28 files changed, 165 insertions, 234 deletions

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index f0f3447e8aa4..861ae2a165f4 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -34,11 +34,11 @@ static struct lock_class_key bridge_netdev_addr_lock_key;
 netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
-        const unsigned char *dest = skb->data;
         struct net_bridge_fdb_entry *dst;
         struct net_bridge_mdb_entry *mdst;
         struct pcpu_sw_netstats *brstats = this_cpu_ptr(br->stats);
         const struct nf_br_ops *nf_ops;
+        const unsigned char *dest;
         u16 vid = 0;
 
         rcu_read_lock();
@@ -61,6 +61,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         if (!br_allowed_ingress(br, br_vlan_group_rcu(br), skb, &vid))
                 goto out;
 
+        dest = eth_hdr(skb)->h_dest;
         if (is_broadcast_ether_addr(dest)) {
                 br_flood(br, skb, BR_PKT_BROADCAST, false, true);
         } else if (is_multicast_ether_addr(dest)) {
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 013f2290bfa5..7637f58c1226 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -131,11 +131,11 @@ static void br_do_proxy_arp(struct sk_buff *skb, struct net_bridge *br,
 int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
         struct net_bridge_port *p = br_port_get_rcu(skb->dev);
-        const unsigned char *dest = eth_hdr(skb)->h_dest;
         enum br_pkt_type pkt_type = BR_PKT_UNICAST;
         struct net_bridge_fdb_entry *dst = NULL;
         struct net_bridge_mdb_entry *mdst;
         bool local_rcv, mcast_hit = false;
+        const unsigned char *dest;
         struct net_bridge *br;
         u16 vid = 0;
 
@@ -153,6 +153,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
                 br_fdb_update(br, p, eth_hdr(skb)->h_source, vid, false);
 
         local_rcv = !!(br->dev->flags & IFF_PROMISC);
+        dest = eth_hdr(skb)->h_dest;
         if (is_multicast_ether_addr(dest)) {
                 /* by definition the broadcast is also a multicast address */
                 if (is_broadcast_ether_addr(dest)) {
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 0c31035bbfee..b7cc615d42ef 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -3203,8 +3203,10 @@ static struct ceph_msg_data *ceph_msg_data_create(enum ceph_msg_data_type type)
                 return NULL;
 
         data = kmem_cache_zalloc(ceph_msg_data_cache, GFP_NOFS);
-        if (data)
-                data->type = type;
+        if (!data)
+                return NULL;
+
+        data->type = type;
         INIT_LIST_HEAD(&data->links);
 
         return data;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 86a9737d8e3f..901bb8221366 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -5310,7 +5310,10 @@ static int invalidate_authorizer(struct ceph_connection *con)
 
 static void osd_reencode_message(struct ceph_msg *msg)
 {
-        encode_request_finish(msg);
+        int type = le16_to_cpu(msg->hdr.type);
+
+        if (type == CEPH_MSG_OSD_OP)
+                encode_request_finish(msg);
 }
 
 static int osd_sign_message(struct ceph_msg *msg)
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index 864789c5974e..64ae9f89773a 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -338,7 +338,7 @@ static void crush_finalize(struct crush_map *c)
 static struct crush_map *crush_decode(void *pbyval, void *end)
 {
         struct crush_map *c;
-        int err = -EINVAL;
+        int err;
         int i, j;
         void **p = &pbyval;
         void *start = pbyval;
@@ -407,7 +407,6 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                         size = sizeof(struct crush_bucket_straw2);
                         break;
                 default:
-                        err = -EINVAL;
                         goto bad;
                 }
                 BUG_ON(size == 0);
@@ -439,31 +438,31 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                         err = crush_decode_uniform_bucket(p, end,
                                   (struct crush_bucket_uniform *)b);
                         if (err < 0)
-                                goto bad;
+                                goto fail;
                         break;
                 case CRUSH_BUCKET_LIST:
                         err = crush_decode_list_bucket(p, end,
                                (struct crush_bucket_list *)b);
                         if (err < 0)
-                                goto bad;
+                                goto fail;
                         break;
                 case CRUSH_BUCKET_TREE:
                         err = crush_decode_tree_bucket(p, end,
                                 (struct crush_bucket_tree *)b);
                         if (err < 0)
-                                goto bad;
+                                goto fail;
                         break;
                 case CRUSH_BUCKET_STRAW:
                         err = crush_decode_straw_bucket(p, end,
                                 (struct crush_bucket_straw *)b);
                         if (err < 0)
-                                goto bad;
+                                goto fail;
                         break;
                 case CRUSH_BUCKET_STRAW2:
                         err = crush_decode_straw2_bucket(p, end,
                                 (struct crush_bucket_straw2 *)b);
                         if (err < 0)
-                                goto bad;
+                                goto fail;
                         break;
                 }
         }
@@ -474,7 +473,6 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                 u32 yes;
                 struct crush_rule *r;
 
-                err = -EINVAL;
                 ceph_decode_32_safe(p, end, yes, bad);
                 if (!yes) {
                         dout("crush_decode NO rule %d off %x %p to %p\n",
@@ -489,7 +487,6 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                 /* len */
                 ceph_decode_32_safe(p, end, yes, bad);
 #if BITS_PER_LONG == 32
-                err = -EINVAL;
                 if (yes > (ULONG_MAX - sizeof(*r))
                           / sizeof(struct crush_rule_step))
                         goto bad;
@@ -557,7 +554,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
         if (*p != end) {
                 err = decode_choose_args(p, end, c);
                 if (err)
-                        goto bad;
+                        goto fail;
         }
 
 done:
@@ -567,10 +564,14 @@ done:
 
 badmem:
         err = -ENOMEM;
-bad:
+fail:
         dout("crush_decode fail %d\n", err);
         crush_destroy(c);
         return ERR_PTR(err);
+
+bad:
+        err = -EINVAL;
+        goto fail;
 }
 
 int ceph_pg_compare(const struct ceph_pg *lhs, const struct ceph_pg *rhs)
@@ -1399,7 +1400,7 @@ static struct ceph_pg_mapping *__decode_pg_upmap_items(void **p, void *end,
                 return ERR_PTR(-EINVAL);
 
         ceph_decode_need(p, end, 2 * len * sizeof(u32), e_inval);
-        pg = kzalloc(sizeof(*pg) + 2 * len * sizeof(u32), GFP_NOIO);
+        pg = alloc_pg_mapping(2 * len * sizeof(u32));
         if (!pg)
                 return ERR_PTR(-ENOMEM);
 
@@ -1544,7 +1545,7 @@ static int osdmap_decode(void **p, void *end, struct ceph_osdmap *map)
         if (struct_v >= 3) {
                 /* erasure_code_profiles */
                 ceph_decode_skip_map_of_map(p, end, string, string, string,
-                                            bad);
+                                            e_inval);
         }
 
         if (struct_v >= 4) {
@@ -1825,9 +1826,9 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
         if (struct_v >= 3) {
                 /* new_erasure_code_profiles */
                 ceph_decode_skip_map_of_map(p, end, string, string, string,
-                                            bad);
+                                            e_inval);
                 /* old_erasure_code_profiles */
-                ceph_decode_skip_set(p, end, string, bad);
+                ceph_decode_skip_set(p, end, string, e_inval);
         }
 
         if (struct_v >= 4) {
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 82fd4c9c4a1b..06b147d7d9e2 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -28,6 +28,7 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg)
 
         if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
                 return -EFAULT;
+        ifr.ifr_name[IFNAMSIZ-1] = 0;
 
         error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex);
         if (error)
@@ -424,6 +425,8 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                 if (copy_from_user(&iwr, arg, sizeof(iwr)))
                         return -EFAULT;
 
+                iwr.ifr_name[sizeof(iwr.ifr_name) - 1] = 0;
+
                 return wext_handle_ioctl(net, &iwr, cmd, arg);
         }
 
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index a0093e1b0235..fdcb1bcd2afa 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -400,6 +400,7 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                 err = -ENOMEM;
                 goto errout;
         }
+        refcount_set(&rule->refcnt, 1);
         rule->fr_net = net;
 
         rule->pref = tb[FRA_PRIORITY] ? nla_get_u32(tb[FRA_PRIORITY])
@@ -517,8 +518,6 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                 last = r;
         }
 
-        refcount_set(&rule->refcnt, 1);
-
         if (last)
                 list_add_rcu(&rule->list, &last->list);
         else
diff --git a/net/core/filter.c b/net/core/filter.c
index c7f737058d89..f44fc22fd45a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2248,7 +2248,7 @@ static int bpf_skb_adjust_net(struct sk_buff *skb, s32 len_diff)
                        bpf_skb_net_grow(skb, len_diff_abs);
 
         bpf_compute_data_end(skb);
-        return 0;
+        return ret;
 }
 
 BPF_CALL_4(bpf_skb_adjust_room, struct sk_buff *, skb, s32, len_diff,
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index d3408a693166..8357f164c660 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -277,7 +277,7 @@ static void zap_completion_queue(void)
                         struct sk_buff *skb = clist;
                         clist = clist->next;
                         if (!skb_irq_freeable(skb)) {
-                                refcount_inc(&skb->users);
+                                refcount_set(&skb->users, 1);
                                 dev_kfree_skb_any(skb); /* put this one back */
                         } else {
                                 __kfree_skb(skb);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d1ba90980be1..9201e3621351 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2031,7 +2031,8 @@ static int do_setlink(const struct sk_buff *skb,
                 struct sockaddr *sa;
                 int len;
 
-                len = sizeof(sa_family_t) + dev->addr_len;
+                len = sizeof(sa_family_t) + max_t(size_t, dev->addr_len,
+                                                  sizeof(*sa));
                 sa = kmalloc(len, GFP_KERNEL);
                 if (!sa) {
                         err = -ENOMEM;
@@ -4241,6 +4242,7 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
 
         switch (event) {
         case NETDEV_REBOOT:
+        case NETDEV_CHANGEADDR:
         case NETDEV_CHANGENAME:
         case NETDEV_FEAT_CHANGE:
         case NETDEV_BONDING_FAILOVER:
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 4a05d7876850..fa6be9750bb4 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -126,7 +126,7 @@ static int dccp_rcv_closereq(struct sock *sk, struct sk_buff *skb)
 
 static u16 dccp_reset_code_convert(const u8 code)
 {
-        const u16 error_code[] = {
+        static const u16 error_code[] = {
         [DCCP_RESET_CODE_CLOSED]             = 0,       /* normal termination */
         [DCCP_RESET_CODE_UNSPECIFIED]        = 0,       /* nothing known */
         [DCCP_RESET_CODE_ABORTED]            = ECONNRESET,
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 4e678fa892dd..044d2a159a3c 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1334,13 +1334,14 @@ static struct pernet_operations fib_net_ops = {
 
 void __init ip_fib_init(void)
 {
-        rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
-        rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
-        rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
+        fib_trie_init();
 
         register_pernet_subsys(&fib_net_ops);
+
         register_netdevice_notifier(&fib_netdev_notifier);
         register_inetaddr_notifier(&fib_inetaddr_notifier);
 
-        fib_trie_init();
+        rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
+        rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
+        rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
 }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 7eb252dcecee..50c74cd890bc 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -599,6 +599,7 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
         hlen = iph->ihl * 4;
         mtu = mtu - hlen;       /* Size of data space */
         IPCB(skb)->flags |= IPSKB_FRAG_COMPLETE;
+        ll_rs = LL_RESERVED_SPACE(rt->dst.dev);
 
         /* When frag_list is given, use it. First, check its validity:
          * some transformers could create wrong frag_list or break existing
@@ -614,14 +615,15 @@ int ip_do_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                 if (first_len - hlen > mtu ||
                     ((first_len - hlen) & 7) ||
                     ip_is_fragment(iph) ||
-                    skb_cloned(skb))
+                    skb_cloned(skb) ||
+                    skb_headroom(skb) < ll_rs)
                         goto slow_path;
 
                 skb_walk_frags(skb, frag) {
                         /* Correct geometry. */
                         if (frag->len > mtu ||
                             ((frag->len & 7) && frag->next) ||
-                            skb_headroom(frag) < hlen)
+                            skb_headroom(frag) < hlen + ll_rs)
                                 goto slow_path_clean;
 
                         /* Partially cloned skb? */
@@ -711,8 +713,6 @@ slow_path:
         left = skb->len - hlen;         /* Space per frame */
         ptr = hlen;             /* Where to start from */
 
-        ll_rs = LL_RESERVED_SPACE(rt->dst.dev);
-
         /*
          *      Fragment the datagram.
          */
diff --git a/net/ipv4/netfilter/nf_tables_arp.c b/net/ipv4/netfilter/nf_tables_arp.c
index 805c8ddfe860..4bbc273b45e8 100644
--- a/net/ipv4/netfilter/nf_tables_arp.c
+++ b/net/ipv4/netfilter/nf_tables_arp.c
@@ -72,8 +72,7 @@ static const struct nf_chain_type filter_arp = {
         .family         = NFPROTO_ARP,
         .owner          = THIS_MODULE,
         .hook_mask      = (1 << NF_ARP_IN) |
-                          (1 << NF_ARP_OUT) |
-                          (1 << NF_ARP_FORWARD),
+                          (1 << NF_ARP_OUT),
 };
 
 static int __init nf_tables_arp_init(void)
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 0905cf04c2a4..03ad8778c395 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -335,6 +335,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
         treq->rcv_isn           = ntohl(th->seq) - 1;
         treq->snt_isn           = cookie;
         treq->ts_off            = 0;
+        treq->txhash            = net_tx_rndhash();
         req->mss                = mss;
         ireq->ir_num            = ntohs(th->dest);
         ireq->ir_rmt_port       = th->source;
diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
index dbcc9352a48f..69ee877574d0 100644
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -112,7 +112,8 @@ struct bbr {
                 cwnd_gain:10,   /* current gain for setting cwnd */
                 full_bw_cnt:3,  /* number of rounds without large bw gains */
                 cycle_idx:3,    /* current index in pacing_gain cycle array */
-                unused_b:6;
+                has_seen_rtt:1, /* have we seen an RTT sample yet? */
+                unused_b:5;
         u32     prior_cwnd;     /* prior cwnd upon entering loss recovery */
         u32     full_bw;        /* recent bw, to estimate if pipe is full */
 };
@@ -211,6 +212,35 @@ static u64 bbr_rate_bytes_per_sec(struct sock *sk, u64 rate, int gain)
         return rate >> BW_SCALE;
 }
 
+/* Convert a BBR bw and gain factor to a pacing rate in bytes per second. */
+static u32 bbr_bw_to_pacing_rate(struct sock *sk, u32 bw, int gain)
+{
+        u64 rate = bw;
+
+        rate = bbr_rate_bytes_per_sec(sk, rate, gain);
+        rate = min_t(u64, rate, sk->sk_max_pacing_rate);
+        return rate;
+}
+
+/* Initialize pacing rate to: high_gain * init_cwnd / RTT. */
+static void bbr_init_pacing_rate_from_rtt(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct bbr *bbr = inet_csk_ca(sk);
+        u64 bw;
+        u32 rtt_us;
+
+        if (tp->srtt_us) {              /* any RTT sample yet? */
+                rtt_us = max(tp->srtt_us >> 3, 1U);
+                bbr->has_seen_rtt = 1;
+        } else {                         /* no RTT sample yet */
+                rtt_us = USEC_PER_MSEC;  /* use nominal default RTT */
+        }
+        bw = (u64)tp->snd_cwnd * BW_UNIT;
+        do_div(bw, rtt_us);
+        sk->sk_pacing_rate = bbr_bw_to_pacing_rate(sk, bw, bbr_high_gain);
+}
+
 /* Pace using current bw estimate and a gain factor. In order to help drive the
  * network toward lower queues while maintaining high utilization and low
  * latency, the average pacing rate aims to be slightly (~1%) lower than the
@@ -220,12 +250,13 @@ static u64 bbr_rate_bytes_per_sec(struct sock *sk, u64 rate, int gain)
  */
 static void bbr_set_pacing_rate(struct sock *sk, u32 bw, int gain)
 {
+        struct tcp_sock *tp = tcp_sk(sk);
         struct bbr *bbr = inet_csk_ca(sk);
-        u64 rate = bw;
+        u32 rate = bbr_bw_to_pacing_rate(sk, bw, gain);
 
-        rate = bbr_rate_bytes_per_sec(sk, rate, gain);
-        rate = min_t(u64, rate, sk->sk_max_pacing_rate);
-        if (bbr->mode != BBR_STARTUP || rate > sk->sk_pacing_rate)
+        if (unlikely(!bbr->has_seen_rtt && tp->srtt_us))
+                bbr_init_pacing_rate_from_rtt(sk);
+        if (bbr_full_bw_reached(sk) || rate > sk->sk_pacing_rate)
                 sk->sk_pacing_rate = rate;
 }
 
@@ -798,7 +829,6 @@ static void bbr_init(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct bbr *bbr = inet_csk_ca(sk);
-        u64 bw;
 
         bbr->prior_cwnd = 0;
         bbr->tso_segs_goal = 0;  /* default segs per skb until first ACK */
@@ -814,11 +844,8 @@ static void bbr_init(struct sock *sk)
 
         minmax_reset(&bbr->bw, bbr->rtt_cnt, 0);  /* init max bw to 0 */
 
-        /* Initialize pacing rate to: high_gain * init_cwnd / RTT. */
-        bw = (u64)tp->snd_cwnd * BW_UNIT;
-        do_div(bw, (tp->srtt_us >> 3) ? : USEC_PER_MSEC);
-        sk->sk_pacing_rate = 0;         /* force an update of sk_pacing_rate */
-        bbr_set_pacing_rate(sk, bw, bbr_high_gain);
+        bbr->has_seen_rtt = 0;
+        bbr_init_pacing_rate_from_rtt(sk);
 
         bbr->restore_cwnd = 0;
         bbr->round_start = 0;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 25294d43e147..b057653ceca9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1388,6 +1388,11 @@ void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len)
                 unlock_sock_fast(sk, slow);
         }
 
+        /* we cleared the head states previously only if the skb lacks any IP
+         * options, see __udp_queue_rcv_skb().
+         */
+        if (unlikely(IPCB(skb)->opt.optlen > 0))
+                skb_release_head_state(skb);
         consume_stateless_skb(skb);
 }
 EXPORT_SYMBOL_GPL(skb_consume_udp);
@@ -1779,8 +1784,12 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 sk_mark_napi_id_once(sk, skb);
         }
 
-        /* clear all pending head states while they are hot in the cache */
-        skb_release_head_state(skb);
+        /* At recvmsg() time we need skb->dst to process IP options-related
+         * cmsg, elsewhere can we clear all pending head states while they are
+         * hot in the cache
+         */
+        if (likely(IPCB(skb)->opt.optlen == 0))
+                skb_release_head_state(skb);
 
         rc = __udp_enqueue_schedule_skb(sk, skb);
         if (rc < 0) {
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index e9065b8d3af8..abb2c307fbe8 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -78,7 +78,7 @@ EXPORT_SYMBOL(ipv6_select_ident);
 
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
-        u16 offset = sizeof(struct ipv6hdr);
+        unsigned int offset = sizeof(struct ipv6hdr);
         unsigned int packet_len = skb_tail_pointer(skb) -
                 skb_network_header(skb);
         int found_rhdr = 0;
@@ -86,6 +86,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 
         while (offset <= packet_len) {
                 struct ipv6_opt_hdr *exthdr;
+                unsigned int len;
 
                 switch (**nexthdr) {
 
@@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 
                 exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
                                                  offset);
-                offset += ipv6_optlen(exthdr);
+                len = ipv6_optlen(exthdr);
+                if (len + offset >= IPV6_MAXPLEN)
+                        return -EINVAL;
+                offset += len;
                 *nexthdr = &exthdr->nexthdr;
         }
 
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 7b75b0620730..4e7817abc0b9 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -216,6 +216,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         treq->rcv_isn = ntohl(th->seq) - 1;
         treq->snt_isn = cookie;
         treq->ts_off = 0;
+        treq->txhash = net_tx_rndhash();
 
         /*
          * We need to lookup the dst_entry to get the correct window size.
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 552d606e57ca..974cf2a3795a 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -227,114 +227,6 @@ void nf_unregister_net_hooks(struct net *net, const struct nf_hook_ops *reg,
 }
 EXPORT_SYMBOL(nf_unregister_net_hooks);
 
-static LIST_HEAD(nf_hook_list);
-
-static int _nf_register_hook(struct nf_hook_ops *reg)
-{
-        struct net *net, *last;
-        int ret;
-
-        for_each_net(net) {
-                ret = nf_register_net_hook(net, reg);
-                if (ret && ret != -ENOENT)
-                        goto rollback;
-        }
-        list_add_tail(&reg->list, &nf_hook_list);
-
-        return 0;
-rollback:
-        last = net;
-        for_each_net(net) {
-                if (net == last)
-                        break;
-                nf_unregister_net_hook(net, reg);
-        }
-        return ret;
-}
-
-int nf_register_hook(struct nf_hook_ops *reg)
-{
-        int ret;
-
-        rtnl_lock();
-        ret = _nf_register_hook(reg);
-        rtnl_unlock();
-
-        return ret;
-}
-EXPORT_SYMBOL(nf_register_hook);
-
-static void _nf_unregister_hook(struct nf_hook_ops *reg)
-{
-        struct net *net;
-
-        list_del(&reg->list);
-        for_each_net(net)
-                nf_unregister_net_hook(net, reg);
-}
-
-void nf_unregister_hook(struct nf_hook_ops *reg)
-{
-        rtnl_lock();
-        _nf_unregister_hook(reg);
-        rtnl_unlock();
-}
-EXPORT_SYMBOL(nf_unregister_hook);
-
-int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
-{
-        unsigned int i;
-        int err = 0;
-
-        for (i = 0; i < n; i++) {
-                err = nf_register_hook(&reg[i]);
-                if (err)
-                        goto err;
-        }
-        return err;
-
-err:
-        if (i > 0)
-                nf_unregister_hooks(reg, i);
-        return err;
-}
-EXPORT_SYMBOL(nf_register_hooks);
-
-/* Caller MUST take rtnl_lock() */
-int _nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
-{
-        unsigned int i;
-        int err = 0;
-
-        for (i = 0; i < n; i++) {
-                err = _nf_register_hook(&reg[i]);
-                if (err)
-                        goto err;
-        }
-        return err;
-
-err:
-        if (i > 0)
-                _nf_unregister_hooks(reg, i);
-        return err;
-}
-EXPORT_SYMBOL(_nf_register_hooks);
-
-void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
-{
-        while (n-- > 0)
-                nf_unregister_hook(&reg[n]);
-}
-EXPORT_SYMBOL(nf_unregister_hooks);
-
-/* Caller MUST take rtnl_lock */
-void _nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
-{
-        while (n-- > 0)
-                _nf_unregister_hook(&reg[n]);
-}
-EXPORT_SYMBOL(_nf_unregister_hooks);
-
 /* Returns 1 if okfn() needs to be executed by the caller,
  * -EPERM for NF_DROP, 0 otherwise.  Caller must hold rcu_read_lock. */
 int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
@@ -450,40 +342,9 @@ void (*nf_nat_decode_session_hook)(struct sk_buff *, struct flowi *);
 EXPORT_SYMBOL(nf_nat_decode_session_hook);
 #endif
 
-static int nf_register_hook_list(struct net *net)
-{
-        struct nf_hook_ops *elem;
-        int ret;
-
-        rtnl_lock();
-        list_for_each_entry(elem, &nf_hook_list, list) {
-                ret = nf_register_net_hook(net, elem);
-                if (ret && ret != -ENOENT)
-                        goto out_undo;
-        }
-        rtnl_unlock();
-        return 0;
-
-out_undo:
-        list_for_each_entry_continue_reverse(elem, &nf_hook_list, list)
-                nf_unregister_net_hook(net, elem);
-        rtnl_unlock();
-        return ret;
-}
-
-static void nf_unregister_hook_list(struct net *net)
-{
-        struct nf_hook_ops *elem;
-
-        rtnl_lock();
-        list_for_each_entry(elem, &nf_hook_list, list)
-                nf_unregister_net_hook(net, elem);
-        rtnl_unlock();
-}
-
 static int __net_init netfilter_net_init(struct net *net)
 {
-        int i, h, ret;
+        int i, h;
 
         for (i = 0; i < ARRAY_SIZE(net->nf.hooks); i++) {
                 for (h = 0; h < NF_MAX_HOOKS; h++)
@@ -500,16 +361,12 @@ static int __net_init netfilter_net_init(struct net *net)
                 return -ENOMEM;
         }
 #endif
-        ret = nf_register_hook_list(net);
-        if (ret)
-                remove_proc_entry("netfilter", net->proc_net);
 
-        return ret;
+        return 0;
 }
 
 static void __net_exit netfilter_net_exit(struct net *net)
 {
-        nf_unregister_hook_list(net);
         remove_proc_entry("netfilter", net->proc_net);
 }
 
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index e03d16ed550d..899c2c36da13 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -422,7 +422,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect)
         h = nf_ct_expect_dst_hash(net, &expect->tuple);
         hlist_for_each_entry_safe(i, next, &nf_ct_expect_hash[h], hnode) {
                 if (expect_matches(i, expect)) {
-                        if (nf_ct_remove_expect(expect))
+                        if (nf_ct_remove_expect(i))
                                 break;
                 } else if (expect_clash(i, expect)) {
                         ret = -EBUSY;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 832c5a08d9a5..eb541786ccb7 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -222,20 +222,21 @@ find_appropriate_src(struct net *net,
                 .tuple = tuple,
                 .zone = zone
         };
-        struct rhlist_head *hl;
+        struct rhlist_head *hl, *h;
 
         hl = rhltable_lookup(&nf_nat_bysource_table, &key,
                              nf_nat_bysource_params);
-        if (!hl)
-                return 0;
 
-        ct = container_of(hl, typeof(*ct), nat_bysource);
+        rhl_for_each_entry_rcu(ct, h, hl, nat_bysource) {
+                nf_ct_invert_tuplepr(result,
+                                     &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+                result->dst = tuple->dst;
 
-        nf_ct_invert_tuplepr(result,
-                             &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
-        result->dst = tuple->dst;
+                if (in_range(l3proto, l4proto, result, range))
+                        return 1;
+        }
 
-        return in_range(l3proto, l4proto, result, range);
+        return 0;
 }
 
 /* For [FUTURE] fragmentation handling, we want the least-used
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 92b05e188fd1..733d3e4a30d8 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -472,8 +472,7 @@ static void nfnetlink_rcv_skb_batch(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (msglen > skb->len)
                 msglen = skb->len;
 
-        if (nlh->nlmsg_len < NLMSG_HDRLEN ||
-            skb->len < NLMSG_HDRLEN + sizeof(struct nfgenmsg))
+        if (skb->len < NLMSG_HDRLEN + sizeof(struct nfgenmsg))
                 return;
 
         err = nla_parse(cda, NFNL_BATCH_MAX, attr, attrlen, nfnl_batch_policy,
@@ -500,7 +499,8 @@ static void nfnetlink_rcv(struct sk_buff *skb)
 {
         struct nlmsghdr *nlh = nlmsg_hdr(skb);
 
-        if (nlh->nlmsg_len < NLMSG_HDRLEN ||
+        if (skb->len < NLMSG_HDRLEN ||
+            nlh->nlmsg_len < NLMSG_HDRLEN ||
             skb->len < nlh->nlmsg_len)
                 return;
 
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 08679ebb3068..e3c4c6c3fef7 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -629,6 +629,34 @@ ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
         return ct;
 }
 
+static
+struct nf_conn *ovs_ct_executed(struct net *net,
+                                const struct sw_flow_key *key,
+                                const struct ovs_conntrack_info *info,
+                                struct sk_buff *skb,
+                                bool *ct_executed)
+{
+        struct nf_conn *ct = NULL;
+
+        /* If no ct, check if we have evidence that an existing conntrack entry
+         * might be found for this skb.  This happens when we lose a skb->_nfct
+         * due to an upcall, or if the direction is being forced.  If the
+         * connection was not confirmed, it is not cached and needs to be run
+         * through conntrack again.
+         */
+        *ct_executed = (key->ct_state & OVS_CS_F_TRACKED) &&
+                       !(key->ct_state & OVS_CS_F_INVALID) &&
+                       (key->ct_zone == info->zone.id);
+
+        if (*ct_executed || (!key->ct_state && info->force)) {
+                ct = ovs_ct_find_existing(net, &info->zone, info->family, skb,
+                                          !!(key->ct_state &
+                                          OVS_CS_F_NAT_MASK));
+        }
+
+        return ct;
+}
+
 /* Determine whether skb->_nfct is equal to the result of conntrack lookup. */
 static bool skb_nfct_cached(struct net *net,
                             const struct sw_flow_key *key,
@@ -637,24 +665,17 @@ static bool skb_nfct_cached(struct net *net,
 {
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct;
+        bool ct_executed = true;
 
         ct = nf_ct_get(skb, &ctinfo);
-        /* If no ct, check if we have evidence that an existing conntrack entry
-         * might be found for this skb.  This happens when we lose a skb->_nfct
-         * due to an upcall.  If the connection was not confirmed, it is not
-         * cached and needs to be run through conntrack again.
-         */
-        if (!ct && key->ct_state & OVS_CS_F_TRACKED &&
-            !(key->ct_state & OVS_CS_F_INVALID) &&
-            key->ct_zone == info->zone.id) {
-                ct = ovs_ct_find_existing(net, &info->zone, info->family, skb,
-                                          !!(key->ct_state
-                                             & OVS_CS_F_NAT_MASK));
-                if (ct)
-                        nf_ct_get(skb, &ctinfo);
-        }
         if (!ct)
+                ct = ovs_ct_executed(net, key, info, skb, &ct_executed);
+
+        if (ct)
+                nf_ct_get(skb, &ctinfo);
+        else
                 return false;
+
         if (!net_eq(net, read_pnet(&ct->ct_net)))
                 return false;
         if (!nf_ct_zone_equal_any(info->ct, nf_ct_zone(ct)))
@@ -679,7 +700,7 @@ static bool skb_nfct_cached(struct net *net,
                 return false;
         }
 
-        return true;
+        return ct_executed;
 }
 
 #ifdef CONFIG_NF_NAT_NEEDED
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index e3beb28203eb..008bb34ee324 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -214,6 +214,7 @@ static void prb_clear_rxhash(struct tpacket_kbdq_core *,
 static void prb_fill_vlan_info(struct tpacket_kbdq_core *,
                 struct tpacket3_hdr *);
 static void packet_flush_mclist(struct sock *sk);
+static void packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb);
 
 struct packet_skb_cb {
         union {
@@ -260,6 +261,7 @@ static int packet_direct_xmit(struct sk_buff *skb)
         if (skb != orig_skb)
                 goto drop;
 
+        packet_pick_tx_queue(dev, skb);
         txq = skb_get_tx_queue(dev, skb);
 
         local_bh_disable();
@@ -2747,8 +2749,6 @@ tpacket_error:
                         goto tpacket_error;
                 }
 
-                packet_pick_tx_queue(dev, skb);
-
                 skb->destructor = tpacket_destruct_skb;
                 __packet_set_status(po, ph, TP_STATUS_SENDING);
                 packet_inc_pending(&po->tx_ring);
@@ -2931,8 +2931,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         skb->priority = sk->sk_priority;
         skb->mark = sockc.mark;
 
-        packet_pick_tx_queue(dev, skb);
-
         if (po->has_vnet_hdr) {
                 err = virtio_net_hdr_to_skb(skb, &vnet_hdr, vio_le());
                 if (err)
diff --git a/net/rds/send.c b/net/rds/send.c
index e81aa176f4e2..41b9f0f5bb9c 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -170,8 +170,8 @@ restart:
          * The acquire_in_xmit() check above ensures that only one
          * caller can increment c_send_gen at any time.
          */
-        cp->cp_send_gen++;
-        send_gen = cp->cp_send_gen;
+        send_gen = READ_ONCE(cp->cp_send_gen) + 1;
+        WRITE_ONCE(cp->cp_send_gen, send_gen);
 
         /*
          * rds_conn_shutdown() sets the conn state and then tests RDS_IN_XMIT,
@@ -431,7 +431,7 @@ over_batch:
                 smp_mb();
                 if ((test_bit(0, &conn->c_map_queued) ||
                      !list_empty(&cp->cp_send_queue)) &&
-                    send_gen == cp->cp_send_gen) {
+                        send_gen == READ_ONCE(cp->cp_send_gen)) {
                         rds_stats_inc(s_send_lock_queue_raced);
                         if (batch_count < send_batch_count)
                                 goto restart;
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index aed6cf2e9fd8..f2e9ed34a963 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -835,7 +835,7 @@ out_nlmsg_trim:
 }
 
 static int
-act_get_notify(struct net *net, u32 portid, struct nlmsghdr *n,
+tcf_get_notify(struct net *net, u32 portid, struct nlmsghdr *n,
                struct list_head *actions, int event)
 {
         struct sk_buff *skb;
@@ -1018,7 +1018,7 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
         }
 
         if (event == RTM_GETACTION)
-                ret = act_get_notify(net, portid, n, &actions, event);
+                ret = tcf_get_notify(net, portid, n, &actions, event);
         else { /* delete */
                 ret = tcf_del_notify(net, n, &actions, portid);
                 if (ret)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 4e16b02ed832..6110447fe51d 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -228,7 +228,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
         sctp_adaptation_ind_param_t aiparam;
         sctp_supported_ext_param_t ext_param;
         int num_ext = 0;
-        __u8 extensions[3];
+        __u8 extensions[4];
         struct sctp_paramhdr *auth_chunks = NULL,
                         *auth_hmacs = NULL;
 
@@ -396,7 +396,7 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
         sctp_adaptation_ind_param_t aiparam;
         sctp_supported_ext_param_t ext_param;
         int num_ext = 0;
-        __u8 extensions[3];
+        __u8 extensions[4];
         struct sctp_paramhdr *auth_chunks = NULL,
                         *auth_hmacs = NULL,
                         *auth_random = NULL;