
         free_percpu(pp->stats);
+        if (of_phy_is_fixed_link(dn))
+                of_phy_deregister_fixed_link(dn);
         irq_dispose_mapping(dev->irq);
         of_node_put(pp->phy_node);
         free_netdev(dev);
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index 4a62ffd7729d..86a89cbd3ec9 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -318,6 +318,8 @@ static int mtk_phy_connect(struct net_device *dev)
         return 0;
 
 err_phy:
+        if (of_phy_is_fixed_link(mac->of_node))
+                of_phy_deregister_fixed_link(mac->of_node);
         of_node_put(np);
         dev_err(eth->dev, "%s: invalid phy\n", __func__);
         return -EINVAL;
@@ -1923,6 +1925,8 @@ static void mtk_uninit(struct net_device *dev)
         struct mtk_eth *eth = mac->hw;
 
         phy_disconnect(dev->phydev);
+        if (of_phy_is_fixed_link(mac->of_node))
+                of_phy_deregister_fixed_link(mac->of_node);
         mtk_irq_disable(eth, MTK_QDMA_INT_MASK, ~0);
         mtk_irq_disable(eth, MTK_PDMA_INT_MASK, ~0);
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index a60f635da78b..fb8bb027b69c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2079,13 +2079,6 @@ err:
         return -ENOMEM;
 }
 
-static void mlx4_en_shutdown(struct net_device *dev)
-{
-        rtnl_lock();
-        netif_device_detach(dev);
-        mlx4_en_close(dev);
-        rtnl_unlock();
-}
 
 static int mlx4_en_copy_priv(struct mlx4_en_priv *dst,
                              struct mlx4_en_priv *src,
@@ -2162,8 +2155,6 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
         struct mlx4_en_dev *mdev = priv->mdev;
-        bool shutdown = mdev->dev->persist->interface_state &
-                                            MLX4_INTERFACE_STATE_SHUTDOWN;
 
         en_dbg(DRV, priv, "Destroying netdev on port:%d\n", priv->port);
 
@@ -2171,10 +2162,7 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
         if (priv->registered) {
                 devlink_port_type_clear(mlx4_get_devlink_port(mdev->dev,
                                                               priv->port));
-                if (shutdown)
-                        mlx4_en_shutdown(dev);
-                else
-                        unregister_netdev(dev);
+                unregister_netdev(dev);
         }
 
         if (priv->allocated)
@@ -2203,8 +2191,7 @@ void mlx4_en_destroy_netdev(struct net_device *dev)
         kfree(priv->tx_ring);
         kfree(priv->tx_cq);
 
-        if (!shutdown)
-                free_netdev(dev);
+        free_netdev(dev);
 }
 
 static int mlx4_en_change_mtu(struct net_device *dev, int new_mtu)
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 6f4e67bc3538..75d07fa9d0b1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -4147,11 +4147,8 @@ static void mlx4_shutdown(struct pci_dev *pdev)
 
         mlx4_info(persist->dev, "mlx4_shutdown was called\n");
         mutex_lock(&persist->interface_state_mutex);
-        if (persist->interface_state & MLX4_INTERFACE_STATE_UP) {
-                /* Notify mlx4 clients that the kernel is being shut down */
-                persist->interface_state |= MLX4_INTERFACE_STATE_SHUTDOWN;
+        if (persist->interface_state & MLX4_INTERFACE_STATE_UP)
                 mlx4_unload_one(pdev);
-        }
         mutex_unlock(&persist->interface_state_mutex);
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index 94b891c118c1..1a670b681555 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -1457,7 +1457,12 @@ EXPORT_SYMBOL_GPL(mlx4_multicast_detach);
 int mlx4_flow_steer_promisc_add(struct mlx4_dev *dev, u8 port,
                                 u32 qpn, enum mlx4_net_trans_promisc_mode mode)
 {
-        struct mlx4_net_trans_rule rule;
+        struct mlx4_net_trans_rule rule = {
+                .queue_mode = MLX4_NET_TRANS_Q_FIFO,
+                .exclusive = 0,
+                .allow_loopback = 1,
+        };
+
         u64 *regid_p;
 
         switch (mode) {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac-phy.c b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
index da4e90db4d98..99a14df28b96 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac-phy.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac-phy.c
@@ -212,6 +212,7 @@ int emac_phy_config(struct platform_device *pdev, struct emac_adapter *adpt)
 
                 phy_np = of_parse_phandle(np, "phy-handle", 0);
                 adpt->phydev = of_phy_find_device(phy_np);
+                of_node_put(phy_np);
         }
 
         if (!adpt->phydev) {
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c
index 4fede4b86538..57b35aeac51a 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -711,6 +711,8 @@ static int emac_probe(struct platform_device *pdev)
 err_undo_napi:
         netif_napi_del(&adpt->rx_q.napi);
 err_undo_mdiobus:
+        if (!has_acpi_companion(&pdev->dev))
+                put_device(&adpt->phydev->mdio.dev);
         mdiobus_unregister(adpt->mii_bus);
 err_undo_clocks:
         emac_clks_teardown(adpt);
@@ -730,6 +732,8 @@ static int emac_remove(struct platform_device *pdev)
 
         emac_clks_teardown(adpt);
 
+        if (!has_acpi_companion(&pdev->dev))
+                put_device(&adpt->phydev->mdio.dev);
         mdiobus_unregister(adpt->mii_bus);
         free_netdev(netdev);
 
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 630536bc72f9..d6a217874a8b 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1008,20 +1008,18 @@ static int ravb_phy_init(struct net_device *ndev)
         of_node_put(pn);
         if (!phydev) {
                 netdev_err(ndev, "failed to connect PHY\n");
-                return -ENOENT;
+                err = -ENOENT;
+                goto err_deregister_fixed_link;
         }
 
         /* This driver only support 10/100Mbit speeds on Gen3
          * at this time.
          */
         if (priv->chip_id == RCAR_GEN3) {
-                int err;
-
                 err = phy_set_max_speed(phydev, SPEED_100);
                 if (err) {
                         netdev_err(ndev, "failed to limit PHY to 100Mbit/s\n");
-                        phy_disconnect(phydev);
-                        return err;
+                        goto err_phy_disconnect;
                 }
 
                 netdev_info(ndev, "limited PHY to 100Mbit/s\n");
@@ -1033,6 +1031,14 @@ static int ravb_phy_init(struct net_device *ndev)
         phy_attached_info(phydev);
 
         return 0;
+
+err_phy_disconnect:
+        phy_disconnect(phydev);
+err_deregister_fixed_link:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+
+        return err;
 }
 
 /* PHY control start function */
@@ -1634,6 +1640,7 @@ static void ravb_set_rx_mode(struct net_device *ndev)
 /* Device close function for Ethernet AVB */
 static int ravb_close(struct net_device *ndev)
 {
+        struct device_node *np = ndev->dev.parent->of_node;
         struct ravb_private *priv = netdev_priv(ndev);
         struct ravb_tstamp_skb *ts_skb, *ts_skb2;
 
@@ -1663,6 +1670,8 @@ static int ravb_close(struct net_device *ndev)
         if (ndev->phydev) {
                 phy_stop(ndev->phydev);
                 phy_disconnect(ndev->phydev);
+                if (of_phy_is_fixed_link(np))
+                        of_phy_deregister_fixed_link(np);
         }
 
         if (priv->chip_id != RCAR_GEN2) {
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 05b0dc55de77..1a92de705199 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -518,7 +518,7 @@ static struct sh_eth_cpu_data r7s72100_data = {
 
         .ecsr_value     = ECSR_ICD,
         .ecsipr_value   = ECSIPR_ICDIP,
-        .eesipr_value   = 0xff7f009f,
+        .eesipr_value   = 0xe77f009f,
 
         .tx_check       = EESR_TC1 | EESR_FTC,
         .eesr_err_check = EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
index b1e5f24708c9..e6e6c2fcc4b7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
@@ -50,10 +50,23 @@ static int dwmac_generic_probe(struct platform_device *pdev)
         if (plat_dat->init) {
                 ret = plat_dat->init(pdev, plat_dat->bsp_priv);
                 if (ret)
-                        return ret;
+                        goto err_remove_config_dt;
         }
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_exit;
+
+        return 0;
+
+err_exit:
+        if (plat_dat->exit)
+                plat_dat->exit(pdev, plat_dat->bsp_priv);
+err_remove_config_dt:
+        if (pdev->dev.of_node)
+                stmmac_remove_config_dt(pdev, plat_dat);
+
+        return ret;
 }
 
 static const struct of_device_id dwmac_generic_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
index 36d3355f2fb0..866444b6c82f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
@@ -271,15 +271,17 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         gmac = devm_kzalloc(dev, sizeof(*gmac), GFP_KERNEL);
-        if (!gmac)
-                return -ENOMEM;
+        if (!gmac) {
+                err = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         gmac->pdev = pdev;
 
         err = ipq806x_gmac_of_parse(gmac);
         if (err) {
                 dev_err(dev, "device tree parsing error\n");
-                return err;
+                goto err_remove_config_dt;
         }
 
         regmap_write(gmac->qsgmii_csr, QSGMII_PCS_CAL_LCKDT_CTL,
@@ -300,7 +302,8 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
         default:
                 dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
                         phy_modes(gmac->phy_mode));
-                return -EINVAL;
+                err = -EINVAL;
+                goto err_remove_config_dt;
         }
         regmap_write(gmac->nss_common, NSS_COMMON_GMAC_CTL(gmac->id), val);
 
@@ -319,7 +322,8 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
         default:
                 dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
                         phy_modes(gmac->phy_mode));
-                return -EINVAL;
+                err = -EINVAL;
+                goto err_remove_config_dt;
         }
         regmap_write(gmac->nss_common, NSS_COMMON_CLK_SRC_CTRL, val);
 
@@ -346,7 +350,16 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
         plat_dat->bsp_priv = gmac;
         plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed;
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        err = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (err)
+                goto err_remove_config_dt;
+
+        return 0;
+
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
+
+        return err;
 }
 
 static const struct of_device_id ipq806x_gmac_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c
index 78e9d1861896..3d3f43d91b98 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c
@@ -46,7 +46,8 @@ static int lpc18xx_dwmac_probe(struct platform_device *pdev)
         reg = syscon_regmap_lookup_by_compatible("nxp,lpc1850-creg");
         if (IS_ERR(reg)) {
                 dev_err(&pdev->dev, "syscon lookup failed\n");
-                return PTR_ERR(reg);
+                ret = PTR_ERR(reg);
+                goto err_remove_config_dt;
         }
 
         if (plat_dat->interface == PHY_INTERFACE_MODE_MII) {
@@ -55,13 +56,23 @@ static int lpc18xx_dwmac_probe(struct platform_device *pdev)
                 ethmode = LPC18XX_CREG_CREG6_ETHMODE_RMII;
         } else {
                 dev_err(&pdev->dev, "Only MII and RMII mode supported\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_remove_config_dt;
         }
 
         regmap_update_bits(reg, LPC18XX_CREG_CREG6,
                            LPC18XX_CREG_CREG6_ETHMODE_MASK, ethmode);
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_remove_config_dt;
+
+        return 0;
+
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
+
+        return ret;
 }
 
 static const struct of_device_id lpc18xx_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.c
index 309d99536a2c..7fdd1760a74c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.c
@@ -64,18 +64,31 @@ static int meson6_dwmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
-                return -ENOMEM;
+        if (!dwmac) {
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         dwmac->reg = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(dwmac->reg))
-                return PTR_ERR(dwmac->reg);
+        if (IS_ERR(dwmac->reg)) {
+                ret = PTR_ERR(dwmac->reg);
+                goto err_remove_config_dt;
+        }
 
         plat_dat->bsp_priv = dwmac;
         plat_dat->fix_mac_speed = meson6_dwmac_fix_mac_speed;
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_remove_config_dt;
+
+        return 0;
+
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
+
+        return ret;
 }
 
 static const struct of_device_id meson6_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
index 250e4ceafc8d..ffaed1f35efe 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
@@ -264,32 +264,48 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
-                return -ENOMEM;
+        if (!dwmac) {
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
         dwmac->regs = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(dwmac->regs))
-                return PTR_ERR(dwmac->regs);
+        if (IS_ERR(dwmac->regs)) {
+                ret = PTR_ERR(dwmac->regs);
+                goto err_remove_config_dt;
+        }
 
         dwmac->pdev = pdev;
         dwmac->phy_mode = of_get_phy_mode(pdev->dev.of_node);
         if (dwmac->phy_mode < 0) {
                 dev_err(&pdev->dev, "missing phy-mode property\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_remove_config_dt;
         }
 
         ret = meson8b_init_clk(dwmac);
         if (ret)
-                return ret;
+                goto err_remove_config_dt;
 
         ret = meson8b_init_prg_eth(dwmac);
         if (ret)
-                return ret;
+                goto err_remove_config_dt;
 
         plat_dat->bsp_priv = dwmac;
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_clk_disable;
+
+        return 0;
+
+err_clk_disable:
+        clk_disable_unprepare(dwmac->m25_div_clk);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
+
+        return ret;
 }
 
 static int meson8b_dwmac_remove(struct platform_device *pdev)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
index 3740a4417fa0..d80c88bd2bba 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -981,14 +981,27 @@ static int rk_gmac_probe(struct platform_device *pdev)
         plat_dat->resume = rk_gmac_resume;
 
         plat_dat->bsp_priv = rk_gmac_setup(pdev, data);
-        if (IS_ERR(plat_dat->bsp_priv))
-                return PTR_ERR(plat_dat->bsp_priv);
+        if (IS_ERR(plat_dat->bsp_priv)) {
+                ret = PTR_ERR(plat_dat->bsp_priv);
+                goto err_remove_config_dt;
+        }
 
         ret = rk_gmac_init(pdev, plat_dat->bsp_priv);
         if (ret)
-                return ret;
+                goto err_remove_config_dt;
+
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_gmac_exit;
+
+        return 0;
+
+err_gmac_exit:
+        rk_gmac_exit(pdev, plat_dat->bsp_priv);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        return ret;
 }
 
 static const struct of_device_id rk_gmac_dwmac_match[] = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
index bec6963ac71e..0c420e97de1e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
@@ -304,6 +304,8 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)
         struct device           *dev = &pdev->dev;
         int                     ret;
         struct socfpga_dwmac    *dwmac;
+        struct net_device       *ndev;
+        struct stmmac_priv      *stpriv;
 
         ret = stmmac_get_platform_resources(pdev, &stmmac_res);
         if (ret)
@@ -314,32 +316,43 @@ static int socfpga_dwmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         dwmac = devm_kzalloc(dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
-                return -ENOMEM;
+        if (!dwmac) {
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         ret = socfpga_dwmac_parse_data(dwmac, dev);
         if (ret) {
                 dev_err(dev, "Unable to parse OF data\n");
-                return ret;
+                goto err_remove_config_dt;
         }
 
         plat_dat->bsp_priv = dwmac;
         plat_dat->fix_mac_speed = socfpga_dwmac_fix_mac_speed;
 
         ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_remove_config_dt;
 
-        if (!ret) {
-                struct net_device *ndev = platform_get_drvdata(pdev);
-                struct stmmac_priv *stpriv = netdev_priv(ndev);
+        ndev = platform_get_drvdata(pdev);
+        stpriv = netdev_priv(ndev);
 
-                /* The socfpga driver needs to control the stmmac reset to
-                 * set the phy mode. Create a copy of the core reset handel
-                 * so it can be used by the driver later.
-                 */
-                dwmac->stmmac_rst = stpriv->stmmac_rst;
+        /* The socfpga driver needs to control the stmmac reset to set the phy
+         * mode. Create a copy of the core reset handle so it can be used by
+         * the driver later.
+         */
+        dwmac->stmmac_rst = stpriv->stmmac_rst;
 
-                ret = socfpga_dwmac_set_phy_mode(dwmac);
-        }
+        ret = socfpga_dwmac_set_phy_mode(dwmac);
+        if (ret)
+                goto err_dvr_remove;
+
+        return 0;
+
+err_dvr_remove:
+        stmmac_dvr_remove(&pdev->dev);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
 
         return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
index 58c05acc2aab..060b98c37a85 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
@@ -345,13 +345,15 @@ static int sti_dwmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
-                return -ENOMEM;
+        if (!dwmac) {
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         ret = sti_dwmac_parse_data(dwmac, pdev);
         if (ret) {
                 dev_err(&pdev->dev, "Unable to parse OF data\n");
-                return ret;
+                goto err_remove_config_dt;
         }
 
         dwmac->fix_retime_src = data->fix_retime_src;
@@ -363,9 +365,20 @@ static int sti_dwmac_probe(struct platform_device *pdev)
 
         ret = sti_dwmac_init(pdev, plat_dat->bsp_priv);
         if (ret)
-                return ret;
+                goto err_remove_config_dt;
+
+        ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        if (ret)
+                goto err_dwmac_exit;
+
+        return 0;
+
+err_dwmac_exit:
+        sti_dwmac_exit(pdev, plat_dat->bsp_priv);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
 
-        return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+        return ret;
 }
 
 static const struct sti_dwmac_of_data stih4xx_dwmac_data = {
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
index e5a926b8bee7..61cb24810d10 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
@@ -107,24 +107,33 @@ static int stm32_dwmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
-        if (!dwmac)
-                return -ENOMEM;
+        if (!dwmac) {
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         ret = stm32_dwmac_parse_data(dwmac, &pdev->dev);
         if (ret) {
                 dev_err(&pdev->dev, "Unable to parse OF data\n");
-                return ret;
+                goto err_remove_config_dt;
         }
 
         plat_dat->bsp_priv = dwmac;
 
         ret = stm32_dwmac_init(plat_dat);
         if (ret)
-                return ret;
+                goto err_remove_config_dt;
 
         ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
         if (ret)
-                stm32_dwmac_clk_disable(dwmac);
+                goto err_clk_disable;
+
+        return 0;
+
+err_clk_disable:
+        stm32_dwmac_clk_disable(dwmac);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
 
         return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
index adff46375a32..d07520fb969e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
@@ -120,22 +120,27 @@ static int sun7i_gmac_probe(struct platform_device *pdev)
                 return PTR_ERR(plat_dat);
 
         gmac = devm_kzalloc(dev, sizeof(*gmac), GFP_KERNEL);
-        if (!gmac)
-                return -ENOMEM;
+        if (!gmac) {
+                ret = -ENOMEM;
+                goto err_remove_config_dt;
+        }
 
         gmac->interface = of_get_phy_mode(dev->of_node);
 
         gmac->tx_clk = devm_clk_get(dev, "allwinner_gmac_tx");
         if (IS_ERR(gmac->tx_clk)) {
                 dev_err(dev, "could not get tx clock\n");
-                return PTR_ERR(gmac->tx_clk);
+                ret = PTR_ERR(gmac->tx_clk);
+                goto err_remove_config_dt;
         }
 
         /* Optional regulator for PHY */
         gmac->regulator = devm_regulator_get_optional(dev, "phy");
         if (IS_ERR(gmac->regulator)) {
-                if (PTR_ERR(gmac->regulator) == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
+                if (PTR_ERR(gmac->regulator) == -EPROBE_DEFER) {
+                        ret = -EPROBE_DEFER;
+                        goto err_remove_config_dt;
+                }
                 dev_info(dev, "no regulator found\n");
                 gmac->regulator = NULL;
         }
@@ -151,11 +156,18 @@ static int sun7i_gmac_probe(struct platform_device *pdev)
 
         ret = sun7i_gmac_init(pdev, plat_dat->bsp_priv);
         if (ret)
-                return ret;
+                goto err_remove_config_dt;
 
         ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
         if (ret)
-                sun7i_gmac_exit(pdev, plat_dat->bsp_priv);
+                goto err_gmac_exit;
+
+        return 0;
+
+err_gmac_exit:
+        sun7i_gmac_exit(pdev, plat_dat->bsp_priv);
+err_remove_config_dt:
+        stmmac_remove_config_dt(pdev, plat_dat);
 
         return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 1f9ec02fa7f8..caf069a465f2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3416,7 +3416,6 @@ int stmmac_dvr_remove(struct device *dev)
         stmmac_set_mac(priv->ioaddr, false);
         netif_carrier_off(ndev);
         unregister_netdev(ndev);
-        of_node_put(priv->plat->phy_node);
         if (priv->stmmac_rst)
                 reset_control_assert(priv->stmmac_rst);
         clk_disable_unprepare(priv->pclk);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 0a0d6a86f397..a840818bf4df 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -200,7 +200,6 @@ static int stmmac_dt_phy(struct plat_stmmacenet_data *plat,
 /**
  * stmmac_probe_config_dt - parse device-tree driver parameters
  * @pdev: platform_device structure
- * @plat: driver data platform structure
  * @mac: MAC address to use
  * Description:
  * this function is to read the driver parameters from device-tree and
@@ -306,7 +305,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
                 dma_cfg = devm_kzalloc(&pdev->dev, sizeof(*dma_cfg),
                                        GFP_KERNEL);
                 if (!dma_cfg) {
-                        of_node_put(plat->phy_node);
+                        stmmac_remove_config_dt(pdev, plat);
                         return ERR_PTR(-ENOMEM);
                 }
                 plat->dma_cfg = dma_cfg;
@@ -329,14 +328,37 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
 
         return plat;
 }
+
+/**
+ * stmmac_remove_config_dt - undo the effects of stmmac_probe_config_dt()
+ * @pdev: platform_device structure
+ * @plat: driver data platform structure
+ *
+ * Release resources claimed by stmmac_probe_config_dt().
+ */
+void stmmac_remove_config_dt(struct platform_device *pdev,
+                             struct plat_stmmacenet_data *plat)
+{
+        struct device_node *np = pdev->dev.of_node;
+
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+        of_node_put(plat->phy_node);
+}
 #else
 struct plat_stmmacenet_data *
 stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
 {
         return ERR_PTR(-ENOSYS);
 }
+
+void stmmac_remove_config_dt(struct platform_device *pdev,
+                             struct plat_stmmacenet_data *plat)
+{
+}
 #endif /* CONFIG_OF */
 EXPORT_SYMBOL_GPL(stmmac_probe_config_dt);
+EXPORT_SYMBOL_GPL(stmmac_remove_config_dt);
 
 int stmmac_get_platform_resources(struct platform_device *pdev,
                                   struct stmmac_resources *stmmac_res)
@@ -392,10 +414,13 @@ int stmmac_pltfr_remove(struct platform_device *pdev)
 {
         struct net_device *ndev = platform_get_drvdata(pdev);
         struct stmmac_priv *priv = netdev_priv(ndev);
+        struct plat_stmmacenet_data *plat = priv->plat;
         int ret = stmmac_dvr_remove(&pdev->dev);
 
-        if (priv->plat->exit)
-                priv->plat->exit(pdev, priv->plat->bsp_priv);
+        if (plat->exit)
+                plat->exit(pdev, plat->bsp_priv);
+
+        stmmac_remove_config_dt(pdev, plat);
 
         return ret;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h
index 64e147f53a9c..b72eb0de57b7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.h
@@ -23,6 +23,8 @@
 
 struct plat_stmmacenet_data *
 stmmac_probe_config_dt(struct platform_device *pdev, const char **mac);
+void stmmac_remove_config_dt(struct platform_device *pdev,
+                             struct plat_stmmacenet_data *plat);
 
 int stmmac_get_platform_resources(struct platform_device *pdev,
                                   struct stmmac_resources *stmmac_res);
diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
index 4ba2421e625d..97d64bfed465 100644
--- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c
+++ b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
@@ -2881,7 +2881,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = of_get_phy_mode(lp->pdev->dev.of_node);
         if (ret < 0) {
                 dev_err(&lp->pdev->dev, "error in getting phy i/f\n");
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
         }
 
         lp->phy_interface = ret;
@@ -2889,14 +2889,14 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = dwceqos_mii_init(lp);
         if (ret) {
                 dev_err(&lp->pdev->dev, "error in dwceqos_mii_init\n");
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
         }
 
         ret = dwceqos_mii_probe(ndev);
         if (ret != 0) {
                 netdev_err(ndev, "mii_probe fail.\n");
                 ret = -ENXIO;
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
         }
 
         dwceqos_set_umac_addr(lp, lp->ndev->dev_addr, 0);
@@ -2914,7 +2914,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&lp->pdev->dev, "Unable to retrieve DT, error %d\n",
                         ret);
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
         }
         dev_info(&lp->pdev->dev, "pdev->id %d, baseaddr 0x%08lx, irq %d\n",
                  pdev->id, ndev->base_addr, ndev->irq);
@@ -2924,7 +2924,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&lp->pdev->dev, "Unable to request IRQ %d, error %d\n",
                         ndev->irq, ret);
-                goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
         }
 
         if (netif_msg_probe(lp))
@@ -2935,11 +2935,14 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = register_netdev(ndev);
         if (ret) {
                 dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
-                        goto err_out_clk_dis_phy;
+                goto err_out_deregister_fixed_link;
         }
 
         return 0;
 
+err_out_deregister_fixed_link:
+        if (of_phy_is_fixed_link(pdev->dev.of_node))
+                of_phy_deregister_fixed_link(pdev->dev.of_node);
 err_out_clk_dis_phy:
         clk_disable_unprepare(lp->phy_ref_clk);
 err_out_clk_dis_aper:
@@ -2959,8 +2962,11 @@ static int dwceqos_remove(struct platform_device *pdev)
         if (ndev) {
                 lp = netdev_priv(ndev);
 
-                if (ndev->phydev)
+                if (ndev->phydev) {
                         phy_disconnect(ndev->phydev);
+                        if (of_phy_is_fixed_link(pdev->dev.of_node))
+                                of_phy_deregister_fixed_link(pdev->dev.of_node);
+                }
                 mdiobus_unregister(lp->mii_bus);
                 mdiobus_free(lp->mii_bus);
 
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 58947aae31c7..b9087b828eff 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2459,20 +2459,8 @@ static void cpsw_remove_dt(struct platform_device *pdev)
                 if (strcmp(slave_node->name, "slave"))
                         continue;
 
-                if (of_phy_is_fixed_link(slave_node)) {
-                        struct phy_device *phydev;
-
-                        phydev = of_phy_find_device(slave_node);
-                        if (phydev) {
-                                fixed_phy_unregister(phydev);
-                                /* Put references taken by
-                                 * of_phy_find_device() and
-                                 * of_phy_register_fixed_link().
-                                 */
-                                phy_device_free(phydev);
-                                phy_device_free(phydev);
-                        }
-                }
+                if (of_phy_is_fixed_link(slave_node))
+                        of_phy_deregister_fixed_link(slave_node);
 
                 of_node_put(slave_data->phy_node);
 
@@ -2942,6 +2930,8 @@ static int cpsw_resume(struct device *dev)
         /* Select default pin state */
         pinctrl_pm_select_default_state(dev);
 
+        /* shut up ASSERT_RTNL() warning in netif_set_real_num_tx/rx_queues */
+        rtnl_lock();
         if (cpsw->data.dual_emac) {
                 int i;
 
@@ -2953,6 +2943,8 @@ static int cpsw_resume(struct device *dev)
                 if (netif_running(ndev))
                         cpsw_ndo_open(ndev);
         }
+        rtnl_unlock();
+
         return 0;
 }
 #endif
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 84fbe5714f8b..481c7bf0395b 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1767,6 +1767,7 @@ static int davinci_emac_try_get_mac(struct platform_device *pdev,
  */
 static int davinci_emac_probe(struct platform_device *pdev)
 {
+        struct device_node *np = pdev->dev.of_node;
         int rc = 0;
         struct resource *res, *res_ctrl;
         struct net_device *ndev;
@@ -1805,7 +1806,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
         if (!pdata) {
                 dev_err(&pdev->dev, "no platform data\n");
                 rc = -ENODEV;
-                goto no_pdata;
+                goto err_free_netdev;
         }
 
         /* MAC addr and PHY mask , RMII enable info from platform_data */
@@ -1941,6 +1942,10 @@ no_cpdma_chan:
                 cpdma_chan_destroy(priv->rxchan);
         cpdma_ctlr_destroy(priv->dma);
 no_pdata:
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
+        of_node_put(priv->phy_node);
+err_free_netdev:
         free_netdev(ndev);
         return rc;
 }
@@ -1956,6 +1961,7 @@ static int davinci_emac_remove(struct platform_device *pdev)
 {
         struct net_device *ndev = platform_get_drvdata(pdev);
         struct emac_priv *priv = netdev_priv(ndev);
+        struct device_node *np = pdev->dev.of_node;
 
         dev_notice(&ndev->dev, "DaVinci EMAC: davinci_emac_remove()\n");
 
@@ -1968,6 +1974,8 @@ static int davinci_emac_remove(struct platform_device *pdev)
         unregister_netdev(ndev);
         of_node_put(priv->phy_node);
         pm_runtime_disable(&pdev->dev);
+        if (of_phy_is_fixed_link(np))
+                of_phy_deregister_fixed_link(np);
         free_netdev(ndev);
 
         return 0;
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 42edd7b7902f..8b4822ad27cb 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -859,7 +859,6 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
         struct geneve_dev *geneve = netdev_priv(dev);
         struct geneve_sock *gs4;
         struct rtable *rt = NULL;
-        const struct iphdr *iip; /* interior IP header */
         int err = -EINVAL;
         struct flowi4 fl4;
         __u8 tos, ttl;
@@ -890,8 +889,6 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
         sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
         skb_reset_mac_header(skb);
 
-        iip = ip_hdr(skb);
-
         if (info) {
                 const struct ip_tunnel_key *key = &info->key;
                 u8 *opts = NULL;
@@ -911,7 +908,7 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                 if (unlikely(err))
                         goto tx_error;
 
-                tos = ip_tunnel_ecn_encap(key->tos, iip, skb);
+                tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
                 ttl = key->ttl;
                 df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0;
         } else {
@@ -920,7 +917,7 @@ static netdev_tx_t geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                 if (unlikely(err))
                         goto tx_error;
 
-                tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, iip, skb);
+                tos = ip_tunnel_ecn_encap(fl4.flowi4_tos, ip_hdr(skb), skb);
                 ttl = geneve->ttl;
                 if (!ttl && IN_MULTICAST(ntohl(fl4.daddr)))
                         ttl = 1;
@@ -952,7 +949,6 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
 {
         struct geneve_dev *geneve = netdev_priv(dev);
         struct dst_entry *dst = NULL;
-        const struct iphdr *iip; /* interior IP header */
         struct geneve_sock *gs6;
         int err = -EINVAL;
         struct flowi6 fl6;
@@ -982,8 +978,6 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
         sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
         skb_reset_mac_header(skb);
 
-        iip = ip_hdr(skb);
-
         if (info) {
                 const struct ip_tunnel_key *key = &info->key;
                 u8 *opts = NULL;
@@ -1004,7 +998,7 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                 if (unlikely(err))
                         goto tx_error;
 
-                prio = ip_tunnel_ecn_encap(key->tos, iip, skb);
+                prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb);
                 ttl = key->ttl;
                 label = info->key.label;
         } else {
@@ -1014,7 +1008,7 @@ static netdev_tx_t geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev,
                         goto tx_error;
 
                 prio = ip_tunnel_ecn_encap(ip6_tclass(fl6.flowlabel),
-                                           iip, skb);
+                                           ip_hdr(skb), skb);
                 ttl = geneve->ttl;
                 if (!ttl && ipv6_addr_is_multicast(&fl6.daddr))
                         ttl = 1;
diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index f442eb366863..0fef17874d50 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -497,6 +497,7 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev,
         struct net_device *phy_dev;
         int err;
         u16 mode = IPVLAN_MODE_L3;
+        bool create = false;
 
         if (!tb[IFLA_LINK])
                 return -EINVAL;
@@ -513,6 +514,7 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev,
                 err = ipvlan_port_create(phy_dev);
                 if (err < 0)
                         return err;
+                create = true;
         }
 
         if (data && data[IFLA_IPVLAN_MODE])
@@ -536,22 +538,27 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev,
 
         err = register_netdevice(dev);
         if (err < 0)
-                return err;
+                goto destroy_ipvlan_port;
 
         err = netdev_upper_dev_link(phy_dev, dev);
         if (err) {
-                unregister_netdevice(dev);
-                return err;
+                goto unregister_netdev;
         }
         err = ipvlan_set_port_mode(port, mode);
         if (err) {
-                unregister_netdevice(dev);
-                return err;
+                goto unregister_netdev;
         }
 
         list_add_tail_rcu(&ipvlan->pnode, &port->ipvlans);
         netif_stacked_transfer_operstate(phy_dev, dev);
         return 0;
+
+unregister_netdev:
+        unregister_netdevice(dev);
+destroy_ipvlan_port:
+        if (create)
+                ipvlan_port_destroy(phy_dev);
+        return err;
 }
 
 static void ipvlan_link_delete(struct net_device *dev, struct list_head *head)
diff --git a/drivers/net/irda/w83977af_ir.c b/drivers/net/irda/w83977af_ir.c
index 4e3d2e7c697c..e8c3a8c32534 100644
--- a/drivers/net/irda/w83977af_ir.c
+++ b/drivers/net/irda/w83977af_ir.c
@@ -518,7 +518,9 @@ static netdev_tx_t w83977af_hard_xmit(struct sk_buff *skb,
                 
                 mtt = irda_get_mtt(skb);
                 pr_debug("%s(%ld), mtt=%d\n", __func__ , jiffies, mtt);
-                        if (mtt)
+                        if (mtt > 1000)
+                                mdelay(mtt/1000);
+                        else if (mtt)
                                 udelay(mtt);
 
                         /* Enable DMA interrupt */
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 070e3290aa6e..7869b0651576 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -491,7 +491,13 @@ static int macvtap_newlink(struct net *src_net,
         /* Don't put anything that may fail after macvlan_common_newlink
          * because we can't undo what it does.
          */
-        return macvlan_common_newlink(src_net, dev, tb, data);
+        err = macvlan_common_newlink(src_net, dev, tb, data);
+        if (err) {
+                netdev_rx_handler_unregister(dev);
+                return err;
+        }
+
+        return 0;
 }
 
 static void macvtap_dellink(struct net_device *dev,
@@ -736,13 +742,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
 
         if (zerocopy)
                 err = zerocopy_sg_from_iter(skb, from);
-        else {
+        else
                 err = skb_copy_datagram_from_iter(skb, 0, from, len);
-                if (!err && m && m->msg_control) {
-                        struct ubuf_info *uarg = m->msg_control;
-                        uarg->callback(uarg, false);
-                }
-        }
 
         if (err)
                 goto err_kfree;
@@ -773,7 +774,11 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
                 skb_shinfo(skb)->destructor_arg = m->msg_control;
                 skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
                 skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
+        } else if (m && m->msg_control) {
+                struct ubuf_info *uarg = m->msg_control;
+                uarg->callback(uarg, false);
         }
+
         if (vlan) {
                 skb->dev = vlan->dev;
                 dev_queue_xmit(skb);
diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
index aadd6e9f54ad..9cbe645e3d89 100644
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -102,15 +102,19 @@ static int rtl8211f_config_init(struct phy_device *phydev)
         if (ret < 0)
                 return ret;
 
-        if (phydev->interface == PHY_INTERFACE_MODE_RGMII) {
-                /* enable TXDLY */
-                phy_write(phydev, RTL8211F_PAGE_SELECT, 0xd08);
-                reg = phy_read(phydev, 0x11);
+        phy_write(phydev, RTL8211F_PAGE_SELECT, 0xd08);
+        reg = phy_read(phydev, 0x11);
+
+        /* enable TX-delay for rgmii-id and rgmii-txid, otherwise disable it */
+        if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID ||
+            phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
                 reg |= RTL8211F_TX_DELAY;
-                phy_write(phydev, 0x11, reg);
-                /* restore to default page 0 */
-                phy_write(phydev, RTL8211F_PAGE_SELECT, 0x0);
-        }
+        else
+                reg &= ~RTL8211F_TX_DELAY;
+
+        phy_write(phydev, 0x11, reg);
+        /* restore to default page 0 */
+        phy_write(phydev, RTL8211F_PAGE_SELECT, 0x0);
 
         return 0;
 }
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 8093e39ae263..db6acecabeaa 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1246,13 +1246,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
 
         if (zerocopy)
                 err = zerocopy_sg_from_iter(skb, from);
-        else {
+        else
                 err = skb_copy_datagram_from_iter(skb, 0, from, len);
-                if (!err && msg_control) {
-                        struct ubuf_info *uarg = msg_control;
-                        uarg->callback(uarg, false);
-                }
-        }
 
         if (err) {
                 this_cpu_inc(tun->pcpu_stats->rx_dropped);
@@ -1298,6 +1293,9 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                 skb_shinfo(skb)->destructor_arg = msg_control;
                 skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
                 skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
+        } else if (msg_control) {
+                struct ubuf_info *uarg = msg_control;
+                uarg->callback(uarg, false);
         }
 
         skb_reset_network_header(skb);
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index cce24950a0ab..dc7b6392e75a 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -603,12 +603,12 @@ static void ax88772_suspend(struct usbnet *dev)
         u16 medium;
 
         /* Stop MAC operation */
-        medium = asix_read_medium_status(dev, 0);
+        medium = asix_read_medium_status(dev, 1);
         medium &= ~AX_MEDIUM_RE;
-        asix_write_medium_mode(dev, medium, 0);
+        asix_write_medium_mode(dev, medium, 1);
 
         netdev_dbg(dev->net, "ax88772_suspend: medium=0x%04x\n",
-                   asix_read_medium_status(dev, 0));
+                   asix_read_medium_status(dev, 1));
 
         /* Preserve BMCR for restoring */
         priv->presvd_phy_bmcr =
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index c47ec0a04c8e..dd623f674487 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -388,12 +388,6 @@ void usbnet_cdc_status(struct usbnet *dev, struct urb *urb)
         case USB_CDC_NOTIFY_NETWORK_CONNECTION:
                 netif_dbg(dev, timer, dev->net, "CDC: carrier %s\n",
                           event->wValue ? "on" : "off");
-
-                /* Work-around for devices with broken off-notifications */
-                if (event->wValue &&
-                    !test_bit(__LINK_STATE_NOCARRIER, &dev->net->state))
-                        usbnet_link_change(dev, 0, 0);
-
                 usbnet_link_change(dev, !!event->wValue, 0);
                 break;
         case USB_CDC_NOTIFY_SPEED_CHANGE:       /* tx/rx rates */
@@ -466,6 +460,36 @@ static int usbnet_cdc_zte_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
         return 1;
 }
 
+/* Ensure correct link state
+ *
+ * Some devices (ZTE MF823/831/910) export two carrier on notifications when
+ * connected. This causes the link state to be incorrect. Work around this by
+ * always setting the state to off, then on.
+ */
+void usbnet_cdc_zte_status(struct usbnet *dev, struct urb *urb)
+{
+        struct usb_cdc_notification *event;
+
+        if (urb->actual_length < sizeof(*event))
+                return;
+
+        event = urb->transfer_buffer;
+
+        if (event->bNotificationType != USB_CDC_NOTIFY_NETWORK_CONNECTION) {
+                usbnet_cdc_status(dev, urb);
+                return;
+        }
+
+        netif_dbg(dev, timer, dev->net, "CDC: carrier %s\n",
+                  event->wValue ? "on" : "off");
+
+        if (event->wValue &&
+            netif_carrier_ok(dev->net))
+                netif_carrier_off(dev->net);
+
+        usbnet_link_change(dev, !!event->wValue, 0);
+}
+
 static const struct driver_info cdc_info = {
         .description =  "CDC Ethernet Device",
         .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
@@ -481,7 +505,7 @@ static const struct driver_info	zte_cdc_info = {
         .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
         .bind =         usbnet_cdc_zte_bind,
         .unbind =       usbnet_cdc_unbind,
-        .status =       usbnet_cdc_status,
+        .status =       usbnet_cdc_zte_status,
         .set_rx_mode =  usbnet_cdc_update_filter,
         .manage_power = usbnet_manage_power,
         .rx_fixup = usbnet_cdc_zte_rx_fixup,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 3ff76c6db4f6..6fe1cdb0174f 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -894,6 +894,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
         {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
         {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
+        {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
         {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
         {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},    /* Telit LE920 */
         {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},    /* XS Stick W100-2 from 4G Systems */
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 24532cdebb00..2ba01ca02c9c 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -611,6 +611,7 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
         struct vxlan_rdst *rd = NULL;
         struct vxlan_fdb *f;
         int notify = 0;
+        int rc;
 
         f = __vxlan_find_mac(vxlan, mac);
         if (f) {
@@ -641,8 +642,7 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                 if ((flags & NLM_F_APPEND) &&
                     (is_multicast_ether_addr(f->eth_addr) ||
                      is_zero_ether_addr(f->eth_addr))) {
-                        int rc = vxlan_fdb_append(f, ip, port, vni, ifindex,
-                                                  &rd);
+                        rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
 
                         if (rc < 0)
                                 return rc;
@@ -673,7 +673,11 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan,
                 INIT_LIST_HEAD(&f->remotes);
                 memcpy(f->eth_addr, mac, ETH_ALEN);
 
-                vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
+                rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
+                if (rc < 0) {
+                        kfree(f);
+                        return rc;
+                }
 
                 ++vxlan->addrcnt;
                 hlist_add_head_rcu(&f->hlist,
diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 39ce76ad00bc..16241d21727b 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -2222,8 +2222,9 @@ done:
                         is_scanning_required = 1;
                 } else {
                         mwifiex_dbg(priv->adapter, MSG,
-                                    "info: trying to associate to '%s' bssid %pM\n",
-                                    (char *)req_ssid.ssid, bss->bssid);
+                                    "info: trying to associate to '%.*s' bssid %pM\n",
+                                    req_ssid.ssid_len, (char *)req_ssid.ssid,
+                                    bss->bssid);
                         memcpy(&priv->cfg_bssid, bss->bssid, ETH_ALEN);
                         break;
                 }
@@ -2283,8 +2284,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
         }
 
         mwifiex_dbg(adapter, INFO,
-                    "info: Trying to associate to %s and bssid %pM\n",
-                    (char *)sme->ssid, sme->bssid);
+                    "info: Trying to associate to %.*s and bssid %pM\n",
+                    (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
 
         if (!mwifiex_stop_bg_scan(priv))
                 cfg80211_sched_scan_stopped_rtnl(priv->wdev.wiphy);
@@ -2417,8 +2418,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
         }
 
         mwifiex_dbg(priv->adapter, MSG,
-                    "info: trying to join to %s and bssid %pM\n",
-                    (char *)params->ssid, params->bssid);
+                    "info: trying to join to %.*s and bssid %pM\n",
+                    params->ssid_len, (char *)params->ssid, params->bssid);
 
         mwifiex_set_ibss_params(priv, params);
 
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 5a3145a02547..262281bd68fa 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -490,3 +490,18 @@ int of_phy_register_fixed_link(struct device_node *np)
         return -ENODEV;
 }
 EXPORT_SYMBOL(of_phy_register_fixed_link);
+
+void of_phy_deregister_fixed_link(struct device_node *np)
+{
+        struct phy_device *phydev;
+
+        phydev = of_phy_find_device(np);
+        if (!phydev)
+                return;
+
+        fixed_phy_unregister(phydev);
+
+        put_device(&phydev->mdio.dev);  /* of_phy_find_device() */
+        phy_device_free(phydev);        /* fixed_phy_register() */
+}
+EXPORT_SYMBOL(of_phy_deregister_fixed_link);
diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
index 3be7abd6e722..c9f379689dd0 100644
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -476,7 +476,6 @@ enum {
 enum {
         MLX4_INTERFACE_STATE_UP         = 1 << 0,
         MLX4_INTERFACE_STATE_DELETION   = 1 << 1,
-        MLX4_INTERFACE_STATE_SHUTDOWN   = 1 << 2,
 };
 
 #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \
diff --git a/include/linux/of_mdio.h b/include/linux/of_mdio.h
index 2ab233661ae5..a58cca8bcb29 100644
--- a/include/linux/of_mdio.h
+++ b/include/linux/of_mdio.h
@@ -29,6 +29,7 @@ struct phy_device *of_phy_attach(struct net_device *dev,
 extern struct mii_bus *of_mdio_find_bus(struct device_node *mdio_np);
 extern int of_mdio_parse_addr(struct device *dev, const struct device_node *np);
 extern int of_phy_register_fixed_link(struct device_node *np);
+extern void of_phy_deregister_fixed_link(struct device_node *np);
 extern bool of_phy_is_fixed_link(struct device_node *np);
 
 #else /* CONFIG_OF */
@@ -83,6 +84,9 @@ static inline int of_phy_register_fixed_link(struct device_node *np)
 {
         return -ENOSYS;
 }
+static inline void of_phy_deregister_fixed_link(struct device_node *np)
+{
+}
 static inline bool of_phy_is_fixed_link(struct device_node *np)
 {
         return false;
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 8fed1cd78658..f11ca837361b 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -970,6 +970,8 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
 int compat_ipv6_getsockopt(struct sock *sk, int level, int optname,
                            char __user *optval, int __user *optlen);
 
+int __ip6_datagram_connect(struct sock *sk, struct sockaddr *addr,
+                           int addr_len);
 int ip6_datagram_connect(struct sock *sk, struct sockaddr *addr, int addr_len);
 int ip6_datagram_connect_v6_only(struct sock *sk, struct sockaddr *addr,
                                  int addr_len);
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 50418052a520..d9d52c020a70 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -100,6 +100,9 @@ struct nf_conn {
 
         possible_net_t ct_net;
 
+#if IS_ENABLED(CONFIG_NF_NAT)
+        struct rhlist_head nat_bysource;
+#endif
         /* all members below initialized via memset */
         u8 __nfct_init_offset[0];
 
@@ -117,9 +120,6 @@ struct nf_conn {
         /* Extensions */
         struct nf_ct_ext *ext;
 
-#if IS_ENABLED(CONFIG_NF_NAT)
-        struct rhash_head       nat_bysource;
-#endif
         /* Storage reserved for other modules, must be the last member */
         union nf_conntrack_proto proto;
 };
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index d79d1e9b9546..b02af0bf5777 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -313,7 +313,7 @@ void nft_unregister_set(struct nft_set_ops *ops);
  *      @size: maximum set size
  *      @nelems: number of elements
  *      @ndeact: number of deactivated elements queued for removal
- *      @timeout: default timeout value in msecs
+ *      @timeout: default timeout value in jiffies
  *      @gc_int: garbage collection interval in msecs
  *      @policy: set parameterization (see enum nft_set_policies)
  *      @udlen: user data length
diff --git a/include/uapi/linux/tc_act/Kbuild b/include/uapi/linux/tc_act/Kbuild
index e3969bd939e4..9611c7b6c18f 100644
--- a/include/uapi/linux/tc_act/Kbuild
+++ b/include/uapi/linux/tc_act/Kbuild
@@ -11,3 +11,4 @@ header-y += tc_vlan.h
 header-y += tc_bpf.h
 header-y += tc_connmark.h
 header-y += tc_ife.h
+header-y += tc_tunnel_key.h
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6a936159c6e0..8199821f54cf 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2454,6 +2454,7 @@ static bool states_equal(struct bpf_verifier_env *env,
                          struct bpf_verifier_state *old,
                          struct bpf_verifier_state *cur)
 {
+        bool varlen_map_access = env->varlen_map_value_access;
         struct bpf_reg_state *rold, *rcur;
         int i;
 
@@ -2467,12 +2468,17 @@ static bool states_equal(struct bpf_verifier_env *env,
                 /* If the ranges were not the same, but everything else was and
                  * we didn't do a variable access into a map then we are a-ok.
                  */
-                if (!env->varlen_map_value_access &&
+                if (!varlen_map_access &&
                     rold->type == rcur->type && rold->imm == rcur->imm)
                         continue;
 
+                /* If we didn't map access then again we don't care about the
+                 * mismatched range values and it's ok if our old type was
+                 * UNKNOWN and we didn't go to a NOT_INIT'ed reg.
+                 */
                 if (rold->type == NOT_INIT ||
-                    (rold->type == UNKNOWN_VALUE && rcur->type != NOT_INIT))
+                    (!varlen_map_access && rold->type == UNKNOWN_VALUE &&
+                     rcur->type != NOT_INIT))
                         continue;
 
                 if (rold->type == PTR_TO_PACKET && rcur->type == PTR_TO_PACKET &&
diff --git a/net/core/flow.c b/net/core/flow.c
index 3937b1b68d5b..18e8893d4be5 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -95,7 +95,6 @@ static void flow_cache_gc_task(struct work_struct *work)
         list_for_each_entry_safe(fce, n, &gc_list, u.gc_list) {
                 flow_entry_kill(fce, xfrm);
                 atomic_dec(&xfrm->flow_cache_gc_count);
-                WARN_ON(atomic_read(&xfrm->flow_cache_gc_count) < 0);
         }
 }
 
@@ -236,9 +235,8 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
                 if (fcp->hash_count > fc->high_watermark)
                         flow_cache_shrink(fc, fcp);
 
-                if (fcp->hash_count > 2 * fc->high_watermark ||
-                    atomic_read(&net->xfrm.flow_cache_gc_count) > fc->high_watermark) {
-                        atomic_inc(&net->xfrm.flow_cache_genid);
+                if (atomic_read(&net->xfrm.flow_cache_gc_count) >
+                    2 * num_online_cpus() * fc->high_watermark) {
                         flo = ERR_PTR(-ENOBUFS);
                         goto ret_object;
                 }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index deb35acbefd0..a6196cf844f6 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -931,8 +931,8 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
                + nla_total_size(4) /* IFLA_PROMISCUITY */
                + nla_total_size(4) /* IFLA_NUM_TX_QUEUES */
                + nla_total_size(4) /* IFLA_NUM_RX_QUEUES */
-               + nla_total_size(4) /* IFLA_MAX_GSO_SEGS */
-               + nla_total_size(4) /* IFLA_MAX_GSO_SIZE */
+               + nla_total_size(4) /* IFLA_GSO_MAX_SEGS */
+               + nla_total_size(4) /* IFLA_GSO_MAX_SIZE */
                + nla_total_size(1) /* IFLA_OPERSTATE */
                + nla_total_size(1) /* IFLA_LINKMODE */
                + nla_total_size(4) /* IFLA_CARRIER_CHANGES */
diff --git a/net/core/sock.c b/net/core/sock.c
index 5e3ca414357e..00a074dbfe9b 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -715,7 +715,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
                 val = min_t(u32, val, sysctl_wmem_max);
 set_sndbuf:
                 sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
-                sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF);
+                sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
                 /* Wake up sending tasks if we upped the value. */
                 sk->sk_write_space(sk);
                 break;
@@ -751,7 +751,7 @@ set_rcvbuf:
                  * returning the value we actually used in getsockopt
                  * is the most desirable behavior.
                  */
-                sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF);
+                sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
                 break;
 
         case SO_RCVBUFFORCE:
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index b567c8725aea..edbe59d203ef 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -700,6 +700,7 @@ int dccp_invalid_packet(struct sk_buff *skb)
 {
         const struct dccp_hdr *dh;
         unsigned int cscov;
+        u8 dccph_doff;
 
         if (skb->pkt_type != PACKET_HOST)
                 return 1;
@@ -721,18 +722,19 @@ int dccp_invalid_packet(struct sk_buff *skb)
         /*
          * If P.Data Offset is too small for packet type, drop packet and return
          */
-        if (dh->dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
-                DCCP_WARN("P.Data Offset(%u) too small\n", dh->dccph_doff);
+        dccph_doff = dh->dccph_doff;
+        if (dccph_doff < dccp_hdr_len(skb) / sizeof(u32)) {
+                DCCP_WARN("P.Data Offset(%u) too small\n", dccph_doff);
                 return 1;
         }
         /*
          * If P.Data Offset is too too large for packet, drop packet and return
          */
-        if (!pskb_may_pull(skb, dh->dccph_doff * sizeof(u32))) {
-                DCCP_WARN("P.Data Offset(%u) too large\n", dh->dccph_doff);
+        if (!pskb_may_pull(skb, dccph_doff * sizeof(u32))) {
+                DCCP_WARN("P.Data Offset(%u) too large\n", dccph_doff);
                 return 1;
         }
-
+        dh = dccp_hdr(skb);
         /*
          * If P.type is not Data, Ack, or DataAck and P.X == 0 (the packet
          * has short sequence numbers), drop packet and return
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index a6902c1e2f28..7899919cd9f0 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -233,6 +233,8 @@ int dsa_cpu_dsa_setup(struct dsa_switch *ds, struct device *dev,
                 genphy_read_status(phydev);
                 if (ds->ops->adjust_link)
                         ds->ops->adjust_link(ds, port, phydev);
+
+                put_device(&phydev->mdio.dev);
         }
 
         return 0;
@@ -504,15 +506,8 @@ dsa_switch_setup(struct dsa_switch_tree *dst, int index,
 
 void dsa_cpu_dsa_destroy(struct device_node *port_dn)
 {
-        struct phy_device *phydev;
-
-        if (of_phy_is_fixed_link(port_dn)) {
-                phydev = of_phy_find_device(port_dn);
-                if (phydev) {
-                        phy_device_free(phydev);
-                        fixed_phy_unregister(phydev);
-                }
-        }
+        if (of_phy_is_fixed_link(port_dn))
+                of_phy_deregister_fixed_link(port_dn);
 }
 
 static void dsa_switch_destroy(struct dsa_switch *ds)
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index f8a7d9aab437..5fff951a0a49 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -28,8 +28,10 @@ static struct dsa_switch_tree *dsa_get_dst(u32 tree)
         struct dsa_switch_tree *dst;
 
         list_for_each_entry(dst, &dsa_switch_trees, list)
-                if (dst->tree == tree)
+                if (dst->tree == tree) {
+                        kref_get(&dst->refcount);
                         return dst;
+                }
         return NULL;
 }
 
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 6b1282c006b1..30e2e21d7619 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1125,7 +1125,7 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
         p->phy_interface = mode;
 
         phy_dn = of_parse_phandle(port_dn, "phy-handle", 0);
-        if (of_phy_is_fixed_link(port_dn)) {
+        if (!phy_dn && of_phy_is_fixed_link(port_dn)) {
                 /* In the case of a fixed PHY, the DT node associated
                  * to the fixed PHY is the Port DT node
                  */
@@ -1135,7 +1135,7 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
                         return ret;
                 }
                 phy_is_fixed = true;
-                phy_dn = port_dn;
+                phy_dn = of_node_get(port_dn);
         }
 
         if (ds->ops->get_phy_flags)
@@ -1154,6 +1154,7 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
                         ret = dsa_slave_phy_connect(p, slave_dev, phy_id);
                         if (ret) {
                                 netdev_err(slave_dev, "failed to connect to phy%d: %d\n", phy_id, ret);
+                                of_node_put(phy_dn);
                                 return ret;
                         }
                 } else {
@@ -1162,6 +1163,8 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
                                                 phy_flags,
                                                 p->phy_interface);
                 }
+
+                of_node_put(phy_dn);
         }
 
         if (p->phy && phy_is_fixed)
@@ -1174,6 +1177,8 @@ static int dsa_slave_phy_setup(struct dsa_slave_priv *p,
                 ret = dsa_slave_phy_connect(p, slave_dev, p->port);
                 if (ret) {
                         netdev_err(slave_dev, "failed to connect to port %d: %d\n", p->port, ret);
+                        if (phy_is_fixed)
+                                of_phy_deregister_fixed_link(port_dn);
                         return ret;
                 }
         }
@@ -1289,10 +1294,18 @@ int dsa_slave_create(struct dsa_switch *ds, struct device *parent,
 void dsa_slave_destroy(struct net_device *slave_dev)
 {
         struct dsa_slave_priv *p = netdev_priv(slave_dev);
+        struct dsa_switch *ds = p->parent;
+        struct device_node *port_dn;
+
+        port_dn = ds->ports[p->port].dn;
 
         netif_carrier_off(slave_dev);
-        if (p->phy)
+        if (p->phy) {
                 phy_disconnect(p->phy);
+
+                if (of_phy_is_fixed_link(port_dn))
+                        of_phy_deregister_fixed_link(port_dn);
+        }
         unregister_netdev(slave_dev);
         free_netdev(slave_dev);
 }
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 300b06888fdf..b54b3ca939db 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -715,6 +715,7 @@ config DEFAULT_TCP_CONG
         default "reno" if DEFAULT_RENO
         default "dctcp" if DEFAULT_DCTCP
         default "cdg" if DEFAULT_CDG
+        default "bbr" if DEFAULT_BBR
         default "cubic"
 
 config TCP_MD5SIG
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 5ddf5cda07f4..215143246e4b 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1233,7 +1233,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
                 fixedid = !!(skb_shinfo(skb)->gso_type & SKB_GSO_TCP_FIXEDID);
 
                 /* fixed ID is invalid if DF bit is not set */
-                if (fixedid && !(iph->frag_off & htons(IP_DF)))
+                if (fixedid && !(ip_hdr(skb)->frag_off & htons(IP_DF)))
                         goto out;
         }
 
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index d95631d09248..20fb25e3027b 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -476,7 +476,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
                 esph = (void *)skb_push(skb, 4);
                 *seqhi = esph->spi;
                 esph->spi = esph->seq_no;
-                esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.input.hi);
+                esph->seq_no = XFRM_SKB_CB(skb)->seq.input.hi;
                 aead_request_set_callback(req, 0, esp_input_done_esn, skb);
         }
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 105908d841a3..877bdb02e887 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -107,6 +107,8 @@ int __ip_local_out(struct net *net, struct sock *sk, struct sk_buff *skb)
         if (unlikely(!skb))
                 return 0;
 
+        skb->protocol = htons(ETH_P_IP);
+
         return nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT,
                        net, sk, skb, NULL, skb_dst(skb)->dev,
                        dst_output);
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index c3776ff6749f..b3cc1335adbc 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -24,10 +24,11 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t
         struct flowi4 fl4 = {};
         __be32 saddr = iph->saddr;
         __u8 flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
+        struct net_device *dev = skb_dst(skb)->dev;
         unsigned int hh_len;
 
         if (addr_type == RTN_UNSPEC)
-                addr_type = inet_addr_type(net, saddr);
+                addr_type = inet_addr_type_dev_table(net, dev, saddr);
         if (addr_type == RTN_LOCAL || addr_type == RTN_UNICAST)
                 flags |= FLOWI_FLAG_ANYSRC;
         else
@@ -40,6 +41,8 @@ int ip_route_me_harder(struct net *net, struct sk_buff *skb, unsigned int addr_t
         fl4.saddr = saddr;
         fl4.flowi4_tos = RT_TOS(iph->tos);
         fl4.flowi4_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
+        if (!fl4.flowi4_oif)
+                fl4.flowi4_oif = l3mdev_master_ifindex(dev);
         fl4.flowi4_mark = skb->mark;
         fl4.flowi4_flags = flags;
         rt = ip_route_output_key(net, &fl4);
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index b31df597fd37..697538464e6e 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1201,8 +1201,8 @@ static int translate_compat_table(struct xt_table_info **pinfo,
 
         newinfo->number = compatr->num_entries;
         for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
-                newinfo->hook_entry[i] = info->hook_entry[i];
-                newinfo->underflow[i] = info->underflow[i];
+                newinfo->hook_entry[i] = compatr->hook_entry[i];
+                newinfo->underflow[i] = compatr->underflow[i];
         }
         entry1 = newinfo->entries;
         pos = entry1;
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 37874e2f30ed..ccf40550c475 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -139,7 +139,8 @@ void ip6_datagram_release_cb(struct sock *sk)
 }
 EXPORT_SYMBOL_GPL(ip6_datagram_release_cb);
 
-static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr,
+                           int addr_len)
 {
         struct sockaddr_in6     *usin = (struct sockaddr_in6 *) uaddr;
         struct inet_sock        *inet = inet_sk(sk);
@@ -252,6 +253,7 @@ ipv4_connected:
 out:
         return err;
 }
+EXPORT_SYMBOL_GPL(__ip6_datagram_connect);
 
 int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 060a60b2f8a6..111ba55fd512 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -418,7 +418,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
                 esph = (void *)skb_push(skb, 4);
                 *seqhi = esph->spi;
                 esph->spi = esph->seq_no;
-                esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.input.hi);
+                esph->seq_no = XFRM_SKB_CB(skb)->seq.input.hi;
                 aead_request_set_callback(req, 0, esp_input_done_esn, skb);
         }
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 7370ad2e693a..2772004ba5a1 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -447,8 +447,10 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
 
         if (__ipv6_addr_needs_scope_id(addr_type))
                 iif = skb->dev->ifindex;
-        else
-                iif = l3mdev_master_ifindex(skb_dst(skb)->dev);
+        else {
+                dst = skb_dst(skb);
+                iif = l3mdev_master_ifindex(dst ? dst->dev : skb->dev);
+        }
 
         /*
          *      Must not send error if the source does not uniquely
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 1fcf61f1cbc3..89c59e656f44 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -99,7 +99,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                 segs = ops->callbacks.gso_segment(skb, features);
         }
 
-        if (IS_ERR(segs))
+        if (IS_ERR_OR_NULL(segs))
                 goto out;
 
         gso_partial = !!(skb_shinfo(segs)->gso_type & SKB_GSO_PARTIAL);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 0a4759b89da2..d76674efe523 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1181,7 +1181,6 @@ route_lookup:
         if (err)
                 return err;
 
-        skb->protocol = htons(ETH_P_IPV6);
         skb_push(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         ipv6h = ipv6_hdr(skb);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 8a02ca8a11af..c299c1e2bbf0 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -1138,6 +1138,33 @@ static struct xfrm6_protocol vti_ipcomp6_protocol __read_mostly = {
         .priority       =       100,
 };
 
+static bool is_vti6_tunnel(const struct net_device *dev)
+{
+        return dev->netdev_ops == &vti6_netdev_ops;
+}
+
+static int vti6_device_event(struct notifier_block *unused,
+                             unsigned long event, void *ptr)
+{
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct ip6_tnl *t = netdev_priv(dev);
+
+        if (!is_vti6_tunnel(dev))
+                return NOTIFY_DONE;
+
+        switch (event) {
+        case NETDEV_DOWN:
+                if (!net_eq(t->net, dev_net(dev)))
+                        xfrm_garbage_collect(t->net);
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block vti6_notifier_block __read_mostly = {
+        .notifier_call = vti6_device_event,
+};
+
 /**
  * vti6_tunnel_init - register protocol and reserve needed resources
  *
@@ -1148,6 +1175,8 @@ static int __init vti6_tunnel_init(void)
         const char *msg;
         int err;
 
+        register_netdevice_notifier(&vti6_notifier_block);
+
         msg = "tunnel device";
         err = register_pernet_device(&vti6_net_ops);
         if (err < 0)
@@ -1180,6 +1209,7 @@ xfrm_proto_ah_failed:
 xfrm_proto_esp_failed:
         unregister_pernet_device(&vti6_net_ops);
 pernet_dev_failed:
+        unregister_netdevice_notifier(&vti6_notifier_block);
         pr_err("vti6 init: failed to register %s\n", msg);
         return err;
 }
@@ -1194,6 +1224,7 @@ static void __exit vti6_tunnel_cleanup(void)
         xfrm6_protocol_deregister(&vti_ah6_protocol, IPPROTO_AH);
         xfrm6_protocol_deregister(&vti_esp6_protocol, IPPROTO_ESP);
         unregister_pernet_device(&vti6_net_ops);
+        unregister_netdevice_notifier(&vti6_notifier_block);
 }
 
 module_init(vti6_tunnel_init);
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index e4347aeb2e65..9948b5ce52da 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -576,11 +576,11 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
         /* Jumbo payload inhibits frag. header */
         if (ipv6_hdr(skb)->payload_len == 0) {
                 pr_debug("payload len = 0\n");
-                return -EINVAL;
+                return 0;
         }
 
         if (find_prev_fhdr(skb, &prevhdr, &nhoff, &fhoff) < 0)
-                return -EINVAL;
+                return 0;
 
         if (!pskb_may_pull(skb, fhoff + sizeof(*fhdr)))
                 return -ENOMEM;
diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
index f7aab5ab93a5..f06b0471f39f 100644
--- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
+++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
@@ -69,7 +69,7 @@ static unsigned int ipv6_defrag(void *priv,
         if (err == -EINPROGRESS)
                 return NF_STOLEN;
 
-        return NF_ACCEPT;
+        return err == 0 ? NF_ACCEPT : NF_DROP;
 }
 
 static struct nf_hook_ops ipv6_defrag_ops[] = {
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index a5400223fd74..10090400c72f 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -156,6 +156,7 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
         fl6.daddr = oip6h->saddr;
         fl6.fl6_sport = otcph->dest;
         fl6.fl6_dport = otcph->source;
+        fl6.flowi6_oif = l3mdev_master_ifindex(skb_dst(oldskb)->dev);
         security_skb_classify_flow(oldskb, flowi6_to_flowi(&fl6));
         dst = ip6_route_output(net, NULL, &fl6);
         if (dst->error) {
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 7cca8ac66fe9..cd4252346a32 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -155,6 +155,8 @@ int __ip6_local_out(struct net *net, struct sock *sk, struct sk_buff *skb)
         if (unlikely(!skb))
                 return 0;
 
+        skb->protocol = htons(ETH_P_IPV6);
+
         return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
                        net, sk, skb, NULL, skb_dst(skb)->dev,
                        dst_output);
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 982f6c44ea01..8938b6ba57a0 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -61,7 +61,8 @@ static struct sock *__l2tp_ip_bind_lookup(struct net *net, __be32 laddr, int dif
                 if ((l2tp->conn_id == tunnel_id) &&
                     net_eq(sock_net(sk), net) &&
                     !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
-                    !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
+                    (!sk->sk_bound_dev_if || !dif ||
+                     sk->sk_bound_dev_if == dif))
                         goto found;
         }
 
@@ -182,15 +183,17 @@ pass_up:
                 struct iphdr *iph = (struct iphdr *) skb_network_header(skb);
 
                 read_lock_bh(&l2tp_ip_lock);
-                sk = __l2tp_ip_bind_lookup(net, iph->daddr, 0, tunnel_id);
+                sk = __l2tp_ip_bind_lookup(net, iph->daddr, inet_iif(skb),
+                                           tunnel_id);
+                if (!sk) {
+                        read_unlock_bh(&l2tp_ip_lock);
+                        goto discard;
+                }
+
+                sock_hold(sk);
                 read_unlock_bh(&l2tp_ip_lock);
         }
 
-        if (sk == NULL)
-                goto discard;
-
-        sock_hold(sk);
-
         if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_put;
 
@@ -256,15 +259,9 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (addr->l2tp_family != AF_INET)
                 return -EINVAL;
 
-        ret = -EADDRINUSE;
-        read_lock_bh(&l2tp_ip_lock);
-        if (__l2tp_ip_bind_lookup(net, addr->l2tp_addr.s_addr,
-                                  sk->sk_bound_dev_if, addr->l2tp_conn_id))
-                goto out_in_use;
-
-        read_unlock_bh(&l2tp_ip_lock);
-
         lock_sock(sk);
+
+        ret = -EINVAL;
         if (!sock_flag(sk, SOCK_ZAPPED))
                 goto out;
 
@@ -281,14 +278,22 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 inet->inet_rcv_saddr = inet->inet_saddr = addr->l2tp_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
                 inet->inet_saddr = 0;  /* Use device */
-        sk_dst_reset(sk);
 
+        write_lock_bh(&l2tp_ip_lock);
+        if (__l2tp_ip_bind_lookup(net, addr->l2tp_addr.s_addr,
+                                  sk->sk_bound_dev_if, addr->l2tp_conn_id)) {
+                write_unlock_bh(&l2tp_ip_lock);
+                ret = -EADDRINUSE;
+                goto out;
+        }
+
+        sk_dst_reset(sk);
         l2tp_ip_sk(sk)->conn_id = addr->l2tp_conn_id;
 
-        write_lock_bh(&l2tp_ip_lock);
         sk_add_bind_node(sk, &l2tp_ip_bind_table);
         sk_del_node_init(sk);
         write_unlock_bh(&l2tp_ip_lock);
+
         ret = 0;
         sock_reset_flag(sk, SOCK_ZAPPED);
 
@@ -296,11 +301,6 @@ out:
         release_sock(sk);
 
         return ret;
-
-out_in_use:
-        read_unlock_bh(&l2tp_ip_lock);
-
-        return ret;
 }
 
 static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
@@ -308,21 +308,24 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
         struct sockaddr_l2tpip *lsa = (struct sockaddr_l2tpip *) uaddr;
         int rc;
 
-        if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
-                return -EINVAL;
-
         if (addr_len < sizeof(*lsa))
                 return -EINVAL;
 
         if (ipv4_is_multicast(lsa->l2tp_addr.s_addr))
                 return -EINVAL;
 
-        rc = ip4_datagram_connect(sk, uaddr, addr_len);
-        if (rc < 0)
-                return rc;
-
         lock_sock(sk);
 
+        /* Must bind first - autobinding does not work */
+        if (sock_flag(sk, SOCK_ZAPPED)) {
+                rc = -EINVAL;
+                goto out_sk;
+        }
+
+        rc = __ip4_datagram_connect(sk, uaddr, addr_len);
+        if (rc < 0)
+                goto out_sk;
+
         l2tp_ip_sk(sk)->peer_conn_id = lsa->l2tp_conn_id;
 
         write_lock_bh(&l2tp_ip_lock);
@@ -330,7 +333,9 @@ static int l2tp_ip_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
         sk_add_bind_node(sk, &l2tp_ip_bind_table);
         write_unlock_bh(&l2tp_ip_lock);
 
+out_sk:
         release_sock(sk);
+
         return rc;
 }
 
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 9978d01ba0ba..aa821cb639e5 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -72,8 +72,9 @@ static struct sock *__l2tp_ip6_bind_lookup(struct net *net,
 
                 if ((l2tp->conn_id == tunnel_id) &&
                     net_eq(sock_net(sk), net) &&
-                    !(addr && ipv6_addr_equal(addr, laddr)) &&
-                    !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
+                    (!addr || ipv6_addr_equal(addr, laddr)) &&
+                    (!sk->sk_bound_dev_if || !dif ||
+                     sk->sk_bound_dev_if == dif))
                         goto found;
         }
 
@@ -196,16 +197,17 @@ pass_up:
                 struct ipv6hdr *iph = ipv6_hdr(skb);
 
                 read_lock_bh(&l2tp_ip6_lock);
-                sk = __l2tp_ip6_bind_lookup(net, &iph->daddr,
-                                            0, tunnel_id);
+                sk = __l2tp_ip6_bind_lookup(net, &iph->daddr, inet6_iif(skb),
+                                            tunnel_id);
+                if (!sk) {
+                        read_unlock_bh(&l2tp_ip6_lock);
+                        goto discard;
+                }
+
+                sock_hold(sk);
                 read_unlock_bh(&l2tp_ip6_lock);
         }
 
-        if (sk == NULL)
-                goto discard;
-
-        sock_hold(sk);
-
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_put;
 
@@ -266,6 +268,7 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         struct sockaddr_l2tpip6 *addr = (struct sockaddr_l2tpip6 *) uaddr;
         struct net *net = sock_net(sk);
         __be32 v4addr = 0;
+        int bound_dev_if;
         int addr_type;
         int err;
 
@@ -284,13 +287,6 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (addr_type & IPV6_ADDR_MULTICAST)
                 return -EADDRNOTAVAIL;
 
-        err = -EADDRINUSE;
-        read_lock_bh(&l2tp_ip6_lock);
-        if (__l2tp_ip6_bind_lookup(net, &addr->l2tp_addr,
-                                   sk->sk_bound_dev_if, addr->l2tp_conn_id))
-                goto out_in_use;
-        read_unlock_bh(&l2tp_ip6_lock);
-
         lock_sock(sk);
 
         err = -EINVAL;
@@ -300,28 +296,25 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (sk->sk_state != TCP_CLOSE)
                 goto out_unlock;
 
+        bound_dev_if = sk->sk_bound_dev_if;
+
         /* Check if the address belongs to the host. */
         rcu_read_lock();
         if (addr_type != IPV6_ADDR_ANY) {
                 struct net_device *dev = NULL;
 
                 if (addr_type & IPV6_ADDR_LINKLOCAL) {
-                        if (addr_len >= sizeof(struct sockaddr_in6) &&
-                            addr->l2tp_scope_id) {
-                                /* Override any existing binding, if another
-                                 * one is supplied by user.
-                                 */
-                                sk->sk_bound_dev_if = addr->l2tp_scope_id;
-                        }
+                        if (addr->l2tp_scope_id)
+                                bound_dev_if = addr->l2tp_scope_id;
 
                         /* Binding to link-local address requires an
-                           interface */
-                        if (!sk->sk_bound_dev_if)
+                         * interface.
+                         */
+                        if (!bound_dev_if)
                                 goto out_unlock_rcu;
 
                         err = -ENODEV;
-                        dev = dev_get_by_index_rcu(sock_net(sk),
-                                                   sk->sk_bound_dev_if);
+                        dev = dev_get_by_index_rcu(sock_net(sk), bound_dev_if);
                         if (!dev)
                                 goto out_unlock_rcu;
                 }
@@ -336,13 +329,22 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         }
         rcu_read_unlock();
 
-        inet->inet_rcv_saddr = inet->inet_saddr = v4addr;
+        write_lock_bh(&l2tp_ip6_lock);
+        if (__l2tp_ip6_bind_lookup(net, &addr->l2tp_addr, bound_dev_if,
+                                   addr->l2tp_conn_id)) {
+                write_unlock_bh(&l2tp_ip6_lock);
+                err = -EADDRINUSE;
+                goto out_unlock;
+        }
+
+        inet->inet_saddr = v4addr;
+        inet->inet_rcv_saddr = v4addr;
+        sk->sk_bound_dev_if = bound_dev_if;
         sk->sk_v6_rcv_saddr = addr->l2tp_addr;
         np->saddr = addr->l2tp_addr;
 
         l2tp_ip6_sk(sk)->conn_id = addr->l2tp_conn_id;
 
-        write_lock_bh(&l2tp_ip6_lock);
         sk_add_bind_node(sk, &l2tp_ip6_bind_table);
         sk_del_node_init(sk);
         write_unlock_bh(&l2tp_ip6_lock);
@@ -355,10 +357,7 @@ out_unlock_rcu:
         rcu_read_unlock();
 out_unlock:
         release_sock(sk);
-        return err;
 
-out_in_use:
-        read_unlock_bh(&l2tp_ip6_lock);
         return err;
 }
 
@@ -371,9 +370,6 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
         int     addr_type;
         int rc;
 
-        if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
-                return -EINVAL;
-
         if (addr_len < sizeof(*lsa))
                 return -EINVAL;
 
@@ -390,10 +386,18 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
                         return -EINVAL;
         }
 
-        rc = ip6_datagram_connect(sk, uaddr, addr_len);
-
         lock_sock(sk);
 
+         /* Must bind first - autobinding does not work */
+        if (sock_flag(sk, SOCK_ZAPPED)) {
+                rc = -EINVAL;
+                goto out_sk;
+        }
+
+        rc = __ip6_datagram_connect(sk, uaddr, addr_len);
+        if (rc < 0)
+                goto out_sk;
+
         l2tp_ip6_sk(sk)->peer_conn_id = lsa->l2tp_conn_id;
 
         write_lock_bh(&l2tp_ip6_lock);
@@ -401,6 +405,7 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
         sk_add_bind_node(sk, &l2tp_ip6_bind_table);
         write_unlock_bh(&l2tp_ip6_lock);
 
+out_sk:
         release_sock(sk);
 
         return rc;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index bbb8f3df79f7..5b9c884a452e 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -42,7 +42,7 @@ struct nf_nat_conn_key {
         const struct nf_conntrack_zone *zone;
 };
 
-static struct rhashtable nf_nat_bysource_table;
+static struct rhltable nf_nat_bysource_table;
 
 inline const struct nf_nat_l3proto *
 __nf_nat_l3proto_find(u8 family)
@@ -193,9 +193,12 @@ static int nf_nat_bysource_cmp(struct rhashtable_compare_arg *arg,
         const struct nf_nat_conn_key *key = arg->key;
         const struct nf_conn *ct = obj;
 
-        return same_src(ct, key->tuple) &&
-               net_eq(nf_ct_net(ct), key->net) &&
-               nf_ct_zone_equal(ct, key->zone, IP_CT_DIR_ORIGINAL);
+        if (!same_src(ct, key->tuple) ||
+            !net_eq(nf_ct_net(ct), key->net) ||
+            !nf_ct_zone_equal(ct, key->zone, IP_CT_DIR_ORIGINAL))
+                return 1;
+
+        return 0;
 }
 
 static struct rhashtable_params nf_nat_bysource_params = {
@@ -204,7 +207,6 @@ static struct rhashtable_params nf_nat_bysource_params = {
         .obj_cmpfn = nf_nat_bysource_cmp,
         .nelem_hint = 256,
         .min_size = 1024,
-        .nulls_base = (1U << RHT_BASE_SHIFT),
 };
 
 /* Only called for SRC manip */
@@ -223,12 +225,15 @@ find_appropriate_src(struct net *net,
                 .tuple = tuple,
                 .zone = zone
         };
+        struct rhlist_head *hl;
 
-        ct = rhashtable_lookup_fast(&nf_nat_bysource_table, &key,
-                                    nf_nat_bysource_params);
-        if (!ct)
+        hl = rhltable_lookup(&nf_nat_bysource_table, &key,
+                             nf_nat_bysource_params);
+        if (!hl)
                 return 0;
 
+        ct = container_of(hl, typeof(*ct), nat_bysource);
+
         nf_ct_invert_tuplepr(result,
                              &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
         result->dst = tuple->dst;
@@ -446,11 +451,17 @@ nf_nat_setup_info(struct nf_conn *ct,
         }
 
         if (maniptype == NF_NAT_MANIP_SRC) {
+                struct nf_nat_conn_key key = {
+                        .net = nf_ct_net(ct),
+                        .tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                        .zone = nf_ct_zone(ct),
+                };
                 int err;
 
-                err = rhashtable_insert_fast(&nf_nat_bysource_table,
-                                             &ct->nat_bysource,
-                                             nf_nat_bysource_params);
+                err = rhltable_insert_key(&nf_nat_bysource_table,
+                                          &key,
+                                          &ct->nat_bysource,
+                                          nf_nat_bysource_params);
                 if (err)
                         return NF_DROP;
         }
@@ -567,8 +578,8 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
          * will delete entry from already-freed table.
          */
         ct->status &= ~IPS_NAT_DONE_MASK;
-        rhashtable_remove_fast(&nf_nat_bysource_table, &ct->nat_bysource,
-                               nf_nat_bysource_params);
+        rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
+                        nf_nat_bysource_params);
 
         /* don't delete conntrack.  Although that would make things a lot
          * simpler, we'd end up flushing all conntracks on nat rmmod.
@@ -698,8 +709,8 @@ static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
         if (!nat)
                 return;
 
-        rhashtable_remove_fast(&nf_nat_bysource_table, &ct->nat_bysource,
-                               nf_nat_bysource_params);
+        rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
+                        nf_nat_bysource_params);
 }
 
 static struct nf_ct_ext_type nat_extend __read_mostly = {
@@ -834,13 +845,13 @@ static int __init nf_nat_init(void)
 {
         int ret;
 
-        ret = rhashtable_init(&nf_nat_bysource_table, &nf_nat_bysource_params);
+        ret = rhltable_init(&nf_nat_bysource_table, &nf_nat_bysource_params);
         if (ret)
                 return ret;
 
         ret = nf_ct_extend_register(&nat_extend);
         if (ret < 0) {
-                rhashtable_destroy(&nf_nat_bysource_table);
+                rhltable_destroy(&nf_nat_bysource_table);
                 printk(KERN_ERR "nf_nat_core: Unable to register extension\n");
                 return ret;
         }
@@ -864,7 +875,7 @@ static int __init nf_nat_init(void)
         return 0;
 
  cleanup_extend:
-        rhashtable_destroy(&nf_nat_bysource_table);
+        rhltable_destroy(&nf_nat_bysource_table);
         nf_ct_extend_unregister(&nat_extend);
         return ret;
 }
@@ -883,7 +894,7 @@ static void __exit nf_nat_cleanup(void)
         for (i = 0; i < NFPROTO_NUMPROTO; i++)
                 kfree(nf_nat_l4protos[i]);
 
-        rhashtable_destroy(&nf_nat_bysource_table);
+        rhltable_destroy(&nf_nat_bysource_table);
 }
 
 MODULE_LICENSE("GPL");
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 026581b04ea8..e5194f6f906c 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2570,7 +2570,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
         }
 
         if (set->timeout &&
-            nla_put_be64(skb, NFTA_SET_TIMEOUT, cpu_to_be64(set->timeout),
+            nla_put_be64(skb, NFTA_SET_TIMEOUT,
+                         cpu_to_be64(jiffies_to_msecs(set->timeout)),
                          NFTA_SET_PAD))
                 goto nla_put_failure;
         if (set->gc_int &&
@@ -2859,7 +2860,8 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
         if (nla[NFTA_SET_TIMEOUT] != NULL) {
                 if (!(flags & NFT_SET_TIMEOUT))
                         return -EINVAL;
-                timeout = be64_to_cpu(nla_get_be64(nla[NFTA_SET_TIMEOUT]));
+                timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
+                                                nla[NFTA_SET_TIMEOUT])));
         }
         gc_int = 0;
         if (nla[NFTA_SET_GC_INTERVAL] != NULL) {
@@ -3178,7 +3180,8 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,
 
         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT) &&
             nla_put_be64(skb, NFTA_SET_ELEM_TIMEOUT,
-                         cpu_to_be64(*nft_set_ext_timeout(ext)),
+                         cpu_to_be64(jiffies_to_msecs(
+                                                *nft_set_ext_timeout(ext))),
                          NFTA_SET_ELEM_PAD))
                 goto nla_put_failure;
 
@@ -3447,7 +3450,7 @@ void *nft_set_elem_init(const struct nft_set *set,
                 memcpy(nft_set_ext_data(ext), data, set->dlen);
         if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION))
                 *nft_set_ext_expiration(ext) =
-                        jiffies + msecs_to_jiffies(timeout);
+                        jiffies + timeout;
         if (nft_set_ext_exists(ext, NFT_SET_EXT_TIMEOUT))
                 *nft_set_ext_timeout(ext) = timeout;
 
@@ -3535,7 +3538,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
         if (nla[NFTA_SET_ELEM_TIMEOUT] != NULL) {
                 if (!(set->flags & NFT_SET_TIMEOUT))
                         return -EINVAL;
-                timeout = be64_to_cpu(nla_get_be64(nla[NFTA_SET_ELEM_TIMEOUT]));
+                timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
+                                        nla[NFTA_SET_ELEM_TIMEOUT])));
         } else if (set->flags & NFT_SET_TIMEOUT) {
                 timeout = set->timeout;
         }
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index baf694de3935..d5447a22275c 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -53,6 +53,7 @@ static int nft_hash_init(const struct nft_ctx *ctx,
 {
         struct nft_hash *priv = nft_expr_priv(expr);
         u32 len;
+        int err;
 
         if (!tb[NFTA_HASH_SREG] ||
             !tb[NFTA_HASH_DREG] ||
@@ -67,8 +68,10 @@ static int nft_hash_init(const struct nft_ctx *ctx,
         priv->sreg = nft_parse_register(tb[NFTA_HASH_SREG]);
         priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]);
 
-        len = ntohl(nla_get_be32(tb[NFTA_HASH_LEN]));
-        if (len == 0 || len > U8_MAX)
+        err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len);
+        if (err < 0)
+                return err;
+        if (len == 0)
                 return -ERANGE;
 
         priv->len = len;
diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c
index fbc88009ca2e..8f0aaaea1376 100644
--- a/net/netfilter/nft_range.c
+++ b/net/netfilter/nft_range.c
@@ -59,6 +59,12 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr
         int err;
         u32 op;
 
+        if (!tb[NFTA_RANGE_SREG]      ||
+            !tb[NFTA_RANGE_OP]        ||
+            !tb[NFTA_RANGE_FROM_DATA] ||
+            !tb[NFTA_RANGE_TO_DATA])
+                return -EINVAL;
+
         err = nft_data_init(NULL, &priv->data_from, sizeof(priv->data_from),
                             &desc_from, tb[NFTA_RANGE_FROM_DATA]);
         if (err < 0)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 62bea4591054..602e5ebe9db3 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -322,14 +322,11 @@ static void netlink_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
         sk_mem_charge(sk, skb->truesize);
 }
 
-static void netlink_sock_destruct(struct sock *sk)
+static void __netlink_sock_destruct(struct sock *sk)
 {
         struct netlink_sock *nlk = nlk_sk(sk);
 
         if (nlk->cb_running) {
-                if (nlk->cb.done)
-                        nlk->cb.done(&nlk->cb);
-
                 module_put(nlk->cb.module);
                 kfree_skb(nlk->cb.skb);
         }
@@ -346,6 +343,28 @@ static void netlink_sock_destruct(struct sock *sk)
         WARN_ON(nlk_sk(sk)->groups);
 }
 
+static void netlink_sock_destruct_work(struct work_struct *work)
+{
+        struct netlink_sock *nlk = container_of(work, struct netlink_sock,
+                                                work);
+
+        nlk->cb.done(&nlk->cb);
+        __netlink_sock_destruct(&nlk->sk);
+}
+
+static void netlink_sock_destruct(struct sock *sk)
+{
+        struct netlink_sock *nlk = nlk_sk(sk);
+
+        if (nlk->cb_running && nlk->cb.done) {
+                INIT_WORK(&nlk->work, netlink_sock_destruct_work);
+                schedule_work(&nlk->work);
+                return;
+        }
+
+        __netlink_sock_destruct(sk);
+}
+
 /* This lock without WQ_FLAG_EXCLUSIVE is good on UP and it is _very_ bad on
  * SMP. Look, when several writers sleep and reader wakes them up, all but one
  * immediately hit write lock and grab all the cpus. Exclusive sleep solves
diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
index 3cfd6cc60504..4fdb38318977 100644
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -3,6 +3,7 @@
 
 #include <linux/rhashtable.h>
 #include <linux/atomic.h>
+#include <linux/workqueue.h>
 #include <net/sock.h>
 
 #define NLGRPSZ(x)      (ALIGN(x, sizeof(unsigned long) * 8) / 8)
@@ -33,6 +34,7 @@ struct netlink_sock {
 
         struct rhash_head       node;
         struct rcu_head         rcu;
+        struct work_struct      work;
 };
 
 static inline struct netlink_sock *nlk_sk(struct sock *sk)
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 31045ef44a82..fecefa2dc94e 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -370,8 +370,11 @@ static int handle_fragments(struct net *net, struct sw_flow_key *key,
                 skb_orphan(skb);
                 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
                 err = nf_ct_frag6_gather(net, skb, user);
-                if (err)
+                if (err) {
+                        if (err != -EINPROGRESS)
+                                kfree_skb(skb);
                         return err;
+                }
 
                 key->ip.proto = ipv6_hdr(skb)->nexthdr;
                 ovs_cb.mru = IP6CB(skb)->frag_max_size;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index d2238b204691..dd2332390c45 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
                 if (optlen != sizeof(val))
                         return -EINVAL;
-                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
-                        return -EBUSY;
                 if (copy_from_user(&val, optval, sizeof(val)))
                         return -EFAULT;
                 switch (val) {
                 case TPACKET_V1:
                 case TPACKET_V2:
                 case TPACKET_V3:
-                        po->tp_version = val;
-                        return 0;
+                        break;
                 default:
                         return -EINVAL;
                 }
+                lock_sock(sk);
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
+                        ret = -EBUSY;
+                } else {
+                        po->tp_version = val;
+                        ret = 0;
+                }
+                release_sock(sk);
+                return ret;
         }
         case PACKET_RESERVE:
         {
@@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
         /* Added to avoid minimal code churn */
         struct tpacket_req *req = &req_u->req;
 
+        lock_sock(sk);
         /* Opening a Tx-ring is NOT supported in TPACKET_V3 */
         if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) {
                 net_warn_ratelimited("Tx-ring is not supported.\n");
@@ -4245,7 +4252,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                         goto out;
         }
 
-        lock_sock(sk);
 
         /* Detach socket from network */
         spin_lock(&po->bind_lock);
@@ -4294,11 +4300,11 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 if (!tx_ring)
                         prb_shutdown_retire_blk_timer(po, rb_queue);
         }
-        release_sock(sk);
 
         if (pg_vec)
                 free_pg_vec(pg_vec, order, req->tp_block_nr);
 out:
+        release_sock(sk);
         return err;
 }
 
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index fcddacc92e01..20e2923dc827 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -659,6 +659,8 @@ out_recv:
 out_pernet:
         unregister_pernet_subsys(&rds_tcp_net_ops);
 out_slab:
+        if (unregister_netdevice_notifier(&rds_tcp_dev_notifier))
+                pr_warn("could not unregister rds_tcp_dev_notifier\n");
         kmem_cache_destroy(rds_tcp_conn_slab);
 out:
         return ret;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index b54d56d4959b..cf9b2fe8eac6 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -108,6 +108,17 @@ static void tcf_pedit_cleanup(struct tc_action *a, int bind)
         kfree(keys);
 }
 
+static bool offset_valid(struct sk_buff *skb, int offset)
+{
+        if (offset > 0 && offset > skb->len)
+                return false;
+
+        if  (offset < 0 && -offset > skb_headroom(skb))
+                return false;
+
+        return true;
+}
+
 static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
                      struct tcf_result *res)
 {
@@ -134,6 +145,11 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
                         if (tkey->offmask) {
                                 char *d, _d;
 
+                                if (!offset_valid(skb, off + tkey->at)) {
+                                        pr_info("tc filter pedit 'at' offset %d out of bounds\n",
+                                                off + tkey->at);
+                                        goto bad;
+                                }
                                 d = skb_header_pointer(skb, off + tkey->at, 1,
                                                        &_d);
                                 if (!d)
@@ -146,10 +162,10 @@ static int tcf_pedit(struct sk_buff *skb, const struct tc_action *a,
                                         " offset must be on 32 bit boundaries\n");
                                 goto bad;
                         }
-                        if (offset > 0 && offset > skb->len) {
-                                pr_info("tc filter pedit"
-                                        " offset %d can't exceed pkt length %d\n",
-                                       offset, skb->len);
+
+                        if (!offset_valid(skb, off + offset)) {
+                                pr_info("tc filter pedit offset %d out of bounds\n",
+                                        offset);
                                 goto bad;
                         }
 
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index eb219b78cd49..5877f6061b57 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -62,9 +62,6 @@ static unsigned long basic_get(struct tcf_proto *tp, u32 handle)
         struct basic_head *head = rtnl_dereference(tp->root);
         struct basic_filter *f;
 
-        if (head == NULL)
-                return 0UL;
-
         list_for_each_entry(f, &head->flist, link) {
                 if (f->handle == handle) {
                         l = (unsigned long) f;
@@ -109,7 +106,6 @@ static bool basic_destroy(struct tcf_proto *tp, bool force)
                 tcf_unbind_filter(tp, &f->res);
                 call_rcu(&f->rcu, basic_delete_filter);
         }
-        RCU_INIT_POINTER(tp->root, NULL);
         kfree_rcu(head, rcu);
         return true;
 }
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index bb1d5a487081..0a47ba5e6109 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -292,7 +292,6 @@ static bool cls_bpf_destroy(struct tcf_proto *tp, bool force)
                 call_rcu(&prog->rcu, __cls_bpf_delete_prog);
         }
 
-        RCU_INIT_POINTER(tp->root, NULL);
         kfree_rcu(head, rcu);
         return true;
 }
@@ -303,9 +302,6 @@ static unsigned long cls_bpf_get(struct tcf_proto *tp, u32 handle)
         struct cls_bpf_prog *prog;
         unsigned long ret = 0UL;
 
-        if (head == NULL)
-                return 0UL;
-
         list_for_each_entry(prog, &head->plist, link) {
                 if (prog->handle == handle) {
                         ret = (unsigned long) prog;
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 85233c470035..c1f20077837f 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -137,11 +137,10 @@ static bool cls_cgroup_destroy(struct tcf_proto *tp, bool force)
 
         if (!force)
                 return false;
-
-        if (head) {
-                RCU_INIT_POINTER(tp->root, NULL);
+        /* Head can still be NULL due to cls_cgroup_init(). */
+        if (head)
                 call_rcu(&head->rcu, cls_cgroup_destroy_rcu);
-        }
+
         return true;
 }
 
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
index e39672394c7b..6575aba87630 100644
--- a/net/sched/cls_flow.c
+++ b/net/sched/cls_flow.c
@@ -596,7 +596,6 @@ static bool flow_destroy(struct tcf_proto *tp, bool force)
                 list_del_rcu(&f->list);
                 call_rcu(&f->rcu, flow_destroy_filter);
         }
-        RCU_INIT_POINTER(tp->root, NULL);
         kfree_rcu(head, rcu);
         return true;
 }
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index f6f40fba599b..904442421db3 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -13,6 +13,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/rhashtable.h>
+#include <linux/workqueue.h>
 
 #include <linux/if_ether.h>
 #include <linux/in6.h>
@@ -64,7 +65,10 @@ struct cls_fl_head {
         bool mask_assigned;
         struct list_head filters;
         struct rhashtable_params ht_params;
-        struct rcu_head rcu;
+        union {
+                struct work_struct work;
+                struct rcu_head rcu;
+        };
 };
 
 struct cls_fl_filter {
@@ -269,6 +273,24 @@ static void fl_hw_update_stats(struct tcf_proto *tp, struct cls_fl_filter *f)
         dev->netdev_ops->ndo_setup_tc(dev, tp->q->handle, tp->protocol, &tc);
 }
 
+static void fl_destroy_sleepable(struct work_struct *work)
+{
+        struct cls_fl_head *head = container_of(work, struct cls_fl_head,
+                                                work);
+        if (head->mask_assigned)
+                rhashtable_destroy(&head->ht);
+        kfree(head);
+        module_put(THIS_MODULE);
+}
+
+static void fl_destroy_rcu(struct rcu_head *rcu)
+{
+        struct cls_fl_head *head = container_of(rcu, struct cls_fl_head, rcu);
+
+        INIT_WORK(&head->work, fl_destroy_sleepable);
+        schedule_work(&head->work);
+}
+
 static bool fl_destroy(struct tcf_proto *tp, bool force)
 {
         struct cls_fl_head *head = rtnl_dereference(tp->root);
@@ -282,10 +304,9 @@ static bool fl_destroy(struct tcf_proto *tp, bool force)
                 list_del_rcu(&f->list);
                 call_rcu(&f->rcu, fl_destroy_filter);
         }
-        RCU_INIT_POINTER(tp->root, NULL);
-        if (head->mask_assigned)
-                rhashtable_destroy(&head->ht);
-        kfree_rcu(head, rcu);
+
+        __module_get(THIS_MODULE);
+        call_rcu(&head->rcu, fl_destroy_rcu);
         return true;
 }
 
@@ -711,8 +732,9 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
                 goto errout;
 
         if (fold) {
-                rhashtable_remove_fast(&head->ht, &fold->ht_node,
-                                       head->ht_params);
+                if (!tc_skip_sw(fold->flags))
+                        rhashtable_remove_fast(&head->ht, &fold->ht_node,
+                                               head->ht_params);
                 fl_hw_destroy_filter(tp, (unsigned long)fold);
         }
 
@@ -739,8 +761,9 @@ static int fl_delete(struct tcf_proto *tp, unsigned long arg)
         struct cls_fl_head *head = rtnl_dereference(tp->root);
         struct cls_fl_filter *f = (struct cls_fl_filter *) arg;
 
-        rhashtable_remove_fast(&head->ht, &f->ht_node,
-                               head->ht_params);
+        if (!tc_skip_sw(f->flags))
+                rhashtable_remove_fast(&head->ht, &f->ht_node,
+                                       head->ht_params);
         list_del_rcu(&f->list);
         fl_hw_destroy_filter(tp, (unsigned long)f);
         tcf_unbind_filter(tp, &f->res);
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index 25927b6c4436..f935429bd5ef 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -114,7 +114,6 @@ static bool mall_destroy(struct tcf_proto *tp, bool force)
 
                 call_rcu(&f->rcu, mall_destroy_filter);
         }
-        RCU_INIT_POINTER(tp->root, NULL);
         kfree_rcu(head, rcu);
         return true;
 }
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 4f05a19fb073..322438fb3ffc 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -152,7 +152,8 @@ static int rsvp_classify(struct sk_buff *skb, const struct tcf_proto *tp,
                 return -1;
         nhptr = ip_hdr(skb);
 #endif
-
+        if (unlikely(!head))
+                return -1;
 restart:
 
 #if RSVP_DST_LEN == 4
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 96144bdf30db..0751245a6ace 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -543,7 +543,6 @@ static bool tcindex_destroy(struct tcf_proto *tp, bool force)
         walker.fn = tcindex_destroy_element;
         tcindex_walk(tp, &walker);
 
-        RCU_INIT_POINTER(tp->root, NULL);
         call_rcu(&p->rcu, __tcindex_destroy);
         return true;
 }
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 975dbeb60ab0..52d74760fb68 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -421,6 +421,10 @@ int tipc_enable_l2_media(struct net *net, struct tipc_bearer *b,
         dev = dev_get_by_name(net, driver_name);
         if (!dev)
                 return -ENODEV;
+        if (tipc_mtu_bad(dev, 0)) {
+                dev_put(dev);
+                return -EINVAL;
+        }
 
         /* Associate TIPC bearer with L2 bearer */
         rcu_assign_pointer(b->media_ptr, dev);
@@ -610,8 +614,6 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
         if (!b)
                 return NOTIFY_DONE;
 
-        b->mtu = dev->mtu;
-
         switch (evt) {
         case NETDEV_CHANGE:
                 if (netif_carrier_ok(dev))
@@ -624,6 +626,11 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt,
                 tipc_reset_bearer(net, b);
                 break;
         case NETDEV_CHANGEMTU:
+                if (tipc_mtu_bad(dev, 0)) {
+                        bearer_disable(net, b);
+                        break;
+                }
+                b->mtu = dev->mtu;
                 tipc_reset_bearer(net, b);
                 break;
         case NETDEV_CHANGEADDR:
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 78892e2f53e3..278ff7f616f9 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -39,6 +39,7 @@
 
 #include "netlink.h"
 #include "core.h"
+#include "msg.h"
 #include <net/genetlink.h>
 
 #define MAX_MEDIA       3
@@ -59,6 +60,9 @@
 #define TIPC_MEDIA_TYPE_IB      2
 #define TIPC_MEDIA_TYPE_UDP     3
 
+/* minimum bearer MTU */
+#define TIPC_MIN_BEARER_MTU     (MAX_H_SIZE + INT_H_SIZE)
+
 /**
  * struct tipc_media_addr - destination address used by TIPC bearers
  * @value: address info (format defined by media)
@@ -215,4 +219,13 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id,
 void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id,
                          struct sk_buff_head *xmitq);
 
+/* check if device MTU is too low for tipc headers */
+static inline bool tipc_mtu_bad(struct net_device *dev, unsigned int reserve)
+{
+        if (dev->mtu >= TIPC_MIN_BEARER_MTU + reserve)
+                return false;
+        netdev_warn(dev, "MTU too low for tipc bearer\n");
+        return true;
+}
+
 #endif  /* _TIPC_BEARER_H */
diff --git a/net/tipc/link.c b/net/tipc/link.c
index ecc12411155e..bda89bf9f4ff 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -47,8 +47,8 @@
 #include <linux/pkt_sched.h>
 
 struct tipc_stats {
-        u32 sent_info;          /* used in counting # sent packets */
-        u32 recv_info;          /* used in counting # recv'd packets */
+        u32 sent_pkts;
+        u32 recv_pkts;
         u32 sent_states;
         u32 recv_states;
         u32 sent_probes;
@@ -857,7 +857,6 @@ void tipc_link_reset(struct tipc_link *l)
         l->acked = 0;
         l->silent_intv_cnt = 0;
         l->rst_cnt = 0;
-        l->stats.recv_info = 0;
         l->stale_count = 0;
         l->bc_peer_is_up = false;
         memset(&l->mon_state, 0, sizeof(l->mon_state));
@@ -888,6 +887,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
         struct sk_buff_head *transmq = &l->transmq;
         struct sk_buff_head *backlogq = &l->backlogq;
         struct sk_buff *skb, *_skb, *bskb;
+        int pkt_cnt = skb_queue_len(list);
 
         /* Match msg importance against this and all higher backlog limits: */
         if (!skb_queue_empty(backlogq)) {
@@ -901,6 +901,11 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
                 return -EMSGSIZE;
         }
 
+        if (pkt_cnt > 1) {
+                l->stats.sent_fragmented++;
+                l->stats.sent_fragments += pkt_cnt;
+        }
+
         /* Prepare each packet for sending, and add to relevant queue: */
         while (skb_queue_len(list)) {
                 skb = skb_peek(list);
@@ -920,6 +925,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
                         __skb_queue_tail(xmitq, _skb);
                         TIPC_SKB_CB(skb)->ackers = l->ackers;
                         l->rcv_unacked = 0;
+                        l->stats.sent_pkts++;
                         seqno++;
                         continue;
                 }
@@ -968,6 +974,7 @@ void tipc_link_advance_backlog(struct tipc_link *l, struct sk_buff_head *xmitq)
                 msg_set_ack(hdr, ack);
                 msg_set_bcast_ack(hdr, bc_ack);
                 l->rcv_unacked = 0;
+                l->stats.sent_pkts++;
                 seqno++;
         }
         l->snd_nxt = seqno;
@@ -1260,7 +1267,7 @@ int tipc_link_rcv(struct tipc_link *l, struct sk_buff *skb,
 
                 /* Deliver packet */
                 l->rcv_nxt++;
-                l->stats.recv_info++;
+                l->stats.recv_pkts++;
                 if (!tipc_data_input(l, skb, l->inputq))
                         rc |= tipc_link_input(l, skb, l->inputq);
                 if (unlikely(++l->rcv_unacked >= TIPC_MIN_LINK_WIN))
@@ -1800,10 +1807,6 @@ void tipc_link_set_queue_limits(struct tipc_link *l, u32 win)
 void tipc_link_reset_stats(struct tipc_link *l)
 {
         memset(&l->stats, 0, sizeof(l->stats));
-        if (!link_is_bc_sndlink(l)) {
-                l->stats.sent_info = l->snd_nxt;
-                l->stats.recv_info = l->rcv_nxt;
-        }
 }
 
 static void link_print(struct tipc_link *l, const char *str)
@@ -1867,12 +1870,12 @@ static int __tipc_nl_add_stats(struct sk_buff *skb, struct tipc_stats *s)
         };
 
         struct nla_map map[] = {
-                {TIPC_NLA_STATS_RX_INFO, s->recv_info},
+                {TIPC_NLA_STATS_RX_INFO, 0},
                 {TIPC_NLA_STATS_RX_FRAGMENTS, s->recv_fragments},
                 {TIPC_NLA_STATS_RX_FRAGMENTED, s->recv_fragmented},
                 {TIPC_NLA_STATS_RX_BUNDLES, s->recv_bundles},
                 {TIPC_NLA_STATS_RX_BUNDLED, s->recv_bundled},
-                {TIPC_NLA_STATS_TX_INFO, s->sent_info},
+                {TIPC_NLA_STATS_TX_INFO, 0},
                 {TIPC_NLA_STATS_TX_FRAGMENTS, s->sent_fragments},
                 {TIPC_NLA_STATS_TX_FRAGMENTED, s->sent_fragmented},
                 {TIPC_NLA_STATS_TX_BUNDLES, s->sent_bundles},
@@ -1947,9 +1950,9 @@ int __tipc_nl_add_link(struct net *net, struct tipc_nl_msg *msg,
                 goto attr_msg_full;
         if (nla_put_u32(msg->skb, TIPC_NLA_LINK_MTU, link->mtu))
                 goto attr_msg_full;
-        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_RX, link->rcv_nxt))
+        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_RX, link->stats.recv_pkts))
                 goto attr_msg_full;
-        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_TX, link->snd_nxt))
+        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_TX, link->stats.sent_pkts))
                 goto attr_msg_full;
 
         if (tipc_link_is_up(link))
@@ -2004,12 +2007,12 @@ static int __tipc_nl_add_bc_link_stat(struct sk_buff *skb,
         };
 
         struct nla_map map[] = {
-                {TIPC_NLA_STATS_RX_INFO, stats->recv_info},
+                {TIPC_NLA_STATS_RX_INFO, stats->recv_pkts},
                 {TIPC_NLA_STATS_RX_FRAGMENTS, stats->recv_fragments},
                 {TIPC_NLA_STATS_RX_FRAGMENTED, stats->recv_fragmented},
                 {TIPC_NLA_STATS_RX_BUNDLES, stats->recv_bundles},
                 {TIPC_NLA_STATS_RX_BUNDLED, stats->recv_bundled},
-                {TIPC_NLA_STATS_TX_INFO, stats->sent_info},
+                {TIPC_NLA_STATS_TX_INFO, stats->sent_pkts},
                 {TIPC_NLA_STATS_TX_FRAGMENTS, stats->sent_fragments},
                 {TIPC_NLA_STATS_TX_FRAGMENTED, stats->sent_fragmented},
                 {TIPC_NLA_STATS_TX_BUNDLES, stats->sent_bundles},
@@ -2076,9 +2079,9 @@ int tipc_nl_add_bc_link(struct net *net, struct tipc_nl_msg *msg)
                 goto attr_msg_full;
         if (nla_put_string(msg->skb, TIPC_NLA_LINK_NAME, bcl->name))
                 goto attr_msg_full;
-        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_RX, bcl->rcv_nxt))
+        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_RX, 0))
                 goto attr_msg_full;
-        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_TX, bcl->snd_nxt))
+        if (nla_put_u32(msg->skb, TIPC_NLA_LINK_TX, 0))
                 goto attr_msg_full;
 
         prop = nla_nest_start(msg->skb, TIPC_NLA_LINK_PROP);
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index 78cab9c5a445..b58dc95f3d35 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -697,6 +697,11 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
                 udp_conf.local_ip.s_addr = htonl(INADDR_ANY);
                 udp_conf.use_udp_checksums = false;
                 ub->ifindex = dev->ifindex;
+                if (tipc_mtu_bad(dev, sizeof(struct iphdr) +
+                                      sizeof(struct udphdr))) {
+                        err = -EINVAL;
+                        goto err;
+                }
                 b->mtu = dev->mtu - sizeof(struct iphdr)
                         - sizeof(struct udphdr);
 #if IS_ENABLED(CONFIG_IPV6)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index fd6986634e6f..5bf7e1bfeac7 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1268,12 +1268,14 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
                         err = security_xfrm_policy_lookup(pol->security,
                                                       fl->flowi_secid,
                                                       policy_to_flow_dir(dir));
-                        if (!err && !xfrm_pol_hold_rcu(pol))
-                                goto again;
-                        else if (err == -ESRCH)
+                        if (!err) {
+                                if (!xfrm_pol_hold_rcu(pol))
+                                        goto again;
+                        } else if (err == -ESRCH) {
                                 pol = NULL;
-                        else
+                        } else {
                                 pol = ERR_PTR(err);
+                        }
                 } else
                         pol = NULL;
         }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 08892091cfe3..671a1d0333f0 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2450,7 +2450,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 
 #ifdef CONFIG_COMPAT
         if (in_compat_syscall())
-                return -ENOTSUPP;
+                return -EOPNOTSUPP;
 #endif
 
         type = nlh->nlmsg_type;
diff --git a/samples/bpf/bpf_helpers.h b/samples/bpf/bpf_helpers.h
index 90f44bd2045e..dadd5161bd91 100644
--- a/samples/bpf/bpf_helpers.h
+++ b/samples/bpf/bpf_helpers.h
@@ -113,7 +113,7 @@ static int (*bpf_skb_under_cgroup)(void *ctx, void *map, int index) =
 #define PT_REGS_FP(x) ((x)->gprs[11]) /* Works only with CONFIG_FRAME_POINTER */
 #define PT_REGS_RC(x) ((x)->gprs[2])
 #define PT_REGS_SP(x) ((x)->gprs[15])
-#define PT_REGS_IP(x) ((x)->ip)
+#define PT_REGS_IP(x) ((x)->psw.addr)
 
 #elif defined(__aarch64__)
 
diff --git a/samples/bpf/sampleip_kern.c b/samples/bpf/sampleip_kern.c
index 774a681f374a..ceabf31079cf 100644
--- a/samples/bpf/sampleip_kern.c
+++ b/samples/bpf/sampleip_kern.c
@@ -25,7 +25,7 @@ int do_sample(struct bpf_perf_event_data *ctx)
         u64 ip;
         u32 *value, init_val = 1;
 
-        ip = ctx->regs.ip;
+        ip = PT_REGS_IP(&ctx->regs);
         value = bpf_map_lookup_elem(&ip_map, &ip);
         if (value)
                 *value += 1;
diff --git a/samples/bpf/trace_event_kern.c b/samples/bpf/trace_event_kern.c
index 71a8ed32823e..41b6115a32eb 100644
--- a/samples/bpf/trace_event_kern.c
+++ b/samples/bpf/trace_event_kern.c
@@ -50,7 +50,7 @@ int bpf_prog1(struct bpf_perf_event_data *ctx)
         key.userstack = bpf_get_stackid(ctx, &stackmap, USER_STACKID_FLAGS);
         if ((int)key.kernstack < 0 && (int)key.userstack < 0) {
                 bpf_trace_printk(fmt, sizeof(fmt), cpu, ctx->sample_period,
-                                 ctx->regs.ip);
+                                 PT_REGS_IP(&ctx->regs));
                 return 0;
         }