40 files changed, 465 insertions, 272 deletions

diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index 253bc77eda3b..7dbc80d01eb0 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -61,6 +61,19 @@ static void __mdb_entry_fill_flags(struct br_mdb_entry *e, unsigned char flags)
                 e->flags |= MDB_FLAGS_OFFLOAD;
 }
 
+static void __mdb_entry_to_br_ip(struct br_mdb_entry *entry, struct br_ip *ip)
+{
+        memset(ip, 0, sizeof(struct br_ip));
+        ip->vid = entry->vid;
+        ip->proto = entry->addr.proto;
+        if (ip->proto == htons(ETH_P_IP))
+                ip->u.ip4 = entry->addr.u.ip4;
+#if IS_ENABLED(CONFIG_IPV6)
+        else
+                ip->u.ip6 = entry->addr.u.ip6;
+#endif
+}
+
 static int br_mdb_fill_info(struct sk_buff *skb, struct netlink_callback *cb,
                             struct net_device *dev)
 {
@@ -243,9 +256,45 @@ static inline size_t rtnl_mdb_nlmsg_size(void)
                 + nla_total_size(sizeof(struct br_mdb_entry));
 }
 
-static void __br_mdb_notify(struct net_device *dev, struct br_mdb_entry *entry,
-                            int type, struct net_bridge_port_group *pg)
+struct br_mdb_complete_info {
+        struct net_bridge_port *port;
+        struct br_ip ip;
+};
+
+static void br_mdb_complete(struct net_device *dev, int err, void *priv)
 {
+        struct br_mdb_complete_info *data = priv;
+        struct net_bridge_port_group __rcu **pp;
+        struct net_bridge_port_group *p;
+        struct net_bridge_mdb_htable *mdb;
+        struct net_bridge_mdb_entry *mp;
+        struct net_bridge_port *port = data->port;
+        struct net_bridge *br = port->br;
+
+        if (err)
+                goto err;
+
+        spin_lock_bh(&br->multicast_lock);
+        mdb = mlock_dereference(br->mdb, br);
+        mp = br_mdb_ip_get(mdb, &data->ip);
+        if (!mp)
+                goto out;
+        for (pp = &mp->ports; (p = mlock_dereference(*pp, br)) != NULL;
+             pp = &p->next) {
+                if (p->port != port)
+                        continue;
+                p->flags |= MDB_PG_FLAGS_OFFLOAD;
+        }
+out:
+        spin_unlock_bh(&br->multicast_lock);
+err:
+        kfree(priv);
+}
+
+static void __br_mdb_notify(struct net_device *dev, struct net_bridge_port *p,
+                            struct br_mdb_entry *entry, int type)
+{
+        struct br_mdb_complete_info *complete_info;
         struct switchdev_obj_port_mdb mdb = {
                 .obj = {
                         .id = SWITCHDEV_OBJ_ID_PORT_MDB,
@@ -268,9 +317,14 @@ static void __br_mdb_notify(struct net_device *dev, struct br_mdb_entry *entry,
 
         mdb.obj.orig_dev = port_dev;
         if (port_dev && type == RTM_NEWMDB) {
-                err = switchdev_port_obj_add(port_dev, &mdb.obj);
-                if (!err && pg)
-                        pg->flags |= MDB_PG_FLAGS_OFFLOAD;
+                complete_info = kmalloc(sizeof(*complete_info), GFP_ATOMIC);
+                if (complete_info) {
+                        complete_info->port = p;
+                        __mdb_entry_to_br_ip(entry, &complete_info->ip);
+                        mdb.obj.complete_priv = complete_info;
+                        mdb.obj.complete = br_mdb_complete;
+                        switchdev_port_obj_add(port_dev, &mdb.obj);
+                }
         } else if (port_dev && type == RTM_DELMDB) {
                 switchdev_port_obj_del(port_dev, &mdb.obj);
         }
@@ -291,21 +345,21 @@ errout:
         rtnl_set_sk_err(net, RTNLGRP_MDB, err);
 }
 
-void br_mdb_notify(struct net_device *dev, struct net_bridge_port_group *pg,
-                   int type)
+void br_mdb_notify(struct net_device *dev, struct net_bridge_port *port,
+                   struct br_ip *group, int type, u8 flags)
 {
         struct br_mdb_entry entry;
 
         memset(&entry, 0, sizeof(entry));
-        entry.ifindex = pg->port->dev->ifindex;
-        entry.addr.proto = pg->addr.proto;
-        entry.addr.u.ip4 = pg->addr.u.ip4;
+        entry.ifindex = port->dev->ifindex;
+        entry.addr.proto = group->proto;
+        entry.addr.u.ip4 = group->u.ip4;
 #if IS_ENABLED(CONFIG_IPV6)
-        entry.addr.u.ip6 = pg->addr.u.ip6;
+        entry.addr.u.ip6 = group->u.ip6;
 #endif
-        entry.vid = pg->addr.vid;
-        __mdb_entry_fill_flags(&entry, pg->flags);
-        __br_mdb_notify(dev, &entry, type, pg);
+        entry.vid = group->vid;
+        __mdb_entry_fill_flags(&entry, flags);
+        __br_mdb_notify(dev, port, &entry, type);
 }
 
 static int nlmsg_populate_rtr_fill(struct sk_buff *skb,
@@ -450,8 +504,7 @@ static int br_mdb_parse(struct sk_buff *skb, struct nlmsghdr *nlh,
 }
 
 static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
-                            struct br_ip *group, unsigned char state,
-                            struct net_bridge_port_group **pg)
+                            struct br_ip *group, unsigned char state)
 {
         struct net_bridge_mdb_entry *mp;
         struct net_bridge_port_group *p;
@@ -482,7 +535,6 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
         if (unlikely(!p))
                 return -ENOMEM;
         rcu_assign_pointer(*pp, p);
-        *pg = p;
         if (state == MDB_TEMPORARY)
                 mod_timer(&p->timer, now + br->multicast_membership_interval);
 
@@ -490,8 +542,7 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port,
 }
 
 static int __br_mdb_add(struct net *net, struct net_bridge *br,
-                        struct br_mdb_entry *entry,
-                        struct net_bridge_port_group **pg)
+                        struct br_mdb_entry *entry)
 {
         struct br_ip ip;
         struct net_device *dev;
@@ -509,18 +560,10 @@ static int __br_mdb_add(struct net *net, struct net_bridge *br,
         if (!p || p->br != br || p->state == BR_STATE_DISABLED)
                 return -EINVAL;
 
-        memset(&ip, 0, sizeof(ip));
-        ip.vid = entry->vid;
-        ip.proto = entry->addr.proto;
-        if (ip.proto == htons(ETH_P_IP))
-                ip.u.ip4 = entry->addr.u.ip4;
-#if IS_ENABLED(CONFIG_IPV6)
-        else
-                ip.u.ip6 = entry->addr.u.ip6;
-#endif
+        __mdb_entry_to_br_ip(entry, &ip);
 
         spin_lock_bh(&br->multicast_lock);
-        ret = br_mdb_add_group(br, p, &ip, entry->state, pg);
+        ret = br_mdb_add_group(br, p, &ip, entry->state);
         spin_unlock_bh(&br->multicast_lock);
         return ret;
 }
@@ -528,7 +571,6 @@ static int __br_mdb_add(struct net *net, struct net_bridge *br,
 static int br_mdb_add(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         struct net *net = sock_net(skb->sk);
-        struct net_bridge_port_group *pg;
         struct net_bridge_vlan_group *vg;
         struct net_device *dev, *pdev;
         struct br_mdb_entry *entry;
@@ -558,15 +600,15 @@ static int br_mdb_add(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (br_vlan_enabled(br) && vg && entry->vid == 0) {
                 list_for_each_entry(v, &vg->vlan_list, vlist) {
                         entry->vid = v->vid;
-                        err = __br_mdb_add(net, br, entry, &pg);
+                        err = __br_mdb_add(net, br, entry);
                         if (err)
                                 break;
-                        __br_mdb_notify(dev, entry, RTM_NEWMDB, pg);
+                        __br_mdb_notify(dev, p, entry, RTM_NEWMDB);
                 }
         } else {
-                err = __br_mdb_add(net, br, entry, &pg);
+                err = __br_mdb_add(net, br, entry);
                 if (!err)
-                        __br_mdb_notify(dev, entry, RTM_NEWMDB, pg);
+                        __br_mdb_notify(dev, p, entry, RTM_NEWMDB);
         }
 
         return err;
@@ -584,15 +626,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry)
         if (!netif_running(br->dev) || br->multicast_disabled)
                 return -EINVAL;
 
-        memset(&ip, 0, sizeof(ip));
-        ip.vid = entry->vid;
-        ip.proto = entry->addr.proto;
-        if (ip.proto == htons(ETH_P_IP))
-                ip.u.ip4 = entry->addr.u.ip4;
-#if IS_ENABLED(CONFIG_IPV6)
-        else
-                ip.u.ip6 = entry->addr.u.ip6;
-#endif
+        __mdb_entry_to_br_ip(entry, &ip);
 
         spin_lock_bh(&br->multicast_lock);
         mdb = mlock_dereference(br->mdb, br);
@@ -662,12 +696,12 @@ static int br_mdb_del(struct sk_buff *skb, struct nlmsghdr *nlh)
                         entry->vid = v->vid;
                         err = __br_mdb_del(br, entry);
                         if (!err)
-                                __br_mdb_notify(dev, entry, RTM_DELMDB, NULL);
+                                __br_mdb_notify(dev, p, entry, RTM_DELMDB);
                 }
         } else {
                 err = __br_mdb_del(br, entry);
                 if (!err)
-                        __br_mdb_notify(dev, entry, RTM_DELMDB, NULL);
+                        __br_mdb_notify(dev, p, entry, RTM_DELMDB);
         }
 
         return err;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index a4c15df2b792..191ea66e4d92 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -283,7 +283,8 @@ static void br_multicast_del_pg(struct net_bridge *br,
                 rcu_assign_pointer(*pp, p->next);
                 hlist_del_init(&p->mglist);
                 del_timer(&p->timer);
-                br_mdb_notify(br->dev, p, RTM_DELMDB);
+                br_mdb_notify(br->dev, p->port, &pg->addr, RTM_DELMDB,
+                              p->flags);
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
 
                 if (!mp->ports && !mp->mglist &&
@@ -705,7 +706,7 @@ static int br_multicast_add_group(struct net_bridge *br,
         if (unlikely(!p))
                 goto err;
         rcu_assign_pointer(*pp, p);
-        br_mdb_notify(br->dev, p, RTM_NEWMDB);
+        br_mdb_notify(br->dev, port, group, RTM_NEWMDB, 0);
 
 found:
         mod_timer(&p->timer, now + br->multicast_membership_interval);
@@ -1461,7 +1462,8 @@ br_multicast_leave_group(struct net_bridge *br,
                         hlist_del_init(&p->mglist);
                         del_timer(&p->timer);
                         call_rcu_bh(&p->rcu, br_multicast_free_pg);
-                        br_mdb_notify(br->dev, p, RTM_DELMDB);
+                        br_mdb_notify(br->dev, port, group, RTM_DELMDB,
+                                      p->flags);
 
                         if (!mp->ports && !mp->mglist &&
                             netif_running(br->dev))
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 1b5d145dfcbf..d9da857182ef 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -560,8 +560,8 @@ br_multicast_new_port_group(struct net_bridge_port *port, struct br_ip *group,
                             unsigned char flags);
 void br_mdb_init(void);
 void br_mdb_uninit(void);
-void br_mdb_notify(struct net_device *dev, struct net_bridge_port_group *pg,
-                   int type);
+void br_mdb_notify(struct net_device *dev, struct net_bridge_port *port,
+                   struct br_ip *group, int type, u8 flags);
 void br_rtr_notify(struct net_device *dev, struct net_bridge_port *port,
                    int type);
 
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 8570bc7744c2..5a61f35412a0 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -370,7 +370,11 @@ ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
             left - sizeof(struct ebt_entry_match) < m->match_size)
                 return -EINVAL;
 
-        match = xt_request_find_match(NFPROTO_BRIDGE, m->u.name, 0);
+        match = xt_find_match(NFPROTO_BRIDGE, m->u.name, 0);
+        if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) {
+                request_module("ebt_%s", m->u.name);
+                match = xt_find_match(NFPROTO_BRIDGE, m->u.name, 0);
+        }
         if (IS_ERR(match))
                 return PTR_ERR(match);
         m->u.match = match;
diff --git a/net/ceph/auth.c b/net/ceph/auth.c
index 6b923bcaa2a4..2bc5965fdd1e 100644
--- a/net/ceph/auth.c
+++ b/net/ceph/auth.c
@@ -293,13 +293,9 @@ int ceph_auth_create_authorizer(struct ceph_auth_client *ac,
 }
 EXPORT_SYMBOL(ceph_auth_create_authorizer);
 
-void ceph_auth_destroy_authorizer(struct ceph_auth_client *ac,
-                                  struct ceph_authorizer *a)
+void ceph_auth_destroy_authorizer(struct ceph_authorizer *a)
 {
-        mutex_lock(&ac->mutex);
-        if (ac->ops && ac->ops->destroy_authorizer)
-                ac->ops->destroy_authorizer(ac, a);
-        mutex_unlock(&ac->mutex);
+        a->destroy(a);
 }
 EXPORT_SYMBOL(ceph_auth_destroy_authorizer);
 
diff --git a/net/ceph/auth_none.c b/net/ceph/auth_none.c
index 8c93fa8d81bc..5f836f02ae36 100644
--- a/net/ceph/auth_none.c
+++ b/net/ceph/auth_none.c
@@ -16,7 +16,6 @@ static void reset(struct ceph_auth_client *ac)
         struct ceph_auth_none_info *xi = ac->private;
 
         xi->starting = true;
-        xi->built_authorizer = false;
 }
 
 static void destroy(struct ceph_auth_client *ac)
@@ -39,6 +38,27 @@ static int should_authenticate(struct ceph_auth_client *ac)
         return xi->starting;
 }
 
+static int ceph_auth_none_build_authorizer(struct ceph_auth_client *ac,
+                                           struct ceph_none_authorizer *au)
+{
+        void *p = au->buf;
+        void *const end = p + sizeof(au->buf);
+        int ret;
+
+        ceph_encode_8_safe(&p, end, 1, e_range);
+        ret = ceph_entity_name_encode(ac->name, &p, end);
+        if (ret < 0)
+                return ret;
+
+        ceph_encode_64_safe(&p, end, ac->global_id, e_range);
+        au->buf_len = p - (void *)au->buf;
+        dout("%s built authorizer len %d\n", __func__, au->buf_len);
+        return 0;
+
+e_range:
+        return -ERANGE;
+}
+
 static int build_request(struct ceph_auth_client *ac, void *buf, void *end)
 {
         return 0;
@@ -57,32 +77,32 @@ static int handle_reply(struct ceph_auth_client *ac, int result,
         return result;
 }
 
+static void ceph_auth_none_destroy_authorizer(struct ceph_authorizer *a)
+{
+        kfree(a);
+}
+
 /*
- * build an 'authorizer' with our entity_name and global_id.  we can
- * reuse a single static copy since it is identical for all services
- * we connect to.
+ * build an 'authorizer' with our entity_name and global_id.  it is
+ * identical for all services we connect to.
  */
 static int ceph_auth_none_create_authorizer(
         struct ceph_auth_client *ac, int peer_type,
         struct ceph_auth_handshake *auth)
 {
-        struct ceph_auth_none_info *ai = ac->private;
-        struct ceph_none_authorizer *au = &ai->au;
-        void *p, *end;
+        struct ceph_none_authorizer *au;
         int ret;
 
-        if (!ai->built_authorizer) {
-                p = au->buf;
-                end = p + sizeof(au->buf);
-                ceph_encode_8(&p, 1);
-                ret = ceph_entity_name_encode(ac->name, &p, end - 8);
-                if (ret < 0)
-                        goto bad;
-                ceph_decode_need(&p, end, sizeof(u64), bad2);
-                ceph_encode_64(&p, ac->global_id);
-                au->buf_len = p - (void *)au->buf;
-                ai->built_authorizer = true;
-                dout("built authorizer len %d\n", au->buf_len);
+        au = kmalloc(sizeof(*au), GFP_NOFS);
+        if (!au)
+                return -ENOMEM;
+
+        au->base.destroy = ceph_auth_none_destroy_authorizer;
+
+        ret = ceph_auth_none_build_authorizer(ac, au);
+        if (ret) {
+                kfree(au);
+                return ret;
         }
 
         auth->authorizer = (struct ceph_authorizer *) au;
@@ -92,17 +112,6 @@ static int ceph_auth_none_create_authorizer(
         auth->authorizer_reply_buf_len = sizeof (au->reply_buf);
 
         return 0;
-
-bad2:
-        ret = -ERANGE;
-bad:
-        return ret;
-}
-
-static void ceph_auth_none_destroy_authorizer(struct ceph_auth_client *ac,
-                                      struct ceph_authorizer *a)
-{
-        /* nothing to do */
 }
 
 static const struct ceph_auth_client_ops ceph_auth_none_ops = {
@@ -114,7 +123,6 @@ static const struct ceph_auth_client_ops ceph_auth_none_ops = {
         .build_request = build_request,
         .handle_reply = handle_reply,
         .create_authorizer = ceph_auth_none_create_authorizer,
-        .destroy_authorizer = ceph_auth_none_destroy_authorizer,
 };
 
 int ceph_auth_none_init(struct ceph_auth_client *ac)
@@ -127,7 +135,6 @@ int ceph_auth_none_init(struct ceph_auth_client *ac)
                 return -ENOMEM;
 
         xi->starting = true;
-        xi->built_authorizer = false;
 
         ac->protocol = CEPH_AUTH_NONE;
         ac->private = xi;
diff --git a/net/ceph/auth_none.h b/net/ceph/auth_none.h
index 059a3ce4b53f..62021535ae4a 100644
--- a/net/ceph/auth_none.h
+++ b/net/ceph/auth_none.h
@@ -12,6 +12,7 @@
  */
 
 struct ceph_none_authorizer {
+        struct ceph_authorizer base;
         char buf[128];
         int buf_len;
         char reply_buf[0];
@@ -19,8 +20,6 @@ struct ceph_none_authorizer {
 
 struct ceph_auth_none_info {
         bool starting;
-        bool built_authorizer;
-        struct ceph_none_authorizer au;   /* we only need one; it's static */
 };
 
 int ceph_auth_none_init(struct ceph_auth_client *ac);
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 9e43a315e662..a0905f04bd13 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -565,6 +565,14 @@ static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result,
         return -EAGAIN;
 }
 
+static void ceph_x_destroy_authorizer(struct ceph_authorizer *a)
+{
+        struct ceph_x_authorizer *au = (void *)a;
+
+        ceph_x_authorizer_cleanup(au);
+        kfree(au);
+}
+
 static int ceph_x_create_authorizer(
         struct ceph_auth_client *ac, int peer_type,
         struct ceph_auth_handshake *auth)
@@ -581,6 +589,8 @@ static int ceph_x_create_authorizer(
         if (!au)
                 return -ENOMEM;
 
+        au->base.destroy = ceph_x_destroy_authorizer;
+
         ret = ceph_x_build_authorizer(ac, th, au);
         if (ret) {
                 kfree(au);
@@ -643,16 +653,6 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
         return ret;
 }
 
-static void ceph_x_destroy_authorizer(struct ceph_auth_client *ac,
-                                      struct ceph_authorizer *a)
-{
-        struct ceph_x_authorizer *au = (void *)a;
-
-        ceph_x_authorizer_cleanup(au);
-        kfree(au);
-}
-
-
 static void ceph_x_reset(struct ceph_auth_client *ac)
 {
         struct ceph_x_info *xi = ac->private;
@@ -770,7 +770,6 @@ static const struct ceph_auth_client_ops ceph_x_ops = {
         .create_authorizer = ceph_x_create_authorizer,
         .update_authorizer = ceph_x_update_authorizer,
         .verify_authorizer_reply = ceph_x_verify_authorizer_reply,
-        .destroy_authorizer = ceph_x_destroy_authorizer,
         .invalidate_authorizer = ceph_x_invalidate_authorizer,
         .reset =  ceph_x_reset,
         .destroy = ceph_x_destroy,
diff --git a/net/ceph/auth_x.h b/net/ceph/auth_x.h
index 40b1a3cf7397..21a5af904bae 100644
--- a/net/ceph/auth_x.h
+++ b/net/ceph/auth_x.h
@@ -26,6 +26,7 @@ struct ceph_x_ticket_handler {
 
 
 struct ceph_x_authorizer {
+        struct ceph_authorizer base;
         struct ceph_crypto_key session_key;
         struct ceph_buffer *buf;
         unsigned int service;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 32355d9d0103..40a53a70efdf 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1087,10 +1087,8 @@ static void put_osd(struct ceph_osd *osd)
         dout("put_osd %p %d -> %d\n", osd, atomic_read(&osd->o_ref),
              atomic_read(&osd->o_ref) - 1);
         if (atomic_dec_and_test(&osd->o_ref)) {
-                struct ceph_auth_client *ac = osd->o_osdc->client->monc.auth;
-
                 if (osd->o_auth.authorizer)
-                        ceph_auth_destroy_authorizer(ac, osd->o_auth.authorizer);
+                        ceph_auth_destroy_authorizer(osd->o_auth.authorizer);
                 kfree(osd);
         }
 }
@@ -2984,7 +2982,7 @@ static struct ceph_auth_handshake *get_authorizer(struct ceph_connection *con,
         struct ceph_auth_handshake *auth = &o->o_auth;
 
         if (force_new && auth->authorizer) {
-                ceph_auth_destroy_authorizer(ac, auth->authorizer);
+                ceph_auth_destroy_authorizer(auth->authorizer);
                 auth->authorizer = NULL;
         }
         if (!auth->authorizer) {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d04c2d1c8c87..e561f9f07d6d 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4502,13 +4502,16 @@ int skb_vlan_push(struct sk_buff *skb, __be16 vlan_proto, u16 vlan_tci)
                 __skb_push(skb, offset);
                 err = __vlan_insert_tag(skb, skb->vlan_proto,
                                         skb_vlan_tag_get(skb));
-                if (err)
+                if (err) {
+                        __skb_pull(skb, offset);
                         return err;
+                }
+
                 skb->protocol = skb->vlan_proto;
                 skb->mac_len += VLAN_HLEN;
-                __skb_pull(skb, offset);
 
                 skb_postpush_rcsum(skb, skb->data + (2 * ETH_ALEN), VLAN_HLEN);
+                __skb_pull(skb, offset);
         }
         __vlan_hwaccel_put_tag(skb, vlan_proto, vlan_tci);
         return 0;
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 607a14f20d88..b1dc096d22f8 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1034,10 +1034,13 @@ source_ok:
         if (!fld.daddr) {
                 fld.daddr = fld.saddr;
 
-                err = -EADDRNOTAVAIL;
                 if (dev_out)
                         dev_put(dev_out);
+                err = -EINVAL;
                 dev_out = init_net.loopback_dev;
+                if (!dev_out->dn_ptr)
+                        goto out;
+                err = -EADDRNOTAVAIL;
                 dev_hold(dev_out);
                 if (!fld.daddr) {
                         fld.daddr =
@@ -1110,6 +1113,8 @@ source_ok:
                 if (dev_out == NULL)
                         goto out;
                 dn_db = rcu_dereference_raw(dev_out->dn_ptr);
+                if (!dn_db)
+                        goto e_inval;
                 /* Possible improvement - check all devices for local addr */
                 if (dn_dev_islocal(dev_out, fld.daddr)) {
                         dev_put(dev_out);
@@ -1151,6 +1156,8 @@ select_source:
                         dev_put(dev_out);
                 dev_out = init_net.loopback_dev;
                 dev_hold(dev_out);
+                if (!dev_out->dn_ptr)
+                        goto e_inval;
                 fld.flowidn_oif = dev_out->ifindex;
                 if (res.fi)
                         dn_fib_info_put(res.fi);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 8a9246deccfe..63566ec54794 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -904,7 +904,11 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
         if (ifa->ifa_flags & IFA_F_SECONDARY) {
                 prim = inet_ifa_byprefix(in_dev, any, ifa->ifa_mask);
                 if (!prim) {
-                        pr_warn("%s: bug: prim == NULL\n", __func__);
+                        /* if the device has been deleted, we don't perform
+                         * address promotion
+                         */
+                        if (!in_dev->dead)
+                                pr_warn("%s: bug: prim == NULL\n", __func__);
                         return;
                 }
                 if (iprim && iprim != prim) {
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index dd8c80dc32a2..8f8713b4388f 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -81,6 +81,12 @@ static int __init arptable_filter_init(void)
                 return ret;
         }
 
+        ret = arptable_filter_table_init(&init_net);
+        if (ret) {
+                unregister_pernet_subsys(&arptable_filter_net_ops);
+                kfree(arpfilter_ops);
+        }
+
         return ret;
 }
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 02c62299d717..60398a9370e7 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1438,9 +1438,9 @@ static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
 #endif
 }
 
-static struct rtable *rt_dst_alloc(struct net_device *dev,
-                                   unsigned int flags, u16 type,
-                                   bool nopolicy, bool noxfrm, bool will_cache)
+struct rtable *rt_dst_alloc(struct net_device *dev,
+                            unsigned int flags, u16 type,
+                            bool nopolicy, bool noxfrm, bool will_cache)
 {
         struct rtable *rt;
 
@@ -1468,6 +1468,7 @@ static struct rtable *rt_dst_alloc(struct net_device *dev,
 
         return rt;
 }
+EXPORT_SYMBOL(rt_dst_alloc);
 
 /* called in rcu_read_lock() section */
 static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
@@ -2045,6 +2046,18 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
                  */
                 if (fi && res->prefixlen < 4)
                         fi = NULL;
+        } else if ((type == RTN_LOCAL) && (orig_oif != 0) &&
+                   (orig_oif != dev_out->ifindex)) {
+                /* For local routes that require a particular output interface
+                 * we do not want to cache the result.  Caching the result
+                 * causes incorrect behaviour when there are multiple source
+                 * addresses on the interface, the end result being that if the
+                 * intended recipient is waiting on that interface for the
+                 * packet he won't receive it because it will be delivered on
+                 * the loopback interface and the IP_PKTINFO ipi_ifindex will
+                 * be set to the loopback interface as well.
+                 */
+                fi = NULL;
         }
 
         fnhe = NULL;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index e6e65f79ade8..c124c3c12f7c 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1309,6 +1309,7 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
         if (skb == tcp_highest_sack(sk))
                 tcp_advance_highest_sack(sk, skb);
 
+        tcp_skb_collapse_tstamp(prev, skb);
         tcp_unlink_write_queue(skb, sk);
         sk_wmem_free_skb(sk, skb);
 
@@ -3098,7 +3099,8 @@ static void tcp_ack_tstamp(struct sock *sk, struct sk_buff *skb,
 
         shinfo = skb_shinfo(skb);
         if ((shinfo->tx_flags & SKBTX_ACK_TSTAMP) &&
-            between(shinfo->tskey, prior_snd_una, tcp_sk(sk)->snd_una - 1))
+            !before(shinfo->tskey, prior_snd_una) &&
+            before(shinfo->tskey, tcp_sk(sk)->snd_una))
                 __skb_tstamp_tx(skb, NULL, sk, SCM_TSTAMP_ACK);
 }
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7d2dc015cd19..441ae9da3a23 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2441,6 +2441,20 @@ u32 __tcp_select_window(struct sock *sk)
         return window;
 }
 
+void tcp_skb_collapse_tstamp(struct sk_buff *skb,
+                             const struct sk_buff *next_skb)
+{
+        const struct skb_shared_info *next_shinfo = skb_shinfo(next_skb);
+        u8 tsflags = next_shinfo->tx_flags & SKBTX_ANY_TSTAMP;
+
+        if (unlikely(tsflags)) {
+                struct skb_shared_info *shinfo = skb_shinfo(skb);
+
+                shinfo->tx_flags |= tsflags;
+                shinfo->tskey = next_shinfo->tskey;
+        }
+}
+
 /* Collapses two adjacent SKB's during retransmission. */
 static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
 {
@@ -2484,6 +2498,8 @@ static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
 
         tcp_adjust_pcount(sk, next_skb, tcp_skb_pcount(next_skb));
 
+        tcp_skb_collapse_tstamp(skb, next_skb);
+
         sk_wmem_free_skb(sk, next_skb);
 }
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 08eed5e16df0..a2e7f55a1f61 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -339,8 +339,13 @@ found:
 
                 hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
                 spin_lock(&hslot2->lock);
-                hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node,
-                                         &hslot2->head);
+                if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport &&
+                        sk->sk_family == AF_INET6)
+                        hlist_nulls_add_tail_rcu(&udp_sk(sk)->udp_portaddr_node,
+                                                 &hslot2->head);
+                else
+                        hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node,
+                                                 &hslot2->head);
                 hslot2->count++;
                 spin_unlock(&hslot2->lock);
         }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 27aed1afcf81..8ec4b3089e20 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3176,35 +3176,9 @@ static void addrconf_gre_config(struct net_device *dev)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
-/* If the host route is cached on the addr struct make sure it is associated
- * with the proper table. e.g., enslavement can change and if so the cached
- * host route needs to move to the new table.
- */
-static void l3mdev_check_host_rt(struct inet6_dev *idev,
-                                  struct inet6_ifaddr *ifp)
-{
-        if (ifp->rt) {
-                u32 tb_id = l3mdev_fib_table(idev->dev) ? : RT6_TABLE_LOCAL;
-
-                if (tb_id != ifp->rt->rt6i_table->tb6_id) {
-                        ip6_del_rt(ifp->rt);
-                        ifp->rt = NULL;
-                }
-        }
-}
-#else
-static void l3mdev_check_host_rt(struct inet6_dev *idev,
-                                  struct inet6_ifaddr *ifp)
-{
-}
-#endif
-
 static int fixup_permanent_addr(struct inet6_dev *idev,
                                 struct inet6_ifaddr *ifp)
 {
-        l3mdev_check_host_rt(idev, ifp);
-
         if (!ifp->rt) {
                 struct rt6_info *rt;
 
@@ -3255,6 +3229,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                            void *ptr)
 {
         struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct netdev_notifier_changeupper_info *info;
         struct inet6_dev *idev = __in6_dev_get(dev);
         int run_pending = 0;
         int err;
@@ -3303,6 +3278,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                         break;
 
                 if (event == NETDEV_UP) {
+                        /* restore routes for permanent addresses */
+                        addrconf_permanent_addr(dev);
+
                         if (!addrconf_qdisc_ok(dev)) {
                                 /* device is not ready yet. */
                                 pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
@@ -3336,9 +3314,6 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                         run_pending = 1;
                 }
 
-                /* restore routes for permanent addresses */
-                addrconf_permanent_addr(dev);
-
                 switch (dev->type) {
 #if IS_ENABLED(CONFIG_IPV6_SIT)
                 case ARPHRD_SIT:
@@ -3413,6 +3388,15 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                 if (idev)
                         addrconf_type_change(dev, event);
                 break;
+
+        case NETDEV_CHANGEUPPER:
+                info = ptr;
+
+                /* flush all routes if dev is linked to or unlinked from
+                 * an L3 master device (e.g., VRF)
+                 */
+                if (info->upper_dev && netif_is_l3_master(info->upper_dev))
+                        addrconf_ifdown(dev, 0);
         }
 
         return NOTIFY_OK;
@@ -3438,6 +3422,12 @@ static void addrconf_type_change(struct net_device *dev, unsigned long event)
                 ipv6_mc_unmap(idev);
 }
 
+static bool addr_is_local(const struct in6_addr *addr)
+{
+        return ipv6_addr_type(addr) &
+                (IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
+}
+
 static int addrconf_ifdown(struct net_device *dev, int how)
 {
         struct net *net = dev_net(dev);
@@ -3495,7 +3485,8 @@ restart:
                                  * address is retained on a down event
                                  */
                                 if (!keep_addr ||
-                                    !(ifa->flags & IFA_F_PERMANENT)) {
+                                    !(ifa->flags & IFA_F_PERMANENT) ||
+                                    addr_is_local(&ifa->addr)) {
                                         hlist_del_init_rcu(&ifa->addr_lst);
                                         goto restart;
                                 }
@@ -3539,17 +3530,23 @@ restart:
 
         INIT_LIST_HEAD(&del_list);
         list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
+                struct rt6_info *rt = NULL;
+
                 addrconf_del_dad_work(ifa);
 
                 write_unlock_bh(&idev->lock);
                 spin_lock_bh(&ifa->lock);
 
-                if (keep_addr && (ifa->flags & IFA_F_PERMANENT)) {
+                if (keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
+                    !addr_is_local(&ifa->addr)) {
                         /* set state to skip the notifier below */
                         state = INET6_IFADDR_STATE_DEAD;
                         ifa->state = 0;
                         if (!(ifa->flags & IFA_F_NODAD))
                                 ifa->flags |= IFA_F_TENTATIVE;
+
+                        rt = ifa->rt;
+                        ifa->rt = NULL;
                 } else {
                         state = ifa->state;
                         ifa->state = INET6_IFADDR_STATE_DEAD;
@@ -3560,6 +3557,9 @@ restart:
 
                 spin_unlock_bh(&ifa->lock);
 
+                if (rt)
+                        ip6_del_rt(rt);
+
                 if (state != INET6_IFADDR_STATE_DEAD) {
                         __ipv6_ifa_notify(RTM_DELADDR, ifa);
                         inet6addr_notifier_call_chain(NETDEV_DOWN, ifa);
@@ -5325,10 +5325,10 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                         if (rt)
                                 ip6_del_rt(rt);
                 }
-                dst_hold(&ifp->rt->dst);
-
-                ip6_del_rt(ifp->rt);
-
+                if (ifp->rt) {
+                        dst_hold(&ifp->rt->dst);
+                        ip6_del_rt(ifp->rt);
+                }
                 rt_genid_bump_ipv6(net);
                 break;
         }
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 428162155280..9dd3882fe6bf 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -40,18 +40,114 @@ static bool ipv6_mapped_addr_any(const struct in6_addr *a)
         return ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0);
 }
 
+static void ip6_datagram_flow_key_init(struct flowi6 *fl6, struct sock *sk)
+{
+        struct inet_sock *inet = inet_sk(sk);
+        struct ipv6_pinfo *np = inet6_sk(sk);
+
+        memset(fl6, 0, sizeof(*fl6));
+        fl6->flowi6_proto = sk->sk_protocol;
+        fl6->daddr = sk->sk_v6_daddr;
+        fl6->saddr = np->saddr;
+        fl6->flowi6_oif = sk->sk_bound_dev_if;
+        fl6->flowi6_mark = sk->sk_mark;
+        fl6->fl6_dport = inet->inet_dport;
+        fl6->fl6_sport = inet->inet_sport;
+        fl6->flowlabel = np->flow_label;
+
+        if (!fl6->flowi6_oif)
+                fl6->flowi6_oif = np->sticky_pktinfo.ipi6_ifindex;
+
+        if (!fl6->flowi6_oif && ipv6_addr_is_multicast(&fl6->daddr))
+                fl6->flowi6_oif = np->mcast_oif;
+
+        security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
+}
+
+int ip6_datagram_dst_update(struct sock *sk, bool fix_sk_saddr)
+{
+        struct ip6_flowlabel *flowlabel = NULL;
+        struct in6_addr *final_p, final;
+        struct ipv6_txoptions *opt;
+        struct dst_entry *dst;
+        struct inet_sock *inet = inet_sk(sk);
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct flowi6 fl6;
+        int err = 0;
+
+        if (np->sndflow && (np->flow_label & IPV6_FLOWLABEL_MASK)) {
+                flowlabel = fl6_sock_lookup(sk, np->flow_label);
+                if (!flowlabel)
+                        return -EINVAL;
+        }
+        ip6_datagram_flow_key_init(&fl6, sk);
+
+        rcu_read_lock();
+        opt = flowlabel ? flowlabel->opt : rcu_dereference(np->opt);
+        final_p = fl6_update_dst(&fl6, opt, &final);
+        rcu_read_unlock();
+
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
+                goto out;
+        }
+
+        if (fix_sk_saddr) {
+                if (ipv6_addr_any(&np->saddr))
+                        np->saddr = fl6.saddr;
+
+                if (ipv6_addr_any(&sk->sk_v6_rcv_saddr)) {
+                        sk->sk_v6_rcv_saddr = fl6.saddr;
+                        inet->inet_rcv_saddr = LOOPBACK4_IPV6;
+                        if (sk->sk_prot->rehash)
+                                sk->sk_prot->rehash(sk);
+                }
+        }
+
+        ip6_dst_store(sk, dst,
+                      ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr) ?
+                      &sk->sk_v6_daddr : NULL,
+#ifdef CONFIG_IPV6_SUBTREES
+                      ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
+                      &np->saddr :
+#endif
+                      NULL);
+
+out:
+        fl6_sock_release(flowlabel);
+        return err;
+}
+
+void ip6_datagram_release_cb(struct sock *sk)
+{
+        struct dst_entry *dst;
+
+        if (ipv6_addr_v4mapped(&sk->sk_v6_daddr))
+                return;
+
+        rcu_read_lock();
+        dst = __sk_dst_get(sk);
+        if (!dst || !dst->obsolete ||
+            dst->ops->check(dst, inet6_sk(sk)->dst_cookie)) {
+                rcu_read_unlock();
+                return;
+        }
+        rcu_read_unlock();
+
+        ip6_datagram_dst_update(sk, false);
+}
+EXPORT_SYMBOL_GPL(ip6_datagram_release_cb);
+
 static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 {
         struct sockaddr_in6     *usin = (struct sockaddr_in6 *) uaddr;
         struct inet_sock        *inet = inet_sk(sk);
         struct ipv6_pinfo       *np = inet6_sk(sk);
-        struct in6_addr *daddr, *final_p, final;
-        struct dst_entry        *dst;
-        struct flowi6           fl6;
-        struct ip6_flowlabel    *flowlabel = NULL;
-        struct ipv6_txoptions   *opt;
+        struct in6_addr         *daddr;
         int                     addr_type;
         int                     err;
+        __be32                  fl6_flowlabel = 0;
 
         if (usin->sin6_family == AF_INET) {
                 if (__ipv6_only_sock(sk))
@@ -66,15 +162,8 @@ static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int a
         if (usin->sin6_family != AF_INET6)
                 return -EAFNOSUPPORT;
 
-        memset(&fl6, 0, sizeof(fl6));
-        if (np->sndflow) {
-                fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
-                if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
-                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
-                        if (!flowlabel)
-                                return -EINVAL;
-                }
-        }
+        if (np->sndflow)
+                fl6_flowlabel = usin->sin6_flowinfo & IPV6_FLOWINFO_MASK;
 
         addr_type = ipv6_addr_type(&usin->sin6_addr);
 
@@ -145,7 +234,7 @@ ipv4_connected:
         }
 
         sk->sk_v6_daddr = *daddr;
-        np->flow_label = fl6.flowlabel;
+        np->flow_label = fl6_flowlabel;
 
         inet->inet_dport = usin->sin6_port;
 
@@ -154,59 +243,13 @@ ipv4_connected:
          *      destination cache for it.
          */
 
-        fl6.flowi6_proto = sk->sk_protocol;
-        fl6.daddr = sk->sk_v6_daddr;
-        fl6.saddr = np->saddr;
-        fl6.flowi6_oif = sk->sk_bound_dev_if;
-        fl6.flowi6_mark = sk->sk_mark;
-        fl6.fl6_dport = inet->inet_dport;
-        fl6.fl6_sport = inet->inet_sport;
-
-        if (!fl6.flowi6_oif)
-                fl6.flowi6_oif = np->sticky_pktinfo.ipi6_ifindex;
-
-        if (!fl6.flowi6_oif && (addr_type&IPV6_ADDR_MULTICAST))
-                fl6.flowi6_oif = np->mcast_oif;
-
-        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
-
-        rcu_read_lock();
-        opt = flowlabel ? flowlabel->opt : rcu_dereference(np->opt);
-        final_p = fl6_update_dst(&fl6, opt, &final);
-        rcu_read_unlock();
-
-        dst = ip6_dst_lookup_flow(sk, &fl6, final_p);
-        err = 0;
-        if (IS_ERR(dst)) {
-                err = PTR_ERR(dst);
+        err = ip6_datagram_dst_update(sk, true);
+        if (err)
                 goto out;
-        }
-
-        /* source address lookup done in ip6_dst_lookup */
-
-        if (ipv6_addr_any(&np->saddr))
-                np->saddr = fl6.saddr;
-
-        if (ipv6_addr_any(&sk->sk_v6_rcv_saddr)) {
-                sk->sk_v6_rcv_saddr = fl6.saddr;
-                inet->inet_rcv_saddr = LOOPBACK4_IPV6;
-                if (sk->sk_prot->rehash)
-                        sk->sk_prot->rehash(sk);
-        }
-
-        ip6_dst_store(sk, dst,
-                      ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr) ?
-                      &sk->sk_v6_daddr : NULL,
-#ifdef CONFIG_IPV6_SUBTREES
-                      ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
-                      &np->saddr :
-#endif
-                      NULL);
 
         sk->sk_state = TCP_ESTABLISHED;
         sk_set_txhash(sk);
 out:
-        fl6_sock_release(flowlabel);
         return err;
 }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index ed446639219c..d916d6ab9ad2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -338,9 +338,9 @@ static struct rt6_info *__ip6_dst_alloc(struct net *net,
         return rt;
 }
 
-static struct rt6_info *ip6_dst_alloc(struct net *net,
-                                      struct net_device *dev,
-                                      int flags)
+struct rt6_info *ip6_dst_alloc(struct net *net,
+                               struct net_device *dev,
+                               int flags)
 {
         struct rt6_info *rt = __ip6_dst_alloc(net, dev, flags);
 
@@ -364,6 +364,7 @@ static struct rt6_info *ip6_dst_alloc(struct net *net,
 
         return rt;
 }
+EXPORT_SYMBOL(ip6_dst_alloc);
 
 static void ip6_dst_destroy(struct dst_entry *dst)
 {
@@ -1417,8 +1418,20 @@ EXPORT_SYMBOL_GPL(ip6_update_pmtu);
 
 void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
 {
+        struct dst_entry *dst;
+
         ip6_update_pmtu(skb, sock_net(sk), mtu,
                         sk->sk_bound_dev_if, sk->sk_mark);
+
+        dst = __sk_dst_get(sk);
+        if (!dst || !dst->obsolete ||
+            dst->ops->check(dst, inet6_sk(sk)->dst_cookie))
+                return;
+
+        bh_lock_sock(sk);
+        if (!sock_owned_by_user(sk) && !ipv6_addr_v4mapped(&sk->sk_v6_daddr))
+                ip6_datagram_dst_update(sk, false);
+        bh_unlock_sock(sk);
 }
 EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu);
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 8125931106be..6bc5c664fa46 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1539,6 +1539,7 @@ struct proto udpv6_prot = {
         .sendmsg           = udpv6_sendmsg,
         .recvmsg           = udpv6_recvmsg,
         .backlog_rcv       = __udpv6_queue_rcv_skb,
+        .release_cb        = ip6_datagram_release_cb,
         .hash              = udp_lib_hash,
         .unhash            = udp_lib_unhash,
         .rehash            = udp_v6_rehash,
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 278f3b9356ef..7cc1d9c22a9f 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -410,6 +410,8 @@ static void tcp_options(const struct sk_buff *skb,
                         length--;
                         continue;
                 default:
+                        if (length < 2)
+                                return;
                         opsize=*ptr++;
                         if (opsize < 2) /* "silly options" */
                                 return;
@@ -470,6 +472,8 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
                         length--;
                         continue;
                 default:
+                        if (length < 2)
+                                return;
                         opsize = *ptr++;
                         if (opsize < 2) /* "silly options" */
                                 return;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 215fc08c02ab..330ebd600f25 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -688,7 +688,7 @@ static int netlink_release(struct socket *sock)
 
         skb_queue_purge(&sk->sk_write_queue);
 
-        if (nlk->portid) {
+        if (nlk->portid && nlk->bound) {
                 struct netlink_notify n = {
                                                 .net = sock_net(sk),
                                                 .protocol = sk->sk_protocol,
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index e9dd47b2a85b..879185fe183f 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -461,7 +461,7 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,
                 mask_ipv6_addr(saddr, key->ipv6_src, mask->ipv6_src, masked);
 
                 if (unlikely(memcmp(saddr, masked, sizeof(masked)))) {
-                        set_ipv6_addr(skb, key->ipv6_proto, saddr, masked,
+                        set_ipv6_addr(skb, flow_key->ip.proto, saddr, masked,
                                       true);
                         memcpy(&flow_key->ipv6.addr.src, masked,
                                sizeof(flow_key->ipv6.addr.src));
@@ -483,7 +483,7 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,
                                                              NULL, &flags)
                                                != NEXTHDR_ROUTING);
 
-                        set_ipv6_addr(skb, key->ipv6_proto, daddr, masked,
+                        set_ipv6_addr(skb, flow_key->ip.proto, daddr, masked,
                                       recalc_csum);
                         memcpy(&flow_key->ipv6.addr.dst, masked,
                                sizeof(flow_key->ipv6.addr.dst));
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 1b9d286756be..b5fea1101faa 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -367,6 +367,7 @@ static int handle_fragments(struct net *net, struct sw_flow_key *key,
         } else if (key->eth.type == htons(ETH_P_IPV6)) {
                 enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone;
 
+                skb_orphan(skb);
                 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
                 err = nf_ct_frag6_gather(net, skb, user);
                 if (err)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f12c17f355d9..18d0becbc46d 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3521,6 +3521,7 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
         i->ifindex = mreq->mr_ifindex;
         i->alen = mreq->mr_alen;
         memcpy(i->addr, mreq->mr_address, i->alen);
+        memset(i->addr + i->alen, 0, sizeof(i->addr) - i->alen);
         i->count = 1;
         i->next = po->mclist;
         po->mclist = i;
diff --git a/net/rds/cong.c b/net/rds/cong.c
index e6144b8246fd..6641bcf7c185 100644
--- a/net/rds/cong.c
+++ b/net/rds/cong.c
@@ -299,7 +299,7 @@ void rds_cong_set_bit(struct rds_cong_map *map, __be16 port)
         i = be16_to_cpu(port) / RDS_CONG_MAP_PAGE_BITS;
         off = be16_to_cpu(port) % RDS_CONG_MAP_PAGE_BITS;
 
-        __set_bit_le(off, (void *)map->m_page_addrs[i]);
+        set_bit_le(off, (void *)map->m_page_addrs[i]);
 }
 
 void rds_cong_clear_bit(struct rds_cong_map *map, __be16 port)
@@ -313,7 +313,7 @@ void rds_cong_clear_bit(struct rds_cong_map *map, __be16 port)
         i = be16_to_cpu(port) / RDS_CONG_MAP_PAGE_BITS;
         off = be16_to_cpu(port) % RDS_CONG_MAP_PAGE_BITS;
 
-        __clear_bit_le(off, (void *)map->m_page_addrs[i]);
+        clear_bit_le(off, (void *)map->m_page_addrs[i]);
 }
 
 static int rds_cong_test_bit(struct rds_cong_map *map, __be16 port)
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 8764970f0c24..310cabce2311 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -194,7 +194,7 @@ static void rds_ib_cm_fill_conn_param(struct rds_connection *conn,
                 dp->dp_protocol_major = RDS_PROTOCOL_MAJOR(protocol_version);
                 dp->dp_protocol_minor = RDS_PROTOCOL_MINOR(protocol_version);
                 dp->dp_protocol_minor_mask = cpu_to_be16(RDS_IB_SUPPORTED_PROTOCOLS);
-                dp->dp_ack_seq = rds_ib_piggyb_ack(ic);
+                dp->dp_ack_seq = cpu_to_be64(rds_ib_piggyb_ack(ic));
 
                 /* Advertise flow control */
                 if (ic->i_flowctl) {
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index f18c35024207..80742edea96f 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -159,12 +159,15 @@ int sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
         if (validate)
                 skb = validate_xmit_skb_list(skb, dev);
 
-        if (skb) {
+        if (likely(skb)) {
                 HARD_TX_LOCK(dev, txq, smp_processor_id());
                 if (!netif_xmit_frozen_or_stopped(txq))
                         skb = dev_hard_start_xmit(skb, dev, txq, &ret);
 
                 HARD_TX_UNLOCK(dev, txq);
+        } else {
+                spin_lock(root_lock);
+                return qdisc_qlen(q);
         }
         spin_lock(root_lock);
 
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 8d3d3625130e..084718f9b3da 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -866,8 +866,10 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout, gfp_t gfp)
                                  * sender MUST assure that at least one T3-rtx
                                  * timer is running.
                                  */
-                                if (chunk->chunk_hdr->type == SCTP_CID_FWD_TSN)
-                                        sctp_transport_reset_timers(transport);
+                                if (chunk->chunk_hdr->type == SCTP_CID_FWD_TSN) {
+                                        sctp_transport_reset_t3_rtx(transport);
+                                        transport->last_time_sent = jiffies;
+                                }
                         }
                         break;
 
@@ -924,8 +926,10 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout, gfp_t gfp)
                         error = sctp_outq_flush_rtx(q, packet,
                                                     rtx_timeout, &start_timer);
 
-                        if (start_timer)
-                                sctp_transport_reset_timers(transport);
+                        if (start_timer) {
+                                sctp_transport_reset_t3_rtx(transport);
+                                transport->last_time_sent = jiffies;
+                        }
 
                         /* This can happen on COOKIE-ECHO resend.  Only
                          * one chunk can get bundled with a COOKIE-ECHO.
@@ -1062,7 +1066,8 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout, gfp_t gfp)
                         list_add_tail(&chunk->transmitted_list,
                                       &transport->transmitted);
 
-                        sctp_transport_reset_timers(transport);
+                        sctp_transport_reset_t3_rtx(transport);
+                        transport->last_time_sent = jiffies;
 
                         /* Only let one DATA chunk get bundled with a
                          * COOKIE-ECHO chunk.
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 7f0bf798205b..56f364d8f932 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3080,8 +3080,7 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
                         return SCTP_ERROR_RSRC_LOW;
 
                 /* Start the heartbeat timer. */
-                if (!mod_timer(&peer->hb_timer, sctp_transport_timeout(peer)))
-                        sctp_transport_hold(peer);
+                sctp_transport_reset_hb_timer(peer);
                 asoc->new_transport = peer;
                 break;
         case SCTP_PARAM_DEL_IP:
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 7fe56d0acabf..41b081a64752 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -69,8 +69,6 @@ static int sctp_side_effects(sctp_event_t event_type, sctp_subtype_t subtype,
                              sctp_cmd_seq_t *commands,
                              gfp_t gfp);
 
-static void sctp_cmd_hb_timer_update(sctp_cmd_seq_t *cmds,
-                                     struct sctp_transport *t);
 /********************************************************************
  * Helper functions
  ********************************************************************/
@@ -367,6 +365,7 @@ void sctp_generate_heartbeat_event(unsigned long data)
         struct sctp_association *asoc = transport->asoc;
         struct sock *sk = asoc->base.sk;
         struct net *net = sock_net(sk);
+        u32 elapsed, timeout;
 
         bh_lock_sock(sk);
         if (sock_owned_by_user(sk)) {
@@ -378,6 +377,16 @@ void sctp_generate_heartbeat_event(unsigned long data)
                 goto out_unlock;
         }
 
+        /* Check if we should still send the heartbeat or reschedule */
+        elapsed = jiffies - transport->last_time_sent;
+        timeout = sctp_transport_timeout(transport);
+        if (elapsed < timeout) {
+                elapsed = timeout - elapsed;
+                if (!mod_timer(&transport->hb_timer, jiffies + elapsed))
+                        sctp_transport_hold(transport);
+                goto out_unlock;
+        }
+
         error = sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT,
                            SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_HEARTBEAT),
                            asoc->state, asoc->ep, asoc,
@@ -507,7 +516,7 @@ static void sctp_do_8_2_transport_strike(sctp_cmd_seq_t *commands,
                                              0);
 
                 /* Update the hb timer to resend a heartbeat every rto */
-                sctp_cmd_hb_timer_update(commands, transport);
+                sctp_transport_reset_hb_timer(transport);
         }
 
         if (transport->state != SCTP_INACTIVE &&
@@ -634,11 +643,8 @@ static void sctp_cmd_hb_timers_start(sctp_cmd_seq_t *cmds,
          * hold a reference on the transport to make sure none of
          * the needed data structures go away.
          */
-        list_for_each_entry(t, &asoc->peer.transport_addr_list, transports) {
-
-                if (!mod_timer(&t->hb_timer, sctp_transport_timeout(t)))
-                        sctp_transport_hold(t);
-        }
+        list_for_each_entry(t, &asoc->peer.transport_addr_list, transports)
+                sctp_transport_reset_hb_timer(t);
 }
 
 static void sctp_cmd_hb_timers_stop(sctp_cmd_seq_t *cmds,
@@ -669,15 +675,6 @@ static void sctp_cmd_t3_rtx_timers_stop(sctp_cmd_seq_t *cmds,
 }
 
 
-/* Helper function to update the heartbeat timer. */
-static void sctp_cmd_hb_timer_update(sctp_cmd_seq_t *cmds,
-                                     struct sctp_transport *t)
-{
-        /* Update the heartbeat timer.  */
-        if (!mod_timer(&t->hb_timer, sctp_transport_timeout(t)))
-                sctp_transport_hold(t);
-}
-
 /* Helper function to handle the reception of an HEARTBEAT ACK.  */
 static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
                                   struct sctp_association *asoc,
@@ -742,8 +739,7 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
         sctp_transport_update_rto(t, (jiffies - hbinfo->sent_at));
 
         /* Update the heartbeat timer.  */
-        if (!mod_timer(&t->hb_timer, sctp_transport_timeout(t)))
-                sctp_transport_hold(t);
+        sctp_transport_reset_hb_timer(t);
 
         if (was_unconfirmed && asoc->peer.transport_count == 1)
                 sctp_transport_immediate_rtx(t);
@@ -1614,7 +1610,7 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
 
                 case SCTP_CMD_HB_TIMER_UPDATE:
                         t = cmd->obj.transport;
-                        sctp_cmd_hb_timer_update(commands, t);
+                        sctp_transport_reset_hb_timer(t);
                         break;
 
                 case SCTP_CMD_HB_TIMERS_STOP:
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 9b6b48c7524e..81b86678be4d 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -183,7 +183,7 @@ static void sctp_transport_destroy(struct sctp_transport *transport)
 /* Start T3_rtx timer if it is not already running and update the heartbeat
  * timer.  This routine is called every time a DATA chunk is sent.
  */
-void sctp_transport_reset_timers(struct sctp_transport *transport)
+void sctp_transport_reset_t3_rtx(struct sctp_transport *transport)
 {
         /* RFC 2960 6.3.2 Retransmission Timer Rules
          *
@@ -197,11 +197,18 @@ void sctp_transport_reset_timers(struct sctp_transport *transport)
                 if (!mod_timer(&transport->T3_rtx_timer,
                                jiffies + transport->rto))
                         sctp_transport_hold(transport);
+}
+
+void sctp_transport_reset_hb_timer(struct sctp_transport *transport)
+{
+        unsigned long expires;
 
         /* When a data chunk is sent, reset the heartbeat interval.  */
-        if (!mod_timer(&transport->hb_timer,
-                       sctp_transport_timeout(transport)))
-            sctp_transport_hold(transport);
+        expires = jiffies + sctp_transport_timeout(transport);
+        if (time_before(transport->hb_timer.expires, expires) &&
+            !mod_timer(&transport->hb_timer,
+                       expires + prandom_u32_max(transport->rto)))
+                sctp_transport_hold(transport);
 }
 
 /* This transport has been assigned to an association.
@@ -595,13 +602,13 @@ void sctp_transport_burst_reset(struct sctp_transport *t)
 unsigned long sctp_transport_timeout(struct sctp_transport *trans)
 {
         /* RTO + timer slack +/- 50% of RTO */
-        unsigned long timeout = (trans->rto >> 1) + prandom_u32_max(trans->rto);
+        unsigned long timeout = trans->rto >> 1;
 
         if (trans->state != SCTP_UNCONFIRMED &&
             trans->state != SCTP_PF)
                 timeout += trans->hbinterval;
 
-        return timeout + jiffies;
+        return timeout;
 }
 
 /* Reset transport variables to their initial values */
diff --git a/net/switchdev/switchdev.c b/net/switchdev/switchdev.c
index 2b9b98f1c2ff..b7e01d88bdc5 100644
--- a/net/switchdev/switchdev.c
+++ b/net/switchdev/switchdev.c
@@ -305,6 +305,8 @@ static void switchdev_port_attr_set_deferred(struct net_device *dev,
         if (err && err != -EOPNOTSUPP)
                 netdev_err(dev, "failed (err=%d) to set attribute (id=%d)\n",
                            err, attr->id);
+        if (attr->complete)
+                attr->complete(dev, err, attr->complete_priv);
 }
 
 static int switchdev_port_attr_set_defer(struct net_device *dev,
@@ -434,6 +436,8 @@ static void switchdev_port_obj_add_deferred(struct net_device *dev,
         if (err && err != -EOPNOTSUPP)
                 netdev_err(dev, "failed (err=%d) to add object (id=%d)\n",
                            err, obj->id);
+        if (obj->complete)
+                obj->complete(dev, err, obj->complete_priv);
 }
 
 static int switchdev_port_obj_add_defer(struct net_device *dev,
@@ -502,6 +506,8 @@ static void switchdev_port_obj_del_deferred(struct net_device *dev,
         if (err && err != -EOPNOTSUPP)
                 netdev_err(dev, "failed (err=%d) to del object (id=%d)\n",
                            err, obj->id);
+        if (obj->complete)
+                obj->complete(dev, err, obj->complete_priv);
 }
 
 static int switchdev_port_obj_del_defer(struct net_device *dev,
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 03a842870c52..e2bdb07a49a2 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -69,6 +69,7 @@ static int __net_init tipc_init_net(struct net *net)
         if (err)
                 goto out_nametbl;
 
+        INIT_LIST_HEAD(&tn->dist_queue);
         err = tipc_topsrv_start(net);
         if (err)
                 goto out_subscr;
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 5504d63503df..eff58dc53aa1 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -103,6 +103,9 @@ struct tipc_net {
         spinlock_t nametbl_lock;
         struct name_table *nametbl;
 
+        /* Name dist queue */
+        struct list_head dist_queue;
+
         /* Topology subscription server */
         struct tipc_server *topsrv;
         atomic_t subscription_count;
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index ebe9d0ff6e9e..6b626a64b517 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -40,11 +40,6 @@
 
 int sysctl_tipc_named_timeout __read_mostly = 2000;
 
-/**
- * struct tipc_dist_queue - queue holding deferred name table updates
- */
-static struct list_head tipc_dist_queue = LIST_HEAD_INIT(tipc_dist_queue);
-
 struct distr_queue_item {
         struct distr_item i;
         u32 dtype;
@@ -229,12 +224,31 @@ static void tipc_publ_purge(struct net *net, struct publication *publ, u32 addr)
         kfree_rcu(p, rcu);
 }
 
+/**
+ * tipc_dist_queue_purge - remove deferred updates from a node that went down
+ */
+static void tipc_dist_queue_purge(struct net *net, u32 addr)
+{
+        struct tipc_net *tn = net_generic(net, tipc_net_id);
+        struct distr_queue_item *e, *tmp;
+
+        spin_lock_bh(&tn->nametbl_lock);
+        list_for_each_entry_safe(e, tmp, &tn->dist_queue, next) {
+                if (e->node != addr)
+                        continue;
+                list_del(&e->next);
+                kfree(e);
+        }
+        spin_unlock_bh(&tn->nametbl_lock);
+}
+
 void tipc_publ_notify(struct net *net, struct list_head *nsub_list, u32 addr)
 {
         struct publication *publ, *tmp;
 
         list_for_each_entry_safe(publ, tmp, nsub_list, nodesub_list)
                 tipc_publ_purge(net, publ, addr);
+        tipc_dist_queue_purge(net, addr);
 }
 
 /**
@@ -279,9 +293,11 @@ static bool tipc_update_nametbl(struct net *net, struct distr_item *i,
  * tipc_named_add_backlog - add a failed name table update to the backlog
  *
  */
-static void tipc_named_add_backlog(struct distr_item *i, u32 type, u32 node)
+static void tipc_named_add_backlog(struct net *net, struct distr_item *i,
+                                   u32 type, u32 node)
 {
         struct distr_queue_item *e;
+        struct tipc_net *tn = net_generic(net, tipc_net_id);
         unsigned long now = get_jiffies_64();
 
         e = kzalloc(sizeof(*e), GFP_ATOMIC);
@@ -291,7 +307,7 @@ static void tipc_named_add_backlog(struct distr_item *i, u32 type, u32 node)
         e->node = node;
         e->expires = now + msecs_to_jiffies(sysctl_tipc_named_timeout);
         memcpy(e, i, sizeof(*i));
-        list_add_tail(&e->next, &tipc_dist_queue);
+        list_add_tail(&e->next, &tn->dist_queue);
 }
 
 /**
@@ -301,10 +317,11 @@ static void tipc_named_add_backlog(struct distr_item *i, u32 type, u32 node)
 void tipc_named_process_backlog(struct net *net)
 {
         struct distr_queue_item *e, *tmp;
+        struct tipc_net *tn = net_generic(net, tipc_net_id);
         char addr[16];
         unsigned long now = get_jiffies_64();
 
-        list_for_each_entry_safe(e, tmp, &tipc_dist_queue, next) {
+        list_for_each_entry_safe(e, tmp, &tn->dist_queue, next) {
                 if (time_after(e->expires, now)) {
                         if (!tipc_update_nametbl(net, &e->i, e->node, e->dtype))
                                 continue;
@@ -344,7 +361,7 @@ void tipc_named_rcv(struct net *net, struct sk_buff_head *inputq)
                 node = msg_orignode(msg);
                 while (count--) {
                         if (!tipc_update_nametbl(net, item, node, mtype))
-                                tipc_named_add_backlog(item, mtype, node);
+                                tipc_named_add_backlog(net, item, mtype, node);
                         item++;
                 }
                 kfree_skb(skb);
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index 662bdd20a748..56214736fe88 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -1735,11 +1735,8 @@ static int vmci_transport_dgram_dequeue(struct vsock_sock *vsk,
         /* Retrieve the head sk_buff from the socket's receive queue. */
         err = 0;
         skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err);
-        if (err)
-                return err;
-
         if (!skb)
-                return -EAGAIN;
+                return err;
 
         dg = (struct vmci_datagram *)skb->data;
         if (!dg)
@@ -2154,7 +2151,7 @@ module_exit(vmci_transport_exit);
 
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMCI transport for Virtual Sockets");
-MODULE_VERSION("1.0.3.0-k");
+MODULE_VERSION("1.0.4.0-k");
 MODULE_LICENSE("GPL v2");
 MODULE_ALIAS("vmware_vsock");
 MODULE_ALIAS_NETPROTO(PF_VSOCK);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 98c924260b3d..056a7307862b 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -13216,7 +13216,7 @@ static int nl80211_netlink_notify(struct notifier_block * nb,
         struct wireless_dev *wdev;
         struct cfg80211_beacon_registration *reg, *tmp;
 
-        if (state != NETLINK_URELEASE)
+        if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
                 return NOTIFY_DONE;
 
         rcu_read_lock();