22 files changed, 263 insertions, 100 deletions

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 421a80b09b62..30b544f025ac 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -256,7 +256,8 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         aead_givcrypt_set_crypt(req, sg, sg, clen, iv);
         aead_givcrypt_set_assoc(req, asg, assoclen);
         aead_givcrypt_set_giv(req, esph->enc_data,
-                              XFRM_SKB_CB(skb)->seq.output.low);
+                              XFRM_SKB_CB(skb)->seq.output.low +
+                              ((u64)XFRM_SKB_CB(skb)->seq.output.hi << 32));
 
         ESP_SKB_CB(skb)->tmp = tmp;
         err = crypto_aead_givencrypt(req);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index e13fcc602da2..09b62e17dd8c 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1164,6 +1164,7 @@ int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
                         state = fa->fa_state;
                         new_fa->fa_state = state & ~FA_S_ACCESSED;
                         new_fa->fa_slen = fa->fa_slen;
+                        new_fa->tb_id = tb->tb_id;
 
                         err = netdev_switch_fib_ipv4_add(key, plen, fi,
                                                          new_fa->fa_tos,
@@ -1764,7 +1765,7 @@ void fib_table_flush_external(struct fib_table *tb)
                         /* record local slen */
                         slen = fa->fa_slen;
 
-                        if (!fi || !(fi->fib_flags & RTNH_F_EXTERNAL))
+                        if (!fi || !(fi->fib_flags & RTNH_F_OFFLOAD))
                                 continue;
 
                         netdev_switch_fib_ipv4_del(n->key,
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 5c3dd6267ed3..8976ca423a07 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -564,6 +564,40 @@ int inet_rtx_syn_ack(struct sock *parent, struct request_sock *req)
 }
 EXPORT_SYMBOL(inet_rtx_syn_ack);
 
+/* return true if req was found in the syn_table[] */
+static bool reqsk_queue_unlink(struct request_sock_queue *queue,
+                               struct request_sock *req)
+{
+        struct listen_sock *lopt = queue->listen_opt;
+        struct request_sock **prev;
+        bool found = false;
+
+        spin_lock(&queue->syn_wait_lock);
+
+        for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL;
+             prev = &(*prev)->dl_next) {
+                if (*prev == req) {
+                        *prev = req->dl_next;
+                        found = true;
+                        break;
+                }
+        }
+
+        spin_unlock(&queue->syn_wait_lock);
+        if (del_timer(&req->rsk_timer))
+                reqsk_put(req);
+        return found;
+}
+
+void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req)
+{
+        if (reqsk_queue_unlink(&inet_csk(sk)->icsk_accept_queue, req)) {
+                reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req);
+                reqsk_put(req);
+        }
+}
+EXPORT_SYMBOL(inet_csk_reqsk_queue_drop);
+
 static void reqsk_timer_handler(unsigned long data)
 {
         struct request_sock *req = (struct request_sock *)data;
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index bb77ebdae3b3..4d32262c7502 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -224,14 +224,16 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
         handler->idiag_get_info(sk, r, info);
 
         if (sk->sk_state < TCP_TIME_WAIT) {
-                int err = 0;
+                union tcp_cc_info info;
+                size_t sz = 0;
+                int attr;
 
                 rcu_read_lock();
                 ca_ops = READ_ONCE(icsk->icsk_ca_ops);
                 if (ca_ops && ca_ops->get_info)
-                        err = ca_ops->get_info(sk, ext, skb);
+                        sz = ca_ops->get_info(sk, ext, &attr, &info);
                 rcu_read_unlock();
-                if (err < 0)
+                if (sz && nla_put(skb, attr, sz, &info) < 0)
                         goto errout;
         }
 
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 9f7269f3c54a..0c152087ca15 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -65,7 +65,6 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
                         goto drop;
 
                 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
-                skb->mark = be32_to_cpu(tunnel->parms.i_key);
 
                 return xfrm_input(skb, nexthdr, spi, encap_type);
         }
@@ -91,6 +90,8 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
         struct pcpu_sw_netstats *tstats;
         struct xfrm_state *x;
         struct ip_tunnel *tunnel = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4;
+        u32 orig_mark = skb->mark;
+        int ret;
 
         if (!tunnel)
                 return 1;
@@ -107,7 +108,11 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
         x = xfrm_input_state(skb);
         family = x->inner_mode->afinfo->family;
 
-        if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
+        skb->mark = be32_to_cpu(tunnel->parms.i_key);
+        ret = xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family);
+        skb->mark = orig_mark;
+
+        if (!ret)
                 return -EPERM;
 
         skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(skb->dev)));
@@ -216,8 +221,6 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 
         memset(&fl, 0, sizeof(fl));
 
-        skb->mark = be32_to_cpu(tunnel->parms.o_key);
-
         switch (skb->protocol) {
         case htons(ETH_P_IP):
                 xfrm_decode_session(skb, &fl, AF_INET);
@@ -233,6 +236,9 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_OK;
         }
 
+        /* override mark with tunnel output key */
+        fl.flowi_mark = be32_to_cpu(tunnel->parms.o_key);
+
         return vti_xmit(skb, dev, &fl);
 }
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 13bfe84bf3ca..a61200754f4b 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1075,6 +1075,9 @@ static int do_replace(struct net *net, const void __user *user,
         /* overflow check */
         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
                 return -ENOMEM;
+        if (tmp.num_counters == 0)
+                return -EINVAL;
+
         tmp.name[sizeof(tmp.name)-1] = 0;
 
         newinfo = xt_alloc_table_info(tmp.size);
@@ -1499,6 +1502,9 @@ static int compat_do_replace(struct net *net, void __user *user,
                 return -ENOMEM;
         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
                 return -ENOMEM;
+        if (tmp.num_counters == 0)
+                return -EINVAL;
+
         tmp.name[sizeof(tmp.name)-1] = 0;
 
         newinfo = xt_alloc_table_info(tmp.size);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index c69db7fa25ee..2d0e265fef6e 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1262,6 +1262,9 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
         /* overflow check */
         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
                 return -ENOMEM;
+        if (tmp.num_counters == 0)
+                return -EINVAL;
+
         tmp.name[sizeof(tmp.name)-1] = 0;
 
         newinfo = xt_alloc_table_info(tmp.size);
@@ -1809,6 +1812,9 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
                 return -ENOMEM;
         if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
                 return -ENOMEM;
+        if (tmp.num_counters == 0)
+                return -EINVAL;
+
         tmp.name[sizeof(tmp.name)-1] = 0;
 
         newinfo = xt_alloc_table_info(tmp.size);
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index a93f260cf24c..05ff44b758df 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -158,6 +158,7 @@ void ping_unhash(struct sock *sk)
         if (sk_hashed(sk)) {
                 write_lock_bh(&ping_table.lock);
                 hlist_nulls_del(&sk->sk_nulls_node);
+                sk_nulls_node_init(&sk->sk_nulls_node);
                 sock_put(sk);
                 isk->inet_num = 0;
                 isk->inet_sport = 0;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a78540f28276..f45f2a12f37b 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -902,6 +902,10 @@ static int ip_error(struct sk_buff *skb)
         bool send;
         int code;
 
+        /* IP on this device is disabled. */
+        if (!in_dev)
+                goto out;
+
         net = dev_net(rt->dst.dev);
         if (!IN_DEV_FORWARD(in_dev)) {
                 switch (rt->dst.error) {
@@ -962,10 +966,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
         if (dst_metric_locked(dst, RTAX_MTU))
                 return;
 
-        if (dst->dev->mtu < mtu)
-                return;
-
-        if (rt->rt_pmtu && rt->rt_pmtu < mtu)
+        if (ipv4_mtu(dst) < mtu)
                 return;
 
         if (mtu < ip_rt_min_pmtu)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 8c5cd9efebbc..f1377f2a0472 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -252,6 +252,7 @@
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/poll.h>
+#include <linux/inet_diag.h>
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/skbuff.h>
@@ -401,6 +402,7 @@ void tcp_init_sock(struct sock *sk)
         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
         tp->snd_cwnd_clamp = ~0;
         tp->mss_cache = TCP_MSS_DEFAULT;
+        u64_stats_init(&tp->syncp);
 
         tp->reordering = sysctl_tcp_reordering;
         tcp_enable_early_retrans(tp);
@@ -2592,11 +2594,12 @@ EXPORT_SYMBOL(compat_tcp_setsockopt);
 #endif
 
 /* Return information about state of tcp endpoint in API format. */
-void tcp_get_info(const struct sock *sk, struct tcp_info *info)
+void tcp_get_info(struct sock *sk, struct tcp_info *info)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         u32 now = tcp_time_stamp;
+        unsigned int start;
         u32 rate;
 
         memset(info, 0, sizeof(*info));
@@ -2663,6 +2666,12 @@ void tcp_get_info(const struct sock *sk, struct tcp_info *info)
 
         rate = READ_ONCE(sk->sk_max_pacing_rate);
         info->tcpi_max_pacing_rate = rate != ~0U ? rate : ~0ULL;
+
+        do {
+                start = u64_stats_fetch_begin_irq(&tp->syncp);
+                info->tcpi_bytes_acked = tp->bytes_acked;
+                info->tcpi_bytes_received = tp->bytes_received;
+        } while (u64_stats_fetch_retry_irq(&tp->syncp, start));
 }
 EXPORT_SYMBOL_GPL(tcp_get_info);
 
@@ -2734,6 +2743,26 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                         return -EFAULT;
                 return 0;
         }
+        case TCP_CC_INFO: {
+                const struct tcp_congestion_ops *ca_ops;
+                union tcp_cc_info info;
+                size_t sz = 0;
+                int attr;
+
+                if (get_user(len, optlen))
+                        return -EFAULT;
+
+                ca_ops = icsk->icsk_ca_ops;
+                if (ca_ops && ca_ops->get_info)
+                        sz = ca_ops->get_info(sk, ~0U, &attr, &info);
+
+                len = min_t(unsigned int, len, sz);
+                if (put_user(len, optlen))
+                        return -EFAULT;
+                if (copy_to_user(optval, &info, len))
+                        return -EFAULT;
+                return 0;
+        }
         case TCP_QUICKACK:
                 val = !icsk->icsk_ack.pingpong;
                 break;
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 7a5ae50c80c8..84be008c945c 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -187,6 +187,7 @@ static void tcp_reinit_congestion_control(struct sock *sk,
 
         tcp_cleanup_congestion_control(sk);
         icsk->icsk_ca_ops = ca;
+        icsk->icsk_ca_setsockopt = 1;
 
         if (sk->sk_state != TCP_CLOSE && icsk->icsk_ca_ops->init)
                 icsk->icsk_ca_ops->init(sk);
@@ -335,8 +336,10 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
         rcu_read_lock();
         ca = __tcp_ca_find_autoload(name);
         /* No change asking for existing value */
-        if (ca == icsk->icsk_ca_ops)
+        if (ca == icsk->icsk_ca_ops) {
+                icsk->icsk_ca_setsockopt = 1;
                 goto out;
+        }
         if (!ca)
                 err = -ENOENT;
         else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) ||
diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
index 4376016f7fa5..4c41c1287197 100644
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -277,7 +277,8 @@ static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
         }
 }
 
-static int dctcp_get_info(struct sock *sk, u32 ext, struct sk_buff *skb)
+static size_t dctcp_get_info(struct sock *sk, u32 ext, int *attr,
+                             union tcp_cc_info *info)
 {
         const struct dctcp *ca = inet_csk_ca(sk);
 
@@ -286,18 +287,17 @@ static int dctcp_get_info(struct sock *sk, u32 ext, struct sk_buff *skb)
          */
         if (ext & (1 << (INET_DIAG_DCTCPINFO - 1)) ||
             ext & (1 << (INET_DIAG_VEGASINFO - 1))) {
-                struct tcp_dctcp_info info;
-
-                memset(&info, 0, sizeof(info));
+                memset(info, 0, sizeof(struct tcp_dctcp_info));
                 if (inet_csk(sk)->icsk_ca_ops != &dctcp_reno) {
-                        info.dctcp_enabled = 1;
-                        info.dctcp_ce_state = (u16) ca->ce_state;
-                        info.dctcp_alpha = ca->dctcp_alpha;
-                        info.dctcp_ab_ecn = ca->acked_bytes_ecn;
-                        info.dctcp_ab_tot = ca->acked_bytes_total;
+                        info->dctcp.dctcp_enabled = 1;
+                        info->dctcp.dctcp_ce_state = (u16) ca->ce_state;
+                        info->dctcp.dctcp_alpha = ca->dctcp_alpha;
+                        info->dctcp.dctcp_ab_ecn = ca->acked_bytes_ecn;
+                        info->dctcp.dctcp_ab_tot = ca->acked_bytes_total;
                 }
 
-                return nla_put(skb, INET_DIAG_DCTCPINFO, sizeof(info), &info);
+                *attr = INET_DIAG_DCTCPINFO;
+                return sizeof(*info);
         }
         return 0;
 }
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index e3d87aca6be8..46b087a27503 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -206,6 +206,11 @@ static bool tcp_fastopen_create_child(struct sock *sk,
                         skb_set_owner_r(skb2, child);
                         __skb_queue_tail(&child->sk_receive_queue, skb2);
                         tp->syn_data_acked = 1;
+
+                        /* u64_stats_update_begin(&tp->syncp) not needed here,
+                         * as we certainly are not changing upper 32bit value (0)
+                         */
+                        tp->bytes_received = end_seq - TCP_SKB_CB(skb)->seq - 1;
                 } else {
                         end_seq = TCP_SKB_CB(skb)->seq + 1;
                 }
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
index 67476f085e48..f71002e4db0b 100644
--- a/net/ipv4/tcp_illinois.c
+++ b/net/ipv4/tcp_illinois.c
@@ -300,24 +300,25 @@ static u32 tcp_illinois_ssthresh(struct sock *sk)
 }
 
 /* Extract info for Tcp socket info provided via netlink. */
-static int tcp_illinois_info(struct sock *sk, u32 ext, struct sk_buff *skb)
+static size_t tcp_illinois_info(struct sock *sk, u32 ext, int *attr,
+                                union tcp_cc_info *info)
 {
         const struct illinois *ca = inet_csk_ca(sk);
 
         if (ext & (1 << (INET_DIAG_VEGASINFO - 1))) {
-                struct tcpvegas_info info = {
-                        .tcpv_enabled = 1,
-                        .tcpv_rttcnt = ca->cnt_rtt,
-                        .tcpv_minrtt = ca->base_rtt,
-                };
+                info->vegas.tcpv_enabled = 1;
+                info->vegas.tcpv_rttcnt = ca->cnt_rtt;
+                info->vegas.tcpv_minrtt = ca->base_rtt;
+                info->vegas.tcpv_rtt = 0;
 
-                if (info.tcpv_rttcnt > 0) {
+                if (info->vegas.tcpv_rttcnt > 0) {
                         u64 t = ca->sum_rtt;
 
-                        do_div(t, info.tcpv_rttcnt);
-                        info.tcpv_rtt = t;
+                        do_div(t, info->vegas.tcpv_rttcnt);
+                        info->vegas.tcpv_rtt = t;
                 }
-                return nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
+                *attr = INET_DIAG_VEGASINFO;
+                return sizeof(struct tcpvegas_info);
         }
         return 0;
 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3a4d9b34bed4..c9ab964189a0 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1820,14 +1820,12 @@ advance_sp:
         for (j = 0; j < used_sacks; j++)
                 tp->recv_sack_cache[i++] = sp[j];
 
-        tcp_mark_lost_retrans(sk);
-
-        tcp_verify_left_out(tp);
-
         if ((state.reord < tp->fackets_out) &&
             ((inet_csk(sk)->icsk_ca_state != TCP_CA_Loss) || tp->undo_marker))
                 tcp_update_reordering(sk, tp->fackets_out - state.reord, 0);
 
+        tcp_mark_lost_retrans(sk);
+        tcp_verify_left_out(tp);
 out:
 
 #if FASTRETRANS_DEBUG > 0
@@ -2700,16 +2698,21 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack)
         struct tcp_sock *tp = tcp_sk(sk);
         bool recovered = !before(tp->snd_una, tp->high_seq);
 
+        if ((flag & FLAG_SND_UNA_ADVANCED) &&
+            tcp_try_undo_loss(sk, false))
+                return;
+
         if (tp->frto) { /* F-RTO RFC5682 sec 3.1 (sack enhanced version). */
                 /* Step 3.b. A timeout is spurious if not all data are
                  * lost, i.e., never-retransmitted data are (s)acked.
                  */
-                if (tcp_try_undo_loss(sk, flag & FLAG_ORIG_SACK_ACKED))
+                if ((flag & FLAG_ORIG_SACK_ACKED) &&
+                    tcp_try_undo_loss(sk, true))
                         return;
 
-                if (after(tp->snd_nxt, tp->high_seq) &&
-                    (flag & FLAG_DATA_SACKED || is_dupack)) {
-                        tp->frto = 0; /* Loss was real: 2nd part of step 3.a */
+                if (after(tp->snd_nxt, tp->high_seq)) {
+                        if (flag & FLAG_DATA_SACKED || is_dupack)
+                                tp->frto = 0; /* Step 3.a. loss was real */
                 } else if (flag & FLAG_SND_UNA_ADVANCED && !recovered) {
                         tp->high_seq = tp->snd_nxt;
                         __tcp_push_pending_frames(sk, tcp_current_mss(sk),
@@ -2734,8 +2737,6 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack)
                 else if (flag & FLAG_SND_UNA_ADVANCED)
                         tcp_reset_reno_sack(tp);
         }
-        if (tcp_try_undo_loss(sk, false))
-                return;
         tcp_xmit_retransmit_queue(sk);
 }
 
@@ -3280,6 +3281,28 @@ static inline bool tcp_may_update_window(const struct tcp_sock *tp,
                 (ack_seq == tp->snd_wl1 && nwin > tp->snd_wnd);
 }
 
+/* If we update tp->snd_una, also update tp->bytes_acked */
+static void tcp_snd_una_update(struct tcp_sock *tp, u32 ack)
+{
+        u32 delta = ack - tp->snd_una;
+
+        u64_stats_update_begin(&tp->syncp);
+        tp->bytes_acked += delta;
+        u64_stats_update_end(&tp->syncp);
+        tp->snd_una = ack;
+}
+
+/* If we update tp->rcv_nxt, also update tp->bytes_received */
+static void tcp_rcv_nxt_update(struct tcp_sock *tp, u32 seq)
+{
+        u32 delta = seq - tp->rcv_nxt;
+
+        u64_stats_update_begin(&tp->syncp);
+        tp->bytes_received += delta;
+        u64_stats_update_end(&tp->syncp);
+        tp->rcv_nxt = seq;
+}
+
 /* Update our send window.
  *
  * Window update algorithm, described in RFC793/RFC1122 (used in linux-2.2
@@ -3315,7 +3338,7 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32
                 }
         }
 
-        tp->snd_una = ack;
+        tcp_snd_una_update(tp, ack);
 
         return flag;
 }
@@ -3497,7 +3520,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
                  * Note, we use the fact that SND.UNA>=SND.WL2.
                  */
                 tcp_update_wl(tp, ack_seq);
-                tp->snd_una = ack;
+                tcp_snd_una_update(tp, ack);
                 flag |= FLAG_WIN_UPDATE;
 
                 tcp_in_ack_event(sk, CA_ACK_WIN_UPDATE);
@@ -4236,7 +4259,7 @@ static void tcp_ofo_queue(struct sock *sk)
 
                 tail = skb_peek_tail(&sk->sk_receive_queue);
                 eaten = tail && tcp_try_coalesce(sk, tail, skb, &fragstolen);
-                tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+                tcp_rcv_nxt_update(tp, TCP_SKB_CB(skb)->end_seq);
                 if (!eaten)
                         __skb_queue_tail(&sk->sk_receive_queue, skb);
                 if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
@@ -4404,7 +4427,7 @@ static int __must_check tcp_queue_rcv(struct sock *sk, struct sk_buff *skb, int
         __skb_pull(skb, hdrlen);
         eaten = (tail &&
                  tcp_try_coalesce(sk, tail, skb, fragstolen)) ? 1 : 0;
-        tcp_sk(sk)->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+        tcp_rcv_nxt_update(tcp_sk(sk), TCP_SKB_CB(skb)->end_seq);
         if (!eaten) {
                 __skb_queue_tail(&sk->sk_receive_queue, skb);
                 skb_set_owner_r(skb, sk);
@@ -4497,7 +4520,7 @@ queue_and_out:
 
                         eaten = tcp_queue_rcv(sk, skb, 0, &fragstolen);
                 }
-                tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+                tcp_rcv_nxt_update(tp, TCP_SKB_CB(skb)->end_seq);
                 if (skb->len)
                         tcp_event_data_recv(sk, skb);
                 if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
@@ -5245,7 +5268,7 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                                         tcp_rcv_rtt_measure_ts(sk, skb);
 
                                         __skb_pull(skb, tcp_header_len);
-                                        tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
+                                        tcp_rcv_nxt_update(tp, TCP_SKB_CB(skb)->end_seq);
                                         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPHPHITSTOUSER);
                                         eaten = 1;
                                 }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 3571f2be4470..fc1c658ec6c1 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1348,7 +1348,8 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
         req = inet_csk_search_req(sk, th->source, iph->saddr, iph->daddr);
         if (req) {
                 nsk = tcp_check_req(sk, skb, req, false);
-                reqsk_put(req);
+                if (!nsk)
+                        reqsk_put(req);
                 return nsk;
         }
 
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 63d6311b5365..17e7339ee5ca 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -300,7 +300,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                         tw->tw_v6_daddr = sk->sk_v6_daddr;
                         tw->tw_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
                         tw->tw_tclass = np->tclass;
-                        tw->tw_flowlabel = np->flow_label >> 12;
+                        tw->tw_flowlabel = be32_to_cpu(np->flow_label & IPV6_FLOWLABEL_MASK);
                         tw->tw_ipv6only = sk->sk_ipv6only;
                 }
 #endif
@@ -420,7 +420,10 @@ void tcp_ca_openreq_child(struct sock *sk, const struct dst_entry *dst)
                 rcu_read_unlock();
         }
 
-        if (!ca_got_dst && !try_module_get(icsk->icsk_ca_ops->owner))
+        /* If no valid choice made yet, assign current system default ca. */
+        if (!ca_got_dst &&
+            (!icsk->icsk_ca_setsockopt ||
+             !try_module_get(icsk->icsk_ca_ops->owner)))
                 tcp_assign_congestion_control(sk);
 
         tcp_set_ca_state(sk, TCP_CA_Open);
@@ -755,10 +758,11 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         if (!child)
                 goto listen_overflow;
 
-        inet_csk_reqsk_queue_unlink(sk, req);
-        inet_csk_reqsk_queue_removed(sk, req);
-
+        inet_csk_reqsk_queue_drop(sk, req);
         inet_csk_reqsk_queue_add(sk, req, child);
+        /* Warning: caller must not call reqsk_put(req);
+         * child stole last reference on it.
+         */
         return child;
 
 listen_overflow:
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 8c8d7e06b72f..a369e8a70b2c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2812,39 +2812,65 @@ begin_fwd:
         }
 }
 
-/* Send a fin.  The caller locks the socket for us.  This cannot be
- * allowed to fail queueing a FIN frame under any circumstances.
+/* We allow to exceed memory limits for FIN packets to expedite
+ * connection tear down and (memory) recovery.
+ * Otherwise tcp_send_fin() could be tempted to either delay FIN
+ * or even be forced to close flow without any FIN.
+ */
+static void sk_forced_wmem_schedule(struct sock *sk, int size)
+{
+        int amt, status;
+
+        if (size <= sk->sk_forward_alloc)
+                return;
+        amt = sk_mem_pages(size);
+        sk->sk_forward_alloc += amt * SK_MEM_QUANTUM;
+        sk_memory_allocated_add(sk, amt, &status);
+}
+
+/* Send a FIN. The caller locks the socket for us.
+ * We should try to send a FIN packet really hard, but eventually give up.
  */
 void tcp_send_fin(struct sock *sk)
 {
+        struct sk_buff *skb, *tskb = tcp_write_queue_tail(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *skb = tcp_write_queue_tail(sk);
-        int mss_now;
 
-        /* Optimization, tack on the FIN if we have a queue of
-         * unsent frames.  But be careful about outgoing SACKS
-         * and IP options.
+        /* Optimization, tack on the FIN if we have one skb in write queue and
+         * this skb was not yet sent, or we are under memory pressure.
+         * Note: in the latter case, FIN packet will be sent after a timeout,
+         * as TCP stack thinks it has already been transmitted.
          */
-        mss_now = tcp_current_mss(sk);
-
-        if (tcp_send_head(sk)) {
-                TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_FIN;
-                TCP_SKB_CB(skb)->end_seq++;
+        if (tskb && (tcp_send_head(sk) || sk_under_memory_pressure(sk))) {
+coalesce:
+                TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN;
+                TCP_SKB_CB(tskb)->end_seq++;
                 tp->write_seq++;
+                if (!tcp_send_head(sk)) {
+                        /* This means tskb was already sent.
+                         * Pretend we included the FIN on previous transmit.
+                         * We need to set tp->snd_nxt to the value it would have
+                         * if FIN had been sent. This is because retransmit path
+                         * does not change tp->snd_nxt.
+                         */
+                        tp->snd_nxt++;
+                        return;
+                }
         } else {
-                /* Socket is locked, keep trying until memory is available. */
-                for (;;) {
-                        skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
-                        if (skb)
-                                break;
-                        yield();
+                skb = alloc_skb_fclone(MAX_TCP_HEADER, sk->sk_allocation);
+                if (unlikely(!skb)) {
+                        if (tskb)
+                                goto coalesce;
+                        return;
                 }
+                skb_reserve(skb, MAX_TCP_HEADER);
+                sk_forced_wmem_schedule(sk, skb->truesize);
                 /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
                 tcp_init_nondata_skb(skb, tp->write_seq,
                                      TCPHDR_ACK | TCPHDR_FIN);
                 tcp_queue_skb(sk, skb);
         }
-        __tcp_push_pending_frames(sk, mss_now, TCP_NAGLE_OFF);
+        __tcp_push_pending_frames(sk, tcp_current_mss(sk), TCP_NAGLE_OFF);
 }
 
 /* We get here when a process closes a file descriptor (either due to
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
index c71a1b8f7bde..a6cea1d5e20d 100644
--- a/net/ipv4/tcp_vegas.c
+++ b/net/ipv4/tcp_vegas.c
@@ -286,18 +286,19 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 acked)
 }
 
 /* Extract info for Tcp socket info provided via netlink. */
-int tcp_vegas_get_info(struct sock *sk, u32 ext, struct sk_buff *skb)
+size_t tcp_vegas_get_info(struct sock *sk, u32 ext, int *attr,
+                          union tcp_cc_info *info)
 {
         const struct vegas *ca = inet_csk_ca(sk);
+
         if (ext & (1 << (INET_DIAG_VEGASINFO - 1))) {
-                struct tcpvegas_info info = {
-                        .tcpv_enabled = ca->doing_vegas_now,
-                        .tcpv_rttcnt = ca->cntRTT,
-                        .tcpv_rtt = ca->baseRTT,
-                        .tcpv_minrtt = ca->minRTT,
-                };
-
-                return nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
+                info->vegas.tcpv_enabled = ca->doing_vegas_now,
+                info->vegas.tcpv_rttcnt = ca->cntRTT,
+                info->vegas.tcpv_rtt = ca->baseRTT,
+                info->vegas.tcpv_minrtt = ca->minRTT,
+
+                *attr = INET_DIAG_VEGASINFO;
+                return sizeof(struct tcpvegas_info);
         }
         return 0;
 }
diff --git a/net/ipv4/tcp_vegas.h b/net/ipv4/tcp_vegas.h
index e8a6b33cc61d..ef9da5306c68 100644
--- a/net/ipv4/tcp_vegas.h
+++ b/net/ipv4/tcp_vegas.h
@@ -19,6 +19,7 @@ void tcp_vegas_init(struct sock *sk);
 void tcp_vegas_state(struct sock *sk, u8 ca_state);
 void tcp_vegas_pkts_acked(struct sock *sk, u32 cnt, s32 rtt_us);
 void tcp_vegas_cwnd_event(struct sock *sk, enum tcp_ca_event event);
-int tcp_vegas_get_info(struct sock *sk, u32 ext, struct sk_buff *skb);
+size_t tcp_vegas_get_info(struct sock *sk, u32 ext, int *attr,
+                          union tcp_cc_info *info);
 
 #endif  /* __TCP_VEGAS_H */
diff --git a/net/ipv4/tcp_westwood.c b/net/ipv4/tcp_westwood.c
index b3c57cceb990..c10732e39837 100644
--- a/net/ipv4/tcp_westwood.c
+++ b/net/ipv4/tcp_westwood.c
@@ -256,18 +256,19 @@ static void tcp_westwood_event(struct sock *sk, enum tcp_ca_event event)
 }
 
 /* Extract info for Tcp socket info provided via netlink. */
-static int tcp_westwood_info(struct sock *sk, u32 ext, struct sk_buff *skb)
+static size_t tcp_westwood_info(struct sock *sk, u32 ext, int *attr,
+                                union tcp_cc_info *info)
 {
         const struct westwood *ca = inet_csk_ca(sk);
 
         if (ext & (1 << (INET_DIAG_VEGASINFO - 1))) {
-                struct tcpvegas_info info = {
-                        .tcpv_enabled = 1,
-                        .tcpv_rtt = jiffies_to_usecs(ca->rtt),
-                        .tcpv_minrtt = jiffies_to_usecs(ca->rtt_min),
-                };
+                info->vegas.tcpv_enabled = 1;
+                info->vegas.tcpv_rttcnt = 0;
+                info->vegas.tcpv_rtt    = jiffies_to_usecs(ca->rtt),
+                info->vegas.tcpv_minrtt = jiffies_to_usecs(ca->rtt_min),
 
-                return nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
+                *attr = INET_DIAG_VEGASINFO;
+                return sizeof(struct tcpvegas_info);
         }
         return 0;
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index d10b7e0112eb..83aa604f9273 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -90,6 +90,7 @@
 #include <linux/socket.h>
 #include <linux/sockios.h>
 #include <linux/igmp.h>
+#include <linux/inetdevice.h>
 #include <linux/in.h>
 #include <linux/errno.h>
 #include <linux/timer.h>
@@ -1345,10 +1346,8 @@ csum_copy_err:
         }
         unlock_sock_fast(sk, slow);
 
-        if (noblock)
-                return -EAGAIN;
-
-        /* starting over for a new packet */
+        /* starting over for a new packet, but check if we need to yield */
+        cond_resched();
         msg->msg_flags &= ~MSG_TRUNC;
         goto try_again;
 }
@@ -1962,6 +1961,7 @@ void udp_v4_early_demux(struct sk_buff *skb)
         struct sock *sk;
         struct dst_entry *dst;
         int dif = skb->dev->ifindex;
+        int ours;
 
         /* validate the packet */
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr)))
@@ -1971,14 +1971,24 @@ void udp_v4_early_demux(struct sk_buff *skb)
         uh = udp_hdr(skb);
 
         if (skb->pkt_type == PACKET_BROADCAST ||
-            skb->pkt_type == PACKET_MULTICAST)
+            skb->pkt_type == PACKET_MULTICAST) {
+                struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+
+                if (!in_dev)
+                        return;
+
+                ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
+                                       iph->protocol);
+                if (!ours)
+                        return;
                 sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
                                                    uh->source, iph->saddr, dif);
-        else if (skb->pkt_type == PACKET_HOST)
+        } else if (skb->pkt_type == PACKET_HOST) {
                 sk = __udp4_lib_demux_lookup(net, uh->dest, iph->daddr,
                                              uh->source, iph->saddr, dif);
-        else
+        } else {
                 return;
+        }
 
         if (!sk)
                 return;