161 files changed, 1345 insertions, 914 deletions
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 467069b73ce1..9649579b5b9f 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -277,7 +277,8 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id)
        return 0;
 out_free_newdev:
-        free_netdev(new_dev);
+        if (new_dev->reg_state == NETREG_UNINITIALIZED)
+                free_netdev(new_dev);
        return err;
 }
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 953b6728bd00..abc5f400fc71 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -813,7 +813,6 @@ static void vlan_dev_free(struct net_device *dev)
        free_percpu(vlan->vlan_pcpu_stats);
        vlan->vlan_pcpu_stats = NULL;
-        free_netdev(dev);
 }
 void vlan_setup(struct net_device *dev)
@@ -826,7 +825,8 @@ void vlan_setup(struct net_device *dev)
        netif_keep_dst(dev);
        dev->netdev_ops         = &vlan_netdev_ops;
-        dev->destructor         = vlan_dev_free;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = vlan_dev_free;
        dev->ethtool_ops        = &vlan_ethtool_ops;
        dev->min_mtu            = 0;
diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index 71e85643b3f9..6ad3e043c617 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -454,8 +454,8 @@ static int xen_9pfs_front_probe(struct xenbus_device *dev,
                        goto error_xenbus;
        }
        priv->tag = xenbus_read(xbt, dev->nodename, "tag", NULL);
-        if (!priv->tag) {
+        if (IS_ERR(priv->tag)) {
-                ret = -EINVAL;
+                ret = PTR_ERR(priv->tag);
                goto error_xenbus;
        }
        ret = xenbus_transaction_end(xbt, 0);
@@ -525,7 +525,7 @@ static struct xenbus_driver xen_9pfs_front_driver = {
        .otherend_changed = xen_9pfs_front_changed,
 };
-int p9_trans_xen_init(void)
+static int p9_trans_xen_init(void)
 {
        if (!xen_domain())
                return -ENODEV;
@@ -537,7 +537,7 @@ int p9_trans_xen_init(void)
 }
 module_init(p9_trans_xen_init);
-void p9_trans_xen_exit(void)
+static void p9_trans_xen_exit(void)
 {
        v9fs_unregister_trans(&p9_xen_trans);
        return xenbus_unregister_driver(&xen_9pfs_front_driver);
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 013e970eff39..000ca2f113ab 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1064,8 +1064,9 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
                skb_new->protocol = eth_type_trans(skb_new, soft_iface);
-                soft_iface->stats.rx_packets++;
+                batadv_inc_counter(bat_priv, BATADV_CNT_RX);
-                soft_iface->stats.rx_bytes += skb->len + ETH_HLEN + hdr_size;
+                batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
+                                   skb->len + ETH_HLEN + hdr_size);
                netif_rx(skb_new);
                batadv_dbg(BATADV_DBG_DAT, bat_priv, "ARP request replied locally\n");
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index e1ebe14ee2a6..ae9f4d37d34f 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -987,7 +987,7 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
                                batadv_dbg(BATADV_DBG_BLA, bat_priv,
                                           "recv_unicast_packet(): Dropped unicast pkt received from another backbone gw %pM.\n",
                                           orig_addr_gw);
-                                return NET_RX_DROP;
+                                goto free_skb;
                        }
                }
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index b25789abf7b9..10f7edfb176e 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -1034,8 +1034,6 @@ static void batadv_softif_free(struct net_device *dev)
         * netdev and its private data (bat_priv)
         */
        rcu_barrier();
-        free_netdev(dev);
 }
 /**
@@ -1047,7 +1045,8 @@ static void batadv_softif_init_early(struct net_device *dev)
        ether_setup(dev);
        dev->netdev_ops = &batadv_netdev_ops;
-        dev->destructor = batadv_softif_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = batadv_softif_free;
        dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_NETNS_LOCAL;
        dev->priv_flags |= IFF_NO_QUEUE;
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 608959989f8e..ab3b654b05cc 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -598,7 +598,7 @@ static void netdev_setup(struct net_device *dev)
        dev->netdev_ops         = &netdev_ops;
        dev->header_ops         = &header_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 static struct device_type bt_type = {
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 430b53e7d941..f0f3447e8aa4 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -379,7 +379,7 @@ void br_dev_setup(struct net_device *dev)
        ether_setup(dev);
        dev->netdev_ops = &br_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->needs_free_netdev = true;
        dev->ethtool_ops = &br_ethtool_ops;
        SET_NETDEV_DEVTYPE(dev, &br_type);
        dev->priv_flags = IFF_EBRIDGE | IFF_NO_QUEUE;
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index c5ce7745b230..32bd3ead9ba1 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -595,7 +595,7 @@ static int br_afspec(struct net_bridge *br,
                err = 0;
                switch (nla_type(attr)) {
                case IFLA_BRIDGE_VLAN_TUNNEL_INFO:
-                        if (!(p->flags & BR_VLAN_TUNNEL))
+                        if (!p || !(p->flags & BR_VLAN_TUNNEL))
                                return -EINVAL;
                        err = br_parse_vlan_tunnel_info(attr, &tinfo_curr);
                        if (err)
@@ -835,6 +835,13 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
                        return -EPROTONOSUPPORT;
                }
        }
+        if (data[IFLA_BR_VLAN_DEFAULT_PVID]) {
+                __u16 defpvid = nla_get_u16(data[IFLA_BR_VLAN_DEFAULT_PVID]);
+                if (defpvid >= VLAN_VID_MASK)
+                        return -EINVAL;
+        }
 #endif
        return 0;
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 08341d2aa9c9..6f12a5271219 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -179,6 +179,8 @@ static void br_stp_start(struct net_bridge *br)
                br_debug(br, "using kernel STP\n");
                /* To start timers on any ports left in blocking */
+                if (br->dev->flags & IFF_UP)
+                        mod_timer(&br->hello_timer, jiffies + br->hello_time);
                br_port_state_selection(br);
        }
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index c98b3e5c140a..60b6fe277a8b 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -40,7 +40,7 @@ static void br_hello_timer_expired(unsigned long arg)
        if (br->dev->flags & IFF_UP) {
                br_config_bpdu_generation(br);
-                if (br->stp_enabled != BR_USER_STP)
+                if (br->stp_enabled == BR_KERNEL_STP)
                        mod_timer(&br->hello_timer,
                                  round_jiffies(jiffies + br->hello_time));
        }
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index 5929309beaa1..db85230e49c3 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -68,6 +68,9 @@ static int ebt_arpreply_tg_check(const struct xt_tgchk_param *par)
        if (e->ethproto != htons(ETH_P_ARP) ||
            e->invflags & EBT_IPROTO)
                return -EINVAL;
+        if (ebt_invalid_target(info->target))
+                return -EINVAL;
        return 0;
 }
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 9ec0c9f908fa..9c6e619f452b 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1373,7 +1373,8 @@ static inline int ebt_obj_to_user(char __user *um, const char *_name,
        strlcpy(name, _name, sizeof(name));
        if (copy_to_user(um, name, EBT_FUNCTION_MAXNAMELEN) ||
            put_user(datasize, (int __user *)(um + EBT_FUNCTION_MAXNAMELEN)) ||
-            xt_data_to_user(um + entrysize, data, usersize, datasize))
+            xt_data_to_user(um + entrysize, data, usersize, datasize,
+                            XT_ALIGN(datasize)))
                return -EFAULT;
        return 0;
@@ -1658,7 +1659,8 @@ static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
                if (match->compat_to_user(cm->data, m->data))
                        return -EFAULT;
        } else {
-                if (xt_data_to_user(cm->data, m->data, match->usersize, msize))
+                if (xt_data_to_user(cm->data, m->data, match->usersize, msize,
+                                    COMPAT_XT_ALIGN(msize)))
                        return -EFAULT;
        }
@@ -1687,7 +1689,8 @@ static int compat_target_to_user(struct ebt_entry_target *t,
                if (target->compat_to_user(cm->data, t->data))
                        return -EFAULT;
        } else {
-                if (xt_data_to_user(cm->data, t->data, target->usersize, tsize))
+                if (xt_data_to_user(cm->data, t->data, target->usersize, tsize,
+                                    COMPAT_XT_ALIGN(tsize)))
                        return -EFAULT;
        }
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index adcad344c843..21f18ea2fce4 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -754,6 +754,10 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
        lock_sock(sk);
+        err = -EINVAL;
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                goto out;
        err = -EAFNOSUPPORT;
        if (uaddr->sa_family != AF_CAIF)
                goto out;
diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c
index 59ce1fcc220c..71b6ab240dea 100644
--- a/net/caif/cfpkt_skbuff.c
+++ b/net/caif/cfpkt_skbuff.c
@@ -81,11 +81,7 @@ static struct cfpkt *cfpkt_create_pfx(u16 len, u16 pfx)
 {
        struct sk_buff *skb;
-        if (likely(in_interrupt()))
+        skb = alloc_skb(len + pfx, GFP_ATOMIC);
-                skb = alloc_skb(len + pfx, GFP_ATOMIC);
-        else
-                skb = alloc_skb(len + pfx, GFP_KERNEL);
        if (unlikely(skb == NULL))
                return NULL;
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 1816fc9f1ee7..fe3c53efb949 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -392,14 +392,14 @@ static void chnl_net_destructor(struct net_device *dev)
 {
        struct chnl_net *priv = netdev_priv(dev);
        caif_free_client(&priv->chnl);
-        free_netdev(dev);
 }
 static void ipcaif_net_setup(struct net_device *dev)
 {
        struct chnl_net *priv;
        dev->netdev_ops = &netdev_ops;
-        dev->destructor = chnl_net_destructor;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = chnl_net_destructor;
        dev->flags |= IFF_NOARP;
        dev->flags |= IFF_POINTOPOINT;
        dev->mtu = GPRS_PDP_MTU;
diff --git a/net/can/af_can.c b/net/can/af_can.c
index b6406fe33c76..88edac0f3e36 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -872,8 +872,7 @@ static int can_notifier(struct notifier_block *nb, unsigned long msg,
 static int can_pernet_init(struct net *net)
 {
-        net->can.can_rcvlists_lock =
+        spin_lock_init(&net->can.can_rcvlists_lock);
-                __SPIN_LOCK_UNLOCKED(net->can.can_rcvlists_lock);
        net->can.can_rx_alldev_list =
                kzalloc(sizeof(struct dev_rcv_lists), GFP_KERNEL);
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 2034fb926670..8757fb87dab8 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -151,7 +151,7 @@ static int process_one_ticket(struct ceph_auth_client *ac,
        struct timespec validity;
        void *tp, *tpend;
        void **ptp;
-        struct ceph_crypto_key new_session_key;
+        struct ceph_crypto_key new_session_key = { 0 };
        struct ceph_buffer *new_ticket_blob;
        unsigned long new_expires, new_renew_after;
        u64 new_secret_id;
@@ -215,6 +215,9 @@ static int process_one_ticket(struct ceph_auth_client *ac,
        dout(" ticket blob is %d bytes\n", dlen);
        ceph_decode_need(ptp, tpend, 1 + sizeof(u64), bad);
        blob_struct_v = ceph_decode_8(ptp);
+        if (blob_struct_v != 1)
+                goto bad;
        new_secret_id = ceph_decode_64(ptp);
        ret = ceph_decode_buffer(&new_ticket_blob, ptp, tpend);
        if (ret)
@@ -234,13 +237,13 @@ static int process_one_ticket(struct ceph_auth_client *ac,
             type, ceph_entity_type_name(type), th->secret_id,
             (int)th->ticket_blob->vec.iov_len);
        xi->have_keys |= th->service;
+        return 0;
-out:
-        return ret;
 bad:
        ret = -EINVAL;
-        goto out;
+out:
+        ceph_crypto_key_destroy(&new_session_key);
+        return ret;
 }
 static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 4fd02831beed..47e94b560ba0 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -56,19 +56,6 @@ static const struct kernel_param_ops param_ops_supported_features = {
 module_param_cb(supported_features, &param_ops_supported_features, NULL,
                S_IRUGO);
-/*
- * find filename portion of a path (/foo/bar/baz -> baz)
- */
-const char *ceph_file_part(const char *s, int len)
-{
-        const char *e = s + len;
-        while (e != s && *(e-1) != '/')
-                e--;
-        return e;
-}
-EXPORT_SYMBOL(ceph_file_part);
 const char *ceph_msg_type_name(int type)
 {
        switch (type) {
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 5766a6c896c4..588a91930051 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -1174,8 +1174,8 @@ static struct page *ceph_msg_data_next(struct ceph_msg_data_cursor *cursor,
 * Returns true if the result moves the cursor on to the next piece
 * of the data item.
 */
-static bool ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
+static void ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
-                                size_t bytes)
+                                  size_t bytes)
 {
        bool new_piece;
@@ -1207,8 +1207,6 @@ static bool ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
                new_piece = true;
        }
        cursor->need_crc = new_piece;
-        return new_piece;
 }
 static size_t sizeof_footer(struct ceph_connection *con)
@@ -1577,7 +1575,6 @@ static int write_partial_message_data(struct ceph_connection *con)
                size_t page_offset;
                size_t length;
                bool last_piece;
-                bool need_crc;
                int ret;
                page = ceph_msg_data_next(cursor, &page_offset, &length,
@@ -1592,7 +1589,7 @@ static int write_partial_message_data(struct ceph_connection *con)
                }
                if (do_datacrc && cursor->need_crc)
                        crc = ceph_crc32c_page(crc, page, page_offset, length);
-                need_crc = ceph_msg_data_advance(cursor, (size_t)ret);
+                ceph_msg_data_advance(cursor, (size_t)ret);
        }
        dout("%s %p msg %p done\n", __func__, con, msg);
@@ -2231,10 +2228,18 @@ static void process_ack(struct ceph_connection *con)
        struct ceph_msg *m;
        u64 ack = le64_to_cpu(con->in_temp_ack);
        u64 seq;
+        bool reconnect = (con->in_tag == CEPH_MSGR_TAG_SEQ);
+        struct list_head *list = reconnect ? &con->out_queue : &con->out_sent;
-        while (!list_empty(&con->out_sent)) {
+        /*
-                m = list_first_entry(&con->out_sent, struct ceph_msg,
+         * In the reconnect case, con_fault() has requeued messages
-                                     list_head);
+         * in out_sent. We should cleanup old messages according to
+         * the reconnect seq.
+         */
+        while (!list_empty(list)) {
+                m = list_first_entry(list, struct ceph_msg, list_head);
+                if (reconnect && m->needs_out_seq)
+                        break;
                seq = le64_to_cpu(m->hdr.seq);
                if (seq > ack)
                        break;
@@ -2243,6 +2248,7 @@ static void process_ack(struct ceph_connection *con)
                m->ack_stamp = jiffies;
                ceph_msg_remove(m);
        }
        prepare_read_tag(con);
 }
@@ -2299,7 +2305,7 @@ static int read_partial_msg_data(struct ceph_connection *con)
                if (do_datacrc)
                        crc = ceph_crc32c_page(crc, page, page_offset, ret);
-                (void) ceph_msg_data_advance(cursor, (size_t)ret);
+                ceph_msg_data_advance(cursor, (size_t)ret);
        }
        if (do_datacrc)
                con->in_data_crc = crc;
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 29a0ef351c5e..250f11f78609 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -43,15 +43,13 @@ struct ceph_monmap *ceph_monmap_decode(void *p, void *end)
        int i, err = -EINVAL;
        struct ceph_fsid fsid;
        u32 epoch, num_mon;
-        u16 version;
        u32 len;
        ceph_decode_32_safe(&p, end, len, bad);
        ceph_decode_need(&p, end, len, bad);
        dout("monmap_decode %p %p len %d\n", p, end, (int)(end-p));
+        p += sizeof(u16);  /* skip version */
-        ceph_decode_16_safe(&p, end, version, bad);
        ceph_decode_need(&p, end, sizeof(fsid) + 2*sizeof(u32), bad);
        ceph_decode_copy(&p, &fsid, sizeof(fsid));
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index ffe9e904d4d1..55e3a477f92d 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -317,6 +317,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                u32 yes;
                struct crush_rule *r;
+                err = -EINVAL;
                ceph_decode_32_safe(p, end, yes, bad);
                if (!yes) {
                        dout("crush_decode NO rule %d off %x %p to %p\n",
diff --git a/net/core/dev.c b/net/core/dev.c
index 96cf83da0d66..416137c64bf8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1253,8 +1253,9 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
        if (!new_ifalias)
                return -ENOMEM;
        dev->ifalias = new_ifalias;
+        memcpy(dev->ifalias, alias, len);
+        dev->ifalias[len] = 0;
-        strlcpy(dev->ifalias, alias, len+1);
        return len;
 }
@@ -4766,6 +4767,13 @@ struct packet_offload *gro_find_complete_by_type(__be16 type)
 }
 EXPORT_SYMBOL(gro_find_complete_by_type);
+static void napi_skb_free_stolen_head(struct sk_buff *skb)
+{
+        skb_dst_drop(skb);
+        secpath_reset(skb);
+        kmem_cache_free(skbuff_head_cache, skb);
+}
 static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb)
 {
        switch (ret) {
@@ -4779,13 +4787,10 @@ static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb)
                break;
        case GRO_MERGED_FREE:
-                if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD) {
+                if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD)
-                        skb_dst_drop(skb);
+                        napi_skb_free_stolen_head(skb);
-                        secpath_reset(skb);
+                else
-                        kmem_cache_free(skbuff_head_cache, skb);
-                } else {
                        __kfree_skb(skb);
-                }
                break;
        case GRO_HELD:
@@ -4857,10 +4862,16 @@ static gro_result_t napi_frags_finish(struct napi_struct *napi,
                break;
        case GRO_DROP:
-        case GRO_MERGED_FREE:
                napi_reuse_skb(napi, skb);
                break;
+        case GRO_MERGED_FREE:
+                if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD)
+                        napi_skb_free_stolen_head(skb);
+                else
+                        napi_reuse_skb(napi, skb);
+                break;
        case GRO_MERGED:
        case GRO_CONSUMED:
                break;
@@ -4948,6 +4959,19 @@ __sum16 __skb_gro_checksum_complete(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(__skb_gro_checksum_complete);
+static void net_rps_send_ipi(struct softnet_data *remsd)
+{
+#ifdef CONFIG_RPS
+        while (remsd) {
+                struct softnet_data *next = remsd->rps_ipi_next;
+                if (cpu_online(remsd->cpu))
+                        smp_call_function_single_async(remsd->cpu, &remsd->csd);
+                remsd = next;
+        }
+#endif
+}
 /*
 * net_rps_action_and_irq_enable sends any pending IPI's for rps.
 * Note: called with local irq disabled, but exits with local irq enabled.
@@ -4963,14 +4987,7 @@ static void net_rps_action_and_irq_enable(struct softnet_data *sd)
                local_irq_enable();
                /* Send pending IPI's to kick RPS processing on remote cpus. */
-                while (remsd) {
+                net_rps_send_ipi(remsd);
-                        struct softnet_data *next = remsd->rps_ipi_next;
-                        if (cpu_online(remsd->cpu))
-                                smp_call_function_single_async(remsd->cpu,
-                                                           &remsd->csd);
-                        remsd = next;
-                }
        } else
 #endif
                local_irq_enable();
@@ -5199,8 +5216,6 @@ static void busy_poll_stop(struct napi_struct *napi, void *have_poll_lock)
        if (rc == BUSY_POLL_BUDGET)
                __napi_schedule(napi);
        local_bh_enable();
-        if (local_softirq_pending())
-                do_softirq();
 }
 void napi_busy_loop(unsigned int napi_id,
@@ -6852,6 +6867,32 @@ int dev_change_proto_down(struct net_device *dev, bool proto_down)
 }
 EXPORT_SYMBOL(dev_change_proto_down);
+bool __dev_xdp_attached(struct net_device *dev, xdp_op_t xdp_op)
+{
+        struct netdev_xdp xdp;
+        memset(&xdp, 0, sizeof(xdp));
+        xdp.command = XDP_QUERY_PROG;
+        /* Query must always succeed. */
+        WARN_ON(xdp_op(dev, &xdp) < 0);
+        return xdp.prog_attached;
+}
+static int dev_xdp_install(struct net_device *dev, xdp_op_t xdp_op,
+                           struct netlink_ext_ack *extack,
+                           struct bpf_prog *prog)
+{
+        struct netdev_xdp xdp;
+        memset(&xdp, 0, sizeof(xdp));
+        xdp.command = XDP_SETUP_PROG;
+        xdp.extack = extack;
+        xdp.prog = prog;
+        return xdp_op(dev, &xdp);
+}
 /**
 *      dev_change_xdp_fd - set or clear a bpf program for a device rx path
 *      @dev: device
@@ -6864,41 +6905,34 @@ EXPORT_SYMBOL(dev_change_proto_down);
 int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
                      int fd, u32 flags)
 {
-        int (*xdp_op)(struct net_device *dev, struct netdev_xdp *xdp);
        const struct net_device_ops *ops = dev->netdev_ops;
        struct bpf_prog *prog = NULL;
-        struct netdev_xdp xdp;
+        xdp_op_t xdp_op, xdp_chk;
        int err;
        ASSERT_RTNL();
-        xdp_op = ops->ndo_xdp;
+        xdp_op = xdp_chk = ops->ndo_xdp;
+        if (!xdp_op && (flags & XDP_FLAGS_DRV_MODE))
+                return -EOPNOTSUPP;
        if (!xdp_op || (flags & XDP_FLAGS_SKB_MODE))
                xdp_op = generic_xdp_install;
+        if (xdp_op == xdp_chk)
+                xdp_chk = generic_xdp_install;
        if (fd >= 0) {
-                if (flags & XDP_FLAGS_UPDATE_IF_NOEXIST) {
+                if (xdp_chk && __dev_xdp_attached(dev, xdp_chk))
-                        memset(&xdp, 0, sizeof(xdp));
+                        return -EEXIST;
-                        xdp.command = XDP_QUERY_PROG;
+                if ((flags & XDP_FLAGS_UPDATE_IF_NOEXIST) &&
+                    __dev_xdp_attached(dev, xdp_op))
-                        err = xdp_op(dev, &xdp);
+                        return -EBUSY;
-                        if (err < 0)
-                                return err;
-                        if (xdp.prog_attached)
-                                return -EBUSY;
-                }
                prog = bpf_prog_get_type(fd, BPF_PROG_TYPE_XDP);
                if (IS_ERR(prog))
                        return PTR_ERR(prog);
        }
-        memset(&xdp, 0, sizeof(xdp));
+        err = dev_xdp_install(dev, xdp_op, extack, prog);
-        xdp.command = XDP_SETUP_PROG;
-        xdp.extack = extack;
-        xdp.prog = prog;
-        err = xdp_op(dev, &xdp);
        if (err < 0 && prog)
                bpf_prog_put(prog);
@@ -7482,6 +7516,8 @@ out:
 err_uninit:
        if (dev->netdev_ops->ndo_uninit)
                dev->netdev_ops->ndo_uninit(dev);
+        if (dev->priv_destructor)
+                dev->priv_destructor(dev);
        goto out;
 }
 EXPORT_SYMBOL(register_netdevice);
@@ -7689,8 +7725,10 @@ void netdev_run_todo(void)
                WARN_ON(rcu_access_pointer(dev->ip6_ptr));
                WARN_ON(dev->dn_ptr);
-                if (dev->destructor)
+                if (dev->priv_destructor)
-                        dev->destructor(dev);
+                        dev->priv_destructor(dev);
+                if (dev->needs_free_netdev)
+                        free_netdev(dev);
                /* Report a network device has been unregistered */
                rtnl_lock();
@@ -7755,9 +7793,9 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
        } else {
                netdev_stats_to_stats64(storage, &dev->stats);
        }
-        storage->rx_dropped += atomic_long_read(&dev->rx_dropped);
+        storage->rx_dropped += (unsigned long)atomic_long_read(&dev->rx_dropped);
-        storage->tx_dropped += atomic_long_read(&dev->tx_dropped);
+        storage->tx_dropped += (unsigned long)atomic_long_read(&dev->tx_dropped);
-        storage->rx_nohandler += atomic_long_read(&dev->rx_nohandler);
+        storage->rx_nohandler += (unsigned long)atomic_long_read(&dev->rx_nohandler);
        return storage;
 }
 EXPORT_SYMBOL(dev_get_stats);
@@ -8173,7 +8211,7 @@ static int dev_cpu_dead(unsigned int oldcpu)
        struct sk_buff **list_skb;
        struct sk_buff *skb;
        unsigned int cpu;
-        struct softnet_data *sd, *oldsd;
+        struct softnet_data *sd, *oldsd, *remsd = NULL;
        local_irq_disable();
        cpu = smp_processor_id();
@@ -8214,6 +8252,13 @@ static int dev_cpu_dead(unsigned int oldcpu)
        raise_softirq_irqoff(NET_TX_SOFTIRQ);
        local_irq_enable();
+#ifdef CONFIG_RPS
+        remsd = oldsd->rps_ipi_list;
+        oldsd->rps_ipi_list = NULL;
+#endif
+        /* send out pending IPI's on offline CPU */
+        net_rps_send_ipi(remsd);
        /* Process offline CPU's input_pkt_queue */
        while ((skb = __skb_dequeue(&oldsd->process_queue))) {
                netif_rx_ni(skb);
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index b94b1d293506..27fad31784a8 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -410,6 +410,22 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
        if (cmd == SIOCGIFNAME)
                return dev_ifname(net, (struct ifreq __user *)arg);
+        /*
+         * Take care of Wireless Extensions. Unfortunately struct iwreq
+         * isn't a proper subset of struct ifreq (it's 8 byte shorter)
+         * so we need to treat it specially, otherwise applications may
+         * fault if the struct they're passing happens to land at the
+         * end of a mapped page.
+         */
+        if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST) {
+                struct iwreq iwr;
+                if (copy_from_user(&iwr, arg, sizeof(iwr)))
+                        return -EFAULT;
+                return wext_handle_ioctl(net, &iwr, cmd, arg);
+        }
        if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
                return -EFAULT;
@@ -559,9 +575,6 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                                ret = -EFAULT;
                        return ret;
                }
-                /* Take care of Wireless Extensions */
-                if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)
-                        return wext_handle_ioctl(net, &ifr, cmd, arg);
                return -ENOTTY;
        }
 }
diff --git a/net/core/devlink.c b/net/core/devlink.c
index b0b87a292e7c..a0adfc31a3fe 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1680,8 +1680,10 @@ start_again:
        hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq,
                          &devlink_nl_family, NLM_F_MULTI, cmd);
-        if (!hdr)
+        if (!hdr) {
+                nlmsg_free(skb);
                return -EMSGSIZE;
+        }
        if (devlink_nl_put_handle(skb, devlink))
                goto nla_put_failure;
@@ -2098,8 +2100,10 @@ start_again:
        hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq,
                          &devlink_nl_family, NLM_F_MULTI, cmd);
-        if (!hdr)
+        if (!hdr) {
+                nlmsg_free(skb);
                return -EMSGSIZE;
+        }
        if (devlink_nl_put_handle(skb, devlink))
                goto nla_put_failure;
diff --git a/net/core/dst.c b/net/core/dst.c
index 960e503b5a52..13ba4a090c41 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -151,13 +151,13 @@ int dst_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(dst_discard_out);
-const u32 dst_default_metrics[RTAX_MAX + 1] = {
+const struct dst_metrics dst_default_metrics = {
        /* This initializer is needed to force linker to place this variable
         * into const section. Otherwise it might end into bss section.
         * We really want to avoid false sharing on this variable, and catch
         * any writes on it.
         */
-        [RTAX_MAX] = 0xdeadbeef,
+        .refcnt = ATOMIC_INIT(1),
 };
 void dst_init(struct dst_entry *dst, struct dst_ops *ops,
@@ -169,7 +169,7 @@ void dst_init(struct dst_entry *dst, struct dst_ops *ops,
        if (dev)
                dev_hold(dev);
        dst->ops = ops;
-        dst_init_metrics(dst, dst_default_metrics, true);
+        dst_init_metrics(dst, dst_default_metrics.metrics, true);
        dst->expires = 0UL;
        dst->path = dst;
        dst->from = NULL;
@@ -314,25 +314,30 @@ EXPORT_SYMBOL(dst_release);
 u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
-        u32 *p = kmalloc(sizeof(u32) * RTAX_MAX, GFP_ATOMIC);
+        struct dst_metrics *p = kmalloc(sizeof(*p), GFP_ATOMIC);
        if (p) {
-                u32 *old_p = __DST_METRICS_PTR(old);
+                struct dst_metrics *old_p = (struct dst_metrics *)__DST_METRICS_PTR(old);
                unsigned long prev, new;
-                memcpy(p, old_p, sizeof(u32) * RTAX_MAX);
+                atomic_set(&p->refcnt, 1);
+                memcpy(p->metrics, old_p->metrics, sizeof(p->metrics));
                new = (unsigned long) p;
                prev = cmpxchg(&dst->_metrics, old, new);
                if (prev != old) {
                        kfree(p);
-                        p = __DST_METRICS_PTR(prev);
+                        p = (struct dst_metrics *)__DST_METRICS_PTR(prev);
                        if (prev & DST_METRICS_READ_ONLY)
                                p = NULL;
+                } else if (prev & DST_METRICS_REFCOUNTED) {
+                        if (atomic_dec_and_test(&old_p->refcnt))
+                                kfree(old_p);
                }
        }
-        return p;
+        BUILD_BUG_ON(offsetof(struct dst_metrics, metrics) != 0);
+        return (u32 *)p;
 }
 EXPORT_SYMBOL(dst_cow_metrics_generic);
@@ -341,7 +346,7 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
        unsigned long prev, new;
-        new = ((unsigned long) dst_default_metrics) | DST_METRICS_READ_ONLY;
+        new = ((unsigned long) &dst_default_metrics) | DST_METRICS_READ_ONLY;
        prev = cmpxchg(&dst->_metrics, old, new);
        if (prev == old)
                kfree(__DST_METRICS_PTR(old));
@@ -464,6 +469,20 @@ static int dst_dev_event(struct notifier_block *this, unsigned long event,
                spin_lock_bh(&dst_garbage.lock);
                dst = dst_garbage.list;
                dst_garbage.list = NULL;
+                /* The code in dst_ifdown places a hold on the loopback device.
+                 * If the gc entry processing is set to expire after a lengthy
+                 * interval, this hold can cause netdev_wait_allrefs() to hang
+                 * out and wait for a long time -- until the the loopback
+                 * interface is released.  If we're really unlucky, it'll emit
+                 * pr_emerg messages to console too.  Reset the interval here,
+                 * so dst cleanups occur in a more timely fashion.
+                 */
+                if (dst_garbage.timer_inc > DST_GC_INC) {
+                        dst_garbage.timer_inc = DST_GC_INC;
+                        dst_garbage.timer_expires = DST_GC_MIN;
+                        mod_delayed_work(system_wq, &dst_gc_work,
+                                         dst_garbage.timer_expires);
+                }
                spin_unlock_bh(&dst_garbage.lock);
                if (last)
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index f21c4d3aeae0..3bba291c6c32 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -568,7 +568,7 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh,
        struct net *net = sock_net(skb->sk);
        struct fib_rule_hdr *frh = nlmsg_data(nlh);
        struct fib_rules_ops *ops = NULL;
-        struct fib_rule *rule, *tmp;
+        struct fib_rule *rule, *r;
        struct nlattr *tb[FRA_MAX+1];
        struct fib_kuid_range range;
        int err = -EINVAL;
@@ -668,16 +668,23 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                /*
                 * Check if this rule is a target to any of them. If so,
+                 * adjust to the next one with the same preference or
                 * disable them. As this operation is eventually very
-                 * expensive, it is only performed if goto rules have
+                 * expensive, it is only performed if goto rules, except
-                 * actually been added.
+                 * current if it is goto rule, have actually been added.
                 */
                if (ops->nr_goto_rules > 0) {
-                        list_for_each_entry(tmp, &ops->rules_list, list) {
+                        struct fib_rule *n;
-                                if (rtnl_dereference(tmp->ctarget) == rule) {
-                                        RCU_INIT_POINTER(tmp->ctarget, NULL);
+                        n = list_next_entry(rule, list);
+                        if (&n->list == &ops->rules_list || n->pref != rule->pref)
+                                n = NULL;
+                        list_for_each_entry(r, &ops->rules_list, list) {
+                                if (rtnl_dereference(r->ctarget) != rule)
+                                        continue;
+                                rcu_assign_pointer(r->ctarget, n);
+                                if (!n)
                                        ops->unresolved_rules++;
-                                }
                        }
                }
diff --git a/net/core/filter.c b/net/core/filter.c
index a253a6197e6b..a6bb95fa87b2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2281,6 +2281,7 @@ bool bpf_helper_changes_pkt_data(void *func)
            func == bpf_skb_change_head ||
            func == bpf_skb_change_tail ||
            func == bpf_skb_pull_data ||
+            func == bpf_clone_redirect ||
            func == bpf_l3_csum_replace ||
            func == bpf_l4_csum_replace ||
            func == bpf_xdp_adjust_head)
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 58b0bcc125b5..d274f81fcc2c 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1132,10 +1132,6 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                lladdr = neigh->ha;
        }
-        if (new & NUD_CONNECTED)
-                neigh->confirmed = jiffies;
-        neigh->updated = jiffies;
        /* If entry was valid and address is not changed,
           do not change entry state, if new one is STALE.
         */
@@ -1157,6 +1153,16 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                }
        }
+        /* Update timestamps only once we know we will make a change to the
+         * neighbour entry. Otherwise we risk to move the locktime window with
+         * noop updates and ignore relevant ARP updates.
+         */
+        if (new != old || lladdr != neigh->ha) {
+                if (new & NUD_CONNECTED)
+                        neigh->confirmed = jiffies;
+                neigh->updated = jiffies;
+        }
        if (new != old) {
                neigh_del_timer(neigh);
                if (new & NUD_PROBE)
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 1934efd4a9d4..26bbfababff2 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -315,6 +315,25 @@ out_undo:
        goto out;
 }
+static int __net_init net_defaults_init_net(struct net *net)
+{
+        net->core.sysctl_somaxconn = SOMAXCONN;
+        return 0;
+}
+static struct pernet_operations net_defaults_ops = {
+        .init = net_defaults_init_net,
+};
+static __init int net_defaults_init(void)
+{
+        if (register_pernet_subsys(&net_defaults_ops))
+                panic("Cannot initialize net default settings");
+        return 0;
+}
+core_initcall(net_defaults_init);
 #ifdef CONFIG_NET_NS
 static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index bcb0f610ee42..467a2f4510a7 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -899,8 +899,7 @@ static size_t rtnl_port_size(const struct net_device *dev,
 static size_t rtnl_xdp_size(void)
 {
        size_t xdp_size = nla_total_size(0) +   /* nest IFLA_XDP */
-                          nla_total_size(1) +   /* XDP_ATTACHED */
+                          nla_total_size(1);    /* XDP_ATTACHED */
-                          nla_total_size(4);    /* XDP_FLAGS */
        return xdp_size;
 }
@@ -932,6 +931,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
               + nla_total_size(1) /* IFLA_LINKMODE */
               + nla_total_size(4) /* IFLA_CARRIER_CHANGES */
               + nla_total_size(4) /* IFLA_LINK_NETNSID */
+               + nla_total_size(4) /* IFLA_GROUP */
               + nla_total_size(ext_filter_mask
                                & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
               + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
@@ -1125,6 +1125,8 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
        struct ifla_vf_mac vf_mac;
        struct ifla_vf_info ivi;
+        memset(&ivi, 0, sizeof(ivi));
        /* Not all SR-IOV capable drivers support the
         * spoofcheck and "RSS query enable" query.  Preset to
         * -1 so the user space tool can detect that the driver
@@ -1133,7 +1135,6 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb,
        ivi.spoofchk = -1;
        ivi.rss_query_en = -1;
        ivi.trusted = -1;
-        memset(ivi.mac, 0, sizeof(ivi.mac));
        /* The default value for VF link state is "auto"
         * IFLA_VF_LINK_STATE_AUTO which equals zero
         */
@@ -1247,37 +1248,34 @@ static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev)
        return 0;
 }
+static u8 rtnl_xdp_attached_mode(struct net_device *dev)
+{
+        const struct net_device_ops *ops = dev->netdev_ops;
+        ASSERT_RTNL();
+        if (rcu_access_pointer(dev->xdp_prog))
+                return XDP_ATTACHED_SKB;
+        if (ops->ndo_xdp && __dev_xdp_attached(dev, ops->ndo_xdp))
+                return XDP_ATTACHED_DRV;
+        return XDP_ATTACHED_NONE;
+}
 static int rtnl_xdp_fill(struct sk_buff *skb, struct net_device *dev)
 {
        struct nlattr *xdp;
-        u32 xdp_flags = 0;
-        u8 val = 0;
        int err;
        xdp = nla_nest_start(skb, IFLA_XDP);
        if (!xdp)
                return -EMSGSIZE;
-        if (rcu_access_pointer(dev->xdp_prog)) {
-                xdp_flags = XDP_FLAGS_SKB_MODE;
+        err = nla_put_u8(skb, IFLA_XDP_ATTACHED,
-                val = 1;
+                         rtnl_xdp_attached_mode(dev));
-        } else if (dev->netdev_ops->ndo_xdp) {
-                struct netdev_xdp xdp_op = {};
-                xdp_op.command = XDP_QUERY_PROG;
-                err = dev->netdev_ops->ndo_xdp(dev, &xdp_op);
-                if (err)
-                        goto err_cancel;
-                val = xdp_op.prog_attached;
-        }
-        err = nla_put_u8(skb, IFLA_XDP_ATTACHED, val);
        if (err)
                goto err_cancel;
-        if (xdp_flags) {
-                err = nla_put_u32(skb, IFLA_XDP_FLAGS, xdp_flags);
-                if (err)
-                        goto err_cancel;
-        }
        nla_nest_end(skb, xdp);
        return 0;
@@ -1471,6 +1469,7 @@ static const struct nla_policy ifla_policy[IFLA_MAX+1] = {
        [IFLA_LINK_NETNSID]     = { .type = NLA_S32 },
        [IFLA_PROTO_DOWN]       = { .type = NLA_U8 },
        [IFLA_XDP]              = { .type = NLA_NESTED },
+        [IFLA_GROUP]            = { .type = NLA_U32 },
 };
 static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
@@ -1631,13 +1630,13 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                                               cb->nlh->nlmsg_seq, 0,
                                               flags,
                                               ext_filter_mask);
-                        /* If we ran out of room on the first message,
-                         * we're in trouble
-                         */
-                        WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
-                        if (err < 0)
+                        if (err < 0) {
-                                goto out;
+                                if (likely(skb->len))
+                                        goto out;
+                                goto out_err;
+                        }
                        nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 cont:
@@ -1645,10 +1644,12 @@ cont:
                }
        }
 out:
+        err = skb->len;
+out_err:
        cb->args[1] = idx;
        cb->args[0] = h;
-        return skb->len;
+        return err;
 }
 int rtnl_nla_parse_ifla(struct nlattr **tb, const struct nlattr *head, int len,
@@ -2199,6 +2200,11 @@ static int do_setlink(const struct sk_buff *skb,
                                err = -EINVAL;
                                goto errout;
                        }
+                        if ((xdp_flags & XDP_FLAGS_SKB_MODE) &&
+                            (xdp_flags & XDP_FLAGS_DRV_MODE)) {
+                                err = -EINVAL;
+                                goto errout;
+                        }
                }
                if (xdp[IFLA_XDP_FD]) {
@@ -3228,8 +3234,11 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
        int err = 0;
        int fidx = 0;
-        if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
+        err = nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
-                        IFLA_MAX, ifla_policy, NULL) == 0) {
+                          IFLA_MAX, ifla_policy, NULL);
+        if (err < 0) {
+                return -EINVAL;
+        } else if (err == 0) {
                if (tb[IFLA_MASTER])
                        br_idx = nla_get_u32(tb[IFLA_MASTER]);
        }
@@ -3452,8 +3461,12 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
                                err = br_dev->netdev_ops->ndo_bridge_getlink(
                                                skb, portid, seq, dev,
                                                filter_mask, NLM_F_MULTI);
-                                if (err < 0 && err != -EOPNOTSUPP)
+                                if (err < 0 && err != -EOPNOTSUPP) {
-                                        break;
+                                        if (likely(skb->len))
+                                                break;
+                                        goto out_err;
+                                }
                        }
                        idx++;
                }
@@ -3464,16 +3477,22 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
                                                              seq, dev,
                                                              filter_mask,
                                                              NLM_F_MULTI);
-                                if (err < 0 && err != -EOPNOTSUPP)
+                                if (err < 0 && err != -EOPNOTSUPP) {
-                                        break;
+                                        if (likely(skb->len))
+                                                break;
+                                        goto out_err;
+                                }
                        }
                        idx++;
                }
        }
+        err = skb->len;
+out_err:
        rcu_read_unlock();
        cb->args[0] = idx;
-        return skb->len;
+        return err;
 }
 static inline size_t bridge_nlmsg_size(void)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 346d3e85dfbc..b1be7c01efe2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3754,8 +3754,11 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk)
        spin_lock_irqsave(&q->lock, flags);
        skb = __skb_dequeue(q);
-        if (skb && (skb_next = skb_peek(q)))
+        if (skb && (skb_next = skb_peek(q))) {
                icmp_next = is_icmp_err_skb(skb_next);
+                if (icmp_next)
+                        sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin;
+        }
        spin_unlock_irqrestore(&q->lock, flags);
        if (is_icmp_err_skb(skb) && !icmp_next)
diff --git a/net/core/sock.c b/net/core/sock.c
index 79c6aee6af9b..727f924b7f91 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -139,10 +139,7 @@
 #include <trace/events/sock.h>
-#ifdef CONFIG_INET
 #include <net/tcp.h>
-#endif
 #include <net/busy_poll.h>
 static DEFINE_MUTEX(proto_list_mutex);
@@ -1803,28 +1800,24 @@ EXPORT_SYMBOL(skb_set_owner_w);
 * delay queue. We want to allow the owner socket to send more
 * packets, as if they were already TX completed by a typical driver.
 * But we also want to keep skb->sk set because some packet schedulers
- * rely on it (sch_fq for example). So we set skb->truesize to a small
+ * rely on it (sch_fq for example).
- * amount (1) and decrease sk_wmem_alloc accordingly.
 */
 void skb_orphan_partial(struct sk_buff *skb)
 {
-        /* If this skb is a TCP pure ACK or already went here,
+        if (skb_is_tcp_pure_ack(skb))
-         * we have nothing to do. 2 is already a very small truesize.
-         */
-        if (skb->truesize <= 2)
                return;
-        /* TCP stack sets skb->ooo_okay based on sk_wmem_alloc,
-         * so we do not completely orphan skb, but transfert all
-         * accounted bytes but one, to avoid unexpected reorders.
-         */
        if (skb->destructor == sock_wfree
 #ifdef CONFIG_INET
            || skb->destructor == tcp_wfree
 #endif
                ) {
-                atomic_sub(skb->truesize - 1, &skb->sk->sk_wmem_alloc);
+                struct sock *sk = skb->sk;
-                skb->truesize = 1;
+                if (atomic_inc_not_zero(&sk->sk_refcnt)) {
+                        atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
+                        skb->destructor = sock_efree;
+                }
        } else {
                skb_orphan(skb);
        }
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index ea23254b2457..b7cd9aafe99e 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -479,8 +479,6 @@ static __net_init int sysctl_core_net_init(struct net *net)
 {
        struct ctl_table *tbl;
-        net->core.sysctl_somaxconn = SOMAXCONN;
        tbl = netns_core_table;
        if (!net_eq(net, &init_net)) {
                tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL);
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 840f14aaa016..992621172220 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -426,6 +426,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
                newsk->sk_backlog_rcv = dccp_v4_do_rcv;
                newnp->pktoptions  = NULL;
                newnp->opt         = NULL;
+                newnp->ipv6_mc_list = NULL;
+                newnp->ipv6_ac_list = NULL;
+                newnp->ipv6_fl_list = NULL;
                newnp->mcast_oif   = inet6_iif(skb);
                newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
@@ -490,6 +493,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
        /* Clone RX bits */
        newnp->rxopt.all = np->rxopt.all;
+        newnp->ipv6_mc_list = NULL;
+        newnp->ipv6_ac_list = NULL;
+        newnp->ipv6_fl_list = NULL;
        newnp->pktoptions = NULL;
        newnp->opt        = NULL;
        newnp->mcast_oif  = inet6_iif(skb);
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 4b9518a0d248..6f95612b4d32 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -188,12 +188,6 @@ static inline void dnrt_free(struct dn_route *rt)
        call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
 }
-static inline void dnrt_drop(struct dn_route *rt)
-{
-        dst_release(&rt->dst);
-        call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
-}
 static void dn_dst_check_expire(unsigned long dummy)
 {
        int i;
@@ -248,7 +242,7 @@ static int dn_dst_gc(struct dst_ops *ops)
                        }
                        *rtp = rt->dst.dn_next;
                        rt->dst.dn_next = NULL;
-                        dnrt_drop(rt);
+                        dnrt_free(rt);
                        break;
                }
                spin_unlock_bh(&dn_rt_hash_table[i].lock);
@@ -350,7 +344,7 @@ static int dn_insert_route(struct dn_route *rt, unsigned int hash, struct dn_rou
                        dst_use(&rth->dst, now);
                        spin_unlock_bh(&dn_rt_hash_table[hash].lock);
-                        dnrt_drop(rt);
+                        dst_free(&rt->dst);
                        *rp = rth;
                        return 0;
                }
@@ -380,7 +374,7 @@ static void dn_run_flush(unsigned long dummy)
                for(; rt; rt = next) {
                        next = rcu_dereference_raw(rt->dst.dn_next);
                        RCU_INIT_POINTER(rt->dst.dn_next, NULL);
-                        dst_free((struct dst_entry *)rt);
+                        dnrt_free(rt);
                }
 nothing_to_declare:
@@ -1187,7 +1181,7 @@ make_route:
        if (dev_out->flags & IFF_LOOPBACK)
                flags |= RTCF_LOCAL;
-        rt = dst_alloc(&dn_dst_ops, dev_out, 1, DST_OBSOLETE_NONE, DST_HOST);
+        rt = dst_alloc(&dn_dst_ops, dev_out, 0, DST_OBSOLETE_NONE, DST_HOST);
        if (rt == NULL)
                goto e_nobufs;
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 1ed81ac6dd1a..aa8ffecc46a4 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -102,7 +102,9 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb)
 {
        struct nlmsghdr *nlh = nlmsg_hdr(skb);
-        if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
+        if (skb->len < sizeof(*nlh) ||
+            nlh->nlmsg_len < sizeof(*nlh) ||
+            skb->len < nlh->nlmsg_len)
                return;
        if (!netlink_capable(skb, CAP_NET_ADMIN))
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 26130ae438da..90038d45a547 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -223,6 +223,53 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
        return 0;
 }
+#ifdef CONFIG_PM_SLEEP
+int dsa_switch_suspend(struct dsa_switch *ds)
+{
+        int i, ret = 0;
+        /* Suspend slave network devices */
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_port_initialized(ds, i))
+                        continue;
+                ret = dsa_slave_suspend(ds->ports[i].netdev);
+                if (ret)
+                        return ret;
+        }
+        if (ds->ops->suspend)
+                ret = ds->ops->suspend(ds);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dsa_switch_suspend);
+int dsa_switch_resume(struct dsa_switch *ds)
+{
+        int i, ret = 0;
+        if (ds->ops->resume)
+                ret = ds->ops->resume(ds);
+        if (ret)
+                return ret;
+        /* Resume slave network devices */
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_port_initialized(ds, i))
+                        continue;
+                ret = dsa_slave_resume(ds->ports[i].netdev);
+                if (ret)
+                        return ret;
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(dsa_switch_resume);
+#endif
 static struct packet_type dsa_pack_type __read_mostly = {
        .type   = cpu_to_be16(ETH_P_XDSA),
        .func   = dsa_switch_rcv,
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index 033b3bfb63dc..7796580e99ee 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -484,8 +484,10 @@ static void dsa_dst_unapply(struct dsa_switch_tree *dst)
                dsa_ds_unapply(dst, ds);
        }
-        if (dst->cpu_switch)
+        if (dst->cpu_switch) {
                dsa_cpu_port_ethtool_restore(dst->cpu_switch);
+                dst->cpu_switch = NULL;
+        }
        pr_info("DSA: tree %d unapplied\n", dst->tree);
        dst->applied = false;
diff --git a/net/dsa/legacy.c b/net/dsa/legacy.c
index ad345c8b0b06..7281098df04e 100644
--- a/net/dsa/legacy.c
+++ b/net/dsa/legacy.c
@@ -289,53 +289,6 @@ static void dsa_switch_destroy(struct dsa_switch *ds)
        dsa_switch_unregister_notifier(ds);
 }
-#ifdef CONFIG_PM_SLEEP
-int dsa_switch_suspend(struct dsa_switch *ds)
-{
-        int i, ret = 0;
-        /* Suspend slave network devices */
-        for (i = 0; i < ds->num_ports; i++) {
-                if (!dsa_is_port_initialized(ds, i))
-                        continue;
-                ret = dsa_slave_suspend(ds->ports[i].netdev);
-                if (ret)
-                        return ret;
-        }
-        if (ds->ops->suspend)
-                ret = ds->ops->suspend(ds);
-        return ret;
-}
-EXPORT_SYMBOL_GPL(dsa_switch_suspend);
-int dsa_switch_resume(struct dsa_switch *ds)
-{
-        int i, ret = 0;
-        if (ds->ops->resume)
-                ret = ds->ops->resume(ds);
-        if (ret)
-                return ret;
-        /* Resume slave network devices */
-        for (i = 0; i < ds->num_ports; i++) {
-                if (!dsa_is_port_initialized(ds, i))
-                        continue;
-                ret = dsa_slave_resume(ds->ports[i].netdev);
-                if (ret)
-                        return ret;
-        }
-        return 0;
-}
-EXPORT_SYMBOL_GPL(dsa_switch_resume);
-#endif
 /* platform driver init and cleanup *****************************************/
 static int dev_is_class(struct device *dev, void *class)
 {
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index c73160fb11e7..0a0a392dc2bd 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -378,7 +378,6 @@ static void hsr_dev_destroy(struct net_device *hsr_dev)
        del_timer_sync(&hsr->announce_timer);
        synchronize_rcu();
-        free_netdev(hsr_dev);
 }
 static const struct net_device_ops hsr_device_ops = {
@@ -404,7 +403,8 @@ void hsr_dev_setup(struct net_device *dev)
        SET_NETDEV_DEVTYPE(dev, &hsr_type);
        dev->priv_flags |= IFF_NO_QUEUE;
-        dev->destructor = hsr_dev_destroy;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = hsr_dev_destroy;
        dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
                           NETIF_F_GSO_MASK | NETIF_F_HW_CSUM |
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index 4ebe2aa3e7d3..04b5450c5a55 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -324,8 +324,7 @@ static int hsr_fill_frame_info(struct hsr_frame_info *frame,
        unsigned long irqflags;
        frame->is_supervision = is_supervision_frame(port->hsr, skb);
-        frame->node_src = hsr_get_node(&port->hsr->node_db, skb,
+        frame->node_src = hsr_get_node(port, skb, frame->is_supervision);
-                                       frame->is_supervision);
        if (frame->node_src == NULL)
                return -1; /* Unknown node and !is_supervision, or no mem */
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 7ea925816f79..284a9b820df8 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -158,9 +158,10 @@ struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
 /* Get the hsr_node from which 'skb' was sent.
 */
-struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
+struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
                              bool is_sup)
 {
+        struct list_head *node_db = &port->hsr->node_db;
        struct hsr_node *node;
        struct ethhdr *ethhdr;
        u16 seq_out;
@@ -186,7 +187,11 @@ struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
                 */
                seq_out = hsr_get_skb_sequence_nr(skb) - 1;
        } else {
-                WARN_ONCE(1, "%s: Non-HSR frame\n", __func__);
+                /* this is called also for frames from master port and
+                 * so warn only for non master ports
+                 */
+                if (port->type != HSR_PT_MASTER)
+                        WARN_ONCE(1, "%s: Non-HSR frame\n", __func__);
                seq_out = HSR_SEQNR_START;
        }
diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h
index 438b40f98f5a..4e04f0e868e9 100644
--- a/net/hsr/hsr_framereg.h
+++ b/net/hsr/hsr_framereg.h
@@ -18,7 +18,7 @@ struct hsr_node;
 struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
                              u16 seq_out);
-struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
+struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
                              bool is_sup);
 void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr,
                          struct hsr_port *port);
diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c
index d7efbf0dad20..0a866f332290 100644
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -107,7 +107,7 @@ static void lowpan_setup(struct net_device *ldev)
        ldev->netdev_ops        = &lowpan_netdev_ops;
        ldev->header_ops        = &lowpan_header_ops;
-        ldev->destructor        = free_netdev;
+        ldev->needs_free_netdev = true;
        ldev->features          |= NETIF_F_NETNS_LOCAL;
 }
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f3dad1661343..58925b6597de 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1043,7 +1043,7 @@ static struct inet_protosw inetsw_array[] =
                .type =       SOCK_DGRAM,
                .protocol =   IPPROTO_ICMP,
                .prot =       &ping_prot,
-                .ops =        &inet_dgram_ops,
+                .ops =        &inet_sockraw_ops,
                .flags =      INET_PROTOSW_REUSE,
       },
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 0937b34c27ca..e9f3386a528b 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -641,6 +641,32 @@ void arp_xmit(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(arp_xmit);
+static bool arp_is_garp(struct net *net, struct net_device *dev,
+                        int *addr_type, __be16 ar_op,
+                        __be32 sip, __be32 tip,
+                        unsigned char *sha, unsigned char *tha)
+{
+        bool is_garp = tip == sip;
+        /* Gratuitous ARP _replies_ also require target hwaddr to be
+         * the same as source.
+         */
+        if (is_garp && ar_op == htons(ARPOP_REPLY))
+                is_garp =
+                        /* IPv4 over IEEE 1394 doesn't provide target
+                         * hardware address field in its ARP payload.
+                         */
+                        tha &&
+                        !memcmp(tha, sha, dev->addr_len);
+        if (is_garp) {
+                *addr_type = inet_addr_type_dev_table(net, dev, sip);
+                if (*addr_type != RTN_UNICAST)
+                        is_garp = false;
+        }
+        return is_garp;
+}
 /*
 *      Process an arp request.
 */
@@ -653,6 +679,7 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
        unsigned char *arp_ptr;
        struct rtable *rt;
        unsigned char *sha;
+        unsigned char *tha = NULL;
        __be32 sip, tip;
        u16 dev_type = dev->type;
        int addr_type;
@@ -724,6 +751,7 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
                break;
 #endif
        default:
+                tha = arp_ptr;
                arp_ptr += dev->addr_len;
        }
        memcpy(&tip, arp_ptr, 4);
@@ -835,19 +863,25 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
        n = __neigh_lookup(&arp_tbl, &sip, dev, 0);
-        if (IN_DEV_ARP_ACCEPT(in_dev)) {
+        addr_type = -1;
-                unsigned int addr_type = inet_addr_type_dev_table(net, dev, sip);
+        if (n || IN_DEV_ARP_ACCEPT(in_dev)) {
+                is_garp = arp_is_garp(net, dev, &addr_type, arp->ar_op,
+                                      sip, tip, sha, tha);
+        }
+        if (IN_DEV_ARP_ACCEPT(in_dev)) {
                /* Unsolicited ARP is not accepted by default.
                   It is possible, that this option should be enabled for some
                   devices (strip is candidate)
                 */
-                is_garp = arp->ar_op == htons(ARPOP_REQUEST) && tip == sip &&
-                          addr_type == RTN_UNICAST;
                if (!n &&
-                    ((arp->ar_op == htons(ARPOP_REPLY)  &&
+                    (is_garp ||
-                                addr_type == RTN_UNICAST) || is_garp))
+                     (arp->ar_op == htons(ARPOP_REPLY) &&
+                      (addr_type == RTN_UNICAST ||
+                       (addr_type < 0 &&
+                        /* postpone calculation to as late as possible */
+                        inet_addr_type_dev_table(net, dev, sip) ==
+                                RTN_UNICAST)))))
                        n = __neigh_lookup(&arp_tbl, &sip, dev, 1);
        }
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 65cc02bd82bc..93322f895eab 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -248,6 +248,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
        u8 *tail;
        u8 *vaddr;
        int nfrags;
+        int esph_offset;
        struct page *page;
        struct sk_buff *trailer;
        int tailen = esp->tailen;
@@ -313,11 +314,13 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
        }
 cow:
+        esph_offset = (unsigned char *)esp->esph - skb_transport_header(skb);
        nfrags = skb_cow_data(skb, tailen, &trailer);
        if (nfrags < 0)
                goto out;
        tail = skb_tail_pointer(trailer);
-        esp->esph = ip_esp_hdr(skb);
+        esp->esph = (struct ip_esp_hdr *)(skb_transport_header(skb) + esph_offset);
 skip_cow:
        esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 39bd1edee676..83e3ed258467 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -763,7 +763,7 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
        unsigned int e = 0, s_e;
        struct fib_table *tb;
        struct hlist_head *head;
-        int dumped = 0;
+        int dumped = 0, err;
        if (nlmsg_len(cb->nlh) >= sizeof(struct rtmsg) &&
            ((struct rtmsg *) nlmsg_data(cb->nlh))->rtm_flags & RTM_F_CLONED)
@@ -783,20 +783,27 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
                        if (dumped)
                                memset(&cb->args[2], 0, sizeof(cb->args) -
                                                 2 * sizeof(cb->args[0]));
-                        if (fib_table_dump(tb, skb, cb) < 0)
+                        err = fib_table_dump(tb, skb, cb);
-                                goto out;
+                        if (err < 0) {
+                                if (likely(skb->len))
+                                        goto out;
+                                goto out_err;
+                        }
                        dumped = 1;
 next:
                        e++;
                }
        }
 out:
+        err = skb->len;
+out_err:
        rcu_read_unlock();
        cb->args[1] = e;
        cb->args[0] = h;
-        return skb->len;
+        return err;
 }
 /* Prepare and feed intra-kernel routing request.
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index da449ddb8cc1..ad9ad4aab5da 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -203,6 +203,7 @@ static void rt_fibinfo_free_cpus(struct rtable __rcu * __percpu *rtp)
 static void free_fib_info_rcu(struct rcu_head *head)
 {
        struct fib_info *fi = container_of(head, struct fib_info, rcu);
+        struct dst_metrics *m;
        change_nexthops(fi) {
                if (nexthop_nh->nh_dev)
@@ -213,8 +214,9 @@ static void free_fib_info_rcu(struct rcu_head *head)
                rt_fibinfo_free(&nexthop_nh->nh_rth_input);
        } endfor_nexthops(fi);
-        if (fi->fib_metrics != (u32 *) dst_default_metrics)
+        m = fi->fib_metrics;
-                kfree(fi->fib_metrics);
+        if (m != &dst_default_metrics && atomic_dec_and_test(&m->refcnt))
+                kfree(m);
        kfree(fi);
 }
@@ -971,11 +973,11 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg)
                        val = 255;
                if (type == RTAX_FEATURES && (val & ~RTAX_FEATURE_MASK))
                        return -EINVAL;
-                fi->fib_metrics[type - 1] = val;
+                fi->fib_metrics->metrics[type - 1] = val;
        }
        if (ecn_ca)
-                fi->fib_metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
+                fi->fib_metrics->metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
        return 0;
 }
@@ -1033,11 +1035,12 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
                goto failure;
        fib_info_cnt++;
        if (cfg->fc_mx) {
-                fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
+                fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
                if (!fi->fib_metrics)
                        goto failure;
+                atomic_set(&fi->fib_metrics->refcnt, 1);
        } else
-                fi->fib_metrics = (u32 *) dst_default_metrics;
+                fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
        fi->fib_net = net;
        fi->fib_protocol = cfg->fc_protocol;
@@ -1238,7 +1241,7 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
        if (fi->fib_priority &&
            nla_put_u32(skb, RTA_PRIORITY, fi->fib_priority))
                goto nla_put_failure;
-        if (rtnetlink_put_metrics(skb, fi->fib_metrics) < 0)
+        if (rtnetlink_put_metrics(skb, fi->fib_metrics->metrics) < 0)
                goto nla_put_failure;
        if (fi->fib_prefsrc &&
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 1201409ba1dc..51182ff2b441 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1983,6 +1983,8 @@ static int fn_trie_dump_leaf(struct key_vector *l, struct fib_table *tb,
        /* rcu_read_lock is hold by caller */
        hlist_for_each_entry_rcu(fa, &l->leaf, fa_list) {
+                int err;
                if (i < s_i) {
                        i++;
                        continue;
@@ -1993,17 +1995,14 @@ static int fn_trie_dump_leaf(struct key_vector *l, struct fib_table *tb,
                        continue;
                }
-                if (fib_dump_info(skb, NETLINK_CB(cb->skb).portid,
+                err = fib_dump_info(skb, NETLINK_CB(cb->skb).portid,
-                                  cb->nlh->nlmsg_seq,
+                                    cb->nlh->nlmsg_seq, RTM_NEWROUTE,
-                                  RTM_NEWROUTE,
+                                    tb->tb_id, fa->fa_type,
-                                  tb->tb_id,
+                                    xkey, KEYLENGTH - fa->fa_slen,
-                                  fa->fa_type,
+                                    fa->fa_tos, fa->fa_info, NLM_F_MULTI);
-                                  xkey,
+                if (err < 0) {
-                                  KEYLENGTH - fa->fa_slen,
-                                  fa->fa_tos,
-                                  fa->fa_info, NLM_F_MULTI) < 0) {
                        cb->args[4] = i;
-                        return -1;
+                        return err;
                }
                i++;
        }
@@ -2025,10 +2024,13 @@ int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
        t_key key = cb->args[3];
        while ((l = leaf_walk_rcu(&tp, key)) != NULL) {
-                if (fn_trie_dump_leaf(l, tb, skb, cb) < 0) {
+                int err;
+                err = fn_trie_dump_leaf(l, tb, skb, cb);
+                if (err < 0) {
                        cb->args[3] = key;
                        cb->args[2] = count;
-                        return -1;
+                        return err;
                }
                ++count;
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 43318b5f5647..9144fa7df2ad 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -657,8 +657,12 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
        /* Needed by both icmp_global_allow and icmp_xmit_lock */
        local_bh_disable();
-        /* Check global sysctl_icmp_msgs_per_sec ratelimit */
+        /* Check global sysctl_icmp_msgs_per_sec ratelimit, unless
-        if (!icmpv4_global_allow(net, type, code))
+         * incoming dev is loopback.  If outgoing dev change to not be
+         * loopback, then peer ratelimit still work (in icmpv4_xrlim_allow)
+         */
+        if (!(skb_in->dev && (skb_in->dev->flags&IFF_LOOPBACK)) &&
+              !icmpv4_global_allow(net, type, code))
                goto out_bh_enable;
        sk = icmp_xmit_lock(net);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 44fd86de2823..ec9a396fa466 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1112,6 +1112,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
        pmc = kzalloc(sizeof(*pmc), GFP_KERNEL);
        if (!pmc)
                return;
+        spin_lock_init(&pmc->lock);
        spin_lock_bh(&im->lock);
        pmc->interface = im->interface;
        in_dev_hold(in_dev);
@@ -2071,21 +2072,26 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
 static void ip_mc_clear_src(struct ip_mc_list *pmc)
 {
-        struct ip_sf_list *psf, *nextpsf;
+        struct ip_sf_list *psf, *nextpsf, *tomb, *sources;
-        for (psf = pmc->tomb; psf; psf = nextpsf) {
+        spin_lock_bh(&pmc->lock);
+        tomb = pmc->tomb;
+        pmc->tomb = NULL;
+        sources = pmc->sources;
+        pmc->sources = NULL;
+        pmc->sfmode = MCAST_EXCLUDE;
+        pmc->sfcount[MCAST_INCLUDE] = 0;
+        pmc->sfcount[MCAST_EXCLUDE] = 1;
+        spin_unlock_bh(&pmc->lock);
+        for (psf = tomb; psf; psf = nextpsf) {
                nextpsf = psf->sf_next;
                kfree(psf);
        }
-        pmc->tomb = NULL;
+        for (psf = sources; psf; psf = nextpsf) {
-        for (psf = pmc->sources; psf; psf = nextpsf) {
                nextpsf = psf->sf_next;
                kfree(psf);
        }
-        pmc->sources = NULL;
-        pmc->sfmode = MCAST_EXCLUDE;
-        pmc->sfcount[MCAST_INCLUDE] = 0;
-        pmc->sfcount[MCAST_EXCLUDE] = 1;
 }
 /* Join a multicast group
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 7a3fd25e8913..532b36e9ce2a 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -964,7 +964,8 @@ static int __ip_append_data(struct sock *sk,
                csummode = CHECKSUM_PARTIAL;
        cork->length += length;
-        if ((((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb))) &&
+        if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
+             (skb && skb_is_gso(skb))) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
            (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index b878ecbc0608..129d1a3616f8 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -446,6 +446,8 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
        return 0;
 drop:
+        if (tun_dst)
+                dst_release((struct dst_entry *)tun_dst);
        kfree_skb(skb);
        return 0;
 }
@@ -967,7 +969,6 @@ static void ip_tunnel_dev_free(struct net_device *dev)
        gro_cells_destroy(&tunnel->gro_cells);
        dst_cache_destroy(&tunnel->dst_cache);
        free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 void ip_tunnel_dellink(struct net_device *dev, struct list_head *head)
@@ -1155,7 +1156,8 @@ int ip_tunnel_init(struct net_device *dev)
        struct iphdr *iph = &tunnel->parms.iph;
        int err;
-        dev->destructor = ip_tunnel_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip_tunnel_dev_free;
        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
        if (!dev->tstats)
                return -ENOMEM;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 3a02d52ed50e..8ae425cad818 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -101,8 +101,8 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id);
 static void ipmr_free_table(struct mr_table *mrt);
 static void ip_mr_forward(struct net *net, struct mr_table *mrt,
-                          struct sk_buff *skb, struct mfc_cache *cache,
+                          struct net_device *dev, struct sk_buff *skb,
-                          int local);
+                          struct mfc_cache *cache, int local);
 static int ipmr_cache_report(struct mr_table *mrt,
                             struct sk_buff *pkt, vifi_t vifi, int assert);
 static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
@@ -501,7 +501,7 @@ static void reg_vif_setup(struct net_device *dev)
        dev->mtu                = ETH_DATA_LEN - sizeof(struct iphdr) - 8;
        dev->flags              = IFF_NOARP;
        dev->netdev_ops         = &reg_vif_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
        dev->features           |= NETIF_F_NETNS_LOCAL;
 }
@@ -988,7 +988,7 @@ static void ipmr_cache_resolve(struct net *net, struct mr_table *mrt,
                        rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
                } else {
-                        ip_mr_forward(net, mrt, skb, c, 0);
+                        ip_mr_forward(net, mrt, skb->dev, skb, c, 0);
                }
        }
 }
@@ -1073,7 +1073,7 @@ static int ipmr_cache_report(struct mr_table *mrt,
 /* Queue a packet for resolution. It gets locked cache entry! */
 static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi,
-                                 struct sk_buff *skb)
+                                 struct sk_buff *skb, struct net_device *dev)
 {
        const struct iphdr *iph = ip_hdr(skb);
        struct mfc_cache *c;
@@ -1130,6 +1130,10 @@ static int ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi,
                kfree_skb(skb);
                err = -ENOBUFS;
        } else {
+                if (dev) {
+                        skb->dev = dev;
+                        skb->skb_iif = dev->ifindex;
+                }
                skb_queue_tail(&c->mfc_un.unres.unresolved, skb);
                err = 0;
        }
@@ -1828,10 +1832,10 @@ static int ipmr_find_vif(struct mr_table *mrt, struct net_device *dev)
 /* "local" means that we should preserve one skb (for local delivery) */
 static void ip_mr_forward(struct net *net, struct mr_table *mrt,
-                          struct sk_buff *skb, struct mfc_cache *cache,
+                          struct net_device *dev, struct sk_buff *skb,
-                          int local)
+                          struct mfc_cache *cache, int local)
 {
-        int true_vifi = ipmr_find_vif(mrt, skb->dev);
+        int true_vifi = ipmr_find_vif(mrt, dev);
        int psend = -1;
        int vif, ct;
@@ -1853,13 +1857,7 @@ static void ip_mr_forward(struct net *net, struct mr_table *mrt,
        }
        /* Wrong interface: drop packet and (maybe) send PIM assert. */
-        if (mrt->vif_table[vif].dev != skb->dev) {
+        if (mrt->vif_table[vif].dev != dev) {
-                struct net_device *mdev;
-                mdev = l3mdev_master_dev_rcu(mrt->vif_table[vif].dev);
-                if (mdev == skb->dev)
-                        goto forward;
                if (rt_is_output_route(skb_rtable(skb))) {
                        /* It is our own packet, looped back.
                         * Very complicated situation...
@@ -1980,6 +1978,20 @@ int ip_mr_input(struct sk_buff *skb)
        struct net *net = dev_net(skb->dev);
        int local = skb_rtable(skb)->rt_flags & RTCF_LOCAL;
        struct mr_table *mrt;
+        struct net_device *dev;
+        /* skb->dev passed in is the loX master dev for vrfs.
+         * As there are no vifs associated with loopback devices,
+         * get the proper interface that does have a vif associated with it.
+         */
+        dev = skb->dev;
+        if (netif_is_l3_master(skb->dev)) {
+                dev = dev_get_by_index_rcu(net, IPCB(skb)->iif);
+                if (!dev) {
+                        kfree_skb(skb);
+                        return -ENODEV;
+                }
+        }
        /* Packet is looped back after forward, it should not be
         * forwarded second time, but still can be delivered locally.
@@ -2017,7 +2029,7 @@ int ip_mr_input(struct sk_buff *skb)
        /* already under rcu_read_lock() */
        cache = ipmr_cache_find(mrt, ip_hdr(skb)->saddr, ip_hdr(skb)->daddr);
        if (!cache) {
-                int vif = ipmr_find_vif(mrt, skb->dev);
+                int vif = ipmr_find_vif(mrt, dev);
                if (vif >= 0)
                        cache = ipmr_cache_find_any(mrt, ip_hdr(skb)->daddr,
@@ -2037,9 +2049,9 @@ int ip_mr_input(struct sk_buff *skb)
                }
                read_lock(&mrt_lock);
-                vif = ipmr_find_vif(mrt, skb->dev);
+                vif = ipmr_find_vif(mrt, dev);
                if (vif >= 0) {
-                        int err2 = ipmr_cache_unresolved(mrt, vif, skb);
+                        int err2 = ipmr_cache_unresolved(mrt, vif, skb, dev);
                        read_unlock(&mrt_lock);
                        return err2;
@@ -2050,7 +2062,7 @@ int ip_mr_input(struct sk_buff *skb)
        }
        read_lock(&mrt_lock);
-        ip_mr_forward(net, mrt, skb, cache, local);
+        ip_mr_forward(net, mrt, dev, skb, cache, local);
        read_unlock(&mrt_lock);
        if (local)
@@ -2224,7 +2236,7 @@ int ipmr_get_route(struct net *net, struct sk_buff *skb,
                iph->saddr = saddr;
                iph->daddr = daddr;
                iph->version = 0;
-                err = ipmr_cache_unresolved(mrt, vif, skb2);
+                err = ipmr_cache_unresolved(mrt, vif, skb2, dev);
                read_unlock(&mrt_lock);
                rcu_read_unlock();
                return err;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 655d9eebe43e..6883b3d4ba8f 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1385,8 +1385,12 @@ static void rt_add_uncached_list(struct rtable *rt)
 static void ipv4_dst_destroy(struct dst_entry *dst)
 {
+        struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);
        struct rtable *rt = (struct rtable *) dst;
+        if (p != &dst_default_metrics && atomic_dec_and_test(&p->refcnt))
+                kfree(p);
        if (!list_empty(&rt->rt_uncached)) {
                struct uncached_list *ul = rt->rt_uncached_list;
@@ -1438,7 +1442,11 @@ static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
                        rt->rt_gateway = nh->nh_gw;
                        rt->rt_uses_gateway = 1;
                }
-                dst_init_metrics(&rt->dst, fi->fib_metrics, true);
+                dst_init_metrics(&rt->dst, fi->fib_metrics->metrics, true);
+                if (fi->fib_metrics != &dst_default_metrics) {
+                        rt->dst._metrics |= DST_METRICS_REFCOUNTED;
+                        atomic_inc(&fi->fib_metrics->refcnt);
+                }
 #ifdef CONFIG_IP_ROUTE_CLASSID
                rt->dst.tclassid = nh->nh_tclassid;
 #endif
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 1e4c76d2b827..40aca7803cf2 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1084,9 +1084,12 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
 {
        struct tcp_sock *tp = tcp_sk(sk);
        struct inet_sock *inet = inet_sk(sk);
+        struct sockaddr *uaddr = msg->msg_name;
        int err, flags;
-        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE))
+        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) ||
+            (uaddr && msg->msg_namelen >= sizeof(uaddr->sa_family) &&
+             uaddr->sa_family == AF_UNSPEC))
                return -EOPNOTSUPP;
        if (tp->fastopen_req)
                return -EALREADY; /* Another Fast Open is in progress */
@@ -1108,7 +1111,7 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
                }
        }
        flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0;
-        err = __inet_stream_connect(sk->sk_socket, msg->msg_name,
+        err = __inet_stream_connect(sk->sk_socket, uaddr,
                                    msg->msg_namelen, flags, 1);
        /* fastopen_req could already be freed in __inet_stream_connect
         * if the connection times out or gets rst
@@ -2320,9 +2323,15 @@ int tcp_disconnect(struct sock *sk, int flags)
        tcp_set_ca_state(sk, TCP_CA_Open);
        tcp_clear_retrans(tp);
        inet_csk_delack_init(sk);
+        /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0
+         * issue in __tcp_select_window()
+         */
+        icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
        tcp_init_send_head(sk);
        memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
        __sk_dst_reset(sk);
+        dst_release(sk->sk_rx_dst);
+        sk->sk_rx_dst = NULL;
        tcp_saved_syn_free(tp);
        /* Clean up fastopen related fields */
@@ -2374,9 +2383,10 @@ static int tcp_repair_set_window(struct tcp_sock *tp, char __user *optbuf, int l
        return 0;
 }
-static int tcp_repair_options_est(struct tcp_sock *tp,
+static int tcp_repair_options_est(struct sock *sk,
                struct tcp_repair_opt __user *optbuf, unsigned int len)
 {
+        struct tcp_sock *tp = tcp_sk(sk);
        struct tcp_repair_opt opt;
        while (len >= sizeof(opt)) {
@@ -2389,6 +2399,7 @@ static int tcp_repair_options_est(struct tcp_sock *tp,
                switch (opt.opt_code) {
                case TCPOPT_MSS:
                        tp->rx_opt.mss_clamp = opt.opt_val;
+                        tcp_mtup_init(sk);
                        break;
                case TCPOPT_WINDOW:
                        {
@@ -2548,7 +2559,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                if (!tp->repair)
                        err = -EINVAL;
                else if (sk->sk_state == TCP_ESTABLISHED)
-                        err = tcp_repair_options_est(tp,
+                        err = tcp_repair_options_est(sk,
                                        (struct tcp_repair_opt __user *)optval,
                                        optlen);
                else
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 6e3c512054a6..324c9bcc5456 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -180,6 +180,7 @@ void tcp_init_congestion_control(struct sock *sk)
 {
        const struct inet_connection_sock *icsk = inet_csk(sk);
+        tcp_sk(sk)->prior_ssthresh = 0;
        if (icsk->icsk_ca_ops->init)
                icsk->icsk_ca_ops->init(sk);
        if (tcp_ca_needs_ecn(sk))
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 5a3ad09e2786..174d4376baa5 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1179,13 +1179,14 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
                 */
                if (pkt_len > mss) {
                        unsigned int new_len = (pkt_len / mss) * mss;
-                        if (!in_sack && new_len < pkt_len) {
+                        if (!in_sack && new_len < pkt_len)
                                new_len += mss;
-                                if (new_len >= skb->len)
-                                        return 0;
-                        }
                        pkt_len = new_len;
                }
+                if (pkt_len >= skb->len && !in_sack)
+                        return 0;
                err = tcp_fragment(sk, skb, pkt_len, mss, GFP_ATOMIC);
                if (err < 0)
                        return err;
@@ -3189,7 +3190,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                        int delta;
                        /* Non-retransmitted hole got filled? That's reordering */
-                        if (reord < prior_fackets)
+                        if (reord < prior_fackets && reord <= tp->fackets_out)
                                tcp_update_reordering(sk, tp->fackets_out - reord, 0);
                        delta = tcp_is_fack(tp) ? pkts_acked :
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ea6e4cff9faf..1d6219bf2d6b 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1612,7 +1612,7 @@ static void udp_v4_rehash(struct sock *sk)
        udp_lib_rehash(sk, new_hash);
 }
-int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
        int rc;
@@ -1657,7 +1657,7 @@ EXPORT_SYMBOL(udp_encap_enable);
 * Note that in the success and error cases, the skb is assumed to
 * have either been requeued or freed.
 */
-int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+static int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
        struct udp_sock *up = udp_sk(sk);
        int is_udplite = IS_UDPLITE(sk);
diff --git a/net/ipv4/udp_impl.h b/net/ipv4/udp_impl.h
index feb50a16398d..a8cf8c6fb60c 100644
--- a/net/ipv4/udp_impl.h
+++ b/net/ipv4/udp_impl.h
@@ -25,7 +25,6 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
                int flags, int *addr_len);
 int udp_sendpage(struct sock *sk, struct page *page, int offset, size_t size,
                 int flags);
-int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 void udp_destroy_sock(struct sock *sk);
 #ifdef CONFIG_PROC_FS
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 8d297a79b568..1d2dbace42ff 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -332,9 +332,9 @@ static void addrconf_mod_rs_timer(struct inet6_dev *idev,
 static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp,
                                   unsigned long delay)
 {
-        if (!delayed_work_pending(&ifp->dad_work))
+        in6_ifa_hold(ifp);
-                in6_ifa_hold(ifp);
+        if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay))
-        mod_delayed_work(addrconf_wq, &ifp->dad_work, delay);
+                in6_ifa_put(ifp);
 }
 static int snmp6_alloc_dev(struct inet6_dev *idev)
@@ -1022,7 +1022,10 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
        INIT_HLIST_NODE(&ifa->addr_lst);
        ifa->scope = scope;
        ifa->prefix_len = pfxlen;
-        ifa->flags = flags | IFA_F_TENTATIVE;
+        ifa->flags = flags;
+        /* No need to add the TENTATIVE flag for addresses with NODAD */
+        if (!(flags & IFA_F_NODAD))
+                ifa->flags |= IFA_F_TENTATIVE;
        ifa->valid_lft = valid_lft;
        ifa->prefered_lft = prefered_lft;
        ifa->cstamp = ifa->tstamp = jiffies;
@@ -3366,6 +3369,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct netdev_notifier_changeupper_info *info;
        struct inet6_dev *idev = __in6_dev_get(dev);
+        struct net *net = dev_net(dev);
        int run_pending = 0;
        int err;
@@ -3381,7 +3385,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
        case NETDEV_CHANGEMTU:
                /* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */
                if (dev->mtu < IPV6_MIN_MTU) {
-                        addrconf_ifdown(dev, 1);
+                        addrconf_ifdown(dev, dev != net->loopback_dev);
                        break;
                }
@@ -3497,7 +3501,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                         * IPV6_MIN_MTU stop IPv6 on this interface.
                         */
                        if (dev->mtu < IPV6_MIN_MTU)
-                                addrconf_ifdown(dev, 1);
+                                addrconf_ifdown(dev, dev != net->loopback_dev);
                }
                break;
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 37ac9de713c6..8d772fea1dde 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -1319,7 +1319,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
        struct ipv6hdr *ip6_hdr;
        struct ipv6_opt_hdr *hop;
        unsigned char buf[CALIPSO_MAX_BUFFER];
-        int len_delta, new_end, pad;
+        int len_delta, new_end, pad, payload;
        unsigned int start, end;
        ip6_hdr = ipv6_hdr(skb);
@@ -1346,6 +1346,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
        if (ret_val < 0)
                return ret_val;
+        ip6_hdr = ipv6_hdr(skb); /* Reset as skb_cow() may have moved it */
        if (len_delta) {
                if (len_delta > 0)
                        skb_push(skb, len_delta);
@@ -1355,6 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
                        sizeof(*ip6_hdr) + start);
                skb_reset_network_header(skb);
                ip6_hdr = ipv6_hdr(skb);
+                payload = ntohs(ip6_hdr->payload_len);
+                ip6_hdr->payload_len = htons(payload + len_delta);
        }
        hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index e011122ebd43..5c786f5ab961 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -250,8 +250,14 @@ ipv4_connected:
         */
        err = ip6_datagram_dst_update(sk, true);
-        if (err)
+        if (err) {
+                /* Reset daddr and dport so that udp_v6_early_demux()
+                 * fails to find this socket
+                 */
+                memset(&sk->sk_v6_daddr, 0, sizeof(sk->sk_v6_daddr));
+                inet->inet_dport = 0;
                goto out;
+        }
        sk->sk_state = TCP_ESTABLISHED;
        sk_set_txhash(sk);
diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index d950d43ba255..f02f131f6435 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -30,6 +30,25 @@
 #include <net/ipv6.h>
 #include <linux/icmpv6.h>
+static __u16 esp6_nexthdr_esp_offset(struct ipv6hdr *ipv6_hdr, int nhlen)
+{
+        int off = sizeof(struct ipv6hdr);
+        struct ipv6_opt_hdr *exthdr;
+        if (likely(ipv6_hdr->nexthdr == NEXTHDR_ESP))
+                return offsetof(struct ipv6hdr, nexthdr);
+        while (off < nhlen) {
+                exthdr = (void *)ipv6_hdr + off;
+                if (exthdr->nexthdr == NEXTHDR_ESP)
+                        return off;
+                off += ipv6_optlen(exthdr);
+        }
+        return 0;
+}
 static struct sk_buff **esp6_gro_receive(struct sk_buff **head,
                                         struct sk_buff *skb)
 {
@@ -38,6 +57,7 @@ static struct sk_buff **esp6_gro_receive(struct sk_buff **head,
        struct xfrm_state *x;
        __be32 seq;
        __be32 spi;
+        int nhoff;
        int err;
        skb_pull(skb, offset);
@@ -72,6 +92,11 @@ static struct sk_buff **esp6_gro_receive(struct sk_buff **head,
        xo->flags |= XFRM_GRO;
+        nhoff = esp6_nexthdr_esp_offset(ipv6_hdr(skb), offset);
+        if (!nhoff)
+                goto out;
+        IP6CB(skb)->nhoff = nhoff;
        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
        XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
        XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index eea23b57c6a5..ec849d88a662 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -32,7 +32,6 @@ struct fib6_rule {
 struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
                                   int flags, pol_lookup_t lookup)
 {
-        struct rt6_info *rt;
        struct fib_lookup_arg arg = {
                .lookup_ptr = lookup,
                .flags = FIB_LOOKUP_NOREF,
@@ -44,21 +43,11 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
        fib_rules_lookup(net->ipv6.fib6_rules_ops,
                         flowi6_to_flowi(fl6), flags, &arg);
-        rt = arg.result;
+        if (arg.result)
+                return arg.result;
-        if (!rt) {
+        dst_hold(&net->ipv6.ip6_null_entry->dst);
-                dst_hold(&net->ipv6.ip6_null_entry->dst);
+        return &net->ipv6.ip6_null_entry->dst;
-                return &net->ipv6.ip6_null_entry->dst;
-        }
-        if (rt->rt6i_flags & RTF_REJECT &&
-            rt->dst.error == -EAGAIN) {
-                ip6_rt_put(rt);
-                rt = net->ipv6.ip6_null_entry;
-                dst_hold(&rt->dst);
-        }
-        return &rt->dst;
 }
 static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
@@ -121,7 +110,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                        flp6->saddr = saddr;
                }
                err = rt->dst.error;
-                goto out;
+                if (err != -EAGAIN)
+                        goto out;
        }
 again:
        ip6_rt_put(rt);
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 230b5aac9f03..8d7b113958b1 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -491,7 +491,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
        local_bh_disable();
        /* Check global sysctl_icmp_msgs_per_sec ratelimit */
-        if (!icmpv6_global_allow(type))
+        if (!(skb->dev->flags&IFF_LOOPBACK) && !icmpv6_global_allow(type))
                goto out_bh_enable;
        mip6_addr_swap(skb);
diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
index 2fd5ca151dcf..77f7f8c7d93d 100644
--- a/net/ipv6/ila/ila_xlat.c
+++ b/net/ipv6/ila/ila_xlat.c
@@ -62,6 +62,7 @@ static inline u32 ila_locator_hash(struct ila_locator loc)
 {
        u32 *v = (u32 *)loc.v32;
+        __ila_hash_secret_init();
        return jhash_2words(v[0], v[1], hashrnd);
 }
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index d4bf2c68a545..e6b78ba0e636 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -289,8 +289,7 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
        struct rt6_info *rt;
        rt = lookup(net, net->ipv6.fib6_main_tbl, fl6, flags);
-        if (rt->rt6i_flags & RTF_REJECT &&
+        if (rt->dst.error == -EAGAIN) {
-            rt->dst.error == -EAGAIN) {
                ip6_rt_put(rt);
                rt = net->ipv6.ip6_null_entry;
                dst_hold(&rt->dst);
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 8d128ba79b66..64eea3962733 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -537,11 +537,10 @@ static inline int ip6gre_xmit_ipv4(struct sk_buff *skb, struct net_device *dev)
        memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
-        dsfield = ipv4_get_dsfield(iph);
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
+                dsfield = ipv4_get_dsfield(iph);
-                                          & IPV6_TCLASS_MASK;
+        else
+                dsfield = ip6_tclass(t->parms.flowinfo);
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
                fl6.flowi6_mark = skb->mark;
        else
@@ -598,9 +597,11 @@ static inline int ip6gre_xmit_ipv6(struct sk_buff *skb, struct net_device *dev)
        memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
-        dsfield = ipv6_get_dsfield(ipv6h);
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
+                dsfield = ipv6_get_dsfield(ipv6h);
+        else
+                dsfield = ip6_tclass(t->parms.flowinfo);
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
                fl6.flowlabel |= ip6_flowlabel(ipv6h);
        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
@@ -990,13 +991,13 @@ static void ip6gre_dev_free(struct net_device *dev)
        dst_cache_destroy(&t->dst_cache);
        free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 static void ip6gre_tunnel_setup(struct net_device *dev)
 {
        dev->netdev_ops = &ip6gre_netdev_ops;
-        dev->destructor = ip6gre_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip6gre_dev_free;
        dev->type = ARPHRD_IP6GRE;
@@ -1147,7 +1148,7 @@ static int __net_init ip6gre_init_net(struct net *net)
        return 0;
 err_reg_dev:
-        ip6gre_dev_free(ign->fb_tunnel_dev);
+        free_netdev(ign->fb_tunnel_dev);
 err_alloc_dev:
        return err;
 }
@@ -1299,7 +1300,8 @@ static void ip6gre_tap_setup(struct net_device *dev)
        ether_setup(dev);
        dev->netdev_ops = &ip6gre_tap_netdev_ops;
-        dev->destructor = ip6gre_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip6gre_dev_free;
        dev->features |= NETIF_F_NETNS_LOCAL;
        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 93e58a5e1837..cdb3728faca7 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -63,7 +63,6 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
        const struct net_offload *ops;
        int proto;
        struct frag_hdr *fptr;
-        unsigned int unfrag_ip6hlen;
        unsigned int payload_len;
        u8 *prevhdr;
        int offset = 0;
@@ -116,8 +115,12 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                skb->network_header = (u8 *)ipv6h - skb->head;
                if (udpfrag) {
-                        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+                        int err = ip6_find_1stfragopt(skb, &prevhdr);
-                        fptr = (struct frag_hdr *)((u8 *)ipv6h + unfrag_ip6hlen);
+                        if (err < 0) {
+                                kfree_skb_list(segs);
+                                return ERR_PTR(err);
+                        }
+                        fptr = (struct frag_hdr *)((u8 *)ipv6h + err);
                        fptr->frag_off = htons(offset);
                        if (skb->next)
                                fptr->frag_off |= htons(IP6_MF);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 58f6288e9ba5..1699acb2fa2c 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -597,7 +597,10 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
        int ptr, offset = 0, err = 0;
        u8 *prevhdr, nexthdr = 0;
-        hlen = ip6_find_1stfragopt(skb, &prevhdr);
+        err = ip6_find_1stfragopt(skb, &prevhdr);
+        if (err < 0)
+                goto fail;
+        hlen = err;
        nexthdr = *prevhdr;
        mtu = ip6_skb_dst_mtu(skb);
@@ -1387,7 +1390,7 @@ emsgsize:
         */
        cork->length += length;
-        if ((((length + fragheaderlen) > mtu) ||
+        if ((((length + (skb ? skb->len : headersize)) > mtu) ||
             (skb && skb_is_gso(skb))) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
@@ -1463,6 +1466,11 @@ alloc_new_skb:
                         */
                        alloclen += sizeof(struct frag_hdr);
+                        copy = datalen - transhdrlen - fraggap;
+                        if (copy < 0) {
+                                err = -EINVAL;
+                                goto error;
+                        }
                        if (transhdrlen) {
                                skb = sock_alloc_send_skb(sk,
                                                alloclen + hh_len,
@@ -1512,13 +1520,9 @@ alloc_new_skb:
                                data += fraggap;
                                pskb_trim_unique(skb_prev, maxfraglen);
                        }
-                        copy = datalen - transhdrlen - fraggap;
+                        if (copy > 0 &&
+                            getfrag(from, data + transhdrlen, offset,
-                        if (copy < 0) {
+                                    copy, fraggap, skb) < 0) {
-                                err = -EINVAL;
-                                kfree_skb(skb);
-                                goto error;
-                        } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
                                err = -EFAULT;
                                kfree_skb(skb);
                                goto error;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 6eb2ae507500..8c6c3c8e7eef 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -254,7 +254,6 @@ static void ip6_dev_free(struct net_device *dev)
        gro_cells_destroy(&t->gro_cells);
        dst_cache_destroy(&t->dst_cache);
        free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 static int ip6_tnl_create2(struct net_device *dev)
@@ -322,7 +321,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
        return t;
 failed_free:
-        ip6_dev_free(dev);
+        free_netdev(dev);
 failed:
        return ERR_PTR(err);
 }
@@ -859,6 +858,8 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,
        return 0;
 drop:
+        if (tun_dst)
+                dst_release((struct dst_entry *)tun_dst);
        kfree_skb(skb);
        return 0;
 }
@@ -1095,6 +1096,9 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
        if (!dst) {
 route_lookup:
+                /* add dsfield to flowlabel for route lookup */
+                fl6->flowlabel = ip6_make_flowinfo(dsfield, fl6->flowlabel);
                dst = ip6_route_output(net, NULL, fl6);
                if (dst->error)
@@ -1196,7 +1200,7 @@ route_lookup:
        skb_push(skb, sizeof(struct ipv6hdr));
        skb_reset_network_header(skb);
        ipv6h = ipv6_hdr(skb);
-        ip6_flow_hdr(ipv6h, INET_ECN_encapsulate(0, dsfield),
+        ip6_flow_hdr(ipv6h, dsfield,
                     ip6_make_flowlabel(net, skb, fl6->flowlabel, true, fl6));
        ipv6h->hop_limit = hop_limit;
        ipv6h->nexthdr = proto;
@@ -1231,8 +1235,6 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        if (tproto != IPPROTO_IPIP && tproto != 0)
                return -1;
-        dsfield = ipv4_get_dsfield(iph);
        if (t->parms.collect_md) {
                struct ip_tunnel_info *tun_info;
                const struct ip_tunnel_key *key;
@@ -1246,6 +1248,7 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                fl6.flowi6_proto = IPPROTO_IPIP;
                fl6.daddr = key->u.ipv6.dst;
                fl6.flowlabel = key->label;
+                dsfield =  key->tos;
        } else {
                if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                        encap_limit = t->parms.encap_limit;
@@ -1254,8 +1257,9 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                fl6.flowi6_proto = IPPROTO_IPIP;
                if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                        fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
+                        dsfield = ipv4_get_dsfield(iph);
-                                         & IPV6_TCLASS_MASK;
+                else
+                        dsfield = ip6_tclass(t->parms.flowinfo);
                if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
                        fl6.flowi6_mark = skb->mark;
                else
@@ -1267,6 +1271,8 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
                return -1;
+        dsfield = INET_ECN_encapsulate(dsfield, ipv4_get_dsfield(iph));
        skb_set_inner_ipproto(skb, IPPROTO_IPIP);
        err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
@@ -1300,8 +1306,6 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
            ip6_tnl_addr_conflict(t, ipv6h))
                return -1;
-        dsfield = ipv6_get_dsfield(ipv6h);
        if (t->parms.collect_md) {
                struct ip_tunnel_info *tun_info;
                const struct ip_tunnel_key *key;
@@ -1315,6 +1319,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                fl6.flowi6_proto = IPPROTO_IPV6;
                fl6.daddr = key->u.ipv6.dst;
                fl6.flowlabel = key->label;
+                dsfield = key->tos;
        } else {
                offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
                /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
@@ -1337,7 +1342,9 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                fl6.flowi6_proto = IPPROTO_IPV6;
                if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                        fl6.flowlabel |= (*(__be32 *)ipv6h & IPV6_TCLASS_MASK);
+                        dsfield = ipv6_get_dsfield(ipv6h);
+                else
+                        dsfield = ip6_tclass(t->parms.flowinfo);
                if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
                        fl6.flowlabel |= ip6_flowlabel(ipv6h);
                if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
@@ -1351,6 +1358,8 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
                return -1;
+        dsfield = INET_ECN_encapsulate(dsfield, ipv6_get_dsfield(ipv6h));
        skb_set_inner_ipproto(skb, IPPROTO_IPV6);
        err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
@@ -1769,7 +1778,8 @@ static const struct net_device_ops ip6_tnl_netdev_ops = {
 static void ip6_tnl_dev_setup(struct net_device *dev)
 {
        dev->netdev_ops = &ip6_tnl_netdev_ops;
-        dev->destructor = ip6_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ip6_dev_free;
        dev->type = ARPHRD_TUNNEL6;
        dev->flags |= IFF_NOARP;
@@ -2216,7 +2226,7 @@ static int __net_init ip6_tnl_init_net(struct net *net)
        return 0;
 err_register:
-        ip6_dev_free(ip6n->fb_tnl_dev);
+        free_netdev(ip6n->fb_tnl_dev);
 err_alloc_dev:
        return err;
 }
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index d67ef56454b2..837ea1eefe7f 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -180,7 +180,6 @@ vti6_tnl_unlink(struct vti6_net *ip6n, struct ip6_tnl *t)
 static void vti6_dev_free(struct net_device *dev)
 {
        free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 static int vti6_tnl_create2(struct net_device *dev)
@@ -235,7 +234,7 @@ static struct ip6_tnl *vti6_tnl_create(struct net *net, struct __ip6_tnl_parm *p
        return t;
 failed_free:
-        vti6_dev_free(dev);
+        free_netdev(dev);
 failed:
        return NULL;
 }
@@ -842,7 +841,8 @@ static const struct net_device_ops vti6_netdev_ops = {
 static void vti6_dev_setup(struct net_device *dev)
 {
        dev->netdev_ops = &vti6_netdev_ops;
-        dev->destructor = vti6_dev_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = vti6_dev_free;
        dev->type = ARPHRD_TUNNEL6;
        dev->hard_header_len = LL_MAX_HEADER + sizeof(struct ipv6hdr);
@@ -1100,7 +1100,7 @@ static int __net_init vti6_init_net(struct net *net)
        return 0;
 err_register:
-        vti6_dev_free(ip6n->fb_tnl_dev);
+        free_netdev(ip6n->fb_tnl_dev);
 err_alloc_dev:
        return err;
 }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 374997d26488..2ecb39b943b5 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -733,7 +733,7 @@ static void reg_vif_setup(struct net_device *dev)
        dev->mtu                = 1500 - sizeof(struct ipv6hdr) - 8;
        dev->flags              = IFF_NOARP;
        dev->netdev_ops         = &reg_vif_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
        dev->features           |= NETIF_F_NETNS_LOCAL;
 }
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index cd4252346a32..e9065b8d3af8 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -79,14 +79,13 @@ EXPORT_SYMBOL(ipv6_select_ident);
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
        u16 offset = sizeof(struct ipv6hdr);
-        struct ipv6_opt_hdr *exthdr =
-                                (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
        unsigned int packet_len = skb_tail_pointer(skb) -
                skb_network_header(skb);
        int found_rhdr = 0;
        *nexthdr = &ipv6_hdr(skb)->nexthdr;
-        while (offset + 1 <= packet_len) {
+        while (offset <= packet_len) {
+                struct ipv6_opt_hdr *exthdr;
                switch (**nexthdr) {
@@ -107,13 +106,16 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
                        return offset;
                }
-                offset += ipv6_optlen(exthdr);
+                if (offset + sizeof(struct ipv6_opt_hdr) > packet_len)
-                *nexthdr = &exthdr->nexthdr;
+                        return -EINVAL;
                exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
                                                 offset);
+                offset += ipv6_optlen(exthdr);
+                *nexthdr = &exthdr->nexthdr;
        }
-        return offset;
+        return -EINVAL;
 }
 EXPORT_SYMBOL(ip6_find_1stfragopt);
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 9b522fa90e6d..ac826dd338ff 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -192,7 +192,7 @@ static struct inet_protosw pingv6_protosw = {
        .type =      SOCK_DGRAM,
        .protocol =  IPPROTO_ICMPV6,
        .prot =      &pingv6_prot,
-        .ops =       &inet6_dgram_ops,
+        .ops =       &inet6_sockraw_ops,
        .flags =     INET_PROTOSW_REUSE,
 };
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index cc8e3ae9ca73..e88bcb8ff0fd 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -219,7 +219,7 @@ static void snmp6_seq_show_item64(struct seq_file *seq, void __percpu *mib,
        u64 buff64[SNMP_MIB_MAX];
        int i;
-        memset(buff64, 0, sizeof(unsigned long) * SNMP_MIB_MAX);
+        memset(buff64, 0, sizeof(u64) * SNMP_MIB_MAX);
        snmp_get_cpu_field64_batch(buff64, itemlist, mib, syncpoff);
        for (i = 0; itemlist[i].name; i++)
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 1f992d9e261d..60be012fe708 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1338,7 +1338,7 @@ void raw6_proc_exit(void)
 #endif  /* CONFIG_PROC_FS */
 /* Same as inet6_dgram_ops, sans udp_poll.  */
-static const struct proto_ops inet6_sockraw_ops = {
+const struct proto_ops inet6_sockraw_ops = {
        .family            = PF_INET6,
        .owner             = THIS_MODULE,
        .release           = inet6_release,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index dc61b0b5e64e..322bd62e688b 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2804,6 +2804,7 @@ static int fib6_ifdown(struct rt6_info *rt, void *arg)
        if ((rt->dst.dev == dev || !dev) &&
            rt != adn->net->ipv6.ip6_null_entry &&
            (rt->rt6i_nsiblings == 0 ||
+             (dev && netdev_unregistering(dev)) ||
             !rt->rt6i_idev->cnf.ignore_routes_with_linkdown))
                return -1;
@@ -3721,7 +3722,11 @@ static int ip6_route_dev_notify(struct notifier_block *this,
                net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
                net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
 #endif
-         } else if (event == NETDEV_UNREGISTER) {
+         } else if (event == NETDEV_UNREGISTER &&
+                    dev->reg_state != NETREG_UNREGISTERED) {
+                /* NETDEV_UNREGISTER could be fired for multiple times by
+                 * netdev_wait_allrefs(). Make sure we only call this once.
+                 */
                in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
                in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 61e5902f0687..f8ad15891cd7 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -265,7 +265,7 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
        return nt;
 failed_free:
-        ipip6_dev_free(dev);
+        free_netdev(dev);
 failed:
        return NULL;
 }
@@ -305,7 +305,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
         * we try harder to allocate.
         */
        kp = (cmax <= 1 || capable(CAP_NET_ADMIN)) ?
-                kcalloc(cmax, sizeof(*kp), GFP_KERNEL) :
+                kcalloc(cmax, sizeof(*kp), GFP_KERNEL | __GFP_NOWARN) :
                NULL;
        rcu_read_lock();
@@ -1336,7 +1336,6 @@ static void ipip6_dev_free(struct net_device *dev)
        dst_cache_destroy(&tunnel->dst_cache);
        free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 #define SIT_FEATURES (NETIF_F_SG           | \
@@ -1351,7 +1350,8 @@ static void ipip6_tunnel_setup(struct net_device *dev)
        int t_hlen = tunnel->hlen + sizeof(struct iphdr);
        dev->netdev_ops         = &ipip6_netdev_ops;
-        dev->destructor         = ipip6_dev_free;
+        dev->needs_free_netdev  = true;
+        dev->priv_destructor    = ipip6_dev_free;
        dev->type               = ARPHRD_SIT;
        dev->hard_header_len    = LL_MAX_HEADER + t_hlen;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 7a8237acd210..4f4310a36a04 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1062,6 +1062,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
                newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
 #endif
+                newnp->ipv6_mc_list = NULL;
                newnp->ipv6_ac_list = NULL;
                newnp->ipv6_fl_list = NULL;
                newnp->pktoptions  = NULL;
@@ -1131,6 +1132,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
           First: no IPv4 options.
         */
        newinet->inet_opt = NULL;
+        newnp->ipv6_mc_list = NULL;
        newnp->ipv6_ac_list = NULL;
        newnp->ipv6_fl_list = NULL;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 04862abfe4ec..75703fda23e7 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -526,7 +526,7 @@ out:
        return;
 }
-int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+static int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
        int rc;
@@ -569,7 +569,7 @@ void udpv6_encap_enable(void)
 }
 EXPORT_SYMBOL(udpv6_encap_enable);
-int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+static int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
        struct udp_sock *up = udp_sk(sk);
        int is_udplite = IS_UDPLITE(sk);
@@ -879,7 +879,8 @@ static struct sock *__udp6_lib_demux_lookup(struct net *net,
        struct sock *sk;
        udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
-                if (INET6_MATCH(sk, net, rmt_addr, loc_addr, ports, dif))
+                if (sk->sk_state == TCP_ESTABLISHED &&
+                    INET6_MATCH(sk, net, rmt_addr, loc_addr, ports, dif))
                        return sk;
                /* Only check first socket in chain */
                break;
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index e78bdc76dcc3..f180b3d85e31 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -26,7 +26,6 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
 int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len);
 int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
                  int flags, int *addr_len);
-int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 void udpv6_destroy_sock(struct sock *sk);
 #ifdef CONFIG_PROC_FS
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index ac858c480f2f..a2267f80febb 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -29,6 +29,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
        u8 frag_hdr_sz = sizeof(struct frag_hdr);
        __wsum csum;
        int tnl_hlen;
+        int err;
        mss = skb_shinfo(skb)->gso_size;
        if (unlikely(skb->len <= mss))
@@ -90,7 +91,10 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                /* Find the unfragmentable header and shift it left by frag_hdr_sz
                 * bytes to insert fragment header.
                 */
-                unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+                err = ip6_find_1stfragopt(skb, &prevhdr);
+                if (err < 0)
+                        return ERR_PTR(err);
+                unfrag_ip6hlen = err;
                nexthdr = *prevhdr;
                *prevhdr = NEXTHDR_FRAGMENT;
                unfrag_len = (skb_network_header(skb) - skb_mac_header(skb)) +
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 08a807b29298..3ef5d913e7a3 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -43,8 +43,8 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async)
                return 1;
 #endif
-        ipv6_hdr(skb)->payload_len = htons(skb->len);
        __skb_push(skb, skb->data - skb_network_header(skb));
+        ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
        if (xo && (xo->flags & XFRM_GRO)) {
                skb_mac_header_rebuild(skb);
diff --git a/net/ipv6/xfrm6_mode_ro.c b/net/ipv6/xfrm6_mode_ro.c
index 0e015906f9ca..07d36573f50b 100644
--- a/net/ipv6/xfrm6_mode_ro.c
+++ b/net/ipv6/xfrm6_mode_ro.c
@@ -47,6 +47,8 @@ static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
        iph = ipv6_hdr(skb);
        hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
        skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
        skb_set_network_header(skb, -x->props.header_len);
        skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c
index 7a92c0f31912..9ad07a91708e 100644
--- a/net/ipv6/xfrm6_mode_transport.c
+++ b/net/ipv6/xfrm6_mode_transport.c
@@ -30,6 +30,8 @@ static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb)
        skb_set_inner_transport_header(skb, skb_transport_offset(skb));
        hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
        skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
        skb_set_network_header(skb, -x->props.header_len);
        skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 74d09f91709e..3be852808a9d 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -65,7 +65,7 @@ static void irlan_eth_setup(struct net_device *dev)
        ether_setup(dev);
        dev->netdev_ops         = &irlan_eth_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
        dev->min_mtu            = 0;
        dev->max_mtu            = ETH_MAX_MTU;
diff --git a/net/key/af_key.c b/net/key/af_key.c
index c1950bb14735..b1432b668033 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1157,6 +1157,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                        goto out;
        }
+        err = -ENOBUFS;
        key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
        if (sa->sadb_sa_auth) {
                int keysize = 0;
@@ -1168,8 +1169,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                if (key)
                        keysize = (key->sadb_key_bits + 7) / 8;
                x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL);
-                if (!x->aalg)
+                if (!x->aalg) {
+                        err = -ENOMEM;
                        goto out;
+                }
                strcpy(x->aalg->alg_name, a->name);
                x->aalg->alg_key_len = 0;
                if (key) {
@@ -1188,8 +1191,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                                goto out;
                        }
                        x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL);
-                        if (!x->calg)
+                        if (!x->calg) {
+                                err = -ENOMEM;
                                goto out;
+                        }
                        strcpy(x->calg->alg_name, a->name);
                        x->props.calgo = sa->sadb_sa_encrypt;
                } else {
@@ -1203,8 +1208,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                        if (key)
                                keysize = (key->sadb_key_bits + 7) / 8;
                        x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL);
-                        if (!x->ealg)
+                        if (!x->ealg) {
+                                err = -ENOMEM;
                                goto out;
+                        }
                        strcpy(x->ealg->alg_name, a->name);
                        x->ealg->alg_key_len = 0;
                        if (key) {
@@ -1249,8 +1256,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net,
                struct xfrm_encap_tmpl *natt;
                x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL);
-                if (!x->encap)
+                if (!x->encap) {
+                        err = -ENOMEM;
                        goto out;
+                }
                natt = x->encap;
                n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1];
@@ -2755,6 +2764,8 @@ static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, const struct sad
        int err, err2;
        err = xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, true);
+        if (!err)
+                xfrm_garbage_collect(net);
        err2 = unicast_flush_resp(sk, hdr);
        if (err || err2) {
                if (err == -ESRCH) /* empty table - old silent behavior */
@@ -3285,7 +3296,7 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
                p += pol->sadb_x_policy_len*8;
                sec_ctx = (struct sadb_x_sec_ctx *)p;
                if (len < pol->sadb_x_policy_len*8 +
-                    sec_ctx->sadb_x_sec_len) {
+                    sec_ctx->sadb_x_sec_len*8) {
                        *dir = -EINVAL;
                        goto out;
                }
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 8b21af7321b9..4de2ec94b08c 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -114,12 +114,13 @@ static void l2tp_eth_get_stats64(struct net_device *dev,
 {
        struct l2tp_eth *priv = netdev_priv(dev);
-        stats->tx_bytes   = atomic_long_read(&priv->tx_bytes);
+        stats->tx_bytes   = (unsigned long) atomic_long_read(&priv->tx_bytes);
-        stats->tx_packets = atomic_long_read(&priv->tx_packets);
+        stats->tx_packets = (unsigned long) atomic_long_read(&priv->tx_packets);
-        stats->tx_dropped = atomic_long_read(&priv->tx_dropped);
+        stats->tx_dropped = (unsigned long) atomic_long_read(&priv->tx_dropped);
-        stats->rx_bytes   = atomic_long_read(&priv->rx_bytes);
+        stats->rx_bytes   = (unsigned long) atomic_long_read(&priv->rx_bytes);
-        stats->rx_packets = atomic_long_read(&priv->rx_packets);
+        stats->rx_packets = (unsigned long) atomic_long_read(&priv->rx_packets);
-        stats->rx_errors  = atomic_long_read(&priv->rx_errors);
+        stats->rx_errors  = (unsigned long) atomic_long_read(&priv->rx_errors);
 }
 static const struct net_device_ops l2tp_eth_netdev_ops = {
@@ -141,7 +142,7 @@ static void l2tp_eth_dev_setup(struct net_device *dev)
        dev->priv_flags         &= ~IFF_TX_SKB_SHARING;
        dev->features           |= NETIF_F_LLTX;
        dev->netdev_ops         = &l2tp_eth_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb, int data_len)
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 8364fe5b59e4..c38d16f22d2a 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -311,6 +311,8 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
        int rc = -EINVAL;
        dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
+        lock_sock(sk);
        if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
                goto out;
        rc = -EAFNOSUPPORT;
@@ -382,6 +384,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
 out_put:
        llc_sap_put(sap);
 out:
+        release_sock(sk);
        return rc;
 }
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 60e2a62f7bef..cf2392b2ac71 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -7,7 +7,7 @@
 * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 * Copyright 2007-2010, Intel Corporation
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -741,46 +741,43 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
        ieee80211_agg_start_txq(sta, tid, true);
 }
-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
+void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
+                              struct tid_ampdu_tx *tid_tx)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct tid_ampdu_tx *tid_tx;
-        trace_api_start_tx_ba_cb(sdata, ra, tid);
+        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
+                return;
+        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
+                ieee80211_agg_tx_operational(local, sta, tid);
+}
+static struct tid_ampdu_tx *
+ieee80211_lookup_tid_tx(struct ieee80211_sub_if_data *sdata,
+                        const u8 *ra, u16 tid, struct sta_info **sta)
+{
+        struct tid_ampdu_tx *tid_tx;
        if (tid >= IEEE80211_NUM_TIDS) {
                ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
                       tid, IEEE80211_NUM_TIDS);
-                return;
+                return NULL;
        }
-        mutex_lock(&local->sta_mtx);
+        *sta = sta_info_get_bss(sdata, ra);
-        sta = sta_info_get_bss(sdata, ra);
+        if (!*sta) {
-        if (!sta) {
-                mutex_unlock(&local->sta_mtx);
                ht_dbg(sdata, "Could not find station: %pM\n", ra);
-                return;
+                return NULL;
        }
-        mutex_lock(&sta->ampdu_mlme.mtx);
+        tid_tx = rcu_dereference((*sta)->ampdu_mlme.tid_tx[tid]);
-        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
-        if (WARN_ON(!tid_tx)) {
+        if (WARN_ON(!tid_tx))
                ht_dbg(sdata, "addBA was not requested!\n");
-                goto unlock;
-        }
-        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
+        return tid_tx;
-                goto unlock;
-        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
-                ieee80211_agg_tx_operational(local, sta, tid);
- unlock:
-        mutex_unlock(&sta->ampdu_mlme.mtx);
-        mutex_unlock(&local->sta_mtx);
 }
 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
@@ -788,19 +785,20 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 {
        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_ra_tid *ra_tid;
+        struct sta_info *sta;
-        struct sk_buff *skb = dev_alloc_skb(0);
+        struct tid_ampdu_tx *tid_tx;
-        if (unlikely(!skb))
+        trace_api_start_tx_ba_cb(sdata, ra, tid);
-                return;
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        rcu_read_lock();
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
-        ra_tid->tid = tid;
+        if (!tid_tx)
+                goto out;
-        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_START;
+        set_bit(HT_AGG_STATE_START_CB, &tid_tx->state);
-        skb_queue_tail(&sdata->skb_queue, skb);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
-        ieee80211_queue_work(&local->hw, &sdata->work);
+ out:
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
@@ -860,37 +858,18 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
+void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct tid_ampdu_tx *tid_tx;
        bool send_delba = false;
-        trace_api_stop_tx_ba_cb(sdata, ra, tid);
+        ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
+               sta->sta.addr, tid);
-        if (tid >= IEEE80211_NUM_TIDS) {
-                ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
-                       tid, IEEE80211_NUM_TIDS);
-                return;
-        }
-        ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n", ra, tid);
-        mutex_lock(&local->sta_mtx);
-        sta = sta_info_get_bss(sdata, ra);
-        if (!sta) {
-                ht_dbg(sdata, "Could not find station: %pM\n", ra);
-                goto unlock;
-        }
-        mutex_lock(&sta->ampdu_mlme.mtx);
        spin_lock_bh(&sta->lock);
-        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
-        if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
+        if (!test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                ht_dbg(sdata,
                       "unexpected callback to A-MPDU stop for %pM tid %d\n",
                       sta->sta.addr, tid);
@@ -906,12 +885,8 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
        spin_unlock_bh(&sta->lock);
        if (send_delba)
-                ieee80211_send_delba(sdata, ra, tid,
+                ieee80211_send_delba(sdata, sta->sta.addr, tid,
                        WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
-        mutex_unlock(&sta->ampdu_mlme.mtx);
- unlock:
-        mutex_unlock(&local->sta_mtx);
 }
 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
@@ -919,19 +894,20 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 {
        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_ra_tid *ra_tid;
+        struct sta_info *sta;
-        struct sk_buff *skb = dev_alloc_skb(0);
+        struct tid_ampdu_tx *tid_tx;
-        if (unlikely(!skb))
+        trace_api_stop_tx_ba_cb(sdata, ra, tid);
-                return;
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
+        rcu_read_lock();
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
+        tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
-        ra_tid->tid = tid;
+        if (!tid_tx)
+                goto out;
-        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_STOP;
+        set_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state);
-        skb_queue_tail(&sdata->skb_queue, skb);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
-        ieee80211_queue_work(&local->hw, &sdata->work);
+ out:
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 6c2e6060cd54..4a388fe8c2d1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -902,6 +902,8 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
        default:
                return -EINVAL;
        }
+        sdata->u.ap.req_smps = sdata->smps_mode;
        sdata->needed_rx_chains = sdata->local->rx_chains;
        sdata->vif.bss_conf.beacon_int = params->beacon_interval;
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index f4a528773563..6ca5442b1e03 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -7,6 +7,7 @@
 * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
 * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
 * Copyright 2007-2010, Intel Corporation
+ * Copyright 2017       Intel Deutschland GmbH
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -289,8 +290,6 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
 {
        int i;
-        cancel_work_sync(&sta->ampdu_mlme.work);
        for (i = 0; i <  IEEE80211_NUM_TIDS; i++) {
                __ieee80211_stop_tx_ba_session(sta, i, reason);
                __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
@@ -298,6 +297,9 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
                                               reason != AGG_STOP_DESTROY_STA &&
                                               reason != AGG_STOP_PEER_REQUEST);
        }
+        /* stopping might queue the work again - so cancel only afterwards */
+        cancel_work_sync(&sta->ampdu_mlme.work);
 }
 void ieee80211_ba_session_work(struct work_struct *work)
@@ -352,10 +354,16 @@ void ieee80211_ba_session_work(struct work_struct *work)
                spin_unlock_bh(&sta->lock);
                tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
-                if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
+                if (!tid_tx)
-                                                 &tid_tx->state))
+                        continue;
+                if (test_and_clear_bit(HT_AGG_STATE_START_CB, &tid_tx->state))
+                        ieee80211_start_tx_ba_cb(sta, tid, tid_tx);
+                if (test_and_clear_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state))
                        ___ieee80211_stop_tx_ba_session(sta, tid,
                                                        AGG_STOP_LOCAL_REQUEST);
+                if (test_and_clear_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state))
+                        ieee80211_stop_tx_ba_cb(sta, tid, tid_tx);
        }
        mutex_unlock(&sta->ampdu_mlme.mtx);
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index f8f6c148f554..5e002f62c235 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1036,8 +1036,6 @@ struct ieee80211_rx_agg {
 enum sdata_queue_type {
        IEEE80211_SDATA_QUEUE_TYPE_FRAME        = 0,
-        IEEE80211_SDATA_QUEUE_AGG_START         = 1,
-        IEEE80211_SDATA_QUEUE_AGG_STOP          = 2,
        IEEE80211_SDATA_QUEUE_RX_AGG_START      = 3,
        IEEE80211_SDATA_QUEUE_RX_AGG_STOP       = 4,
 };
@@ -1427,12 +1425,6 @@ ieee80211_get_sband(struct ieee80211_sub_if_data *sdata)
        return local->hw.wiphy->bands[band];
 }
-/* this struct represents 802.11n's RA/TID combination */
-struct ieee80211_ra_tid {
-        u8 ra[ETH_ALEN];
-        u16 tid;
-};
 /* this struct holds the value parsing from channel switch IE  */
 struct ieee80211_csa_ie {
        struct cfg80211_chan_def chandef;
@@ -1539,7 +1531,7 @@ ieee80211_have_rx_timestamp(struct ieee80211_rx_status *status)
                return true;
        /* can't handle non-legacy preamble yet */
        if (status->flag & RX_FLAG_MACTIME_PLCP_START &&
-            status->encoding != RX_ENC_LEGACY)
+            status->encoding == RX_ENC_LEGACY)
                return true;
        return false;
 }
@@ -1794,8 +1786,10 @@ int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                   enum ieee80211_agg_stop_reason reason);
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                    enum ieee80211_agg_stop_reason reason);
-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid);
+void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid);
+                              struct tid_ampdu_tx *tid_tx);
+void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx);
 void ieee80211_ba_session_work(struct work_struct *work);
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid);
 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 3bd5b81f5d81..f5f50150ba1c 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1213,7 +1213,6 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
 static void ieee80211_if_free(struct net_device *dev)
 {
        free_percpu(dev->tstats);
-        free_netdev(dev);
 }
 static void ieee80211_if_setup(struct net_device *dev)
@@ -1221,7 +1220,8 @@ static void ieee80211_if_setup(struct net_device *dev)
        ether_setup(dev);
        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
        dev->netdev_ops = &ieee80211_dataif_ops;
-        dev->destructor = ieee80211_if_free;
+        dev->needs_free_netdev = true;
+        dev->priv_destructor = ieee80211_if_free;
 }
 static void ieee80211_if_setup_no_queue(struct net_device *dev)
@@ -1237,7 +1237,6 @@ static void ieee80211_iface_work(struct work_struct *work)
        struct ieee80211_local *local = sdata->local;
        struct sk_buff *skb;
        struct sta_info *sta;
-        struct ieee80211_ra_tid *ra_tid;
        struct ieee80211_rx_agg *rx_agg;
        if (!ieee80211_sdata_running(sdata))
@@ -1253,15 +1252,7 @@ static void ieee80211_iface_work(struct work_struct *work)
        while ((skb = skb_dequeue(&sdata->skb_queue))) {
                struct ieee80211_mgmt *mgmt = (void *)skb->data;
-                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_START) {
+                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) {
-                        ra_tid = (void *)&skb->cb;
-                        ieee80211_start_tx_ba_cb(&sdata->vif, ra_tid->ra,
-                                                 ra_tid->tid);
-                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_STOP) {
-                        ra_tid = (void *)&skb->cb;
-                        ieee80211_stop_tx_ba_cb(&sdata->vif, ra_tid->ra,
-                                                ra_tid->tid);
-                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) {
                        rx_agg = (void *)&skb->cb;
                        mutex_lock(&local->sta_mtx);
                        sta = sta_info_get_bss(sdata, rx_agg->addr);
@@ -1825,6 +1816,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                ret = dev_alloc_name(ndev, ndev->name);
                if (ret < 0) {
                        ieee80211_if_free(ndev);
+                        free_netdev(ndev);
                        return ret;
                }
@@ -1914,7 +1906,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                ret = register_netdevice(ndev);
                if (ret) {
-                        ieee80211_if_free(ndev);
+                        free_netdev(ndev);
                        return ret;
                }
        }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0ea9712bd99e..cc8e6ea1b27e 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -601,7 +601,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
        struct ieee80211_supported_band *sband;
        struct ieee80211_chanctx_conf *chanctx_conf;
        struct ieee80211_channel *chan;
-        u32 rate_flags, rates = 0;
+        u32 rates = 0;
        sdata_assert_lock(sdata);
@@ -612,7 +612,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                return;
        }
        chan = chanctx_conf->def.chan;
-        rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
        rcu_read_unlock();
        sband = local->hw.wiphy->bands[chan->band];
        shift = ieee80211_vif_get_shift(&sdata->vif);
@@ -636,9 +635,6 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
                 */
                rates_len = 0;
                for (i = 0; i < sband->n_bitrates; i++) {
-                        if ((rate_flags & sband->bitrates[i].flags)
-                            != rate_flags)
-                                continue;
                        rates |= BIT(i);
                        rates_len++;
                }
@@ -2818,7 +2814,7 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
                                u32 *rates, u32 *basic_rates,
                                bool *have_higher_than_11mbit,
                                int *min_rate, int *min_rate_index,
-                                int shift, u32 rate_flags)
+                                int shift)
 {
        int i, j;
@@ -2846,8 +2842,6 @@ static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
                        int brate;
                        br = &sband->bitrates[j];
-                        if ((rate_flags & br->flags) != rate_flags)
-                                continue;
                        brate = DIV_ROUND_UP(br->bitrate, (1 << shift) * 5);
                        if (brate == rate) {
@@ -4398,40 +4392,32 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                        return -ENOMEM;
        }
-        if (new_sta || override) {
+        /*
-                err = ieee80211_prep_channel(sdata, cbss);
+         * Set up the information for the new channel before setting the
-                if (err) {
+         * new channel. We can't - completely race-free - change the basic
-                        if (new_sta)
+         * rates bitmap and the channel (sband) that it refers to, but if
-                                sta_info_free(local, new_sta);
+         * we set it up before we at least avoid calling into the driver's
-                        return -EINVAL;
+         * bss_info_changed() method with invalid information (since we do
-                }
+         * call that from changing the channel - only for IDLE and perhaps
-        }
+         * some others, but ...).
+         *
+         * So to avoid that, just set up all the new information before the
+         * channel, but tell the driver to apply it only afterwards, since
+         * it might need the new channel for that.
+         */
        if (new_sta) {
                u32 rates = 0, basic_rates = 0;
                bool have_higher_than_11mbit;
                int min_rate = INT_MAX, min_rate_index = -1;
-                struct ieee80211_chanctx_conf *chanctx_conf;
                const struct cfg80211_bss_ies *ies;
                int shift = ieee80211_vif_get_shift(&sdata->vif);
-                u32 rate_flags;
-                rcu_read_lock();
-                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
-                if (WARN_ON(!chanctx_conf)) {
-                        rcu_read_unlock();
-                        sta_info_free(local, new_sta);
-                        return -EINVAL;
-                }
-                rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
-                rcu_read_unlock();
                ieee80211_get_rates(sband, bss->supp_rates,
                                    bss->supp_rates_len,
                                    &rates, &basic_rates,
                                    &have_higher_than_11mbit,
                                    &min_rate, &min_rate_index,
-                                    shift, rate_flags);
+                                    shift);
                /*
                 * This used to be a workaround for basic rates missing
@@ -4489,8 +4475,22 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
                        sdata->vif.bss_conf.sync_dtim_count = 0;
                }
                rcu_read_unlock();
+        }
-                /* tell driver about BSSID, basic rates and timing */
+        if (new_sta || override) {
+                err = ieee80211_prep_channel(sdata, cbss);
+                if (err) {
+                        if (new_sta)
+                                sta_info_free(local, new_sta);
+                        return -EINVAL;
+                }
+        }
+        if (new_sta) {
+                /*
+                 * tell driver about BSSID, basic rates and timing
+                 * this was set up above, before setting the channel
+                 */
                ieee80211_bss_info_change_notify(sdata,
                        BSS_CHANGED_BSSID | BSS_CHANGED_BASIC_RATES |
                        BSS_CHANGED_BEACON_INT);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 35f4c7d7a500..3674fe3d67dc 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1613,12 +1613,16 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         */
        if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
            !ieee80211_has_morefrags(hdr->frame_control) &&
+            !ieee80211_is_back_req(hdr->frame_control) &&
            !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
            (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
             rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
-            /* PM bit is only checked in frames where it isn't reserved,
+            /*
+             * PM bit is only checked in frames where it isn't reserved,
             * in AP mode it's reserved in non-bufferable management frames
             * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
+             * BAR frames should be ignored as specified in
+             * IEEE 802.11-2012 10.2.1.2.
             */
            (!ieee80211_is_mgmt(hdr->frame_control) ||
             ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
@@ -2492,7 +2496,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                if (is_multicast_ether_addr(hdr->addr1)) {
                        mpp_addr = hdr->addr3;
                        proxied_addr = mesh_hdr->eaddr1;
-                } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
+                } else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
+                            MESH_FLAGS_AE_A5_A6) {
                        /* has_a4 already checked in ieee80211_rx_mesh_check */
                        mpp_addr = hdr->addr4;
                        proxied_addr = mesh_hdr->eaddr2;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7cdf7a835bb0..403e3cc58b57 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2155,7 +2155,7 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                        struct ieee80211_sta_rx_stats *cpurxs;
                        cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu);
-                        sinfo->rx_packets += cpurxs->dropped;
+                        sinfo->rx_dropped_misc += cpurxs->dropped;
                }
        }
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 5609cacb20d5..ea0747d6a6da 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -116,6 +116,8 @@ enum ieee80211_sta_info_flags {
 #define HT_AGG_STATE_STOPPING           3
 #define HT_AGG_STATE_WANT_START         4
 #define HT_AGG_STATE_WANT_STOP          5
+#define HT_AGG_STATE_START_CB           6
+#define HT_AGG_STATE_STOP_CB            7
 enum ieee80211_agg_stop_reason {
        AGG_STOP_DECLINED,
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index c1ef22df865f..cc19614ff4e6 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -17,6 +17,7 @@
 #include <asm/unaligned.h>
 #include <net/mac80211.h>
 #include <crypto/aes.h>
+#include <crypto/algapi.h>
 #include "ieee80211_i.h"
 #include "michael.h"
@@ -153,7 +154,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
        data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
        key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
        michael_mic(key, hdr, data, data_len, mic);
-        if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0)
+        if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
                goto mic_fail;
        /* remove Michael MIC from payload */
@@ -1048,7 +1049,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
                bip_aad(skb, aad);
                ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
                                   skb->data + 24, skb->len - 24, mic);
-                if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                        key->u.aes_cmac.icverrors++;
                        return RX_DROP_UNUSABLE;
                }
@@ -1098,7 +1099,7 @@ ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx)
                bip_aad(skb, aad);
                ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad,
                                       skb->data + 24, skb->len - 24, mic);
-                if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                        key->u.aes_cmac.icverrors++;
                        return RX_DROP_UNUSABLE;
                }
@@ -1202,7 +1203,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx)
                if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce,
                                       skb->data + 24, skb->len - 24,
                                       mic) < 0 ||
-                    memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+                    crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
                        key->u.aes_gmac.icverrors++;
                        return RX_DROP_UNUSABLE;
                }
diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c
index 06019dba4b10..bd88a9b80773 100644
--- a/net/mac802154/iface.c
+++ b/net/mac802154/iface.c
@@ -526,8 +526,6 @@ static void mac802154_wpan_free(struct net_device *dev)
        struct ieee802154_sub_if_data *sdata = IEEE802154_DEV_TO_SUB_IF(dev);
        mac802154_llsec_destroy(&sdata->sec);
-        free_netdev(dev);
 }
 static void ieee802154_if_setup(struct net_device *dev)
@@ -593,7 +591,8 @@ ieee802154_setup_sdata(struct ieee802154_sub_if_data *sdata,
                                        sdata->dev->dev_addr);
                sdata->dev->header_ops = &mac802154_header_ops;
-                sdata->dev->destructor = mac802154_wpan_free;
+                sdata->dev->needs_free_netdev = true;
+                sdata->dev->priv_destructor = mac802154_wpan_free;
                sdata->dev->netdev_ops = &mac802154_wpan_ops;
                sdata->dev->ml_priv = &mac802154_mlme_wpan;
                wpan_dev->promiscuous_mode = false;
@@ -608,7 +607,7 @@ ieee802154_setup_sdata(struct ieee802154_sub_if_data *sdata,
                break;
        case NL802154_IFTYPE_MONITOR:
-                sdata->dev->destructor = free_netdev;
+                sdata->dev->needs_free_netdev = true;
                sdata->dev->netdev_ops = &mac802154_monitor_ops;
                wpan_dev->promiscuous_mode = true;
                break;
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 257ec66009da..7b05fd1497ce 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -1418,7 +1418,7 @@ static void mpls_ifup(struct net_device *dev, unsigned int flags)
                                continue;
                        alive++;
                        nh_flags &= ~flags;
-                        WRITE_ONCE(nh->nh_flags, flags);
+                        WRITE_ONCE(nh->nh_flags, nh_flags);
                } endfor_nexthops(rt);
                WRITE_ONCE(rt->rt_nhn_alive, alive);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index d2d7bdf1d510..ad99c1ceea6f 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -849,10 +849,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
 {
        unsigned int verdict = NF_DROP;
-        if (IP_VS_FWD_METHOD(cp) != 0) {
+        if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
-                pr_err("shouldn't reach here, because the box is on the "
+                goto ignore_cp;
-                       "half connection in the tun/dr module.\n");
-        }
        /* Ensure the checksum is correct */
        if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
@@ -886,6 +884,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
                ip_vs_notrack(skb);
        else
                ip_vs_update_conntrack(skb, cp, 0);
+ignore_cp:
        verdict = NF_ACCEPT;
 out:
@@ -1385,8 +1385,11 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
         */
        cp = pp->conn_out_get(ipvs, af, skb, &iph);
-        if (likely(cp))
+        if (likely(cp)) {
+                if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
+                        goto ignore_cp;
                return handle_response(af, skb, pd, cp, &iph, hooknum);
+        }
        /* Check for real-server-started requests */
        if (atomic_read(&ipvs->conn_out_counter)) {
@@ -1444,9 +1447,15 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
                        }
                }
        }
+out:
        IP_VS_DBG_PKT(12, af, pp, skb, iph.off,
                      "ip_vs_out: packet continues traversal as normal");
        return NF_ACCEPT;
+ignore_cp:
+        __ip_vs_conn_put(cp);
+        goto out;
 }
 /*
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 3a60efa7799b..7f6100ca63be 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -174,6 +174,10 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum)
 #endif
        if (h != NULL && !try_module_get(h->me))
                h = NULL;
+        if (h != NULL && !refcount_inc_not_zero(&h->refcnt)) {
+                module_put(h->me);
+                h = NULL;
+        }
        rcu_read_unlock();
@@ -181,6 +185,13 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum)
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_try_module_get);
+void nf_conntrack_helper_put(struct nf_conntrack_helper *helper)
+{
+        refcount_dec(&helper->refcnt);
+        module_put(helper->me);
+}
+EXPORT_SYMBOL_GPL(nf_conntrack_helper_put);
 struct nf_conn_help *
 nf_ct_helper_ext_add(struct nf_conn *ct,
                     struct nf_conntrack_helper *helper, gfp_t gfp)
@@ -417,6 +428,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
                        }
                }
        }
+        refcount_set(&me->refcnt, 1);
        hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]);
        nf_ct_helper_count++;
 out:
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index dcf561b5c97a..a8be9b72e6cd 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -45,6 +45,8 @@
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
 #include <net/netfilter/nf_conntrack_labels.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
 #ifdef CONFIG_NF_NAT_NEEDED
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_l4proto.h>
@@ -888,8 +890,13 @@ restart:
        }
 out:
        local_bh_enable();
-        if (last)
+        if (last) {
+                /* nf ct hash resize happened, now clear the leftover. */
+                if ((struct nf_conn *)cb->args[1] == last)
+                        cb->args[1] = 0;
                nf_ct_put(last);
+        }
        while (i) {
                i--;
@@ -1007,9 +1014,8 @@ static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = {
 static int
 ctnetlink_parse_tuple(const struct nlattr * const cda[],
-                      struct nf_conntrack_tuple *tuple,
+                      struct nf_conntrack_tuple *tuple, u32 type,
-                      enum ctattr_type type, u_int8_t l3num,
+                      u_int8_t l3num, struct nf_conntrack_zone *zone)
-                      struct nf_conntrack_zone *zone)
 {
        struct nlattr *tb[CTA_TUPLE_MAX+1];
        int err;
@@ -1828,6 +1834,8 @@ ctnetlink_create_conntrack(struct net *net,
        nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
        nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
        nf_ct_labels_ext_add(ct);
+        nfct_seqadj_ext_add(ct);
+        nfct_synproxy_ext_add(ct);
        /* we must add conntrack extensions before confirmation. */
        ct->status |= IPS_CONFIRMED;
@@ -2447,7 +2455,7 @@ static struct nfnl_ct_hook ctnetlink_glue_hook = {
 static int ctnetlink_exp_dump_tuple(struct sk_buff *skb,
                                    const struct nf_conntrack_tuple *tuple,
-                                    enum ctattr_expect type)
+                                    u32 type)
 {
        struct nlattr *nest_parms;
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 13875d599a85..1c5b14a6cab3 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -512,16 +512,19 @@ static int sctp_error(struct net *net, struct nf_conn *tpl, struct sk_buff *skb,
                      u8 pf, unsigned int hooknum)
 {
        const struct sctphdr *sh;
-        struct sctphdr _sctph;
        const char *logmsg;
-        sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
+        if (skb->len < dataoff + sizeof(struct sctphdr)) {
-        if (!sh) {
                logmsg = "nf_ct_sctp: short packet ";
                goto out_invalid;
        }
        if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
            skb->ip_summed == CHECKSUM_NONE) {
+                if (!skb_make_writable(skb, dataoff + sizeof(struct sctphdr))) {
+                        logmsg = "nf_ct_sctp: failed to read header ";
+                        goto out_invalid;
+                }
+                sh = (const struct sctphdr *)(skb->data + dataoff);
                if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {
                        logmsg = "nf_ct_sctp: bad CRC ";
                        goto out_invalid;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index b48d6b5aae8a..6c72922d20ca 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -409,6 +409,10 @@ nf_nat_setup_info(struct nf_conn *ct,
 {
        struct nf_conntrack_tuple curr_tuple, new_tuple;
+        /* Can't setup nat info for confirmed ct. */
+        if (nf_ct_is_confirmed(ct))
+                return NF_ACCEPT;
        NF_CT_ASSERT(maniptype == NF_NAT_MANIP_SRC ||
                     maniptype == NF_NAT_MANIP_DST);
        BUG_ON(nf_nat_initialized(ct, maniptype));
@@ -562,7 +566,7 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
         * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
         * will delete entry from already-freed table.
         */
-        ct->status &= ~IPS_NAT_DONE_MASK;
+        clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
        rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
                        nf_nat_bysource_params);
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 559225029740..da314be0c048 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3367,35 +3367,50 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
        return nf_tables_fill_setelem(args->skb, set, elem);
 }
+struct nft_set_dump_ctx {
+        const struct nft_set    *set;
+        struct nft_ctx          ctx;
+};
 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
 {
+        struct nft_set_dump_ctx *dump_ctx = cb->data;
        struct net *net = sock_net(skb->sk);
-        u8 genmask = nft_genmask_cur(net);
+        struct nft_af_info *afi;
+        struct nft_table *table;
        struct nft_set *set;
        struct nft_set_dump_args args;
-        struct nft_ctx ctx;
+        bool set_found = false;
-        struct nlattr *nla[NFTA_SET_ELEM_LIST_MAX + 1];
        struct nfgenmsg *nfmsg;
        struct nlmsghdr *nlh;
        struct nlattr *nest;
        u32 portid, seq;
-        int event, err;
+        int event;
-        err = nlmsg_parse(cb->nlh, sizeof(struct nfgenmsg), nla,
+        rcu_read_lock();
-                          NFTA_SET_ELEM_LIST_MAX, nft_set_elem_list_policy,
+        list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
-                          NULL);
+                if (afi != dump_ctx->ctx.afi)
-        if (err < 0)
+                        continue;
-                return err;
-        err = nft_ctx_init_from_elemattr(&ctx, net, cb->skb, cb->nlh,
+                list_for_each_entry_rcu(table, &afi->tables, list) {
-                                         (void *)nla, genmask);
+                        if (table != dump_ctx->ctx.table)
-        if (err < 0)
+                                continue;
-                return err;
-        set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
+                        list_for_each_entry_rcu(set, &table->sets, list) {
-                                   genmask);
+                                if (set == dump_ctx->set) {
-        if (IS_ERR(set))
+                                        set_found = true;
-                return PTR_ERR(set);
+                                        break;
+                                }
+                        }
+                        break;
+                }
+                break;
+        }
+        if (!set_found) {
+                rcu_read_unlock();
+                return -ENOENT;
+        }
        event  = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
        portid = NETLINK_CB(cb->skb).portid;
@@ -3407,11 +3422,11 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
                goto nla_put_failure;
        nfmsg = nlmsg_data(nlh);
-        nfmsg->nfgen_family = ctx.afi->family;
+        nfmsg->nfgen_family = afi->family;
        nfmsg->version      = NFNETLINK_V0;
-        nfmsg->res_id       = htons(ctx.net->nft.base_seq & 0xffff);
+        nfmsg->res_id       = htons(net->nft.base_seq & 0xffff);
-        if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, ctx.table->name))
+        if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
                goto nla_put_failure;
        if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
                goto nla_put_failure;
@@ -3422,12 +3437,13 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
        args.cb                 = cb;
        args.skb                = skb;
-        args.iter.genmask       = nft_genmask_cur(ctx.net);
+        args.iter.genmask       = nft_genmask_cur(net);
        args.iter.skip          = cb->args[0];
        args.iter.count         = 0;
        args.iter.err           = 0;
        args.iter.fn            = nf_tables_dump_setelem;
-        set->ops->walk(&ctx, set, &args.iter);
+        set->ops->walk(&dump_ctx->ctx, set, &args.iter);
+        rcu_read_unlock();
        nla_nest_end(skb, nest);
        nlmsg_end(skb, nlh);
@@ -3441,9 +3457,16 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
        return skb->len;
 nla_put_failure:
+        rcu_read_unlock();
        return -ENOSPC;
 }
+static int nf_tables_dump_set_done(struct netlink_callback *cb)
+{
+        kfree(cb->data);
+        return 0;
+}
 static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
                                struct sk_buff *skb, const struct nlmsghdr *nlh,
                                const struct nlattr * const nla[])
@@ -3465,7 +3488,18 @@ static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
        if (nlh->nlmsg_flags & NLM_F_DUMP) {
                struct netlink_dump_control c = {
                        .dump = nf_tables_dump_set,
+                        .done = nf_tables_dump_set_done,
                };
+                struct nft_set_dump_ctx *dump_ctx;
+                dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
+                if (!dump_ctx)
+                        return -ENOMEM;
+                dump_ctx->set = set;
+                dump_ctx->ctx = ctx;
+                c.data = dump_ctx;
                return netlink_dump_start(nlsk, skb, nlh, &c);
        }
        return -EOPNOTSUPP;
@@ -3593,9 +3627,9 @@ void nft_set_elem_destroy(const struct nft_set *set, void *elem,
 {
        struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
-        nft_data_uninit(nft_set_ext_key(ext), NFT_DATA_VALUE);
+        nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
        if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
-                nft_data_uninit(nft_set_ext_data(ext), set->dtype);
+                nft_data_release(nft_set_ext_data(ext), set->dtype);
        if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
                nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
        if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
@@ -3604,6 +3638,18 @@ void nft_set_elem_destroy(const struct nft_set *set, void *elem,
 }
 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
+/* Only called from commit path, nft_set_elem_deactivate() already deals with
+ * the refcounting from the preparation phase.
+ */
+static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
+{
+        struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
+                nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
+        kfree(elem);
+}
 static int nft_setelem_parse_flags(const struct nft_set *set,
                                   const struct nlattr *attr, u32 *flags)
 {
@@ -3815,9 +3861,9 @@ err4:
        kfree(elem.priv);
 err3:
        if (nla[NFTA_SET_ELEM_DATA] != NULL)
-                nft_data_uninit(&data, d2.type);
+                nft_data_release(&data, d2.type);
 err2:
-        nft_data_uninit(&elem.key.val, d1.type);
+        nft_data_release(&elem.key.val, d1.type);
 err1:
        return err;
 }
@@ -3862,6 +3908,53 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
        return err;
 }
+/**
+ *      nft_data_hold - hold a nft_data item
+ *
+ *      @data: struct nft_data to release
+ *      @type: type of data
+ *
+ *      Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
+ *      NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
+ *      NFT_GOTO verdicts. This function must be called on active data objects
+ *      from the second phase of the commit protocol.
+ */
+static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
+{
+        if (type == NFT_DATA_VERDICT) {
+                switch (data->verdict.code) {
+                case NFT_JUMP:
+                case NFT_GOTO:
+                        data->verdict.chain->use++;
+                        break;
+                }
+        }
+}
+static void nft_set_elem_activate(const struct net *net,
+                                  const struct nft_set *set,
+                                  struct nft_set_elem *elem)
+{
+        const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
+                nft_data_hold(nft_set_ext_data(ext), set->dtype);
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
+                (*nft_set_ext_obj(ext))->use++;
+}
+static void nft_set_elem_deactivate(const struct net *net,
+                                    const struct nft_set *set,
+                                    struct nft_set_elem *elem)
+{
+        const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
+                nft_data_release(nft_set_ext_data(ext), set->dtype);
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
+                (*nft_set_ext_obj(ext))->use--;
+}
 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
                           const struct nlattr *attr)
 {
@@ -3927,6 +4020,8 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
        kfree(elem.priv);
        elem.priv = priv;
+        nft_set_elem_deactivate(ctx->net, set, &elem);
        nft_trans_elem(trans) = elem;
        list_add_tail(&trans->list, &ctx->net->nft.commit_list);
        return 0;
@@ -3936,7 +4031,7 @@ err4:
 err3:
        kfree(elem.priv);
 err2:
-        nft_data_uninit(&elem.key.val, desc.type);
+        nft_data_release(&elem.key.val, desc.type);
 err1:
        return err;
 }
@@ -4743,8 +4838,8 @@ static void nf_tables_commit_release(struct nft_trans *trans)
                nft_set_destroy(nft_trans_set(trans));
                break;
        case NFT_MSG_DELSETELEM:
-                nft_set_elem_destroy(nft_trans_elem_set(trans),
+                nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
-                                     nft_trans_elem(trans).priv, true);
+                                           nft_trans_elem(trans).priv);
                break;
        case NFT_MSG_DELOBJ:
                nft_obj_destroy(nft_trans_obj(trans));
@@ -4979,6 +5074,7 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb)
                case NFT_MSG_DELSETELEM:
                        te = (struct nft_trans_elem *)trans->data;
+                        nft_set_elem_activate(net, te->set, &te->elem);
                        te->set->ops->activate(net, te->set, &te->elem);
                        te->set->ndeact--;
@@ -5464,7 +5560,7 @@ int nft_data_init(const struct nft_ctx *ctx,
 EXPORT_SYMBOL_GPL(nft_data_init);
 /**
- *      nft_data_uninit - release a nft_data item
+ *      nft_data_release - release a nft_data item
 *
 *      @data: struct nft_data to release
 *      @type: type of data
@@ -5472,7 +5568,7 @@ EXPORT_SYMBOL_GPL(nft_data_init);
 *      Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
 *      all others need to be released by calling this function.
 */
-void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
+void nft_data_release(const struct nft_data *data, enum nft_data_types type)
 {
        if (type < NFT_DATA_VERDICT)
                return;
@@ -5483,7 +5579,7 @@ void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
                WARN_ON(1);
        }
 }
-EXPORT_SYMBOL_GPL(nft_data_uninit);
+EXPORT_SYMBOL_GPL(nft_data_release);
 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
                  enum nft_data_types type, unsigned int len)
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 950bf6eadc65..be678a323598 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -686,6 +686,7 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
                tuple_set = true;
        }
+        ret = -ENOENT;
        list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
                cur = &nlcth->helper;
                j++;
@@ -699,16 +700,20 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
                     tuple.dst.protonum != cur->tuple.dst.protonum))
                        continue;
-                found = true;
+                if (refcount_dec_if_one(&cur->refcnt)) {
-                nf_conntrack_helper_unregister(cur);
+                        found = true;
-                kfree(cur->expect_policy);
+                        nf_conntrack_helper_unregister(cur);
+                        kfree(cur->expect_policy);
-                list_del(&nlcth->list);
+                        list_del(&nlcth->list);
-                kfree(nlcth);
+                        kfree(nlcth);
+                } else {
+                        ret = -EBUSY;
+                }
        }
        /* Make sure we return success if we flush and there is no helpers */
-        return (found || j == 0) ? 0 : -ENOENT;
+        return (found || j == 0) ? 0 : ret;
 }
 static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = {
diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
index 877d9acd91ef..fff8073e2a56 100644
--- a/net/netfilter/nft_bitwise.c
+++ b/net/netfilter/nft_bitwise.c
@@ -83,17 +83,26 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
                            tb[NFTA_BITWISE_MASK]);
        if (err < 0)
                return err;
-        if (d1.len != priv->len)
+        if (d1.len != priv->len) {
-                return -EINVAL;
+                err = -EINVAL;
+                goto err1;
+        }
        err = nft_data_init(NULL, &priv->xor, sizeof(priv->xor), &d2,
                            tb[NFTA_BITWISE_XOR]);
        if (err < 0)
-                return err;
+                goto err1;
-        if (d2.len != priv->len)
+        if (d2.len != priv->len) {
-                return -EINVAL;
+                err = -EINVAL;
+                goto err2;
+        }
        return 0;
+err2:
+        nft_data_release(&priv->xor, d2.type);
+err1:
+        nft_data_release(&priv->mask, d1.type);
+        return err;
 }
 static int nft_bitwise_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
index 2b96effeadc1..c2945eb3397c 100644
--- a/net/netfilter/nft_cmp.c
+++ b/net/netfilter/nft_cmp.c
@@ -201,10 +201,18 @@ nft_cmp_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
        if (err < 0)
                return ERR_PTR(err);
+        if (desc.type != NFT_DATA_VALUE) {
+                err = -EINVAL;
+                goto err1;
+        }
        if (desc.len <= sizeof(u32) && op == NFT_CMP_EQ)
                return &nft_cmp_fast_ops;
-        else
-                return &nft_cmp_ops;
+        return &nft_cmp_ops;
+err1:
+        nft_data_release(&data, desc.type);
+        return ERR_PTR(-EINVAL);
 }
 struct nft_expr_type nft_cmp_type __read_mostly = {
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index a34ceb38fc55..1678e9e75e8e 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -826,9 +826,9 @@ static void nft_ct_helper_obj_destroy(struct nft_object *obj)
        struct nft_ct_helper_obj *priv = nft_obj_data(obj);
        if (priv->helper4)
-                module_put(priv->helper4->me);
+                nf_conntrack_helper_put(priv->helper4);
        if (priv->helper6)
-                module_put(priv->helper6->me);
+                nf_conntrack_helper_put(priv->helper6);
 }
 static void nft_ct_helper_obj_eval(struct nft_object *obj,
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 728baf88295a..4717d7796927 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -65,7 +65,7 @@ static int nft_immediate_init(const struct nft_ctx *ctx,
        return 0;
 err1:
-        nft_data_uninit(&priv->data, desc.type);
+        nft_data_release(&priv->data, desc.type);
        return err;
 }
@@ -73,7 +73,8 @@ static void nft_immediate_destroy(const struct nft_ctx *ctx,
                                  const struct nft_expr *expr)
 {
        const struct nft_immediate_expr *priv = nft_expr_priv(expr);
-        return nft_data_uninit(&priv->data, nft_dreg_to_type(priv->dreg));
+        return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg));
 }
 static int nft_immediate_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c
index 9edc74eedc10..cedb96c3619f 100644
--- a/net/netfilter/nft_range.c
+++ b/net/netfilter/nft_range.c
@@ -102,9 +102,9 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr
        priv->len = desc_from.len;
        return 0;
 err2:
-        nft_data_uninit(&priv->data_to, desc_to.type);
+        nft_data_release(&priv->data_to, desc_to.type);
 err1:
-        nft_data_uninit(&priv->data_from, desc_from.type);
+        nft_data_release(&priv->data_from, desc_from.type);
        return err;
 }
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 8ec086b6b56b..3d3a6df4ce70 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -222,7 +222,7 @@ static void nft_hash_walk(const struct nft_ctx *ctx, struct nft_set *set,
        struct nft_set_elem elem;
        int err;
-        err = rhashtable_walk_init(&priv->ht, &hti, GFP_KERNEL);
+        err = rhashtable_walk_init(&priv->ht, &hti, GFP_ATOMIC);
        iter->err = err;
        if (err)
                return;
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index e97e2fb53f0a..fbdbaa00dd5f 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -116,17 +116,17 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
                else if (d > 0)
                        p = &parent->rb_right;
                else {
-                        if (nft_set_elem_active(&rbe->ext, genmask)) {
+                        if (nft_rbtree_interval_end(rbe) &&
-                                if (nft_rbtree_interval_end(rbe) &&
+                            !nft_rbtree_interval_end(new)) {
-                                    !nft_rbtree_interval_end(new))
+                                p = &parent->rb_left;
-                                        p = &parent->rb_left;
+                        } else if (!nft_rbtree_interval_end(rbe) &&
-                                else if (!nft_rbtree_interval_end(rbe) &&
+                                   nft_rbtree_interval_end(new)) {
-                                         nft_rbtree_interval_end(new))
+                                p = &parent->rb_right;
-                                        p = &parent->rb_right;
+                        } else if (nft_set_elem_active(&rbe->ext, genmask)) {
-                                else {
+                                *ext = &rbe->ext;
-                                        *ext = &rbe->ext;
+                                return -EEXIST;
-                                        return -EEXIST;
+                        } else {
-                                }
+                                p = &parent->rb_left;
                        }
                }
        }
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 8876b7da6884..1770c1d9b37f 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -283,28 +283,30 @@ static int xt_obj_to_user(u16 __user *psize, u16 size,
                       &U->u.user.revision, K->u.kernel.TYPE->revision)
 int xt_data_to_user(void __user *dst, const void *src,
-                    int usersize, int size)
+                    int usersize, int size, int aligned_size)
 {
        usersize = usersize ? : size;
        if (copy_to_user(dst, src, usersize))
                return -EFAULT;
-        if (usersize != size && clear_user(dst + usersize, size - usersize))
+        if (usersize != aligned_size &&
+            clear_user(dst + usersize, aligned_size - usersize))
                return -EFAULT;
        return 0;
 }
 EXPORT_SYMBOL_GPL(xt_data_to_user);
-#define XT_DATA_TO_USER(U, K, TYPE, C_SIZE)                             \
+#define XT_DATA_TO_USER(U, K, TYPE)                                     \
        xt_data_to_user(U->data, K->data,                               \
                        K->u.kernel.TYPE->usersize,                     \
-                        C_SIZE ? : K->u.kernel.TYPE->TYPE##size)
+                        K->u.kernel.TYPE->TYPE##size,                   \
+                        XT_ALIGN(K->u.kernel.TYPE->TYPE##size))
 int xt_match_to_user(const struct xt_entry_match *m,
                     struct xt_entry_match __user *u)
 {
        return XT_OBJ_TO_USER(u, m, match, 0) ||
-               XT_DATA_TO_USER(u, m, match, 0);
+               XT_DATA_TO_USER(u, m, match);
 }
 EXPORT_SYMBOL_GPL(xt_match_to_user);
@@ -312,7 +314,7 @@ int xt_target_to_user(const struct xt_entry_target *t,
                      struct xt_entry_target __user *u)
 {
        return XT_OBJ_TO_USER(u, t, target, 0) ||
-               XT_DATA_TO_USER(u, t, target, 0);
+               XT_DATA_TO_USER(u, t, target);
 }
 EXPORT_SYMBOL_GPL(xt_target_to_user);
@@ -611,6 +613,12 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
 }
 EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
+#define COMPAT_XT_DATA_TO_USER(U, K, TYPE, C_SIZE)                      \
+        xt_data_to_user(U->data, K->data,                               \
+                        K->u.kernel.TYPE->usersize,                     \
+                        C_SIZE,                                         \
+                        COMPAT_XT_ALIGN(C_SIZE))
 int xt_compat_match_to_user(const struct xt_entry_match *m,
                            void __user **dstptr, unsigned int *size)
 {
@@ -626,7 +634,7 @@ int xt_compat_match_to_user(const struct xt_entry_match *m,
                if (match->compat_to_user((void __user *)cm->data, m->data))
                        return -EFAULT;
        } else {
-                if (XT_DATA_TO_USER(cm, m, match, msize - sizeof(*cm)))
+                if (COMPAT_XT_DATA_TO_USER(cm, m, match, msize - sizeof(*cm)))
                        return -EFAULT;
        }
@@ -972,7 +980,7 @@ int xt_compat_target_to_user(const struct xt_entry_target *t,
                if (target->compat_to_user((void __user *)ct->data, t->data))
                        return -EFAULT;
        } else {
-                if (XT_DATA_TO_USER(ct, t, target, tsize - sizeof(*ct)))
+                if (COMPAT_XT_DATA_TO_USER(ct, t, target, tsize - sizeof(*ct)))
                        return -EFAULT;
        }
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index bb7ad82dcd56..623ef37de886 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -96,7 +96,7 @@ xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
        help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
        if (help == NULL) {
-                module_put(helper->me);
+                nf_conntrack_helper_put(helper);
                return -ENOMEM;
        }
@@ -263,7 +263,7 @@ out:
 err4:
        help = nfct_help(ct);
        if (help)
-                module_put(help->helper->me);
+                nf_conntrack_helper_put(help->helper);
 err3:
        nf_ct_tmpl_free(ct);
 err2:
@@ -346,7 +346,7 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
        if (ct) {
                help = nfct_help(ct);
                if (help)
-                        module_put(help->helper->me);
+                        nf_conntrack_helper_put(help->helper);
                nf_ct_netns_put(par->net, par->family);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index ee841f00a6ec..7586d446d7dc 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -62,6 +62,7 @@
 #include <asm/cacheflush.h>
 #include <linux/hash.h>
 #include <linux/genetlink.h>
+#include <linux/net_namespace.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -1415,7 +1416,8 @@ static void do_one_broadcast(struct sock *sk,
                goto out;
        }
        NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
-        NETLINK_CB(p->skb2).nsid_is_set = true;
+        if (NETLINK_CB(p->skb2).nsid != NETNSA_NSID_NOT_ASSIGNED)
+                NETLINK_CB(p->skb2).nsid_is_set = true;
        val = netlink_broadcast_deliver(sk, p->skb2);
        if (val < 0) {
                netlink_overrun(sk);
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index bf602e33c40a..08679ebb3068 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -1123,7 +1123,7 @@ static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
        help = nf_ct_helper_ext_add(info->ct, helper, GFP_KERNEL);
        if (!help) {
-                module_put(helper->me);
+                nf_conntrack_helper_put(helper);
                return -ENOMEM;
        }
@@ -1584,7 +1584,7 @@ void ovs_ct_free_action(const struct nlattr *a)
 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
 {
        if (ct_info->helper)
-                module_put(ct_info->helper->me);
+                nf_conntrack_helper_put(ct_info->helper);
        if (ct_info->ct)
                nf_ct_tmpl_free(ct_info->ct);
 }
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 89193a634da4..04a3128adcf0 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -94,7 +94,6 @@ static void internal_dev_destructor(struct net_device *dev)
        struct vport *vport = ovs_internal_dev_get_vport(dev);
        ovs_vport_free(vport);
-        free_netdev(dev);
 }
 static void
@@ -156,7 +155,8 @@ static void do_setup(struct net_device *netdev)
        netdev->priv_flags &= ~IFF_TX_SKB_SHARING;
        netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_OPENVSWITCH |
                              IFF_PHONY_HEADROOM | IFF_NO_QUEUE;
-        netdev->destructor = internal_dev_destructor;
+        netdev->needs_free_netdev = true;
+        netdev->priv_destructor = internal_dev_destructor;
        netdev->ethtool_ops = &internal_dev_ethtool_ops;
        netdev->rtnl_link_ops = &internal_dev_link_ops;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f4001763134d..e3eeed19cc7a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2658,13 +2658,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
        }
-        sockc.tsflags = po->sk.sk_tsflags;
-        if (msg->msg_controllen) {
-                err = sock_cmsg_send(&po->sk, msg, &sockc);
-                if (unlikely(err))
-                        goto out;
-        }
        err = -ENXIO;
        if (unlikely(dev == NULL))
                goto out;
@@ -2672,6 +2665,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
        if (unlikely(!(dev->flags & IFF_UP)))
                goto out_put;
+        sockc.tsflags = po->sk.sk_tsflags;
+        if (msg->msg_controllen) {
+                err = sock_cmsg_send(&po->sk, msg, &sockc);
+                if (unlikely(err))
+                        goto out_put;
+        }
        if (po->sk.sk_socket->type == SOCK_RAW)
                reserve = dev->hard_header_len;
        size_max = po->tx_ring.frame_size
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index 21c28b51be94..2c9337946e30 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -236,7 +236,7 @@ static void gprs_setup(struct net_device *dev)
        dev->tx_queue_len       = 10;
        dev->netdev_ops         = &gprs_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->needs_free_netdev  = true;
 }
 /*
diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
index 0a4e28477ad9..54369225766e 100644
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -217,7 +217,7 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
                                       unsigned int *_toklen)
 {
        const __be32 *xdr = *_xdr;
-        unsigned int toklen = *_toklen, n_parts, loop, tmp;
+        unsigned int toklen = *_toklen, n_parts, loop, tmp, paddedlen;
        /* there must be at least one name, and at least #names+1 length
         * words */
@@ -247,16 +247,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
                toklen -= 4;
                if (tmp <= 0 || tmp > AFSTOKEN_STRING_MAX)
                        return -EINVAL;
-                if (tmp > toklen)
+                paddedlen = (tmp + 3) & ~3;
+                if (paddedlen > toklen)
                        return -EINVAL;
                princ->name_parts[loop] = kmalloc(tmp + 1, GFP_KERNEL);
                if (!princ->name_parts[loop])
                        return -ENOMEM;
                memcpy(princ->name_parts[loop], xdr, tmp);
                princ->name_parts[loop][tmp] = 0;
-                tmp = (tmp + 3) & ~3;
+                toklen -= paddedlen;
-                toklen -= tmp;
+                xdr += paddedlen >> 2;
-                xdr += tmp >> 2;
        }
        if (toklen < 4)
@@ -265,16 +265,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ,
        toklen -= 4;
        if (tmp <= 0 || tmp > AFSTOKEN_K5_REALM_MAX)
                return -EINVAL;
-        if (tmp > toklen)
+        paddedlen = (tmp + 3) & ~3;
+        if (paddedlen > toklen)
                return -EINVAL;
        princ->realm = kmalloc(tmp + 1, GFP_KERNEL);
        if (!princ->realm)
                return -ENOMEM;
        memcpy(princ->realm, xdr, tmp);
        princ->realm[tmp] = 0;
-        tmp = (tmp + 3) & ~3;
+        toklen -= paddedlen;
-        toklen -= tmp;
+        xdr += paddedlen >> 2;
-        xdr += tmp >> 2;
        _debug("%s/...@%s", princ->name_parts[0], princ->realm);
@@ -293,7 +293,7 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td,
                                         unsigned int *_toklen)
 {
        const __be32 *xdr = *_xdr;
-        unsigned int toklen = *_toklen, len;
+        unsigned int toklen = *_toklen, len, paddedlen;
        /* there must be at least one tag and one length word */
        if (toklen <= 8)
@@ -307,15 +307,17 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td,
        toklen -= 8;
        if (len > max_data_size)
                return -EINVAL;
+        paddedlen = (len + 3) & ~3;
+        if (paddedlen > toklen)
+                return -EINVAL;
        td->data_len = len;
        if (len > 0) {
                td->data = kmemdup(xdr, len, GFP_KERNEL);
                if (!td->data)
                        return -ENOMEM;
-                len = (len + 3) & ~3;
+                toklen -= paddedlen;
-                toklen -= len;
+                xdr += paddedlen >> 2;
-                xdr += len >> 2;
        }
        _debug("tag %x len %x", td->tag, td->data_len);
@@ -387,7 +389,7 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
                                    const __be32 **_xdr, unsigned int *_toklen)
 {
        const __be32 *xdr = *_xdr;
-        unsigned int toklen = *_toklen, len;
+        unsigned int toklen = *_toklen, len, paddedlen;
        /* there must be at least one length word */
        if (toklen <= 4)
@@ -399,6 +401,9 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
        toklen -= 4;
        if (len > AFSTOKEN_K5_TIX_MAX)
                return -EINVAL;
+        paddedlen = (len + 3) & ~3;
+        if (paddedlen > toklen)
+                return -EINVAL;
        *_tktlen = len;
        _debug("ticket len %u", len);
@@ -407,9 +412,8 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen,
                *_ticket = kmemdup(xdr, len, GFP_KERNEL);
                if (!*_ticket)
                        return -ENOMEM;
-                len = (len + 3) & ~3;
+                toklen -= paddedlen;
-                toklen -= len;
+                xdr += paddedlen >> 2;
-                xdr += len >> 2;
        }
        *_xdr = xdr;
@@ -552,7 +556,7 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
 {
        const __be32 *xdr = prep->data, *token;
        const char *cp;
-        unsigned int len, tmp, loop, ntoken, toklen, sec_ix;
+        unsigned int len, paddedlen, loop, ntoken, toklen, sec_ix;
        size_t datalen = prep->datalen;
        int ret;
@@ -578,22 +582,21 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
        if (len < 1 || len > AFSTOKEN_CELL_MAX)
                goto not_xdr;
        datalen -= 4;
-        tmp = (len + 3) & ~3;
+        paddedlen = (len + 3) & ~3;
-        if (tmp > datalen)
+        if (paddedlen > datalen)
                goto not_xdr;
        cp = (const char *) xdr;
        for (loop = 0; loop < len; loop++)
                if (!isprint(cp[loop]))
                        goto not_xdr;
-        if (len < tmp)
+        for (; loop < paddedlen; loop++)
-                for (; loop < tmp; loop++)
+                if (cp[loop])
-                        if (cp[loop])
+                        goto not_xdr;
-                                goto not_xdr;
        _debug("cellname: [%u/%u] '%*.*s'",
-               len, tmp, len, len, (const char *) xdr);
+               len, paddedlen, len, len, (const char *) xdr);
-        datalen -= tmp;
+        datalen -= paddedlen;
-        xdr += tmp >> 2;
+        xdr += paddedlen >> 2;
        /* get the token count */
        if (datalen < 12)
@@ -614,10 +617,11 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep)
                sec_ix = ntohl(*xdr);
                datalen -= 4;
                _debug("token: [%x/%zx] %x", toklen, datalen, sec_ix);
-                if (toklen < 20 || toklen > datalen)
+                paddedlen = (toklen + 3) & ~3;
+                if (toklen < 20 || toklen > datalen || paddedlen > datalen)
                        goto not_xdr;
-                datalen -= (toklen + 3) & ~3;
+                datalen -= paddedlen;
-                xdr += (toklen + 3) >> 2;
+                xdr += paddedlen >> 2;
        } while (--loop > 0);
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 164b5ac094be..7dc5892671c8 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -94,8 +94,10 @@ static struct tcf_pedit_key_ex *tcf_pedit_keys_ex_parse(struct nlattr *nla,
                k++;
        }
-        if (n)
+        if (n) {
+                err = -EINVAL;
                goto err_out;
+        }
        return keys_ex;
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index f42008b29311..b062bc80c7cb 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -132,21 +132,21 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla,
                }
        }
-        spin_lock_bh(&police->tcf_lock);
        if (est) {
                err = gen_replace_estimator(&police->tcf_bstats, NULL,
                                            &police->tcf_rate_est,
                                            &police->tcf_lock,
                                            NULL, est);
                if (err)
-                        goto failure_unlock;
+                        goto failure;
        } else if (tb[TCA_POLICE_AVRATE] &&
                   (ret == ACT_P_CREATED ||
                    !gen_estimator_active(&police->tcf_rate_est))) {
                err = -EINVAL;
-                goto failure_unlock;
+                goto failure;
        }
+        spin_lock_bh(&police->tcf_lock);
        /* No failure allowed after this point */
        police->tcfp_mtu = parm->mtu;
        if (police->tcfp_mtu == 0) {
@@ -192,8 +192,6 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla,
        return ret;
-failure_unlock:
-        spin_unlock_bh(&police->tcf_lock);
 failure:
        qdisc_put_rtab(P_tab);
        qdisc_put_rtab(R_tab);
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index dee469fed967..51859b8edd7e 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -203,7 +203,6 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
        *arg = (unsigned long) head;
        rcu_assign_pointer(tp->root, new);
-        call_rcu(&head->rcu, mall_destroy_rcu);
        return 0;
 err_replace_hw_filter:
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index bbe57d57b67f..cfdbfa18a95e 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1019,7 +1019,8 @@ static struct Qdisc *qdisc_create(struct net_device *dev,
                return sch;
        }
        /* ops->init() failed, we call ->destroy() like qdisc_create_dflt() */
-        ops->destroy(sch);
+        if (ops->destroy)
+                ops->destroy(sch);
 err_out3:
        dev_put(dev);
        kfree((char *) sch - sch->padded);
@@ -1831,6 +1832,12 @@ static int tc_dump_tclass_root(struct Qdisc *root, struct sk_buff *skb,
        if (!qdisc_dev(root))
                return 0;
+        if (tcm->tcm_parent) {
+                q = qdisc_match_from_root(root, TC_H_MAJ(tcm->tcm_parent));
+                if (q && tc_dump_tclass_qdisc(q, skb, tcm, cb, t_p, s_t) < 0)
+                        return -1;
+                return 0;
+        }
        hash_for_each(qdisc_dev(root)->qdisc_hash, b, q, hash) {
                if (tc_dump_tclass_qdisc(q, skb, tcm, cb, t_p, s_t) < 0)
                        return -1;
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index a9708da28eb5..95238284c422 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1176,7 +1176,9 @@ void sctp_assoc_update(struct sctp_association *asoc,
                asoc->ctsn_ack_point = asoc->next_tsn - 1;
                asoc->adv_peer_ack_point = asoc->ctsn_ack_point;
-                if (!asoc->stream) {
+                if (sctp_state(asoc, COOKIE_WAIT)) {
+                        sctp_stream_free(asoc->stream);
                        asoc->stream = new->stream;
                        new->stream = NULL;
                }
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 8c589230794f..3dcd0ecf3d99 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -275,6 +275,7 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
                if (sctp_sk(sk)->bind_hash)
                        sctp_put_port(sk);
+                sctp_sk(sk)->ep = NULL;
                sock_put(sk);
        }
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 0e06a278d2a9..ba9ad32fc447 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -473,15 +473,14 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
                             struct sctp_association **app,
                             struct sctp_transport **tpp)
 {
+        struct sctp_init_chunk *chunkhdr, _chunkhdr;
        union sctp_addr saddr;
        union sctp_addr daddr;
        struct sctp_af *af;
        struct sock *sk = NULL;
        struct sctp_association *asoc;
        struct sctp_transport *transport = NULL;
-        struct sctp_init_chunk *chunkhdr;
        __u32 vtag = ntohl(sctphdr->vtag);
-        int len = skb->len - ((void *)sctphdr - (void *)skb->data);
        *app = NULL; *tpp = NULL;
@@ -516,13 +515,16 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
         * discard the packet.
         */
        if (vtag == 0) {
-                chunkhdr = (void *)sctphdr + sizeof(struct sctphdr);
+                /* chunk header + first 4 octects of init header */
-                if (len < sizeof(struct sctphdr) + sizeof(sctp_chunkhdr_t)
+                chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) +
-                          + sizeof(__be32) ||
+                                              sizeof(struct sctphdr),
+                                              sizeof(struct sctp_chunkhdr) +
+                                              sizeof(__be32), &_chunkhdr);
+                if (!chunkhdr ||
                    chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
-                    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag) {
+                    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag)
                        goto out;
-                }
        } else if (vtag != asoc->c.peer_vtag) {
                goto out;
        }
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 961ee59f696a..f5b45b8b8b16 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -240,12 +240,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
        struct sctp_bind_addr *bp;
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct sctp_sockaddr_entry *laddr;
-        union sctp_addr *baddr = NULL;
        union sctp_addr *daddr = &t->ipaddr;
        union sctp_addr dst_saddr;
        struct in6_addr *final_p, final;
        __u8 matchlen = 0;
-        __u8 bmatchlen;
        sctp_scope_t scope;
        memset(fl6, 0, sizeof(struct flowi6));
@@ -312,23 +310,37 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
         */
        rcu_read_lock();
        list_for_each_entry_rcu(laddr, &bp->address_list, list) {
-                if (!laddr->valid)
+                struct dst_entry *bdst;
+                __u8 bmatchlen;
+                if (!laddr->valid ||
+                    laddr->state != SCTP_ADDR_SRC ||
+                    laddr->a.sa.sa_family != AF_INET6 ||
+                    scope > sctp_scope(&laddr->a))
                        continue;
-                if ((laddr->state == SCTP_ADDR_SRC) &&
-                    (laddr->a.sa.sa_family == AF_INET6) &&
+                fl6->saddr = laddr->a.v6.sin6_addr;
-                    (scope <= sctp_scope(&laddr->a))) {
+                fl6->fl6_sport = laddr->a.v6.sin6_port;
-                        bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
-                        if (!baddr || (matchlen < bmatchlen)) {
-                                baddr = &laddr->a;
-                                matchlen = bmatchlen;
-                        }
-                }
-        }
-        if (baddr) {
-                fl6->saddr = baddr->v6.sin6_addr;
-                fl6->fl6_sport = baddr->v6.sin6_port;
                final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final);
-                dst = ip6_dst_lookup_flow(sk, fl6, final_p);
+                bdst = ip6_dst_lookup_flow(sk, fl6, final_p);
+                if (!IS_ERR(bdst) &&
+                    ipv6_chk_addr(dev_net(bdst->dev),
+                                  &laddr->a.v6.sin6_addr, bdst->dev, 1)) {
+                        if (!IS_ERR_OR_NULL(dst))
+                                dst_release(dst);
+                        dst = bdst;
+                        break;
+                }
+                bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
+                if (matchlen > bmatchlen)
+                        continue;
+                if (!IS_ERR_OR_NULL(dst))
+                        dst_release(dst);
+                dst = bdst;
+                matchlen = bmatchlen;
        }
        rcu_read_unlock();
@@ -665,6 +677,9 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
        newnp = inet6_sk(newsk);
        memcpy(newnp, np, sizeof(struct ipv6_pinfo));
+        newnp->ipv6_mc_list = NULL;
+        newnp->ipv6_ac_list = NULL;
+        newnp->ipv6_fl_list = NULL;
        rcu_read_lock();
        opt = rcu_dereference(np->opt);
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index 048954eee984..9a647214a91e 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -278,7 +278,6 @@ out:
 static int sctp_sock_dump(struct sock *sk, void *p)
 {
-        struct sctp_endpoint *ep = sctp_sk(sk)->ep;
        struct sctp_comm_param *commp = p;
        struct sk_buff *skb = commp->skb;
        struct netlink_callback *cb = commp->cb;
@@ -287,7 +286,9 @@ static int sctp_sock_dump(struct sock *sk, void *p)
        int err = 0;
        lock_sock(sk);
-        list_for_each_entry(assoc, &ep->asocs, asocs) {
+        if (!sctp_sk(sk)->ep)
+                goto release;
+        list_for_each_entry(assoc, &sctp_sk(sk)->ep->asocs, asocs) {
                if (cb->args[4] < cb->args[1])
                        goto next;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 8a08f13469c4..92e332e17391 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2454,16 +2454,11 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
         * stream sequence number shall be set to 0.
         */
-        /* Allocate storage for the negotiated streams if it is not a temporary
+        if (sctp_stream_init(asoc, gfp))
-         * association.
+                goto clean_up;
-         */
-        if (!asoc->temp) {
-                if (sctp_stream_init(asoc, gfp))
-                        goto clean_up;
-                if (sctp_assoc_set_id(asoc, gfp))
+        if (!asoc->temp && sctp_assoc_set_id(asoc, gfp))
-                        goto clean_up;
+                goto clean_up;
-        }
        /* ADDIP Section 4.1 ASCONF Chunk Procedures
         *
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 4f5e6cfc7f60..f863b5573e42 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -2088,6 +2088,9 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(struct net *net,
                }
        }
+        /* Set temp so that it won't be added into hashtable */
+        new_asoc->temp = 1;
        /* Compare the tie_tag in cookie with the verification tag of
         * current association.
         */
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index f16c8d97b7f3..3a8318e518f1 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4622,13 +4622,13 @@ int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
        for (head = sctp_ep_hashtable; hash < sctp_ep_hashsize;
             hash++, head++) {
-                read_lock(&head->lock);
+                read_lock_bh(&head->lock);
                sctp_for_each_hentry(epb, &head->chain) {
                        err = cb(sctp_ep(epb), p);
                        if (err)
                                break;
                }
-                read_unlock(&head->lock);
+                read_unlock_bh(&head->lock);
        }
        return err;
@@ -4666,9 +4666,8 @@ int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *),
        if (err)
                return err;
-        sctp_transport_get_idx(net, &hti, pos);
+        obj = sctp_transport_get_idx(net, &hti, pos + 1);
-        obj = sctp_transport_get_next(net, &hti);
+        for (; !IS_ERR_OR_NULL(obj); obj = sctp_transport_get_next(net, &hti)) {
-        for (; obj && !IS_ERR(obj); obj = sctp_transport_get_next(net, &hti)) {
                struct sctp_transport *transport = obj;
                if (!sctp_transport_hold(transport))
diff --git a/net/smc/Kconfig b/net/smc/Kconfig
index c717ef0896aa..33954852f3f8 100644
--- a/net/smc/Kconfig
+++ b/net/smc/Kconfig
@@ -8,6 +8,10 @@ config SMC
          The Linux implementation of the SMC-R solution is designed as
          a separate socket family SMC.
+          Warning: SMC will expose all memory for remote reads and writes
+          once a connection is established.  Don't enable this option except
+          for tightly controlled lab environment.
          Select this option if you want to run SMC socket applications
 config SMC_DIAG
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index e41f594a1e1d..03ec058d18df 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -204,7 +204,7 @@ int smc_clc_send_confirm(struct smc_sock *smc)
        memcpy(&cclc.lcl.mac, &link->smcibdev->mac[link->ibport - 1], ETH_ALEN);
        hton24(cclc.qpn, link->roce_qp->qp_num);
        cclc.rmb_rkey =
-                htonl(conn->rmb_desc->mr_rx[SMC_SINGLE_LINK]->rkey);
+                htonl(conn->rmb_desc->rkey[SMC_SINGLE_LINK]);
        cclc.conn_idx = 1; /* for now: 1 RMB = 1 RMBE */
        cclc.rmbe_alert_token = htonl(conn->alert_token_local);
        cclc.qp_mtu = min(link->path_mtu, link->peer_mtu);
@@ -256,7 +256,7 @@ int smc_clc_send_accept(struct smc_sock *new_smc, int srv_first_contact)
        memcpy(&aclc.lcl.mac, link->smcibdev->mac[link->ibport - 1], ETH_ALEN);
        hton24(aclc.qpn, link->roce_qp->qp_num);
        aclc.rmb_rkey =
-                htonl(conn->rmb_desc->mr_rx[SMC_SINGLE_LINK]->rkey);
+                htonl(conn->rmb_desc->rkey[SMC_SINGLE_LINK]);
        aclc.conn_idx = 1;                      /* as long as 1 RMB = 1 RMBE */
        aclc.rmbe_alert_token = htonl(conn->alert_token_local);
        aclc.qp_mtu = link->path_mtu;
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 65020e93ff21..3ac09a629ea1 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -613,19 +613,8 @@ int smc_rmb_create(struct smc_sock *smc)
                        rmb_desc = NULL;
                        continue; /* if mapping failed, try smaller one */
                }
-                rc = smc_ib_get_memory_region(lgr->lnk[SMC_SINGLE_LINK].roce_pd,
+                rmb_desc->rkey[SMC_SINGLE_LINK] =
-                                              IB_ACCESS_REMOTE_WRITE |
+                        lgr->lnk[SMC_SINGLE_LINK].roce_pd->unsafe_global_rkey;
-                                              IB_ACCESS_LOCAL_WRITE,
-                                             &rmb_desc->mr_rx[SMC_SINGLE_LINK]);
-                if (rc) {
-                        smc_ib_buf_unmap(lgr->lnk[SMC_SINGLE_LINK].smcibdev,
-                                         tmp_bufsize, rmb_desc,
-                                         DMA_FROM_DEVICE);
-                        kfree(rmb_desc->cpu_addr);
-                        kfree(rmb_desc);
-                        rmb_desc = NULL;
-                        continue;
-                }
                rmb_desc->used = 1;
                write_lock_bh(&lgr->rmbs_lock);
                list_add(&rmb_desc->list,
@@ -668,6 +657,7 @@ int smc_rmb_rtoken_handling(struct smc_connection *conn,
        for (i = 0; i < SMC_RMBS_PER_LGR_MAX; i++) {
                if ((lgr->rtokens[i][SMC_SINGLE_LINK].rkey == rkey) &&
+                    (lgr->rtokens[i][SMC_SINGLE_LINK].dma_addr == dma_addr) &&
                    test_bit(i, lgr->rtokens_used_mask)) {
                        conn->rtoken_idx = i;
                        return 0;
diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h
index 27eb38056a27..b013cb43a327 100644
--- a/net/smc/smc_core.h
+++ b/net/smc/smc_core.h
@@ -93,7 +93,7 @@ struct smc_buf_desc {
        u64                     dma_addr[SMC_LINKS_PER_LGR_MAX];
                                                /* mapped address of buffer */
        void                    *cpu_addr;      /* virtual address of buffer */
-        struct ib_mr            *mr_rx[SMC_LINKS_PER_LGR_MAX];
+        u32                     rkey[SMC_LINKS_PER_LGR_MAX];
                                                /* for rmb only:
                                                 * rkey provided to peer
                                                 */
diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
index cb69ab977cd7..b31715505a35 100644
--- a/net/smc/smc_ib.c
+++ b/net/smc/smc_ib.c
@@ -37,24 +37,6 @@ u8 local_systemid[SMC_SYSTEMID_LEN] = SMC_LOCAL_SYSTEMID_RESET;	/* unique system
                                                                 * identifier
                                                                 */
-int smc_ib_get_memory_region(struct ib_pd *pd, int access_flags,
-                             struct ib_mr **mr)
-{
-        int rc;
-        if (*mr)
-                return 0; /* already done */
-        /* obtain unique key -
-         * next invocation of get_dma_mr returns a different key!
-         */
-        *mr = pd->device->get_dma_mr(pd, access_flags);
-        rc = PTR_ERR_OR_ZERO(*mr);
-        if (IS_ERR(*mr))
-                *mr = NULL;
-        return rc;
-}
 static int smc_ib_modify_qp_init(struct smc_link *lnk)
 {
        struct ib_qp_attr qp_attr;
@@ -210,7 +192,8 @@ int smc_ib_create_protection_domain(struct smc_link *lnk)
 {
        int rc;
-        lnk->roce_pd = ib_alloc_pd(lnk->smcibdev->ibdev, 0);
+        lnk->roce_pd = ib_alloc_pd(lnk->smcibdev->ibdev,
+                                   IB_PD_UNSAFE_GLOBAL_RKEY);
        rc = PTR_ERR_OR_ZERO(lnk->roce_pd);
        if (IS_ERR(lnk->roce_pd))
                lnk->roce_pd = NULL;
diff --git a/net/smc/smc_ib.h b/net/smc/smc_ib.h
index 7e1f0e24d177..b567152a526d 100644
--- a/net/smc/smc_ib.h
+++ b/net/smc/smc_ib.h
@@ -61,8 +61,6 @@ void smc_ib_dealloc_protection_domain(struct smc_link *lnk);
 int smc_ib_create_protection_domain(struct smc_link *lnk);
 void smc_ib_destroy_queue_pair(struct smc_link *lnk);
 int smc_ib_create_queue_pair(struct smc_link *lnk);
-int smc_ib_get_memory_region(struct ib_pd *pd, int access_flags,
-                             struct ib_mr **mr);
 int smc_ib_ready_link(struct smc_link *lnk);
 int smc_ib_modify_qp_rts(struct smc_link *lnk);
 int smc_ib_modify_qp_reset(struct smc_link *lnk);
diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index 24fedd4b117e..03f6b5840764 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -119,11 +119,9 @@ int xprt_rdma_bc_setup(struct rpc_xprt *xprt, unsigned int reqs)
        for (i = 0; i < (reqs << 1); i++) {
                rqst = kzalloc(sizeof(*rqst), GFP_KERNEL);
-                if (!rqst) {
+                if (!rqst)
-                        pr_err("RPC:       %s: Failed to create bc rpc_rqst\n",
-                               __func__);
                        goto out_free;
-                }
                dprintk("RPC:       %s: new rqst %p\n", __func__, rqst);
                rqst->rq_xprt = &r_xprt->rx_xprt;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 16aff8ddc16f..d5b54c020dec 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2432,7 +2432,12 @@ static void xs_tcp_setup_socket(struct work_struct *work)
        case -ENETUNREACH:
        case -EADDRINUSE:
        case -ENOBUFS:
-                /* retry with existing socket, after a delay */
+                /*
+                 * xs_tcp_force_close() wakes tasks with -EIO.
+                 * We need to wake them first to ensure the
+                 * correct error code.
+                 */
+                xprt_wake_pending_tasks(xprt, status);
                xs_tcp_force_close(xprt);
                goto out;
        }
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 312ef7de57d7..ab3087687a32 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -508,7 +508,7 @@ bool tipc_msg_reverse(u32 own_node,  struct sk_buff **skb, int err)
        }
        if (skb_cloned(_skb) &&
-            pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_KERNEL))
+            pskb_expand_head(_skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
                goto exit;
        /* Now reverse the concerned fields */
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 0d4f2f455a7c..1b92b72e812f 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -362,25 +362,25 @@ static int tipc_sk_sock_err(struct socket *sock, long *timeout)
        return 0;
 }
-#define tipc_wait_for_cond(sock_, timeout_, condition_)                 \
+#define tipc_wait_for_cond(sock_, timeo_, condition_)                          \
-({                                                                      \
+({                                                                             \
-        int rc_ = 0;                                                    \
+        struct sock *sk_;                                                      \
-        int done_ = 0;                                                  \
+        int rc_;                                                               \
-                                                                        \
+                                                                               \
-        while (!(condition_) && !done_) {                               \
+        while ((rc_ = !(condition_))) {                                        \
-                struct sock *sk_ = sock->sk;                            \
+                DEFINE_WAIT_FUNC(wait_, woken_wake_function);                  \
-                DEFINE_WAIT_FUNC(wait_, woken_wake_function);           \
+                sk_ = (sock_)->sk;                                             \
-                                                                        \
+                rc_ = tipc_sk_sock_err((sock_), timeo_);                       \
-                rc_ = tipc_sk_sock_err(sock_, timeout_);                \
+                if (rc_)                                                       \
-                if (rc_)                                                \
+                        break;                                                 \
-                        break;                                          \
+                prepare_to_wait(sk_sleep(sk_), &wait_, TASK_INTERRUPTIBLE);    \
-                prepare_to_wait(sk_sleep(sk_), &wait_,                  \
+                release_sock(sk_);                                             \
-                                TASK_INTERRUPTIBLE);                    \
+                *(timeo_) = wait_woken(&wait_, TASK_INTERRUPTIBLE, *(timeo_)); \
-                done_ = sk_wait_event(sk_, timeout_,                    \
+                sched_annotate_sleep();                                        \
-                                      (condition_), &wait_);            \
+                lock_sock(sk_);                                                \
-                remove_wait_queue(sk_sleep(sk_), &wait_);               \
+                remove_wait_queue(sk_sleep(sk_), &wait_);                      \
-        }                                                               \
+        }                                                                      \
-        rc_;                                                            \
+        rc_;                                                                   \
 })
 /**
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 6a7fe7660551..1a0c961f4ffe 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -999,7 +999,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        struct path path = { };
        err = -EINVAL;
-        if (sunaddr->sun_family != AF_UNIX)
+        if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
+            sunaddr->sun_family != AF_UNIX)
                goto out;
        if (addr_len == sizeof(short)) {
@@ -1110,6 +1111,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
        unsigned int hash;
        int err;
+        err = -EINVAL;
+        if (alen < offsetofend(struct sockaddr, sa_family))
+                goto out;
        if (addr->sa_family != AF_UNSPEC) {
                err = unix_mkname(sunaddr, alen, &hash);
                if (err < 0)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 6f7f6757ceef..dfc8c51e4d74 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1540,8 +1540,7 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
        long timeout;
        int err;
        struct vsock_transport_send_notify_data send_data;
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
-        DEFINE_WAIT(wait);
        sk = sock->sk;
        vsk = vsock_sk(sk);
@@ -1584,11 +1583,10 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
        if (err < 0)
                goto out;
        while (total_written < len) {
                ssize_t written;
-                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+                add_wait_queue(sk_sleep(sk), &wait);
                while (vsock_stream_has_space(vsk) == 0 &&
                       sk->sk_err == 0 &&
                       !(sk->sk_shutdown & SEND_SHUTDOWN) &&
@@ -1597,33 +1595,30 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
                        /* Don't wait for non-blocking sockets. */
                        if (timeout == 0) {
                                err = -EAGAIN;
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                goto out_err;
                        }
                        err = transport->notify_send_pre_block(vsk, &send_data);
                        if (err < 0) {
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                goto out_err;
                        }
                        release_sock(sk);
-                        timeout = schedule_timeout(timeout);
+                        timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
                        lock_sock(sk);
                        if (signal_pending(current)) {
                                err = sock_intr_errno(timeout);
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                goto out_err;
                        } else if (timeout == 0) {
                                err = -EAGAIN;
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                goto out_err;
                        }
-                        prepare_to_wait(sk_sleep(sk), &wait,
-                                        TASK_INTERRUPTIBLE);
                }
-                finish_wait(sk_sleep(sk), &wait);
+                remove_wait_queue(sk_sleep(sk), &wait);
                /* These checks occur both as part of and after the loop
                 * conditional since we need to check before and after
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 14d5f0c8c45f..9f0901f3e42b 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -322,9 +322,9 @@ cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
 {
        struct cfg80211_sched_scan_request *pos;
-        ASSERT_RTNL();
+        WARN_ON_ONCE(!rcu_read_lock_held() && !lockdep_rtnl_is_held());
-        list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
+        list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list) {
                if (pos->reqid == reqid)
                        return pos;
        }
@@ -398,13 +398,13 @@ void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
        trace_cfg80211_sched_scan_results(wiphy, reqid);
        /* ignore if we're not scanning */
-        rtnl_lock();
+        rcu_read_lock();
        request = cfg80211_find_sched_scan_req(rdev, reqid);
        if (request) {
                request->report_results = true;
                queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
        }
-        rtnl_unlock();
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(cfg80211_sched_scan_results);
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 7198373e2920..4992f1025c9d 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -454,6 +454,8 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
        if (iftype == NL80211_IFTYPE_MESH_POINT)
                skb_copy_bits(skb, hdrlen, &mesh_flags, 1);
+        mesh_flags &= MESH_FLAGS_AE;
        switch (hdr->frame_control &
                cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
        case cpu_to_le16(IEEE80211_FCTL_TODS):
@@ -469,9 +471,9 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
                             iftype != NL80211_IFTYPE_STATION))
                        return -1;
                if (iftype == NL80211_IFTYPE_MESH_POINT) {
-                        if (mesh_flags & MESH_FLAGS_AE_A4)
+                        if (mesh_flags == MESH_FLAGS_AE_A4)
                                return -1;
-                        if (mesh_flags & MESH_FLAGS_AE_A5_A6) {
+                        if (mesh_flags == MESH_FLAGS_AE_A5_A6) {
                                skb_copy_bits(skb, hdrlen +
                                        offsetof(struct ieee80211s_hdr, eaddr1),
                                        tmp.h_dest, 2 * ETH_ALEN);
@@ -487,9 +489,9 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
                     ether_addr_equal(tmp.h_source, addr)))
                        return -1;
                if (iftype == NL80211_IFTYPE_MESH_POINT) {
-                        if (mesh_flags & MESH_FLAGS_AE_A5_A6)
+                        if (mesh_flags == MESH_FLAGS_AE_A5_A6)
                                return -1;
-                        if (mesh_flags & MESH_FLAGS_AE_A4)
+                        if (mesh_flags == MESH_FLAGS_AE_A4)
                                skb_copy_bits(skb, hdrlen +
                                        offsetof(struct ieee80211s_hdr, eaddr1),
                                        tmp.h_source, ETH_ALEN);
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 1a4db6790e20..6cdb054484d6 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -914,13 +914,12 @@ int call_commit_handler(struct net_device *dev)
 * Main IOCTl dispatcher.
 * Check the type of IOCTL and call the appropriate wrapper...
 */
-static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
+static int wireless_process_ioctl(struct net *net, struct iwreq *iwr,
                                  unsigned int cmd,
                                  struct iw_request_info *info,
                                  wext_ioctl_func standard,
                                  wext_ioctl_func private)
 {
-        struct iwreq *iwr = (struct iwreq *) ifr;
        struct net_device *dev;
        iw_handler      handler;
@@ -928,7 +927,7 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
         * The copy_to/from_user() of ifr is also dealt with in there */
        /* Make sure the device exist */
-        if ((dev = __dev_get_by_name(net, ifr->ifr_name)) == NULL)
+        if ((dev = __dev_get_by_name(net, iwr->ifr_name)) == NULL)
                return -ENODEV;
        /* A bunch of special cases, then the generic case...
@@ -957,9 +956,6 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                else if (private)
                        return private(dev, iwr, cmd, info, handler);
        }
-        /* Old driver API : call driver ioctl handler */
-        if (dev->netdev_ops->ndo_do_ioctl)
-                return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
        return -EOPNOTSUPP;
 }
@@ -977,7 +973,7 @@ static int wext_permission_check(unsigned int cmd)
 }
 /* entry point from dev ioctl */
-static int wext_ioctl_dispatch(struct net *net, struct ifreq *ifr,
+static int wext_ioctl_dispatch(struct net *net, struct iwreq *iwr,
                               unsigned int cmd, struct iw_request_info *info,
                               wext_ioctl_func standard,
                               wext_ioctl_func private)
@@ -987,9 +983,9 @@ static int wext_ioctl_dispatch(struct net *net, struct ifreq *ifr,
        if (ret)
                return ret;
-        dev_load(net, ifr->ifr_name);
+        dev_load(net, iwr->ifr_name);
        rtnl_lock();
-        ret = wireless_process_ioctl(net, ifr, cmd, info, standard, private);
+        ret = wireless_process_ioctl(net, iwr, cmd, info, standard, private);
        rtnl_unlock();
        return ret;
@@ -1039,18 +1035,18 @@ static int ioctl_standard_call(struct net_device *	dev,
 }
-int wext_handle_ioctl(struct net *net, struct ifreq *ifr, unsigned int cmd,
+int wext_handle_ioctl(struct net *net, struct iwreq *iwr, unsigned int cmd,
                      void __user *arg)
 {
        struct iw_request_info info = { .cmd = cmd, .flags = 0 };
        int ret;
-        ret = wext_ioctl_dispatch(net, ifr, cmd, &info,
+        ret = wext_ioctl_dispatch(net, iwr, cmd, &info,
                                  ioctl_standard_call,
                                  ioctl_private_call);
        if (ret >= 0 &&
            IW_IS_GET(cmd) &&
-            copy_to_user(arg, ifr, sizeof(struct iwreq)))
+            copy_to_user(arg, iwr, sizeof(struct iwreq)))
                return -EFAULT;
        return ret;
@@ -1107,7 +1103,7 @@ int compat_wext_handle_ioctl(struct net *net, unsigned int cmd,
        info.cmd = cmd;
        info.flags = IW_REQUEST_FLAG_COMPAT;
-        ret = wext_ioctl_dispatch(net, (struct ifreq *) &iwr, cmd, &info,
+        ret = wext_ioctl_dispatch(net, &iwr, cmd, &info,
                                  compat_standard_call,
                                  compat_private_call);
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 8b911c29860e..5a1a98df3499 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1791,32 +1791,40 @@ void x25_kill_by_neigh(struct x25_neigh *nb)
 static int __init x25_init(void)
 {
-        int rc = proto_register(&x25_proto, 0);
+        int rc;
-        if (rc != 0)
+        rc = proto_register(&x25_proto, 0);
+        if (rc)
                goto out;
        rc = sock_register(&x25_family_ops);
-        if (rc != 0)
+        if (rc)
                goto out_proto;
        dev_add_pack(&x25_packet_type);
        rc = register_netdevice_notifier(&x25_dev_notifier);
-        if (rc != 0)
+        if (rc)
                goto out_sock;
-        pr_info("Linux Version 0.2\n");
+        rc = x25_register_sysctl();
+        if (rc)
+                goto out_dev;
-        x25_register_sysctl();
        rc = x25_proc_init();
-        if (rc != 0)
+        if (rc)
-                goto out_dev;
+                goto out_sysctl;
+        pr_info("Linux Version 0.2\n");
 out:
        return rc;
+out_sysctl:
+        x25_unregister_sysctl();
 out_dev:
        unregister_netdevice_notifier(&x25_dev_notifier);
 out_sock:
+        dev_remove_pack(&x25_packet_type);
        sock_unregister(AF_X25);
 out_proto:
        proto_unregister(&x25_proto);
diff --git a/net/x25/sysctl_net_x25.c b/net/x25/sysctl_net_x25.c
index a06dfe143c67..ba078c85f0a1 100644
--- a/net/x25/sysctl_net_x25.c
+++ b/net/x25/sysctl_net_x25.c
@@ -73,9 +73,12 @@ static struct ctl_table x25_table[] = {
        { },
 };
-void __init x25_register_sysctl(void)
+int __init x25_register_sysctl(void)
 {
        x25_table_header = register_net_sysctl(&init_net, "net/x25", x25_table);
+        if (!x25_table_header)
+                return -ENOMEM;
+        return 0;
 }
 void x25_unregister_sysctl(void)
diff --git a/net/xfrm/Makefile b/net/xfrm/Makefile
index abf81b329dc1..55b2ac300995 100644
--- a/net/xfrm/Makefile
+++ b/net/xfrm/Makefile
@@ -4,8 +4,7 @@
 obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_hash.o \
                      xfrm_input.o xfrm_output.o \
-                      xfrm_sysctl.o xfrm_replay.o
+                      xfrm_sysctl.o xfrm_replay.o xfrm_device.o
-obj-$(CONFIG_XFRM_OFFLOAD) += xfrm_device.o
 obj-$(CONFIG_XFRM_STATISTICS) += xfrm_proc.o
 obj-$(CONFIG_XFRM_ALGO) += xfrm_algo.o
 obj-$(CONFIG_XFRM_USER) += xfrm_user.o
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index 8ec8a3fcf8d4..5aba03685d7d 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -22,6 +22,7 @@
 #include <net/xfrm.h>
 #include <linux/notifier.h>
+#ifdef CONFIG_XFRM_OFFLOAD
 int validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features)
 {
        int err;
@@ -137,6 +138,7 @@ ok:
        return true;
 }
 EXPORT_SYMBOL_GPL(xfrm_dev_offload_ok);
+#endif
 int xfrm_dev_register(struct net_device *dev)
 {
@@ -170,7 +172,7 @@ static int xfrm_dev_feat_change(struct net_device *dev)
 static int xfrm_dev_down(struct net_device *dev)
 {
-        if (dev->hw_features & NETIF_F_HW_ESP)
+        if (dev->features & NETIF_F_HW_ESP)
                xfrm_dev_state_flush(dev_net(dev), dev, true);
        xfrm_garbage_collect(dev_net(dev));
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b00a1d5a7f52..643a18f72032 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1006,10 +1006,6 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
                err = -ESRCH;
 out:
        spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
-        if (cnt)
-                xfrm_garbage_collect(net);
        return err;
 }
 EXPORT_SYMBOL(xfrm_policy_flush);
@@ -1797,43 +1793,6 @@ free_dst:
        goto out;
 }
-#ifdef CONFIG_XFRM_SUB_POLICY
-static int xfrm_dst_alloc_copy(void **target, const void *src, int size)
-{
-        if (!*target) {
-                *target = kmalloc(size, GFP_ATOMIC);
-                if (!*target)
-                        return -ENOMEM;
-        }
-        memcpy(*target, src, size);
-        return 0;
-}
-#endif
-static int xfrm_dst_update_parent(struct dst_entry *dst,
-                                  const struct xfrm_selector *sel)
-{
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-        return xfrm_dst_alloc_copy((void **)&(xdst->partner),
-                                   sel, sizeof(*sel));
-#else
-        return 0;
-#endif
-}
-static int xfrm_dst_update_origin(struct dst_entry *dst,
-                                  const struct flowi *fl)
-{
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-        return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl));
-#else
-        return 0;
-#endif
-}
 static int xfrm_expand_policies(const struct flowi *fl, u16 family,
                                struct xfrm_policy **pols,
                                int *num_pols, int *num_xfrms)
@@ -1905,16 +1864,6 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
        xdst = (struct xfrm_dst *)dst;
        xdst->num_xfrms = err;
-        if (num_pols > 1)
-                err = xfrm_dst_update_parent(dst, &pols[1]->selector);
-        else
-                err = xfrm_dst_update_origin(dst, fl);
-        if (unlikely(err)) {
-                dst_free(dst);
-                XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
-                return ERR_PTR(err);
-        }
        xdst->num_pols = num_pols;
        memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols);
        xdst->policy_genid = atomic_read(&pols[0]->genid);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index fc3c5aa38754..2e291bc5f1fc 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1383,6 +1383,8 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig)
        x->curlft.add_time = orig->curlft.add_time;
        x->km.state = orig->km.state;
        x->km.seq = orig->km.seq;
+        x->replay = orig->replay;
+        x->preplay = orig->preplay;
        return x;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 38614df33ec8..86116e9aaf3d 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2027,6 +2027,7 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                        return 0;
                return err;
        }
+        xfrm_garbage_collect(net);
        c.data.type = type;
        c.event = nlh->nlmsg_type;