70 files changed, 602 insertions, 316 deletions
diff --git a/Documentation/bpf/bpf_devel_QA.txt b/Documentation/bpf/bpf_devel_QA.txt
index 1a0b704e1a38..da57601153a0 100644
--- a/Documentation/bpf/bpf_devel_QA.txt
+++ b/Documentation/bpf/bpf_devel_QA.txt
@@ -557,6 +557,14 @@ A: Although LLVM IR generation and optimization try to stay architecture
       pulls in some header files containing file scope host assembly codes.
     - You can add "-fno-jump-tables" to work around the switch table issue.
-   Otherwise, you can use bpf target.
+   Otherwise, you can use bpf target. Additionally, you _must_ use bpf target
+   when:
+     - Your program uses data structures with pointer or long / unsigned long
+       types that interface with BPF helpers or context data structures. Access
+       into these structures is verified by the BPF verifier and may result
+       in verification failures if the native architecture is not aligned with
+       the BPF architecture, e.g. 64-bit. An example of this is
+       BPF_PROG_TYPE_SK_MSG require '-target bpf'
 Happy BPF hacking!
diff --git a/MAINTAINERS b/MAINTAINERS
index eab763f17aab..b1ccabd0dbc3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9725,6 +9725,7 @@ W:	https://fedorahosted.org/dropwatch/
 F:      net/core/drop_monitor.c
 NETWORKING DRIVERS
+M:      "David S. Miller" <davem@davemloft.net>
 L:      netdev@vger.kernel.org
 W:      http://www.linuxfoundation.org/en/Net
 Q:      http://patchwork.ozlabs.org/project/netdev/list/
@@ -12498,6 +12499,7 @@ F:	drivers/scsi/st_*.h
 SCTP PROTOCOL
 M:      Vlad Yasevich <vyasevich@gmail.com>
 M:      Neil Horman <nhorman@tuxdriver.com>
+M:      Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
 L:      linux-sctp@vger.kernel.org
 W:      http://lksctp.sourceforge.net
 S:      Maintained
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index b725154182cc..263c8453815e 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -1027,7 +1027,17 @@ emit_cond_jmp:		/* convert BPF opcode to x86 */
                        break;
                case BPF_JMP | BPF_JA:
-                        jmp_offset = addrs[i + insn->off] - addrs[i];
+                        if (insn->off == -1)
+                                /* -1 jmp instructions will always jump
+                                 * backwards two bytes. Explicitly handling
+                                 * this case avoids wasting too many passes
+                                 * when there are long sequences of replaced
+                                 * dead code.
+                                 */
+                                jmp_offset = -2;
+                        else
+                                jmp_offset = addrs[i + insn->off] - addrs[i];
                        if (!jmp_offset)
                                /* optimize out nop jumps */
                                break;
@@ -1226,6 +1236,7 @@ skip_init_addrs:
        for (pass = 0; pass < 20 || image; pass++) {
                proglen = do_jit(prog, addrs, image, oldproglen, &ctx);
                if (proglen <= 0) {
+out_image:
                        image = NULL;
                        if (header)
                                bpf_jit_binary_free(header);
@@ -1236,8 +1247,7 @@ skip_init_addrs:
                        if (proglen != oldproglen) {
                                pr_err("bpf_jit: proglen=%d != oldproglen=%d\n",
                                       proglen, oldproglen);
-                                prog = orig_prog;
+                                goto out_image;
-                                goto out_addrs;
                        }
                        break;
                }
@@ -1273,7 +1283,7 @@ skip_init_addrs:
                prog = orig_prog;
        }
-        if (!prog->is_func || extra_pass) {
+        if (!image || !prog->is_func || extra_pass) {
 out_addrs:
                kfree(addrs);
                kfree(jit_data);
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index daa919e5a442..241cf4ff9901 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -4757,7 +4757,7 @@ mlx5_ib_get_vector_affinity(struct ib_device *ibdev, int comp_vector)
 {
        struct mlx5_ib_dev *dev = to_mdev(ibdev);
-        return mlx5_get_vector_affinity(dev->mdev, comp_vector);
+        return mlx5_get_vector_affinity_hint(dev->mdev, comp_vector);
 }
 /* The mlx5_ib_multiport_mutex should be held when calling this function */
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index f9a3c1a76d5d..f33b25fbca63 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -2144,14 +2144,21 @@ static const struct net_device_ops bcm_sysport_netdev_ops = {
        .ndo_select_queue       = bcm_sysport_select_queue,
 };
-static int bcm_sysport_map_queues(struct net_device *dev,
+static int bcm_sysport_map_queues(struct notifier_block *nb,
                                  struct dsa_notifier_register_info *info)
 {
-        struct bcm_sysport_priv *priv = netdev_priv(dev);
        struct bcm_sysport_tx_ring *ring;
+        struct bcm_sysport_priv *priv;
        struct net_device *slave_dev;
        unsigned int num_tx_queues;
        unsigned int q, start, port;
+        struct net_device *dev;
+        priv = container_of(nb, struct bcm_sysport_priv, dsa_notifier);
+        if (priv->netdev != info->master)
+                return 0;
+        dev = info->master;
        /* We can't be setting up queue inspection for non directly attached
         * switches
@@ -2174,11 +2181,12 @@ static int bcm_sysport_map_queues(struct net_device *dev,
        if (priv->is_lite)
                netif_set_real_num_tx_queues(slave_dev,
                                             slave_dev->num_tx_queues / 2);
        num_tx_queues = slave_dev->real_num_tx_queues;
        if (priv->per_port_num_tx_queues &&
            priv->per_port_num_tx_queues != num_tx_queues)
-                netdev_warn(slave_dev, "asymetric number of per-port queues\n");
+                netdev_warn(slave_dev, "asymmetric number of per-port queues\n");
        priv->per_port_num_tx_queues = num_tx_queues;
@@ -2201,7 +2209,7 @@ static int bcm_sysport_map_queues(struct net_device *dev,
        return 0;
 }
-static int bcm_sysport_dsa_notifier(struct notifier_block *unused,
+static int bcm_sysport_dsa_notifier(struct notifier_block *nb,
                                    unsigned long event, void *ptr)
 {
        struct dsa_notifier_register_info *info;
@@ -2211,7 +2219,7 @@ static int bcm_sysport_dsa_notifier(struct notifier_block *unused,
        info = ptr;
-        return notifier_from_errno(bcm_sysport_map_queues(info->master, info));
+        return notifier_from_errno(bcm_sysport_map_queues(nb, info));
 }
 #define REV_FMT "v%2x.%02x"
diff --git a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
index 4df282ed22c7..0beee2cc2ddd 100644
--- a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
+++ b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
@@ -61,7 +61,7 @@ static const char hw_stat_gstrings[][ETH_GSTRING_LEN] = {
 static const char tx_fw_stat_gstrings[][ETH_GSTRING_LEN] = {
        "tx-single-collision",
        "tx-multiple-collision",
-        "tx-late-collsion",
+        "tx-late-collision",
        "tx-aborted-frames",
        "tx-lost-frames",
        "tx-carrier-sense-errors",
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index 4202f9b5b966..6f410235987c 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -942,6 +942,7 @@ struct mvpp2 {
        struct clk *pp_clk;
        struct clk *gop_clk;
        struct clk *mg_clk;
+        struct clk *mg_core_clk;
        struct clk *axi_clk;
        /* List of pointers to port structures */
@@ -8768,18 +8769,27 @@ static int mvpp2_probe(struct platform_device *pdev)
                        err = clk_prepare_enable(priv->mg_clk);
                        if (err < 0)
                                goto err_gop_clk;
+                        priv->mg_core_clk = devm_clk_get(&pdev->dev, "mg_core_clk");
+                        if (IS_ERR(priv->mg_core_clk)) {
+                                priv->mg_core_clk = NULL;
+                        } else {
+                                err = clk_prepare_enable(priv->mg_core_clk);
+                                if (err < 0)
+                                        goto err_mg_clk;
+                        }
                }
                priv->axi_clk = devm_clk_get(&pdev->dev, "axi_clk");
                if (IS_ERR(priv->axi_clk)) {
                        err = PTR_ERR(priv->axi_clk);
                        if (err == -EPROBE_DEFER)
-                                goto err_gop_clk;
+                                goto err_mg_core_clk;
                        priv->axi_clk = NULL;
                } else {
                        err = clk_prepare_enable(priv->axi_clk);
                        if (err < 0)
-                                goto err_gop_clk;
+                                goto err_mg_core_clk;
                }
                /* Get system's tclk rate */
@@ -8793,7 +8803,7 @@ static int mvpp2_probe(struct platform_device *pdev)
        if (priv->hw_version == MVPP22) {
                err = dma_set_mask(&pdev->dev, MVPP2_DESC_DMA_MASK);
                if (err)
-                        goto err_mg_clk;
+                        goto err_axi_clk;
                /* Sadly, the BM pools all share the same register to
                 * store the high 32 bits of their address. So they
                 * must all have the same high 32 bits, which forces
@@ -8801,14 +8811,14 @@ static int mvpp2_probe(struct platform_device *pdev)
                 */
                err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
                if (err)
-                        goto err_mg_clk;
+                        goto err_axi_clk;
        }
        /* Initialize network controller */
        err = mvpp2_init(pdev, priv);
        if (err < 0) {
                dev_err(&pdev->dev, "failed to initialize controller\n");
-                goto err_mg_clk;
+                goto err_axi_clk;
        }
        /* Initialize ports */
@@ -8821,7 +8831,7 @@ static int mvpp2_probe(struct platform_device *pdev)
        if (priv->port_count == 0) {
                dev_err(&pdev->dev, "no ports enabled\n");
                err = -ENODEV;
-                goto err_mg_clk;
+                goto err_axi_clk;
        }
        /* Statistics must be gathered regularly because some of them (like
@@ -8849,8 +8859,13 @@ err_port_probe:
                        mvpp2_port_remove(priv->port_list[i]);
                i++;
        }
-err_mg_clk:
+err_axi_clk:
        clk_disable_unprepare(priv->axi_clk);
+err_mg_core_clk:
+        if (priv->hw_version == MVPP22)
+                clk_disable_unprepare(priv->mg_core_clk);
+err_mg_clk:
        if (priv->hw_version == MVPP22)
                clk_disable_unprepare(priv->mg_clk);
 err_gop_clk:
@@ -8897,6 +8912,7 @@ static int mvpp2_remove(struct platform_device *pdev)
                return 0;
        clk_disable_unprepare(priv->axi_clk);
+        clk_disable_unprepare(priv->mg_core_clk);
        clk_disable_unprepare(priv->mg_clk);
        clk_disable_unprepare(priv->pp_clk);
        clk_disable_unprepare(priv->gop_clk);
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index bfef69235d71..211578ffc70d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1317,7 +1317,7 @@ static int mlx4_mf_unbond(struct mlx4_dev *dev)
        ret = mlx4_unbond_fs_rules(dev);
        if (ret)
-                mlx4_warn(dev, "multifunction unbond for flow rules failedi (%d)\n", ret);
+                mlx4_warn(dev, "multifunction unbond for flow rules failed (%d)\n", ret);
        ret1 = mlx4_unbond_mac_table(dev);
        if (ret1) {
                mlx4_warn(dev, "multifunction unbond for MAC table failed (%d)\n", ret1);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 3d46ef48d5b8..c641d5656b2d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -1007,12 +1007,14 @@ static void mlx5e_trust_update_sq_inline_mode(struct mlx5e_priv *priv)
        mutex_lock(&priv->state_lock);
-        if (!test_bit(MLX5E_STATE_OPENED, &priv->state))
-                goto out;
        new_channels.params = priv->channels.params;
        mlx5e_trust_update_tx_min_inline_mode(priv, &new_channels.params);
+        if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
+                priv->channels.params = new_channels.params;
+                goto out;
+        }
        /* Skip if tx_min_inline is the same */
        if (new_channels.params.tx_min_inline_mode ==
            priv->channels.params.tx_min_inline_mode)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index d8f68e4d1018..876c3e4c6193 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -877,13 +877,14 @@ static const struct net_device_ops mlx5e_netdev_ops_rep = {
 };
 static void mlx5e_build_rep_params(struct mlx5_core_dev *mdev,
-                                   struct mlx5e_params *params)
+                                   struct mlx5e_params *params, u16 mtu)
 {
        u8 cq_period_mode = MLX5_CAP_GEN(mdev, cq_period_start_from_cqe) ?
                                         MLX5_CQ_PERIOD_MODE_START_FROM_CQE :
                                         MLX5_CQ_PERIOD_MODE_START_FROM_EQE;
        params->hard_mtu    = MLX5E_ETH_HARD_MTU;
+        params->sw_mtu      = mtu;
        params->log_sq_size = MLX5E_REP_PARAMS_LOG_SQ_SIZE;
        params->rq_wq_type  = MLX5_WQ_TYPE_LINKED_LIST;
        params->log_rq_mtu_frames = MLX5E_REP_PARAMS_LOG_RQ_SIZE;
@@ -931,7 +932,7 @@ static void mlx5e_init_rep(struct mlx5_core_dev *mdev,
        priv->channels.params.num_channels = profile->max_nch(mdev);
-        mlx5e_build_rep_params(mdev, &priv->channels.params);
+        mlx5e_build_rep_params(mdev, &priv->channels.params, netdev->mtu);
        mlx5e_build_rep_netdev(netdev);
        mlx5e_timestamp_init(priv);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index 707976482c09..027f54ac1ca2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -290,7 +290,7 @@ static int mlx5e_test_loopback(struct mlx5e_priv *priv)
        if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
                netdev_err(priv->netdev,
-                           "\tCan't perform loobpack test while device is down\n");
+                           "\tCan't perform loopback test while device is down\n");
                return -ENODEV;
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 4197001f9801..3c534fc43400 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1864,7 +1864,8 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec,
        }
        ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol);
-        if (modify_ip_header && ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) {
+        if (modify_ip_header && ip_proto != IPPROTO_TCP &&
+            ip_proto != IPPROTO_UDP && ip_proto != IPPROTO_ICMP) {
                pr_info("can't offload re-write of ip proto %d\n", ip_proto);
                return false;
        }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index 20297108528a..5532aa3675c7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -255,7 +255,7 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb,
                dma_addr = dma_map_single(sq->pdev, skb_data, headlen,
                                          DMA_TO_DEVICE);
                if (unlikely(dma_mapping_error(sq->pdev, dma_addr)))
-                        return -ENOMEM;
+                        goto dma_unmap_wqe_err;
                dseg->addr       = cpu_to_be64(dma_addr);
                dseg->lkey       = sq->mkey_be;
@@ -273,7 +273,7 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb,
                dma_addr = skb_frag_dma_map(sq->pdev, frag, 0, fsz,
                                            DMA_TO_DEVICE);
                if (unlikely(dma_mapping_error(sq->pdev, dma_addr)))
-                        return -ENOMEM;
+                        goto dma_unmap_wqe_err;
                dseg->addr       = cpu_to_be64(dma_addr);
                dseg->lkey       = sq->mkey_be;
@@ -285,6 +285,10 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb,
        }
        return num_dma;
+dma_unmap_wqe_err:
+        mlx5e_dma_unmap_wqe_err(sq, num_dma);
+        return -ENOMEM;
 }
 static inline void
@@ -380,17 +384,15 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
        num_dma = mlx5e_txwqe_build_dsegs(sq, skb, skb_data, headlen,
                                          (struct mlx5_wqe_data_seg *)cseg + ds_cnt);
        if (unlikely(num_dma < 0))
-                goto dma_unmap_wqe_err;
+                goto err_drop;
        mlx5e_txwqe_complete(sq, skb, opcode, ds_cnt + num_dma,
                             num_bytes, num_dma, wi, cseg);
        return NETDEV_TX_OK;
-dma_unmap_wqe_err:
+err_drop:
        sq->stats.dropped++;
-        mlx5e_dma_unmap_wqe_err(sq, wi->num_dma);
        dev_kfree_skb_any(skb);
        return NETDEV_TX_OK;
@@ -645,17 +647,15 @@ netdev_tx_t mlx5i_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb,
        num_dma = mlx5e_txwqe_build_dsegs(sq, skb, skb_data, headlen,
                                          (struct mlx5_wqe_data_seg *)cseg + ds_cnt);
        if (unlikely(num_dma < 0))
-                goto dma_unmap_wqe_err;
+                goto err_drop;
        mlx5e_txwqe_complete(sq, skb, opcode, ds_cnt + num_dma,
                             num_bytes, num_dma, wi, cseg);
        return NETDEV_TX_OK;
-dma_unmap_wqe_err:
+err_drop:
        sq->stats.dropped++;
-        mlx5e_dma_unmap_wqe_err(sq, wi->num_dma);
        dev_kfree_skb_any(skb);
        return NETDEV_TX_OK;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index de51e7c39bc8..c39c1692e674 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -187,6 +187,7 @@ static void del_sw_ns(struct fs_node *node);
 static void del_sw_hw_rule(struct fs_node *node);
 static bool mlx5_flow_dests_cmp(struct mlx5_flow_destination *d1,
                                struct mlx5_flow_destination *d2);
+static void cleanup_root_ns(struct mlx5_flow_root_namespace *root_ns);
 static struct mlx5_flow_rule *
 find_flow_rule(struct fs_fte *fte,
               struct mlx5_flow_destination *dest);
@@ -481,7 +482,8 @@ static void del_sw_hw_rule(struct fs_node *node)
        if (rule->dest_attr.type == MLX5_FLOW_DESTINATION_TYPE_COUNTER  &&
            --fte->dests_size) {
-                modify_mask = BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_ACTION);
+                modify_mask = BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_ACTION) |
+                              BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_FLOW_COUNTERS);
                fte->action.action &= ~MLX5_FLOW_CONTEXT_ACTION_COUNT;
                update_fte = true;
                goto out;
@@ -2351,23 +2353,27 @@ static int create_anchor_flow_table(struct mlx5_flow_steering *steering)
 static int init_root_ns(struct mlx5_flow_steering *steering)
 {
+        int err;
        steering->root_ns = create_root_ns(steering, FS_FT_NIC_RX);
        if (!steering->root_ns)
-                goto cleanup;
+                return -ENOMEM;
-        if (init_root_tree(steering, &root_fs, &steering->root_ns->ns.node))
+        err = init_root_tree(steering, &root_fs, &steering->root_ns->ns.node);
-                goto cleanup;
+        if (err)
+                goto out_err;
        set_prio_attrs(steering->root_ns);
+        err = create_anchor_flow_table(steering);
-        if (create_anchor_flow_table(steering))
+        if (err)
-                goto cleanup;
+                goto out_err;
        return 0;
-cleanup:
+out_err:
-        mlx5_cleanup_fs(steering->dev);
+        cleanup_root_ns(steering->root_ns);
-        return -ENOMEM;
+        steering->root_ns = NULL;
+        return err;
 }
 static void clean_tree(struct fs_node *node)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index c11c9a635866..4ed01182a82c 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -1718,13 +1718,11 @@ __mlxsw_sp_port_mdb_del(struct mlxsw_sp_port *mlxsw_sp_port,
        struct net_device *dev = mlxsw_sp_port->dev;
        int err;
-        if (bridge_port->bridge_device->multicast_enabled) {
+        if (bridge_port->bridge_device->multicast_enabled &&
-                if (bridge_port->bridge_device->multicast_enabled) {
+            !bridge_port->mrouter) {
-                        err = mlxsw_sp_port_smid_set(mlxsw_sp_port, mid->mid,
+                err = mlxsw_sp_port_smid_set(mlxsw_sp_port, mid->mid, false);
-                                                     false);
+                if (err)
-                        if (err)
+                        netdev_err(dev, "Unable to remove port from SMID\n");
-                                netdev_err(dev, "Unable to remove port from SMID\n");
-                }
        }
        err = mlxsw_sp_port_remove_from_mid(mlxsw_sp_port, mid);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
index b3567a596fc1..80df9a5d4217 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
@@ -183,17 +183,21 @@ static int
 nfp_fl_set_ipv4_udp_tun(struct nfp_fl_set_ipv4_udp_tun *set_tun,
                        const struct tc_action *action,
                        struct nfp_fl_pre_tunnel *pre_tun,
-                        enum nfp_flower_tun_type tun_type)
+                        enum nfp_flower_tun_type tun_type,
+                        struct net_device *netdev)
 {
        size_t act_size = sizeof(struct nfp_fl_set_ipv4_udp_tun);
        struct ip_tunnel_info *ip_tun = tcf_tunnel_info(action);
        u32 tmp_set_ip_tun_type_index = 0;
        /* Currently support one pre-tunnel so index is always 0. */
        int pretun_idx = 0;
+        struct net *net;
        if (ip_tun->options_len)
                return -EOPNOTSUPP;
+        net = dev_net(netdev);
        set_tun->head.jump_id = NFP_FL_ACTION_OPCODE_SET_IPV4_TUNNEL;
        set_tun->head.len_lw = act_size >> NFP_FL_LW_SIZ;
@@ -204,6 +208,7 @@ nfp_fl_set_ipv4_udp_tun(struct nfp_fl_set_ipv4_udp_tun *set_tun,
        set_tun->tun_type_index = cpu_to_be32(tmp_set_ip_tun_type_index);
        set_tun->tun_id = ip_tun->key.tun_id;
+        set_tun->ttl = net->ipv4.sysctl_ip_default_ttl;
        /* Complete pre_tunnel action. */
        pre_tun->ipv4_dst = ip_tun->key.u.ipv4.dst;
@@ -511,7 +516,8 @@ nfp_flower_loop_action(const struct tc_action *a,
                *a_len += sizeof(struct nfp_fl_pre_tunnel);
                set_tun = (void *)&nfp_fl->action_data[*a_len];
-                err = nfp_fl_set_ipv4_udp_tun(set_tun, a, pre_tun, *tun_type);
+                err = nfp_fl_set_ipv4_udp_tun(set_tun, a, pre_tun, *tun_type,
+                                              netdev);
                if (err)
                        return err;
                *a_len += sizeof(struct nfp_fl_set_ipv4_udp_tun);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
index b6c0fd053a50..bee4367a2c38 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
@@ -190,7 +190,10 @@ struct nfp_fl_set_ipv4_udp_tun {
        __be16 reserved;
        __be64 tun_id __packed;
        __be32 tun_type_index;
-        __be32 extra[3];
+        __be16 reserved2;
+        u8 ttl;
+        u8 reserved3;
+        __be32 extra[2];
 };
 /* Metadata with L2 (1W/4B)
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
index ad02592a82b7..a997e34bcec2 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
@@ -360,7 +360,7 @@ nfp_flower_spawn_phy_reprs(struct nfp_app *app, struct nfp_flower_priv *priv)
                }
                SET_NETDEV_DEV(repr, &priv->nn->pdev->dev);
-                nfp_net_get_mac_addr(app->pf, port);
+                nfp_net_get_mac_addr(app->pf, repr, port);
                cmsg_port_id = nfp_flower_cmsg_phys_port(phys_port);
                err = nfp_repr_init(app, repr,
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c b/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c
index 2a2f2fbc8850..b9618c37403f 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_app_nic.c
@@ -69,7 +69,7 @@ int nfp_app_nic_vnic_alloc(struct nfp_app *app, struct nfp_net *nn,
        if (err)
                return err < 0 ? err : 0;
-        nfp_net_get_mac_addr(app->pf, nn->port);
+        nfp_net_get_mac_addr(app->pf, nn->dp.netdev, nn->port);
        return 0;
 }
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.h b/drivers/net/ethernet/netronome/nfp/nfp_main.h
index add46e28212b..42211083b51f 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_main.h
+++ b/drivers/net/ethernet/netronome/nfp/nfp_main.h
@@ -171,7 +171,9 @@ void nfp_net_pci_remove(struct nfp_pf *pf);
 int nfp_hwmon_register(struct nfp_pf *pf);
 void nfp_hwmon_unregister(struct nfp_pf *pf);
-void nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port);
+void
+nfp_net_get_mac_addr(struct nfp_pf *pf, struct net_device *netdev,
+                     struct nfp_port *port);
 bool nfp_ctrl_tx(struct nfp_net *nn, struct sk_buff *skb);
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
index 15fa47f622aa..45cd2092e498 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_main.c
@@ -67,23 +67,26 @@
 /**
 * nfp_net_get_mac_addr() - Get the MAC address.
 * @pf:       NFP PF handle
+ * @netdev:   net_device to set MAC address on
 * @port:     NFP port structure
 *
 * First try to get the MAC address from NSP ETH table. If that
 * fails generate a random address.
 */
-void nfp_net_get_mac_addr(struct nfp_pf *pf, struct nfp_port *port)
+void
+nfp_net_get_mac_addr(struct nfp_pf *pf, struct net_device *netdev,
+                     struct nfp_port *port)
 {
        struct nfp_eth_table_port *eth_port;
        eth_port = __nfp_port_get_eth_port(port);
        if (!eth_port) {
-                eth_hw_addr_random(port->netdev);
+                eth_hw_addr_random(netdev);
                return;
        }
-        ether_addr_copy(port->netdev->dev_addr, eth_port->mac_addr);
+        ether_addr_copy(netdev->dev_addr, eth_port->mac_addr);
-        ether_addr_copy(port->netdev->perm_addr, eth_port->mac_addr);
+        ether_addr_copy(netdev->perm_addr, eth_port->mac_addr);
 }
 static struct nfp_eth_table_port *
@@ -511,16 +514,18 @@ static int nfp_net_pci_map_mem(struct nfp_pf *pf)
                return PTR_ERR(mem);
        }
-        min_size =  NFP_MAC_STATS_SIZE * (pf->eth_tbl->max_index + 1);
+        if (pf->eth_tbl) {
-        pf->mac_stats_mem = nfp_rtsym_map(pf->rtbl, "_mac_stats",
+                min_size =  NFP_MAC_STATS_SIZE * (pf->eth_tbl->max_index + 1);
-                                          "net.macstats", min_size,
+                pf->mac_stats_mem = nfp_rtsym_map(pf->rtbl, "_mac_stats",
-                                          &pf->mac_stats_bar);
+                                                  "net.macstats", min_size,
-        if (IS_ERR(pf->mac_stats_mem)) {
+                                                  &pf->mac_stats_bar);
-                if (PTR_ERR(pf->mac_stats_mem) != -ENOENT) {
+                if (IS_ERR(pf->mac_stats_mem)) {
-                        err = PTR_ERR(pf->mac_stats_mem);
+                        if (PTR_ERR(pf->mac_stats_mem) != -ENOENT) {
-                        goto err_unmap_ctrl;
+                                err = PTR_ERR(pf->mac_stats_mem);
+                                goto err_unmap_ctrl;
+                        }
+                        pf->mac_stats_mem = NULL;
                }
-                pf->mac_stats_mem = NULL;
        }
        pf->vf_cfg_mem = nfp_net_pf_map_rtsym(pf, "net.vfcfg",
diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
index 74fc626b1ec1..38502815d681 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -2370,7 +2370,7 @@ static int qed_ll2_start_xmit(struct qed_dev *cdev, struct sk_buff *skb)
        u8 flags = 0;
        if (unlikely(skb->ip_summed != CHECKSUM_NONE)) {
-                DP_INFO(cdev, "Cannot transmit a checksumed packet\n");
+                DP_INFO(cdev, "Cannot transmit a checksummed packet\n");
                return -EINVAL;
        }
diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
index fb7c2d1562ae..6acfd43c1a4f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
@@ -848,7 +848,7 @@ int qed_roce_query_qp(struct qed_hwfn *p_hwfn,
        if (!(qp->resp_offloaded)) {
                DP_NOTICE(p_hwfn,
-                          "The responder's qp should be offloded before requester's\n");
+                          "The responder's qp should be offloaded before requester's\n");
                return -EINVAL;
        }
diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c
index d24b47b8e0b2..d118da5a10a2 100644
--- a/drivers/net/ethernet/realtek/8139too.c
+++ b/drivers/net/ethernet/realtek/8139too.c
@@ -2224,7 +2224,7 @@ static void rtl8139_poll_controller(struct net_device *dev)
        struct rtl8139_private *tp = netdev_priv(dev);
        const int irq = tp->pci_dev->irq;
-        disable_irq(irq);
+        disable_irq_nosync(irq);
        rtl8139_interrupt(irq, dev);
        enable_irq(irq);
 }
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 63036d9bf3e6..d90a7b1f4088 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4784,8 +4784,9 @@ expire:
         * will set rule->filter_id to EFX_ARFS_FILTER_ID_PENDING, meaning that
         * the rule is not removed by efx_rps_hash_del() below.
         */
-        ret = efx_ef10_filter_remove_internal(efx, 1U << spec->priority,
+        if (ret)
-                                              filter_idx, true) == 0;
+                ret = efx_ef10_filter_remove_internal(efx, 1U << spec->priority,
+                                                      filter_idx, true) == 0;
        /* While we can't safely dereference rule (we dropped the lock), we can
         * still test it for NULL.
         */
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 64a94f242027..d2e254f2f72b 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -839,6 +839,8 @@ static void efx_filter_rfs_work(struct work_struct *data)
        int rc;
        rc = efx->type->filter_insert(efx, &req->spec, true);
+        if (rc >= 0)
+                rc %= efx->type->max_rx_ip_filters;
        if (efx->rps_hash_table) {
                spin_lock_bh(&efx->rps_hash_lock);
                rule = efx_rps_hash_find(efx, &req->spec);
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 74f828412055..28d893b93d30 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -1340,6 +1340,8 @@ static inline void cpsw_add_dual_emac_def_ale_entries(
        cpsw_ale_add_ucast(cpsw->ale, priv->mac_addr,
                           HOST_PORT_NUM, ALE_VLAN |
                           ALE_SECURE, slave->port_vlan);
+        cpsw_ale_control_set(cpsw->ale, slave_port,
+                             ALE_PORT_DROP_UNKNOWN_VLAN, 1);
 }
 static void soft_reset_slave(struct cpsw_slave *slave)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index ac23322a32e1..9e4ba8e80a18 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -535,8 +535,17 @@ static int get_phy_id(struct mii_bus *bus, int addr, u32 *phy_id,
        /* Grab the bits from PHYIR1, and put them in the upper half */
        phy_reg = mdiobus_read(bus, addr, MII_PHYSID1);
-        if (phy_reg < 0)
+        if (phy_reg < 0) {
+                /* if there is no device, return without an error so scanning
+                 * the bus works properly
+                 */
+                if (phy_reg == -EIO || phy_reg == -ENODEV) {
+                        *phy_id = 0xffffffff;
+                        return 0;
+                }
                return -EIO;
+        }
        *phy_id = (phy_reg & 0xffff) << 16;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index c853e7410f5a..42565dd33aa6 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1098,6 +1098,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x05c6, 0x9080, 8)},
        {QMI_FIXED_INTF(0x05c6, 0x9083, 3)},
        {QMI_FIXED_INTF(0x05c6, 0x9084, 4)},
+        {QMI_FIXED_INTF(0x05c6, 0x90b2, 3)},    /* ublox R410M */
        {QMI_FIXED_INTF(0x05c6, 0x920d, 0)},
        {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
        {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */
@@ -1343,6 +1344,18 @@ static int qmi_wwan_probe(struct usb_interface *intf,
                id->driver_info = (unsigned long)&qmi_wwan_info;
        }
+        /* There are devices where the same interface number can be
+         * configured as different functions. We should only bind to
+         * vendor specific functions when matching on interface number
+         */
+        if (id->match_flags & USB_DEVICE_ID_MATCH_INT_NUMBER &&
+            desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) {
+                dev_dbg(&intf->dev,
+                        "Rejecting interface number match for class %02x\n",
+                        desc->bInterfaceClass);
+                return -ENODEV;
+        }
        /* Quectel EC20 quirk where we've QMI on interface 4 instead of 0 */
        if (quectel_ec20_detected(intf) && desc->bInterfaceNumber == 0) {
                dev_dbg(&intf->dev, "Quectel EC20 quirk, skipping interface 0\n");
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
index 9277f4c2bfeb..94e177d7c9b5 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
@@ -459,7 +459,7 @@ static void brcmf_fw_free_request(struct brcmf_fw_request *req)
        kfree(req);
 }
-static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
+static int brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
 {
        struct brcmf_fw *fwctx = ctx;
        struct brcmf_fw_item *cur;
@@ -498,13 +498,10 @@ static void brcmf_fw_request_nvram_done(const struct firmware *fw, void *ctx)
        brcmf_dbg(TRACE, "nvram %p len %d\n", nvram, nvram_length);
        cur->nv_data.data = nvram;
        cur->nv_data.len = nvram_length;
-        return;
+        return 0;
 fail:
-        brcmf_dbg(TRACE, "failed: dev=%s\n", dev_name(fwctx->dev));
+        return -ENOENT;
-        fwctx->done(fwctx->dev, -ENOENT, NULL);
-        brcmf_fw_free_request(fwctx->req);
-        kfree(fwctx);
 }
 static int brcmf_fw_request_next_item(struct brcmf_fw *fwctx, bool async)
@@ -553,20 +550,27 @@ static void brcmf_fw_request_done(const struct firmware *fw, void *ctx)
        brcmf_dbg(TRACE, "enter: firmware %s %sfound\n", cur->path,
                  fw ? "" : "not ");
-        if (fw) {
+        if (!fw)
-                if (cur->type == BRCMF_FW_TYPE_BINARY)
-                        cur->binary = fw;
-                else if (cur->type == BRCMF_FW_TYPE_NVRAM)
-                        brcmf_fw_request_nvram_done(fw, fwctx);
-                else
-                        release_firmware(fw);
-        } else if (cur->type == BRCMF_FW_TYPE_NVRAM) {
-                brcmf_fw_request_nvram_done(NULL, fwctx);
-        } else if (!(cur->flags & BRCMF_FW_REQF_OPTIONAL)) {
                ret = -ENOENT;
+        switch (cur->type) {
+        case BRCMF_FW_TYPE_NVRAM:
+                ret = brcmf_fw_request_nvram_done(fw, fwctx);
+                break;
+        case BRCMF_FW_TYPE_BINARY:
+                cur->binary = fw;
+                break;
+        default:
+                /* something fishy here so bail out early */
+                brcmf_err("unknown fw type: %d\n", cur->type);
+                release_firmware(fw);
+                ret = -EINVAL;
                goto fail;
        }
+        if (ret < 0 && !(cur->flags & BRCMF_FW_REQF_OPTIONAL))
+                goto fail;
        do {
                if (++fwctx->curpos == fwctx->req->n_items) {
                        ret = 0;
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
index 7af3a0f51b77..a17c4a79b8d4 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
@@ -8,6 +8,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+ * Copyright(c) 2018        Intel Corporation
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +31,7 @@
 * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
 * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
 * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018        Intel Corporation
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
@@ -749,13 +750,9 @@ struct iwl_scan_req_umac {
 } __packed;
 #define IWL_SCAN_REQ_UMAC_SIZE_V8 sizeof(struct iwl_scan_req_umac)
-#define IWL_SCAN_REQ_UMAC_SIZE_V7 (sizeof(struct iwl_scan_req_umac) - \
+#define IWL_SCAN_REQ_UMAC_SIZE_V7 48
-                                         4 * sizeof(u8))
+#define IWL_SCAN_REQ_UMAC_SIZE_V6 44
-#define IWL_SCAN_REQ_UMAC_SIZE_V6 (sizeof(struct iwl_scan_req_umac) - \
+#define IWL_SCAN_REQ_UMAC_SIZE_V1 36
-                                   2 * sizeof(u8) - sizeof(__le16))
-#define IWL_SCAN_REQ_UMAC_SIZE_V1 (sizeof(struct iwl_scan_req_umac) - \
-                                   2 * sizeof(__le32) - 2 * sizeof(u8) - \
-                                   sizeof(__le16))
 /**
 * struct iwl_umac_scan_abort
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index 8928613e033e..ca0174680af9 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -76,6 +76,7 @@
 #include "iwl-io.h"
 #include "iwl-csr.h"
 #include "fw/acpi.h"
+#include "fw/api/nvm-reg.h"
 /* NVM offsets (in words) definitions */
 enum nvm_offsets {
@@ -146,8 +147,8 @@ static const u8 iwl_ext_nvm_channels[] = {
        149, 153, 157, 161, 165, 169, 173, 177, 181
 };
-#define IWL_NUM_CHANNELS                ARRAY_SIZE(iwl_nvm_channels)
+#define IWL_NVM_NUM_CHANNELS            ARRAY_SIZE(iwl_nvm_channels)
-#define IWL_NUM_CHANNELS_EXT    ARRAY_SIZE(iwl_ext_nvm_channels)
+#define IWL_NVM_NUM_CHANNELS_EXT        ARRAY_SIZE(iwl_ext_nvm_channels)
 #define NUM_2GHZ_CHANNELS               14
 #define NUM_2GHZ_CHANNELS_EXT   14
 #define FIRST_2GHZ_HT_MINUS             5
@@ -301,11 +302,11 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
        const u8 *nvm_chan;
        if (cfg->nvm_type != IWL_NVM_EXT) {
-                num_of_ch = IWL_NUM_CHANNELS;
+                num_of_ch = IWL_NVM_NUM_CHANNELS;
                nvm_chan = &iwl_nvm_channels[0];
                num_2ghz_channels = NUM_2GHZ_CHANNELS;
        } else {
-                num_of_ch = IWL_NUM_CHANNELS_EXT;
+                num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
                nvm_chan = &iwl_ext_nvm_channels[0];
                num_2ghz_channels = NUM_2GHZ_CHANNELS_EXT;
        }
@@ -720,12 +721,12 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
        if (cfg->nvm_type != IWL_NVM_EXT)
                data = kzalloc(sizeof(*data) +
                               sizeof(struct ieee80211_channel) *
-                               IWL_NUM_CHANNELS,
+                               IWL_NVM_NUM_CHANNELS,
                               GFP_KERNEL);
        else
                data = kzalloc(sizeof(*data) +
                               sizeof(struct ieee80211_channel) *
-                               IWL_NUM_CHANNELS_EXT,
+                               IWL_NVM_NUM_CHANNELS_EXT,
                               GFP_KERNEL);
        if (!data)
                return NULL;
@@ -842,24 +843,34 @@ static u32 iwl_nvm_get_regdom_bw_flags(const u8 *nvm_chan,
        return flags;
 }
+struct regdb_ptrs {
+        struct ieee80211_wmm_rule *rule;
+        u32 token;
+};
 struct ieee80211_regdomain *
 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
-                       int num_of_ch, __le32 *channels, u16 fw_mcc)
+                       int num_of_ch, __le32 *channels, u16 fw_mcc,
+                       u16 geo_info)
 {
        int ch_idx;
        u16 ch_flags;
        u32 reg_rule_flags, prev_reg_rule_flags = 0;
        const u8 *nvm_chan = cfg->nvm_type == IWL_NVM_EXT ?
                             iwl_ext_nvm_channels : iwl_nvm_channels;
-        struct ieee80211_regdomain *regd;
+        struct ieee80211_regdomain *regd, *copy_rd;
-        int size_of_regd;
+        int size_of_regd, regd_to_copy, wmms_to_copy;
+        int size_of_wmms = 0;
        struct ieee80211_reg_rule *rule;
+        struct ieee80211_wmm_rule *wmm_rule, *d_wmm, *s_wmm;
+        struct regdb_ptrs *regdb_ptrs;
        enum nl80211_band band;
        int center_freq, prev_center_freq = 0;
-        int valid_rules = 0;
+        int valid_rules = 0, n_wmms = 0;
+        int i;
        bool new_rule;
        int max_num_ch = cfg->nvm_type == IWL_NVM_EXT ?
-                         IWL_NUM_CHANNELS_EXT : IWL_NUM_CHANNELS;
+                         IWL_NVM_NUM_CHANNELS_EXT : IWL_NVM_NUM_CHANNELS;
        if (WARN_ON_ONCE(num_of_ch > NL80211_MAX_SUPP_REG_RULES))
                return ERR_PTR(-EINVAL);
@@ -875,10 +886,26 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                sizeof(struct ieee80211_regdomain) +
                num_of_ch * sizeof(struct ieee80211_reg_rule);
-        regd = kzalloc(size_of_regd, GFP_KERNEL);
+        if (geo_info & GEO_WMM_ETSI_5GHZ_INFO)
+                size_of_wmms =
+                        num_of_ch * sizeof(struct ieee80211_wmm_rule);
+        regd = kzalloc(size_of_regd + size_of_wmms, GFP_KERNEL);
        if (!regd)
                return ERR_PTR(-ENOMEM);
+        regdb_ptrs = kcalloc(num_of_ch, sizeof(*regdb_ptrs), GFP_KERNEL);
+        if (!regdb_ptrs) {
+                copy_rd = ERR_PTR(-ENOMEM);
+                goto out;
+        }
+        /* set alpha2 from FW. */
+        regd->alpha2[0] = fw_mcc >> 8;
+        regd->alpha2[1] = fw_mcc & 0xff;
+        wmm_rule = (struct ieee80211_wmm_rule *)((u8 *)regd + size_of_regd);
        for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) {
                ch_flags = (u16)__le32_to_cpup(channels + ch_idx);
                band = (ch_idx < NUM_2GHZ_CHANNELS) ?
@@ -927,14 +954,66 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
                iwl_nvm_print_channel_flags(dev, IWL_DL_LAR,
                                            nvm_chan[ch_idx], ch_flags);
+                if (!(geo_info & GEO_WMM_ETSI_5GHZ_INFO) ||
+                    band == NL80211_BAND_2GHZ)
+                        continue;
+                if (!reg_query_regdb_wmm(regd->alpha2, center_freq,
+                                         &regdb_ptrs[n_wmms].token, wmm_rule)) {
+                        /* Add only new rules */
+                        for (i = 0; i < n_wmms; i++) {
+                                if (regdb_ptrs[i].token ==
+                                    regdb_ptrs[n_wmms].token) {
+                                        rule->wmm_rule = regdb_ptrs[i].rule;
+                                        break;
+                                }
+                        }
+                        if (i == n_wmms) {
+                                rule->wmm_rule = wmm_rule;
+                                regdb_ptrs[n_wmms++].rule = wmm_rule;
+                                wmm_rule++;
+                        }
+                }
        }
        regd->n_reg_rules = valid_rules;
+        regd->n_wmm_rules = n_wmms;
-        /* set alpha2 from FW. */
+        /*
-        regd->alpha2[0] = fw_mcc >> 8;
+         * Narrow down regdom for unused regulatory rules to prevent hole
-        regd->alpha2[1] = fw_mcc & 0xff;
+         * between reg rules to wmm rules.
+         */
+        regd_to_copy = sizeof(struct ieee80211_regdomain) +
+                valid_rules * sizeof(struct ieee80211_reg_rule);
+        wmms_to_copy = sizeof(struct ieee80211_wmm_rule) * n_wmms;
+        copy_rd = kzalloc(regd_to_copy + wmms_to_copy, GFP_KERNEL);
+        if (!copy_rd) {
+                copy_rd = ERR_PTR(-ENOMEM);
+                goto out;
+        }
+        memcpy(copy_rd, regd, regd_to_copy);
+        memcpy((u8 *)copy_rd + regd_to_copy, (u8 *)regd + size_of_regd,
+               wmms_to_copy);
+        d_wmm = (struct ieee80211_wmm_rule *)((u8 *)copy_rd + regd_to_copy);
+        s_wmm = (struct ieee80211_wmm_rule *)((u8 *)regd + size_of_regd);
+        for (i = 0; i < regd->n_reg_rules; i++) {
+                if (!regd->reg_rules[i].wmm_rule)
+                        continue;
+                copy_rd->reg_rules[i].wmm_rule = d_wmm +
+                        (regd->reg_rules[i].wmm_rule - s_wmm) /
+                        sizeof(struct ieee80211_wmm_rule);
+        }
-        return regd;
+out:
+        kfree(regdb_ptrs);
+        kfree(regd);
+        return copy_rd;
 }
 IWL_EXPORT_SYMBOL(iwl_parse_nvm_mcc_info);
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
index 306736c7a042..3071a23b7606 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
@@ -101,12 +101,14 @@ void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
 *
 * This function parses the regulatory channel data received as a
 * MCC_UPDATE_CMD command. It returns a newly allocation regulatory domain,
- * to be fed into the regulatory core. An ERR_PTR is returned on error.
+ * to be fed into the regulatory core. In case the geo_info is set handle
+ * accordingly. An ERR_PTR is returned on error.
 * If not given to the regulatory core, the user is responsible for freeing
 * the regdomain returned here with kfree.
 */
 struct ieee80211_regdomain *
 iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
-                       int num_of_ch, __le32 *channels, u16 fw_mcc);
+                       int num_of_ch, __le32 *channels, u16 fw_mcc,
+                       u16 geo_info);
 #endif /* __iwl_nvm_parse_h__ */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 51b30424575b..90f8c89ea59c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -311,7 +311,8 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
        regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
                                      __le32_to_cpu(resp->n_channels),
                                      resp->channels,
-                                      __le16_to_cpu(resp->mcc));
+                                      __le16_to_cpu(resp->mcc),
+                                      __le16_to_cpu(resp->geo_info));
        /* Store the return source id */
        src_id = resp->source_id;
        kfree(resp);
diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
index 8b6b07a936f5..b026e80940a4 100644
--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
+++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c
@@ -158,16 +158,6 @@ static u8 halbtc_get_wifi_central_chnl(struct btc_coexist *btcoexist)
 static u8 rtl_get_hwpg_single_ant_path(struct rtl_priv *rtlpriv)
 {
-        struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params;
-        /* override ant_num / ant_path */
-        if (mod_params->ant_sel) {
-                rtlpriv->btcoexist.btc_info.ant_num =
-                        (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1);
-                rtlpriv->btcoexist.btc_info.single_ant_path =
-                        (mod_params->ant_sel == 1 ? 0 : 1);
-        }
        return rtlpriv->btcoexist.btc_info.single_ant_path;
 }
@@ -178,7 +168,6 @@ static u8 rtl_get_hwpg_bt_type(struct rtl_priv *rtlpriv)
 static u8 rtl_get_hwpg_ant_num(struct rtl_priv *rtlpriv)
 {
-        struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params;
        u8 num;
        if (rtlpriv->btcoexist.btc_info.ant_num == ANT_X2)
@@ -186,10 +175,6 @@ static u8 rtl_get_hwpg_ant_num(struct rtl_priv *rtlpriv)
        else
                num = 1;
-        /* override ant_num / ant_path */
-        if (mod_params->ant_sel)
-                num = (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1) + 1;
        return num;
 }
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
index e7bbbc95cdb1..b4f3f91b590e 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c
@@ -848,6 +848,9 @@ static bool _rtl8723be_init_mac(struct ieee80211_hw *hw)
                return false;
        }
+        if (rtlpriv->cfg->ops->get_btc_status())
+                rtlpriv->btcoexist.btc_ops->btc_power_on_setting(rtlpriv);
        bytetmp = rtl_read_byte(rtlpriv, REG_MULTI_FUNC_CTRL);
        rtl_write_byte(rtlpriv, REG_MULTI_FUNC_CTRL, bytetmp | BIT(3));
@@ -2696,21 +2699,21 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw,
                rtlpriv->btcoexist.btc_info.bt_type = BT_RTL8723B;
                rtlpriv->btcoexist.btc_info.ant_num = (value & 0x1);
                rtlpriv->btcoexist.btc_info.single_ant_path =
-                         (value & 0x40);        /*0xc3[6]*/
+                         (value & 0x40 ? ANT_AUX : ANT_MAIN);   /*0xc3[6]*/
        } else {
                rtlpriv->btcoexist.btc_info.btcoexist = 0;
                rtlpriv->btcoexist.btc_info.bt_type = BT_RTL8723B;
                rtlpriv->btcoexist.btc_info.ant_num = ANT_X2;
-                rtlpriv->btcoexist.btc_info.single_ant_path = 0;
+                rtlpriv->btcoexist.btc_info.single_ant_path = ANT_MAIN;
        }
        /* override ant_num / ant_path */
        if (mod_params->ant_sel) {
                rtlpriv->btcoexist.btc_info.ant_num =
-                        (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1);
+                        (mod_params->ant_sel == 1 ? ANT_X1 : ANT_X2);
                rtlpriv->btcoexist.btc_info.single_ant_path =
-                        (mod_params->ant_sel == 1 ? 0 : 1);
+                        (mod_params->ant_sel == 1 ? ANT_AUX : ANT_MAIN);
        }
 }
diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
index d27e33960e77..ce1754054a07 100644
--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
@@ -2823,6 +2823,11 @@ enum bt_ant_num {
        ANT_X1 = 1,
 };
+enum bt_ant_path {
+        ANT_MAIN = 0,
+        ANT_AUX = 1,
+};
 enum bt_co_type {
        BT_2WIRE = 0,
        BT_ISSC_3WIRE = 1,
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 486e65e3db26..469b20e1dd7e 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -31,6 +31,7 @@ struct bpf_map_ops {
        void (*map_release)(struct bpf_map *map, struct file *map_file);
        void (*map_free)(struct bpf_map *map);
        int (*map_get_next_key)(struct bpf_map *map, void *key, void *next_key);
+        void (*map_release_uref)(struct bpf_map *map);
        /* funcs callable from userspace and from eBPF programs */
        void *(*map_lookup_elem)(struct bpf_map *map, void *key);
@@ -351,6 +352,7 @@ int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,
                struct bpf_prog **_prog, *__prog;       \
                struct bpf_prog_array *_array;          \
                u32 _ret = 1;                           \
+                preempt_disable();                      \
                rcu_read_lock();                        \
                _array = rcu_dereference(array);        \
                if (unlikely(check_non_null && !_array))\
@@ -362,6 +364,7 @@ int bpf_prog_array_copy(struct bpf_prog_array __rcu *old_array,
                }                                       \
 _out:                                                   \
                rcu_read_unlock();                      \
+                preempt_enable_no_resched();            \
                _ret;                                   \
         })
@@ -434,7 +437,6 @@ int bpf_stackmap_copy(struct bpf_map *map, void *key, void *value);
 int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file,
                                 void *key, void *value, u64 map_flags);
 int bpf_fd_array_map_lookup_elem(struct bpf_map *map, void *key, u32 *value);
-void bpf_fd_array_map_clear(struct bpf_map *map);
 int bpf_fd_htab_map_update_elem(struct bpf_map *map, struct file *map_file,
                                void *key, void *value, u64 map_flags);
 int bpf_fd_htab_map_lookup_elem(struct bpf_map *map, void *key, u32 *value);
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 767d193c269a..2a156c5dfadd 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -1284,25 +1284,19 @@ enum {
 };
 static inline const struct cpumask *
-mlx5_get_vector_affinity(struct mlx5_core_dev *dev, int vector)
+mlx5_get_vector_affinity_hint(struct mlx5_core_dev *dev, int vector)
 {
-        const struct cpumask *mask;
        struct irq_desc *desc;
        unsigned int irq;
        int eqn;
        int err;
-        err = mlx5_vector2eqn(dev, MLX5_EQ_VEC_COMP_BASE + vector, &eqn, &irq);
+        err = mlx5_vector2eqn(dev, vector, &eqn, &irq);
        if (err)
                return NULL;
        desc = irq_to_desc(irq);
-#ifdef CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK
+        return desc->affinity_hint;
-        mask = irq_data_get_effective_affinity_mask(&desc->irq_data);
-#else
-        mask = desc->irq_common_data.affinity;
-#endif
-        return mask;
 }
 #endif /* MLX5_DRIVER_H */
diff --git a/include/net/tls.h b/include/net/tls.h
index 3da8e13a6d96..b400d0bb7448 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -148,6 +148,7 @@ struct tls_context {
        struct scatterlist *partially_sent_record;
        u16 partially_sent_offset;
        unsigned long flags;
+        bool in_tcp_sendpages;
        u16 pending_open_record_frags;
        int (*push_pending_record)(struct sock *sk, int flags);
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 14750e7c5ee4..027107f4be53 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -476,7 +476,7 @@ static u32 prog_fd_array_sys_lookup_elem(void *ptr)
 }
 /* decrement refcnt of all bpf_progs that are stored in this map */
-void bpf_fd_array_map_clear(struct bpf_map *map)
+static void bpf_fd_array_map_clear(struct bpf_map *map)
 {
        struct bpf_array *array = container_of(map, struct bpf_array, map);
        int i;
@@ -495,6 +495,7 @@ const struct bpf_map_ops prog_array_map_ops = {
        .map_fd_get_ptr = prog_fd_array_get_ptr,
        .map_fd_put_ptr = prog_fd_array_put_ptr,
        .map_fd_sys_lookup_elem = prog_fd_array_sys_lookup_elem,
+        .map_release_uref = bpf_fd_array_map_clear,
 };
 static struct bpf_event_entry *bpf_event_entry_gen(struct file *perf_file,
diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c
index a3b21385e947..098eca568c2b 100644
--- a/kernel/bpf/sockmap.c
+++ b/kernel/bpf/sockmap.c
@@ -43,6 +43,7 @@
 #include <net/tcp.h>
 #include <linux/ptr_ring.h>
 #include <net/inet_common.h>
+#include <linux/sched/signal.h>
 #define SOCK_CREATE_FLAG_MASK \
        (BPF_F_NUMA_NODE | BPF_F_RDONLY | BPF_F_WRONLY)
@@ -325,6 +326,9 @@ retry:
                        if (ret > 0) {
                                if (apply)
                                        apply_bytes -= ret;
+                                sg->offset += ret;
+                                sg->length -= ret;
                                size -= ret;
                                offset += ret;
                                if (uncharge)
@@ -332,8 +336,6 @@ retry:
                                goto retry;
                        }
-                        sg->length = size;
-                        sg->offset = offset;
                        return ret;
                }
@@ -391,7 +393,8 @@ static void return_mem_sg(struct sock *sk, int bytes, struct sk_msg_buff *md)
        } while (i != md->sg_end);
 }
-static void free_bytes_sg(struct sock *sk, int bytes, struct sk_msg_buff *md)
+static void free_bytes_sg(struct sock *sk, int bytes,
+                          struct sk_msg_buff *md, bool charge)
 {
        struct scatterlist *sg = md->sg_data;
        int i = md->sg_start, free;
@@ -401,11 +404,13 @@ static void free_bytes_sg(struct sock *sk, int bytes, struct sk_msg_buff *md)
                if (bytes < free) {
                        sg[i].length -= bytes;
                        sg[i].offset += bytes;
-                        sk_mem_uncharge(sk, bytes);
+                        if (charge)
+                                sk_mem_uncharge(sk, bytes);
                        break;
                }
-                sk_mem_uncharge(sk, sg[i].length);
+                if (charge)
+                        sk_mem_uncharge(sk, sg[i].length);
                put_page(sg_page(&sg[i]));
                bytes -= sg[i].length;
                sg[i].length = 0;
@@ -416,6 +421,7 @@ static void free_bytes_sg(struct sock *sk, int bytes, struct sk_msg_buff *md)
                if (i == MAX_SKB_FRAGS)
                        i = 0;
        }
+        md->sg_start = i;
 }
 static int free_sg(struct sock *sk, int start, struct sk_msg_buff *md)
@@ -523,8 +529,6 @@ static int bpf_tcp_ingress(struct sock *sk, int apply_bytes,
        i = md->sg_start;
        do {
-                r->sg_data[i] = md->sg_data[i];
                size = (apply && apply_bytes < md->sg_data[i].length) ?
                        apply_bytes : md->sg_data[i].length;
@@ -535,6 +539,7 @@ static int bpf_tcp_ingress(struct sock *sk, int apply_bytes,
                }
                sk_mem_charge(sk, size);
+                r->sg_data[i] = md->sg_data[i];
                r->sg_data[i].length = size;
                md->sg_data[i].length -= size;
                md->sg_data[i].offset += size;
@@ -575,10 +580,10 @@ static int bpf_tcp_sendmsg_do_redirect(struct sock *sk, int send,
                                       struct sk_msg_buff *md,
                                       int flags)
 {
+        bool ingress = !!(md->flags & BPF_F_INGRESS);
        struct smap_psock *psock;
        struct scatterlist *sg;
-        int i, err, free = 0;
+        int err = 0;
-        bool ingress = !!(md->flags & BPF_F_INGRESS);
        sg = md->sg_data;
@@ -606,16 +611,8 @@ static int bpf_tcp_sendmsg_do_redirect(struct sock *sk, int send,
 out_rcu:
        rcu_read_unlock();
 out:
-        i = md->sg_start;
+        free_bytes_sg(NULL, send, md, false);
-        while (sg[i].length) {
+        return err;
-                free += sg[i].length;
-                put_page(sg_page(&sg[i]));
-                sg[i].length = 0;
-                i++;
-                if (i == MAX_SKB_FRAGS)
-                        i = 0;
-        }
-        return free;
 }
 static inline void bpf_md_init(struct smap_psock *psock)
@@ -700,19 +697,26 @@ more_data:
                err = bpf_tcp_sendmsg_do_redirect(redir, send, m, flags);
                lock_sock(sk);
+                if (unlikely(err < 0)) {
+                        free_start_sg(sk, m);
+                        psock->sg_size = 0;
+                        if (!cork)
+                                *copied -= send;
+                } else {
+                        psock->sg_size -= send;
+                }
                if (cork) {
                        free_start_sg(sk, m);
+                        psock->sg_size = 0;
                        kfree(m);
                        m = NULL;
+                        err = 0;
                }
-                if (unlikely(err))
-                        *copied -= err;
-                else
-                        psock->sg_size -= send;
                break;
        case __SK_DROP:
        default:
-                free_bytes_sg(sk, send, m);
+                free_bytes_sg(sk, send, m, true);
                apply_bytes_dec(psock, send);
                *copied -= send;
                psock->sg_size -= send;
@@ -732,6 +736,26 @@ out_err:
        return err;
 }
+static int bpf_wait_data(struct sock *sk,
+                         struct smap_psock *psk, int flags,
+                         long timeo, int *err)
+{
+        int rc;
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
+        add_wait_queue(sk_sleep(sk), &wait);
+        sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
+        rc = sk_wait_event(sk, &timeo,
+                           !list_empty(&psk->ingress) ||
+                           !skb_queue_empty(&sk->sk_receive_queue),
+                           &wait);
+        sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
+        remove_wait_queue(sk_sleep(sk), &wait);
+        return rc;
+}
 static int bpf_tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                           int nonblock, int flags, int *addr_len)
 {
@@ -755,6 +779,7 @@ static int bpf_tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
        lock_sock(sk);
+bytes_ready:
        while (copied != len) {
                struct scatterlist *sg;
                struct sk_msg_buff *md;
@@ -809,6 +834,28 @@ static int bpf_tcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                }
        }
+        if (!copied) {
+                long timeo;
+                int data;
+                int err = 0;
+                timeo = sock_rcvtimeo(sk, nonblock);
+                data = bpf_wait_data(sk, psock, flags, timeo, &err);
+                if (data) {
+                        if (!skb_queue_empty(&sk->sk_receive_queue)) {
+                                release_sock(sk);
+                                smap_release_sock(psock, sk);
+                                copied = tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
+                                return copied;
+                        }
+                        goto bytes_ready;
+                }
+                if (err)
+                        copied = err;
+        }
        release_sock(sk);
        smap_release_sock(psock, sk);
        return copied;
@@ -1831,7 +1878,7 @@ static int sock_map_update_elem(struct bpf_map *map,
        return err;
 }
-static void sock_map_release(struct bpf_map *map, struct file *map_file)
+static void sock_map_release(struct bpf_map *map)
 {
        struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
        struct bpf_prog *orig;
@@ -1855,7 +1902,7 @@ const struct bpf_map_ops sock_map_ops = {
        .map_get_next_key = sock_map_get_next_key,
        .map_update_elem = sock_map_update_elem,
        .map_delete_elem = sock_map_delete_elem,
-        .map_release = sock_map_release,
+        .map_release_uref = sock_map_release,
 };
 BPF_CALL_4(bpf_sock_map_update, struct bpf_sock_ops_kern *, bpf_sock,
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 4ca46df19c9a..ebfe9f29dae8 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -257,8 +257,8 @@ static void bpf_map_free_deferred(struct work_struct *work)
 static void bpf_map_put_uref(struct bpf_map *map)
 {
        if (atomic_dec_and_test(&map->usercnt)) {
-                if (map->map_type == BPF_MAP_TYPE_PROG_ARRAY)
+                if (map->ops->map_release_uref)
-                        bpf_fd_array_map_clear(map);
+                        map->ops->map_release_uref(map);
        }
 }
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 82c1a6f430b3..5bb6681fa91e 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -518,8 +518,8 @@ int br_add_if(struct net_bridge *br, struct net_device *dev,
                return -ELOOP;
        }
-        /* Device is already being bridged */
+        /* Device has master upper dev */
-        if (br_port_exists(dev))
+        if (netdev_master_upper_dev_get(dev))
                return -EBUSY;
        /* No bridging devices that dislike that (e.g. wireless) */
diff --git a/net/compat.c b/net/compat.c
index 5ae7437d3853..7242cce5631b 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -377,7 +377,8 @@ static int compat_sock_setsockopt(struct socket *sock, int level, int optname,
            optname == SO_ATTACH_REUSEPORT_CBPF)
                return do_set_attach_filter(sock, level, optname,
                                            optval, optlen);
-        if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
+        if (!COMPAT_USE_64BIT_TIME &&
+            (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO))
                return do_set_sock_timeout(sock, level, optname, optval, optlen);
        return sock_setsockopt(sock, level, optname, optval, optlen);
@@ -448,7 +449,8 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
 static int compat_sock_getsockopt(struct socket *sock, int level, int optname,
                                char __user *optval, int __user *optlen)
 {
-        if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
+        if (!COMPAT_USE_64BIT_TIME &&
+            (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO))
                return do_get_sock_timeout(sock, level, optname, optval, optlen);
        return sock_getsockopt(sock, level, optname, optval, optlen);
 }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 03416e6dd5d7..ba02f0dfe85c 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1032,6 +1032,11 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
                info_size = sizeof(info);
                if (copy_from_user(&info, useraddr, info_size))
                        return -EFAULT;
+                /* Since malicious users may modify the original data,
+                 * we need to check whether FLOW_RSS is still requested.
+                 */
+                if (!(info.flow_type & FLOW_RSS))
+                        return -EINVAL;
        }
        if (info.cmd == ETHTOOL_GRXCLSRLALL) {
diff --git a/net/core/filter.c b/net/core/filter.c
index d31aff93270d..e77c30ca491d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3240,6 +3240,7 @@ BPF_CALL_4(bpf_skb_set_tunnel_key, struct sk_buff *, skb,
        skb_dst_set(skb, (struct dst_entry *) md);
        info = &md->u.tun_info;
+        memset(info, 0, sizeof(*info));
        info->mode = IP_TUNNEL_INFO_TX;
        info->key.tun_flags = TUNNEL_KEY | TUNNEL_CSUM | TUNNEL_NOCACHE;
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 92d016e87816..385f153fe031 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -126,6 +126,16 @@ static void ccid2_change_l_seq_window(struct sock *sk, u64 val)
                                                  DCCPF_SEQ_WMAX));
 }
+static void dccp_tasklet_schedule(struct sock *sk)
+{
+        struct tasklet_struct *t = &dccp_sk(sk)->dccps_xmitlet;
+        if (!test_and_set_bit(TASKLET_STATE_SCHED, &t->state)) {
+                sock_hold(sk);
+                __tasklet_schedule(t);
+        }
+}
 static void ccid2_hc_tx_rto_expire(struct timer_list *t)
 {
        struct ccid2_hc_tx_sock *hc = from_timer(hc, t, tx_rtotimer);
@@ -166,7 +176,7 @@ static void ccid2_hc_tx_rto_expire(struct timer_list *t)
        /* if we were blocked before, we may now send cwnd=1 packet */
        if (sender_was_blocked)
-                tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet);
+                dccp_tasklet_schedule(sk);
        /* restart backed-off timer */
        sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
 out:
@@ -706,7 +716,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 done:
        /* check if incoming Acks allow pending packets to be sent */
        if (sender_was_blocked && !ccid2_cwnd_network_limited(hc))
-                tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet);
+                dccp_tasklet_schedule(sk);
        dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks);
 }
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index b50a8732ff43..1501a20a94ca 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -232,6 +232,7 @@ static void dccp_write_xmitlet(unsigned long data)
        else
                dccp_write_xmit(sk);
        bh_unlock_sock(sk);
+        sock_put(sk);
 }
 static void dccp_write_xmit_timer(struct timer_list *t)
@@ -240,7 +241,6 @@ static void dccp_write_xmit_timer(struct timer_list *t)
        struct sock *sk = &dp->dccps_inet_connection.icsk_inet.sk;
        dccp_write_xmitlet((unsigned long)sk);
-        sock_put(sk);
 }
 void dccp_init_xmit_timers(struct sock *sk)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ccb25d80f679..1412a7baf0b9 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -709,7 +709,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
                fnhe->fnhe_gw = gw;
                fnhe->fnhe_pmtu = pmtu;
                fnhe->fnhe_mtu_locked = lock;
-                fnhe->fnhe_expires = expires;
+                fnhe->fnhe_expires = max(1UL, expires);
                /* Exception created; mark the cached routes for the nexthop
                 * stale, so anyone caching it rechecks if this exception
@@ -1297,6 +1297,36 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
        return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
 }
+static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
+{
+        struct fnhe_hash_bucket *hash;
+        struct fib_nh_exception *fnhe, __rcu **fnhe_p;
+        u32 hval = fnhe_hashfun(daddr);
+        spin_lock_bh(&fnhe_lock);
+        hash = rcu_dereference_protected(nh->nh_exceptions,
+                                         lockdep_is_held(&fnhe_lock));
+        hash += hval;
+        fnhe_p = &hash->chain;
+        fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock));
+        while (fnhe) {
+                if (fnhe->fnhe_daddr == daddr) {
+                        rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
+                                fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
+                        fnhe_flush_routes(fnhe);
+                        kfree_rcu(fnhe, rcu);
+                        break;
+                }
+                fnhe_p = &fnhe->fnhe_next;
+                fnhe = rcu_dereference_protected(fnhe->fnhe_next,
+                                                 lockdep_is_held(&fnhe_lock));
+        }
+        spin_unlock_bh(&fnhe_lock);
+}
 static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
 {
        struct fnhe_hash_bucket *hash = rcu_dereference(nh->nh_exceptions);
@@ -1310,8 +1340,14 @@ static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
        for (fnhe = rcu_dereference(hash[hval].chain); fnhe;
             fnhe = rcu_dereference(fnhe->fnhe_next)) {
-                if (fnhe->fnhe_daddr == daddr)
+                if (fnhe->fnhe_daddr == daddr) {
+                        if (fnhe->fnhe_expires &&
+                            time_after(jiffies, fnhe->fnhe_expires)) {
+                                ip_del_fnhe(nh, daddr);
+                                break;
+                        }
                        return fnhe;
+                }
        }
        return NULL;
 }
@@ -1636,36 +1672,6 @@ static void ip_handle_martian_source(struct net_device *dev,
 #endif
 }
-static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
-{
-        struct fnhe_hash_bucket *hash;
-        struct fib_nh_exception *fnhe, __rcu **fnhe_p;
-        u32 hval = fnhe_hashfun(daddr);
-        spin_lock_bh(&fnhe_lock);
-        hash = rcu_dereference_protected(nh->nh_exceptions,
-                                         lockdep_is_held(&fnhe_lock));
-        hash += hval;
-        fnhe_p = &hash->chain;
-        fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock));
-        while (fnhe) {
-                if (fnhe->fnhe_daddr == daddr) {
-                        rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
-                                fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
-                        fnhe_flush_routes(fnhe);
-                        kfree_rcu(fnhe, rcu);
-                        break;
-                }
-                fnhe_p = &fnhe->fnhe_next;
-                fnhe = rcu_dereference_protected(fnhe->fnhe_next,
-                                                 lockdep_is_held(&fnhe_lock));
-        }
-        spin_unlock_bh(&fnhe_lock);
-}
 /* called in rcu_read_lock() section */
 static int __mkroute_input(struct sk_buff *skb,
                           const struct fib_result *res,
@@ -1719,20 +1725,10 @@ static int __mkroute_input(struct sk_buff *skb,
        fnhe = find_exception(&FIB_RES_NH(*res), daddr);
        if (do_cache) {
-                if (fnhe) {
+                if (fnhe)
                        rth = rcu_dereference(fnhe->fnhe_rth_input);
-                        if (rth && rth->dst.expires &&
+                else
-                            time_after(jiffies, rth->dst.expires)) {
+                        rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
-                                ip_del_fnhe(&FIB_RES_NH(*res), daddr);
-                                fnhe = NULL;
-                        } else {
-                                goto rt_cache;
-                        }
-                }
-                rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
-rt_cache:
                if (rt_cache_valid(rth)) {
                        skb_dst_set_noref(skb, &rth->dst);
                        goto out;
@@ -2216,39 +2212,31 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
                 * the loopback interface and the IP_PKTINFO ipi_ifindex will
                 * be set to the loopback interface as well.
                 */
-                fi = NULL;
+                do_cache = false;
        }
        fnhe = NULL;
        do_cache &= fi != NULL;
-        if (do_cache) {
+        if (fi) {
                struct rtable __rcu **prth;
                struct fib_nh *nh = &FIB_RES_NH(*res);
                fnhe = find_exception(nh, fl4->daddr);
+                if (!do_cache)
+                        goto add;
                if (fnhe) {
                        prth = &fnhe->fnhe_rth_output;
-                        rth = rcu_dereference(*prth);
+                } else {
-                        if (rth && rth->dst.expires &&
+                        if (unlikely(fl4->flowi4_flags &
-                            time_after(jiffies, rth->dst.expires)) {
+                                     FLOWI_FLAG_KNOWN_NH &&
-                                ip_del_fnhe(nh, fl4->daddr);
+                                     !(nh->nh_gw &&
-                                fnhe = NULL;
+                                       nh->nh_scope == RT_SCOPE_LINK))) {
-                        } else {
+                                do_cache = false;
-                                goto rt_cache;
+                                goto add;
                        }
+                        prth = raw_cpu_ptr(nh->nh_pcpu_rth_output);
                }
-                if (unlikely(fl4->flowi4_flags &
-                             FLOWI_FLAG_KNOWN_NH &&
-                             !(nh->nh_gw &&
-                               nh->nh_scope == RT_SCOPE_LINK))) {
-                        do_cache = false;
-                        goto add;
-                }
-                prth = raw_cpu_ptr(nh->nh_pcpu_rth_output);
                rth = rcu_dereference(*prth);
-rt_cache:
                if (rt_cache_valid(rth) && dst_hold_safe(&rth->dst))
                        return rth;
        }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9ce1c726185e..c9d00ef54dec 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -697,7 +697,7 @@ static bool tcp_should_autocork(struct sock *sk, struct sk_buff *skb,
 {
        return skb->len < size_goal &&
               sock_net(sk)->ipv4.sysctl_tcp_autocorking &&
-               skb != tcp_write_queue_head(sk) &&
+               !tcp_rtx_queue_empty(sk) &&
               refcount_read(&sk->sk_wmem_alloc) > skb->truesize;
 }
@@ -1204,7 +1204,8 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
                        uarg->zerocopy = 0;
        }
-        if (unlikely(flags & MSG_FASTOPEN || inet_sk(sk)->defer_connect)) {
+        if (unlikely(flags & MSG_FASTOPEN || inet_sk(sk)->defer_connect) &&
+            !tp->repair) {
                err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size);
                if (err == -EINPROGRESS && copied_syn > 0)
                        goto out;
@@ -2673,7 +2674,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
        case TCP_REPAIR_QUEUE:
                if (!tp->repair)
                        err = -EPERM;
-                else if (val < TCP_QUEUES_NR)
+                else if ((unsigned int)val < TCP_QUEUES_NR)
                        tp->repair_queue = val;
                else
                        err = -EINVAL;
diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
index 158d105e76da..58e2f479ffb4 100644
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -806,7 +806,9 @@ static void bbr_update_min_rtt(struct sock *sk, const struct rate_sample *rs)
                        }
                }
        }
-        bbr->idle_restart = 0;
+        /* Restart after idle ends only once we process a new S/ACK for data */
+        if (rs->delivered > 0)
+                bbr->idle_restart = 0;
 }
 static void bbr_update_model(struct sock *sk, const struct rate_sample *rs)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index cde7d8251377..f4d61736c41a 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1835,11 +1835,16 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb,
        const struct ipv6hdr *inner_iph;
        const struct icmp6hdr *icmph;
        struct ipv6hdr _inner_iph;
+        struct icmp6hdr _icmph;
        if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6))
                goto out;
-        icmph = icmp6_hdr(skb);
+        icmph = skb_header_pointer(skb, skb_transport_offset(skb),
+                                   sizeof(_icmph), &_icmph);
+        if (!icmph)
+                goto out;
        if (icmph->icmp6_type != ICMPV6_DEST_UNREACH &&
            icmph->icmp6_type != ICMPV6_PKT_TOOBIG &&
            icmph->icmp6_type != ICMPV6_TIME_EXCEED &&
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index eea1d8611b20..13b38ad0fa4a 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -547,7 +547,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
        rdsdebug("conn %p pd %p cq %p %p\n", conn, ic->i_pd,
                 ic->i_send_cq, ic->i_recv_cq);
-        return ret;
+        goto out;
 sends_out:
        vfree(ic->i_sends);
@@ -572,6 +572,7 @@ send_cq_out:
                ic->i_send_cq = NULL;
 rds_ibdev_out:
        rds_ib_remove_conn(rds_ibdev, conn);
+out:
        rds_ib_dev_put(rds_ibdev);
        return ret;
diff --git a/net/rds/recv.c b/net/rds/recv.c
index de50e2126e40..dc67458b52f0 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -558,6 +558,7 @@ static int rds_cmsg_recv(struct rds_incoming *inc, struct msghdr *msg,
                struct rds_cmsg_rx_trace t;
                int i, j;
+                memset(&t, 0, sizeof(t));
                inc->i_rx_lat_trace[RDS_MSG_RX_CMSG] = local_clock();
                t.rx_traces =  rs->rs_rx_traces;
                for (i = 0; i < rs->rs_rx_traces; i++) {
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index a366e4c9413a..4808713c73b9 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -128,6 +128,28 @@ static bool fq_flow_is_detached(const struct fq_flow *f)
        return f->next == &detached;
 }
+static bool fq_flow_is_throttled(const struct fq_flow *f)
+{
+        return f->next == &throttled;
+}
+static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow)
+{
+        if (head->first)
+                head->last->next = flow;
+        else
+                head->first = flow;
+        head->last = flow;
+        flow->next = NULL;
+}
+static void fq_flow_unset_throttled(struct fq_sched_data *q, struct fq_flow *f)
+{
+        rb_erase(&f->rate_node, &q->delayed);
+        q->throttled_flows--;
+        fq_flow_add_tail(&q->old_flows, f);
+}
 static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f)
 {
        struct rb_node **p = &q->delayed.rb_node, *parent = NULL;
@@ -155,15 +177,6 @@ static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f)
 static struct kmem_cache *fq_flow_cachep __read_mostly;
-static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow)
-{
-        if (head->first)
-                head->last->next = flow;
-        else
-                head->first = flow;
-        head->last = flow;
-        flow->next = NULL;
-}
 /* limit number of collected flows per round */
 #define FQ_GC_MAX 8
@@ -267,6 +280,8 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q)
                                     f->socket_hash != sk->sk_hash)) {
                                f->credit = q->initial_quantum;
                                f->socket_hash = sk->sk_hash;
+                                if (fq_flow_is_throttled(f))
+                                        fq_flow_unset_throttled(q, f);
                                f->time_next_packet = 0ULL;
                        }
                        return f;
@@ -438,9 +453,7 @@ static void fq_check_throttled(struct fq_sched_data *q, u64 now)
                        q->time_next_delayed_flow = f->time_next_packet;
                        break;
                }
-                rb_erase(p, &q->delayed);
+                fq_flow_unset_throttled(q, f);
-                q->throttled_flows--;
-                fq_flow_add_tail(&q->old_flows, f);
        }
 }
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 23ebc5318edc..eb93ffe2408b 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -217,7 +217,7 @@ new_skb:
        skb_pull(chunk->skb, sizeof(*ch));
        chunk->subh.v = NULL; /* Subheader is no longer valid.  */
-        if (chunk->chunk_end + sizeof(*ch) < skb_tail_pointer(chunk->skb)) {
+        if (chunk->chunk_end + sizeof(*ch) <= skb_tail_pointer(chunk->skb)) {
                /* This is not a singleton */
                chunk->singleton = 0;
        } else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) {
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 2e3f7b75a8ec..42247110d842 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -895,6 +895,9 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1,
        if (sctp_is_any(sk, addr1) || sctp_is_any(sk, addr2))
                return 1;
+        if (addr1->sa.sa_family == AF_INET && addr2->sa.sa_family == AF_INET)
+                return addr1->v4.sin_addr.s_addr == addr2->v4.sin_addr.s_addr;
        return __sctp_v6_cmp_addr(addr1, addr2);
 }
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index dd0594a10961..28c070e187c2 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1794,6 +1794,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_a(
                               GFP_ATOMIC))
                goto nomem;
+        if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
+                goto nomem;
        /* Make sure no new addresses are being added during the
         * restart.  Though this is a pretty complicated attack
         * since you'd have to get inside the cookie.
@@ -1906,6 +1909,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_b(
                               GFP_ATOMIC))
                goto nomem;
+        if (sctp_auth_asoc_init_active_key(new_asoc, GFP_ATOMIC))
+                goto nomem;
        /* Update the content of current association.  */
        sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
        sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
@@ -2050,7 +2056,7 @@ static enum sctp_disposition sctp_sf_do_dupcook_d(
                }
        }
-        repl = sctp_make_cookie_ack(new_asoc, chunk);
+        repl = sctp_make_cookie_ack(asoc, chunk);
        if (!repl)
                goto nomem;
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index f799043abec9..f1f1d1b232ba 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -240,6 +240,8 @@ void sctp_stream_update(struct sctp_stream *stream, struct sctp_stream *new)
        new->out = NULL;
        new->in  = NULL;
+        new->outcnt = 0;
+        new->incnt  = 0;
 }
 static int sctp_send_reconf(struct sctp_association *asoc,
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index f5d4b69dbabc..544bab42f925 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -292,6 +292,17 @@ static void smc_copy_sock_settings_to_smc(struct smc_sock *smc)
        smc_copy_sock_settings(&smc->sk, smc->clcsock->sk, SK_FLAGS_CLC_TO_SMC);
 }
+/* register a new rmb */
+static int smc_reg_rmb(struct smc_link *link, struct smc_buf_desc *rmb_desc)
+{
+        /* register memory region for new rmb */
+        if (smc_wr_reg_send(link, rmb_desc->mr_rx[SMC_SINGLE_LINK])) {
+                rmb_desc->regerr = 1;
+                return -EFAULT;
+        }
+        return 0;
+}
 static int smc_clnt_conf_first_link(struct smc_sock *smc)
 {
        struct smc_link_group *lgr = smc->conn.lgr;
@@ -321,9 +332,7 @@ static int smc_clnt_conf_first_link(struct smc_sock *smc)
        smc_wr_remember_qp_attr(link);
-        rc = smc_wr_reg_send(link,
+        if (smc_reg_rmb(link, smc->conn.rmb_desc))
-                             smc->conn.rmb_desc->mr_rx[SMC_SINGLE_LINK]);
-        if (rc)
                return SMC_CLC_DECL_INTERR;
        /* send CONFIRM LINK response over RoCE fabric */
@@ -473,13 +482,8 @@ static int smc_connect_rdma(struct smc_sock *smc)
                        goto decline_rdma_unlock;
                }
        } else {
-                struct smc_buf_desc *buf_desc = smc->conn.rmb_desc;
+                if (!smc->conn.rmb_desc->reused) {
+                        if (smc_reg_rmb(link, smc->conn.rmb_desc)) {
-                if (!buf_desc->reused) {
-                        /* register memory region for new rmb */
-                        rc = smc_wr_reg_send(link,
-                                             buf_desc->mr_rx[SMC_SINGLE_LINK]);
-                        if (rc) {
                                reason_code = SMC_CLC_DECL_INTERR;
                                goto decline_rdma_unlock;
                        }
@@ -719,9 +723,7 @@ static int smc_serv_conf_first_link(struct smc_sock *smc)
        link = &lgr->lnk[SMC_SINGLE_LINK];
-        rc = smc_wr_reg_send(link,
+        if (smc_reg_rmb(link, smc->conn.rmb_desc))
-                             smc->conn.rmb_desc->mr_rx[SMC_SINGLE_LINK]);
-        if (rc)
                return SMC_CLC_DECL_INTERR;
        /* send CONFIRM LINK request to client over the RoCE fabric */
@@ -854,13 +856,8 @@ static void smc_listen_work(struct work_struct *work)
        smc_rx_init(new_smc);
        if (local_contact != SMC_FIRST_CONTACT) {
-                struct smc_buf_desc *buf_desc = new_smc->conn.rmb_desc;
+                if (!new_smc->conn.rmb_desc->reused) {
+                        if (smc_reg_rmb(link, new_smc->conn.rmb_desc)) {
-                if (!buf_desc->reused) {
-                        /* register memory region for new rmb */
-                        rc = smc_wr_reg_send(link,
-                                             buf_desc->mr_rx[SMC_SINGLE_LINK]);
-                        if (rc) {
                                reason_code = SMC_CLC_DECL_INTERR;
                                goto decline_rdma_unlock;
                        }
@@ -978,10 +975,6 @@ static void smc_tcp_listen_work(struct work_struct *work)
        }
 out:
-        if (lsmc->clcsock) {
-                sock_release(lsmc->clcsock);
-                lsmc->clcsock = NULL;
-        }
        release_sock(lsk);
        sock_put(&lsmc->sk); /* sock_hold in smc_listen */
 }
@@ -1170,13 +1163,15 @@ static __poll_t smc_poll(struct file *file, struct socket *sock,
                /* delegate to CLC child sock */
                release_sock(sk);
                mask = smc->clcsock->ops->poll(file, smc->clcsock, wait);
-                /* if non-blocking connect finished ... */
                lock_sock(sk);
-                if ((sk->sk_state == SMC_INIT) && (mask & EPOLLOUT)) {
+                sk->sk_err = smc->clcsock->sk->sk_err;
-                        sk->sk_err = smc->clcsock->sk->sk_err;
+                if (sk->sk_err) {
-                        if (sk->sk_err) {
+                        mask |= EPOLLERR;
-                                mask |= EPOLLERR;
+                } else {
-                        } else {
+                        /* if non-blocking connect finished ... */
+                        if (sk->sk_state == SMC_INIT &&
+                            mask & EPOLLOUT &&
+                            smc->clcsock->sk->sk_state != TCP_CLOSE) {
                                rc = smc_connect_rdma(smc);
                                if (rc < 0)
                                        mask |= EPOLLERR;
@@ -1320,8 +1315,11 @@ static ssize_t smc_sendpage(struct socket *sock, struct page *page,
        smc = smc_sk(sk);
        lock_sock(sk);
-        if (sk->sk_state != SMC_ACTIVE)
+        if (sk->sk_state != SMC_ACTIVE) {
+                release_sock(sk);
                goto out;
+        }
+        release_sock(sk);
        if (smc->use_fallback)
                rc = kernel_sendpage(smc->clcsock, page, offset,
                                     size, flags);
@@ -1329,7 +1327,6 @@ static ssize_t smc_sendpage(struct socket *sock, struct page *page,
                rc = sock_no_sendpage(sock, page, offset, size, flags);
 out:
-        release_sock(sk);
        return rc;
 }
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index f44f6803f7ff..d4bd01bb44e1 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -32,6 +32,9 @@
 static u32 smc_lgr_num;                 /* unique link group number */
+static void smc_buf_free(struct smc_buf_desc *buf_desc, struct smc_link *lnk,
+                         bool is_rmb);
 static void smc_lgr_schedule_free_work(struct smc_link_group *lgr)
 {
        /* client link group creation always follows the server link group
@@ -234,9 +237,22 @@ static void smc_buf_unuse(struct smc_connection *conn)
                conn->sndbuf_size = 0;
        }
        if (conn->rmb_desc) {
-                conn->rmb_desc->reused = true;
+                if (!conn->rmb_desc->regerr) {
-                conn->rmb_desc->used = 0;
+                        conn->rmb_desc->reused = 1;
-                conn->rmbe_size = 0;
+                        conn->rmb_desc->used = 0;
+                        conn->rmbe_size = 0;
+                } else {
+                        /* buf registration failed, reuse not possible */
+                        struct smc_link_group *lgr = conn->lgr;
+                        struct smc_link *lnk;
+                        write_lock_bh(&lgr->rmbs_lock);
+                        list_del(&conn->rmb_desc->list);
+                        write_unlock_bh(&lgr->rmbs_lock);
+                        lnk = &lgr->lnk[SMC_SINGLE_LINK];
+                        smc_buf_free(conn->rmb_desc, lnk, true);
+                }
        }
 }
diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h
index 07e2a393e6d9..5dfcb15d529f 100644
--- a/net/smc/smc_core.h
+++ b/net/smc/smc_core.h
@@ -123,7 +123,8 @@ struct smc_buf_desc {
                                                 */
        u32                     order;          /* allocation order */
        u32                     used;           /* currently used / unused */
-        bool                    reused;         /* new created / reused */
+        u8                      reused  : 1;    /* new created / reused */
+        u8                      regerr  : 1;    /* err during registration */
 };
 struct smc_rtoken {                             /* address/key of remote RMB */
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 6f98b56dd48e..baaf93f12cbd 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -2244,7 +2244,7 @@ int tipc_nl_node_dump_monitor(struct sk_buff *skb, struct netlink_callback *cb)
        rtnl_lock();
        for (bearer_id = prev_bearer; bearer_id < MAX_BEARERS; bearer_id++) {
-                err = __tipc_nl_add_monitor(net, &msg, prev_bearer);
+                err = __tipc_nl_add_monitor(net, &msg, bearer_id);
                if (err)
                        break;
        }
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 0d379970960e..cc03e00785c7 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -114,6 +114,7 @@ int tls_push_sg(struct sock *sk,
        size = sg->length - offset;
        offset += sg->offset;
+        ctx->in_tcp_sendpages = true;
        while (1) {
                if (sg_is_last(sg))
                        sendpage_flags = flags;
@@ -148,6 +149,8 @@ retry:
        }
        clear_bit(TLS_PENDING_CLOSED_RECORD, &ctx->flags);
+        ctx->in_tcp_sendpages = false;
+        ctx->sk_write_space(sk);
        return 0;
 }
@@ -217,6 +220,10 @@ static void tls_write_space(struct sock *sk)
 {
        struct tls_context *ctx = tls_get_ctx(sk);
+        /* We are already sending pages, ignore notification */
+        if (ctx->in_tcp_sendpages)
+                return;
        if (!sk->sk_write_pending && tls_is_pending_closed_record(ctx)) {
                gfp_t sk_allocation = sk->sk_allocation;
                int rc;
diff --git a/samples/sockmap/Makefile b/samples/sockmap/Makefile
index 9bf2881bd11b..fa53f4d77834 100644
--- a/samples/sockmap/Makefile
+++ b/samples/sockmap/Makefile
@@ -65,11 +65,14 @@ $(src)/*.c: verify_target_bpf
 # asm/sysreg.h - inline assembly used by it is incompatible with llvm.
 # But, there is no easy way to fix it, so just exclude it since it is
 # useless for BPF samples.
+#
+# -target bpf option required with SK_MSG programs, this is to ensure
+#  reading 'void *' data types for data and data_end are __u64 reads.
 $(obj)/%.o: $(src)/%.c
        $(CLANG) $(NOSTDINC_FLAGS) $(LINUXINCLUDE) $(EXTRA_CFLAGS) -I$(obj) \
                -D__KERNEL__ -D__ASM_SYSREG_H -Wno-unused-value -Wno-pointer-sign \
                -Wno-compare-distinct-pointer-types \
                -Wno-gnu-variable-sized-type-not-at-end \
                -Wno-address-of-packed-member -Wno-tautological-compare \
-                -Wno-unknown-warning-option \
+                -Wno-unknown-warning-option -O2 -target bpf \
-                -O2 -emit-llvm -c $< -o -| $(LLC) -march=bpf -filetype=obj -o $@
+                -emit-llvm -c $< -o -| $(LLC) -march=bpf -filetype=obj -o $@
diff --git a/tools/bpf/Makefile b/tools/bpf/Makefile
index 1ea545965ee3..53b60ad452f5 100644
--- a/tools/bpf/Makefile
+++ b/tools/bpf/Makefile
@@ -76,6 +76,8 @@ $(OUTPUT)bpf_asm: $(OUTPUT)bpf_asm.o $(OUTPUT)bpf_exp.yacc.o $(OUTPUT)bpf_exp.le
        $(QUIET_LINK)$(CC) $(CFLAGS) -o $@ $^
 $(OUTPUT)bpf_exp.lex.c: $(OUTPUT)bpf_exp.yacc.c
+$(OUTPUT)bpf_exp.yacc.o: $(OUTPUT)bpf_exp.yacc.c
+$(OUTPUT)bpf_exp.lex.o: $(OUTPUT)bpf_exp.lex.c
 clean: bpftool_clean
        $(call QUIET_CLEAN, bpf-progs)
diff --git a/tools/bpf/bpf_dbg.c b/tools/bpf/bpf_dbg.c
index 4f254bcc4423..61b9aa5d6415 100644
--- a/tools/bpf/bpf_dbg.c
+++ b/tools/bpf/bpf_dbg.c
@@ -1063,7 +1063,7 @@ static int cmd_load_pcap(char *file)
 static int cmd_load(char *arg)
 {
-        char *subcmd, *cont, *tmp = strdup(arg);
+        char *subcmd, *cont = NULL, *tmp = strdup(arg);
        int ret = CMD_OK;
        subcmd = strtok_r(tmp, " ", &cont);
@@ -1073,7 +1073,10 @@ static int cmd_load(char *arg)
                bpf_reset();
                bpf_reset_breakpoints();
-                ret = cmd_load_bpf(cont);
+                if (!cont)
+                        ret = CMD_ERR;
+                else
+                        ret = cmd_load_bpf(cont);
        } else if (matches(subcmd, "pcap") == 0) {
                ret = cmd_load_pcap(cont);
        } else {
diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index faadbe233966..4123d0ab90ba 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1108,7 +1108,7 @@ static void test_stacktrace_build_id(void)
        assert(system("dd if=/dev/urandom of=/dev/zero count=4 2> /dev/null")
               == 0);
-        assert(system("./urandom_read if=/dev/urandom of=/dev/zero count=4 2> /dev/null") == 0);
+        assert(system("./urandom_read") == 0);
        /* disable stack trace collection */
        key = 0;
        val = 1;
@@ -1158,7 +1158,7 @@ static void test_stacktrace_build_id(void)
        } while (bpf_map_get_next_key(stackmap_fd, &previous_key, &key) == 0);
        CHECK(build_id_matches < 1, "build id match",
-              "Didn't find expected build ID from the map");
+              "Didn't find expected build ID from the map\n");
 disable_pmu:
        ioctl(pmu_fd, PERF_EVENT_IOC_DISABLE);
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 8f1e13d2e547..daf5effec3f0 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -5,7 +5,8 @@ CFLAGS =  -Wall -Wl,--no-as-needed -O2 -g
 CFLAGS += -I../../../../usr/include/
 TEST_PROGS := run_netsocktests run_afpackettests test_bpf.sh netdevice.sh rtnetlink.sh
-TEST_PROGS += fib_tests.sh fib-onlink-tests.sh in_netns.sh pmtu.sh
+TEST_PROGS += fib_tests.sh fib-onlink-tests.sh pmtu.sh
+TEST_GEN_PROGS_EXTENDED := in_netns.sh
 TEST_GEN_FILES =  socket
 TEST_GEN_FILES += psock_fanout psock_tpacket msg_zerocopy
 TEST_GEN_PROGS = reuseport_bpf reuseport_bpf_cpu reuseport_bpf_numa