56 files changed, 451 insertions, 220 deletions

diff --git a/net/atm/lec.c b/net/atm/lec.c
index d7f5cf5b7594..ad4f829193f0 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -710,7 +710,10 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg)
 
 static int lec_mcast_attach(struct atm_vcc *vcc, int arg)
 {
-        if (arg < 0 || arg >= MAX_LEC_ITF || !dev_lec[arg])
+        if (arg < 0 || arg >= MAX_LEC_ITF)
+                return -EINVAL;
+        arg = array_index_nospec(arg, MAX_LEC_ITF);
+        if (!dev_lec[arg])
                 return -EINVAL;
         vcc->proto_data = dev_lec[arg];
         return lec_mcast_make(netdev_priv(dev_lec[arg]), vcc);
@@ -728,6 +731,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
                 i = arg;
         if (arg >= MAX_LEC_ITF)
                 return -EINVAL;
+        i = array_index_nospec(arg, MAX_LEC_ITF);
         if (!dev_lec[i]) {
                 int size;
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 9a580999ca57..d892b7c3cc42 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -523,12 +523,12 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
         struct sock *sk = sock->sk;
         int err = 0;
 
-        BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
-
         if (!addr || addr_len < sizeof(struct sockaddr_sco) ||
             addr->sa_family != AF_BLUETOOTH)
                 return -EINVAL;
 
+        BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
+
         lock_sock(sk);
 
         if (sk->sk_state != BT_OPEN) {
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 5ea7e56119c1..ba303ee99b9b 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -197,13 +197,10 @@ static void __br_handle_local_finish(struct sk_buff *skb)
 /* note: already called with rcu_read_lock */
 static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
-        struct net_bridge_port *p = br_port_get_rcu(skb->dev);
-
         __br_handle_local_finish(skb);
 
-        BR_INPUT_SKB_CB(skb)->brdev = p->br->dev;
-        br_pass_frame_up(skb);
-        return 0;
+        /* return 1 to signal the okfn() was called so it's ok to use the skb */
+        return 1;
 }
 
 /*
@@ -280,10 +277,18 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
                                 goto forward;
                 }
 
-                /* Deliver packet to local host only */
-                NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, dev_net(skb->dev),
-                        NULL, skb, skb->dev, NULL, br_handle_local_finish);
-                return RX_HANDLER_CONSUMED;
+                /* The else clause should be hit when nf_hook():
+                 *   - returns < 0 (drop/error)
+                 *   - returns = 0 (stolen/nf_queue)
+                 * Thus return 1 from the okfn() to signal the skb is ok to pass
+                 */
+                if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
+                            dev_net(skb->dev), NULL, skb, skb->dev, NULL,
+                            br_handle_local_finish) == 1) {
+                        return RX_HANDLER_PASS;
+                } else {
+                        return RX_HANDLER_CONSUMED;
+                }
         }
 
 forward:
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 02da21d771c9..45e7f4173bba 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -2031,7 +2031,8 @@ static void br_multicast_start_querier(struct net_bridge *br,
 
         __br_multicast_open(br, query);
 
-        list_for_each_entry(port, &br->port_list, list) {
+        rcu_read_lock();
+        list_for_each_entry_rcu(port, &br->port_list, list) {
                 if (port->state == BR_STATE_DISABLED ||
                     port->state == BR_STATE_BLOCKING)
                         continue;
@@ -2043,6 +2044,7 @@ static void br_multicast_start_querier(struct net_bridge *br,
                         br_multicast_enable(&port->ip6_own_query);
 #endif
         }
+        rcu_read_unlock();
 }
 
 int br_multicast_toggle(struct net_bridge *br, unsigned long val)
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 9c07591b0232..7104cf13da84 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1441,7 +1441,7 @@ static int br_fill_info(struct sk_buff *skb, const struct net_device *brdev)
             nla_put_u8(skb, IFLA_BR_VLAN_STATS_ENABLED,
                        br_opt_get(br, BROPT_VLAN_STATS_ENABLED)) ||
             nla_put_u8(skb, IFLA_BR_VLAN_STATS_PER_PORT,
-                       br_opt_get(br, IFLA_BR_VLAN_STATS_PER_PORT)))
+                       br_opt_get(br, BROPT_VLAN_STATS_PER_PORT)))
                 return -EMSGSIZE;
 #endif
 #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
diff --git a/net/core/dev.c b/net/core/dev.c
index fdcff29df915..f409406254dd 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1184,7 +1184,21 @@ int dev_change_name(struct net_device *dev, const char *newname)
         BUG_ON(!dev_net(dev));
 
         net = dev_net(dev);
-        if (dev->flags & IFF_UP)
+
+        /* Some auto-enslaved devices e.g. failover slaves are
+         * special, as userspace might rename the device after
+         * the interface had been brought up and running since
+         * the point kernel initiated auto-enslavement. Allow
+         * live name change even when these slave devices are
+         * up and running.
+         *
+         * Typically, users of these auto-enslaving devices
+         * don't actually care about slave name change, as
+         * they are supposed to operate on master interface
+         * directly.
+         */
+        if (dev->flags & IFF_UP &&
+            likely(!(dev->priv_flags & IFF_LIVE_RENAME_OK)))
                 return -EBUSY;
 
         write_seqcount_begin(&devnet_rename_seq);
diff --git a/net/core/failover.c b/net/core/failover.c
index 4a92a98ccce9..b5cd3c727285 100644
--- a/net/core/failover.c
+++ b/net/core/failover.c
@@ -80,14 +80,14 @@ static int failover_slave_register(struct net_device *slave_dev)
                 goto err_upper_link;
         }
 
-        slave_dev->priv_flags |= IFF_FAILOVER_SLAVE;
+        slave_dev->priv_flags |= (IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
 
         if (fops && fops->slave_register &&
             !fops->slave_register(slave_dev, failover_dev))
                 return NOTIFY_OK;
 
         netdev_upper_dev_unlink(slave_dev, failover_dev);
-        slave_dev->priv_flags &= ~IFF_FAILOVER_SLAVE;
+        slave_dev->priv_flags &= ~(IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
 err_upper_link:
         netdev_rx_handler_unregister(slave_dev);
 done:
@@ -121,7 +121,7 @@ int failover_slave_unregister(struct net_device *slave_dev)
 
         netdev_rx_handler_unregister(slave_dev);
         netdev_upper_dev_unlink(slave_dev, failover_dev);
-        slave_dev->priv_flags &= ~IFF_FAILOVER_SLAVE;
+        slave_dev->priv_flags &= ~(IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
 
         if (fops && fops->slave_unregister &&
             !fops->slave_unregister(slave_dev, failover_dev))
diff --git a/net/core/filter.c b/net/core/filter.c
index fc92ebc4e200..27e61ffd9039 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4383,6 +4383,8 @@ BPF_CALL_3(bpf_bind, struct bpf_sock_addr_kern *, ctx, struct sockaddr *, addr,
          * Only binding to IP is supported.
          */
         err = -EINVAL;
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return err;
         if (addr->sa_family == AF_INET) {
                 if (addr_len < sizeof(struct sockaddr_in))
                         return err;
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index f8f94303a1f5..8f8b7b6c2945 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -1747,20 +1747,16 @@ int netdev_register_kobject(struct net_device *ndev)
 
         error = device_add(dev);
         if (error)
-                goto error_put_device;
+                return error;
 
         error = register_queue_kobjects(ndev);
-        if (error)
-                goto error_device_del;
+        if (error) {
+                device_del(dev);
+                return error;
+        }
 
         pm_runtime_set_memalloc_noio(dev, true);
 
-        return 0;
-
-error_device_del:
-        device_del(dev);
-error_put_device:
-        put_device(dev);
         return error;
 }
 
diff --git a/net/core/ptp_classifier.c b/net/core/ptp_classifier.c
index 703cf76aa7c2..7109c168b5e0 100644
--- a/net/core/ptp_classifier.c
+++ b/net/core/ptp_classifier.c
@@ -185,9 +185,10 @@ void __init ptp_classifier_init(void)
                 { 0x16,  0,  0, 0x00000000 },
                 { 0x06,  0,  0, 0x00000000 },
         };
-        struct sock_fprog_kern ptp_prog = {
-                .len = ARRAY_SIZE(ptp_filter), .filter = ptp_filter,
-        };
+        struct sock_fprog_kern ptp_prog;
+
+        ptp_prog.len = ARRAY_SIZE(ptp_filter);
+        ptp_prog.filter = ptp_filter;
 
         BUG_ON(bpf_prog_create(&ptp_insns, &ptp_prog));
 }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a51cab95ba64..220c56e93659 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -4948,7 +4948,7 @@ static int rtnl_valid_stats_req(const struct nlmsghdr *nlh, bool strict_check,
 {
         struct if_stats_msg *ifsm;
 
-        if (nlh->nlmsg_len < sizeof(*ifsm)) {
+        if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*ifsm))) {
                 NL_SET_ERR_MSG(extack, "Invalid header for stats dump");
                 return -EINVAL;
         }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ef2cd5712098..40796b8bf820 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5083,7 +5083,8 @@ EXPORT_SYMBOL_GPL(skb_gso_validate_mac_len);
 
 static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
 {
-        int mac_len;
+        int mac_len, meta_len;
+        void *meta;
 
         if (skb_cow(skb, skb_headroom(skb)) < 0) {
                 kfree_skb(skb);
@@ -5095,6 +5096,13 @@ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
                 memmove(skb_mac_header(skb) + VLAN_HLEN, skb_mac_header(skb),
                         mac_len - VLAN_HLEN - ETH_TLEN);
         }
+
+        meta_len = skb_metadata_len(skb);
+        if (meta_len) {
+                meta = skb_metadata_end(skb) - meta_len;
+                memmove(meta + VLAN_HLEN, meta, meta_len);
+        }
+
         skb->mac_header += VLAN_HLEN;
         return skb;
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 782343bb925b..067878a1e4c5 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -348,7 +348,7 @@ static int sock_get_timeout(long timeo, void *optval, bool old_timeval)
                 tv.tv_usec = ((timeo % HZ) * USEC_PER_SEC) / HZ;
         }
 
-        if (in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
+        if (old_timeval && in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
                 struct old_timeval32 tv32 = { tv.tv_sec, tv.tv_usec };
                 *(struct old_timeval32 *)optval = tv32;
                 return sizeof(tv32);
@@ -372,7 +372,7 @@ static int sock_set_timeout(long *timeo_p, char __user *optval, int optlen, bool
 {
         struct __kernel_sock_timeval tv;
 
-        if (in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
+        if (old_timeval && in_compat_syscall() && !COMPAT_USE_64BIT_TIME) {
                 struct old_timeval32 tv32;
 
                 if (optlen < sizeof(tv32))
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index 79e98e21cdd7..12ce6c526d72 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -121,6 +121,7 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
         struct guehdr *guehdr;
         void *data;
         u16 doffset = 0;
+        u8 proto_ctype;
 
         if (!fou)
                 return 1;
@@ -212,13 +213,14 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
         if (unlikely(guehdr->control))
                 return gue_control_message(skb, guehdr);
 
+        proto_ctype = guehdr->proto_ctype;
         __skb_pull(skb, sizeof(struct udphdr) + hdrlen);
         skb_reset_transport_header(skb);
 
         if (iptunnel_pull_offloads(skb))
                 goto drop;
 
-        return -guehdr->proto_ctype;
+        return -proto_ctype;
 
 drop:
         kfree_skb(skb);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a5da63e5faa2..88ce038dd495 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1185,9 +1185,23 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
 
 static void ipv4_link_failure(struct sk_buff *skb)
 {
+        struct ip_options opt;
         struct rtable *rt;
+        int res;
 
-        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
+        /* Recompile ip options since IPCB may not be valid anymore.
+         */
+        memset(&opt, 0, sizeof(opt));
+        opt.optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr);
+
+        rcu_read_lock();
+        res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL);
+        rcu_read_unlock();
+
+        if (res)
+                return;
+
+        __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt);
 
         rt = skb_rtable(skb);
         if (rt)
diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
index 359da68d7c06..477cb4aa456c 100644
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -49,9 +49,8 @@
 #define DCTCP_MAX_ALPHA 1024U
 
 struct dctcp {
-        u32 acked_bytes_ecn;
-        u32 acked_bytes_total;
-        u32 prior_snd_una;
+        u32 old_delivered;
+        u32 old_delivered_ce;
         u32 prior_rcv_nxt;
         u32 dctcp_alpha;
         u32 next_seq;
@@ -73,8 +72,8 @@ static void dctcp_reset(const struct tcp_sock *tp, struct dctcp *ca)
 {
         ca->next_seq = tp->snd_nxt;
 
-        ca->acked_bytes_ecn = 0;
-        ca->acked_bytes_total = 0;
+        ca->old_delivered = tp->delivered;
+        ca->old_delivered_ce = tp->delivered_ce;
 }
 
 static void dctcp_init(struct sock *sk)
@@ -86,7 +85,6 @@ static void dctcp_init(struct sock *sk)
              sk->sk_state == TCP_CLOSE)) {
                 struct dctcp *ca = inet_csk_ca(sk);
 
-                ca->prior_snd_una = tp->snd_una;
                 ca->prior_rcv_nxt = tp->rcv_nxt;
 
                 ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
@@ -118,37 +116,25 @@ static void dctcp_update_alpha(struct sock *sk, u32 flags)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         struct dctcp *ca = inet_csk_ca(sk);
-        u32 acked_bytes = tp->snd_una - ca->prior_snd_una;
-
-        /* If ack did not advance snd_una, count dupack as MSS size.
-         * If ack did update window, do not count it at all.
-         */
-        if (acked_bytes == 0 && !(flags & CA_ACK_WIN_UPDATE))
-                acked_bytes = inet_csk(sk)->icsk_ack.rcv_mss;
-        if (acked_bytes) {
-                ca->acked_bytes_total += acked_bytes;
-                ca->prior_snd_una = tp->snd_una;
-
-                if (flags & CA_ACK_ECE)
-                        ca->acked_bytes_ecn += acked_bytes;
-        }
 
         /* Expired RTT */
         if (!before(tp->snd_una, ca->next_seq)) {
-                u64 bytes_ecn = ca->acked_bytes_ecn;
+                u32 delivered_ce = tp->delivered_ce - ca->old_delivered_ce;
                 u32 alpha = ca->dctcp_alpha;
 
                 /* alpha = (1 - g) * alpha + g * F */
 
                 alpha -= min_not_zero(alpha, alpha >> dctcp_shift_g);
-                if (bytes_ecn) {
+                if (delivered_ce) {
+                        u32 delivered = tp->delivered - ca->old_delivered;
+
                         /* If dctcp_shift_g == 1, a 32bit value would overflow
-                         * after 8 Mbytes.
+                         * after 8 M packets.
                          */
-                        bytes_ecn <<= (10 - dctcp_shift_g);
-                        do_div(bytes_ecn, max(1U, ca->acked_bytes_total));
+                        delivered_ce <<= (10 - dctcp_shift_g);
+                        delivered_ce /= max(1U, delivered);
 
-                        alpha = min(alpha + (u32)bytes_ecn, DCTCP_MAX_ALPHA);
+                        alpha = min(alpha + delivered_ce, DCTCP_MAX_ALPHA);
                 }
                 /* dctcp_alpha can be read from dctcp_get_info() without
                  * synchro, so we ask compiler to not use dctcp_alpha
@@ -200,6 +186,7 @@ static size_t dctcp_get_info(struct sock *sk, u32 ext, int *attr,
                              union tcp_cc_info *info)
 {
         const struct dctcp *ca = inet_csk_ca(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
 
         /* Fill it also in case of VEGASINFO due to req struct limits.
          * We can still correctly retrieve it later.
@@ -211,8 +198,10 @@ static size_t dctcp_get_info(struct sock *sk, u32 ext, int *attr,
                         info->dctcp.dctcp_enabled = 1;
                         info->dctcp.dctcp_ce_state = (u16) ca->ce_state;
                         info->dctcp.dctcp_alpha = ca->dctcp_alpha;
-                        info->dctcp.dctcp_ab_ecn = ca->acked_bytes_ecn;
-                        info->dctcp.dctcp_ab_tot = ca->acked_bytes_total;
+                        info->dctcp.dctcp_ab_ecn = tp->mss_cache *
+                                                   (tp->delivered_ce - ca->old_delivered_ce);
+                        info->dctcp.dctcp_ab_tot = tp->mss_cache *
+                                                   (tp->delivered - ca->old_delivered);
                 }
 
                 *attr = INET_DIAG_DCTCPINFO;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 5def3c48870e..731d3045b50a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -402,11 +402,12 @@ static int __tcp_grow_window(const struct sock *sk, const struct sk_buff *skb)
 static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        int room;
+
+        room = min_t(int, tp->window_clamp, tcp_space(sk)) - tp->rcv_ssthresh;
 
         /* Check #1 */
-        if (tp->rcv_ssthresh < tp->window_clamp &&
-            (int)tp->rcv_ssthresh < tcp_space(sk) &&
-            !tcp_under_memory_pressure(sk)) {
+        if (room > 0 && !tcp_under_memory_pressure(sk)) {
                 int incr;
 
                 /* Check #2. Increase window, if skb with such overhead
@@ -419,8 +420,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
 
                 if (incr) {
                         incr = max_t(int, incr, 2 * skb->len);
-                        tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
-                                               tp->window_clamp);
+                        tp->rcv_ssthresh += min(room, incr);
                         inet_csk(sk)->icsk_ack.quick |= 1;
                 }
         }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0302e0eb07af..7178e32eb15d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2330,6 +2330,10 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
 
                 rcu_read_lock();
                 from = rcu_dereference(rt6->from);
+                if (!from) {
+                        rcu_read_unlock();
+                        return;
+                }
                 nrt6 = ip6_rt_cache_alloc(from, daddr, saddr);
                 if (nrt6) {
                         rt6_do_update_pmtu(nrt6, mtu);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index b444483cdb2b..622eeaf5732b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1047,6 +1047,8 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
 static int udpv6_pre_connect(struct sock *sk, struct sockaddr *uaddr,
                              int addr_len)
 {
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return -EINVAL;
         /* The following checks are replicated from __ip6_datagram_connect()
          * and intended to prevent BPF program called below from accessing
          * bytes that are out of the bound specified by user in addr_len.
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index b99e73a7e7e0..2017b7d780f5 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -320,14 +320,13 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
         struct llc_sap *sap;
         int rc = -EINVAL;
 
-        dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
-
         lock_sock(sk);
         if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
                 goto out;
         rc = -EAFNOSUPPORT;
         if (unlikely(addr->sllc_family != AF_LLC))
                 goto out;
+        dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
         rc = -ENODEV;
         rcu_read_lock();
         if (sk->sk_bound_dev_if) {
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 28d022a3eee3..ae4f0be3b393 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -1195,6 +1195,9 @@ static inline void drv_wake_tx_queue(struct ieee80211_local *local,
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif);
 
+        if (local->in_reconfig)
+                return;
+
         if (!check_sdata_in_driver(sdata))
                 return;
 
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 4700718e010f..37e372896230 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -167,8 +167,10 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                  * The driver doesn't know anything about VLAN interfaces.
                  * Hence, don't send GTKs for VLAN interfaces to the driver.
                  */
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                if (!(key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
+                        ret = 1;
                         goto out_unsupported;
+                }
         }
 
         ret = drv_set_key(key->local, SET_KEY, sdata,
@@ -213,11 +215,8 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                 /* all of these we can do in software - if driver can */
                 if (ret == 1)
                         return 0;
-                if (ieee80211_hw_check(&key->local->hw, SW_CRYPTO_CONTROL)) {
-                        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                                return 0;
+                if (ieee80211_hw_check(&key->local->hw, SW_CRYPTO_CONTROL))
                         return -EINVAL;
-                }
                 return 0;
         default:
                 return -EINVAL;
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 95eb5064fa91..b76a2aefa9ec 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -23,7 +23,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl, struct mesh_path *mpath);
 static u32 mesh_table_hash(const void *addr, u32 len, u32 seed)
 {
         /* Use last four bytes of hw addr as hash index */
-        return jhash_1word(*(u32 *)(addr+2), seed);
+        return jhash_1word(__get_unaligned_cpu32((u8 *)addr + 2), seed);
 }
 
 static const struct rhashtable_params mesh_rht_params = {
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 7f8d93401ce0..bf0b187f994e 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1568,7 +1568,15 @@ static void sta_ps_start(struct sta_info *sta)
                 return;
 
         for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
-                if (txq_has_queue(sta->sta.txq[tid]))
+                struct ieee80211_txq *txq = sta->sta.txq[tid];
+                struct txq_info *txqi = to_txq_info(txq);
+
+                spin_lock(&local->active_txq_lock[txq->ac]);
+                if (!list_empty(&txqi->schedule_order))
+                        list_del_init(&txqi->schedule_order);
+                spin_unlock(&local->active_txq_lock[txq->ac]);
+
+                if (txq_has_queue(txq))
                         set_bit(tid, &sta->txq_buffered_tids);
                 else
                         clear_bit(tid, &sta->txq_buffered_tids);
diff --git a/net/mac80211/trace_msg.h b/net/mac80211/trace_msg.h
index 366b9e6f043e..40141df09f25 100644
--- a/net/mac80211/trace_msg.h
+++ b/net/mac80211/trace_msg.h
@@ -1,4 +1,9 @@
 /* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Portions of this file
+ * Copyright (C) 2019 Intel Corporation
+ */
+
 #ifdef CONFIG_MAC80211_MESSAGE_TRACING
 
 #if !defined(__MAC80211_MSG_DRIVER_TRACE) || defined(TRACE_HEADER_MULTI_READ)
@@ -11,7 +16,7 @@
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM mac80211_msg
 
-#define MAX_MSG_LEN     100
+#define MAX_MSG_LEN     120
 
 DECLARE_EVENT_CLASS(mac80211_msg_event,
         TP_PROTO(struct va_format *vaf),
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8a49a74c0a37..2e816dd67be7 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3221,6 +3221,7 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         u8 max_subframes = sta->sta.max_amsdu_subframes;
         int max_frags = local->hw.max_tx_fragments;
         int max_amsdu_len = sta->sta.max_amsdu_len;
+        int orig_truesize;
         __be16 len;
         void *data;
         bool ret = false;
@@ -3261,6 +3262,7 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         if (!head || skb_is_gso(head))
                 goto out;
 
+        orig_truesize = head->truesize;
         orig_len = head->len;
 
         if (skb->len + head->len > max_amsdu_len)
@@ -3318,6 +3320,7 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
         *frag_tail = skb;
 
 out_recalc:
+        fq->memory_usage += head->truesize - orig_truesize;
         if (head->len != orig_len) {
                 flow->backlog += head->len - orig_len;
                 tin->backlog_bytes += head->len - orig_len;
@@ -3646,16 +3649,17 @@ EXPORT_SYMBOL(ieee80211_tx_dequeue);
 struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
 {
         struct ieee80211_local *local = hw_to_local(hw);
+        struct ieee80211_txq *ret = NULL;
         struct txq_info *txqi = NULL;
 
-        lockdep_assert_held(&local->active_txq_lock[ac]);
+        spin_lock_bh(&local->active_txq_lock[ac]);
 
  begin:
         txqi = list_first_entry_or_null(&local->active_txqs[ac],
                                         struct txq_info,
                                         schedule_order);
         if (!txqi)
-                return NULL;
+                goto out;
 
         if (txqi->txq.sta) {
                 struct sta_info *sta = container_of(txqi->txq.sta,
@@ -3672,24 +3676,30 @@ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
 
 
         if (txqi->schedule_round == local->schedule_round[ac])
-                return NULL;
+                goto out;
 
         list_del_init(&txqi->schedule_order);
         txqi->schedule_round = local->schedule_round[ac];
-        return &txqi->txq;
+        ret = &txqi->txq;
+
+out:
+        spin_unlock_bh(&local->active_txq_lock[ac]);
+        return ret;
 }
 EXPORT_SYMBOL(ieee80211_next_txq);
 
-void ieee80211_return_txq(struct ieee80211_hw *hw,
-                          struct ieee80211_txq *txq)
+void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
+                              struct ieee80211_txq *txq,
+                              bool force)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct txq_info *txqi = to_txq_info(txq);
 
-        lockdep_assert_held(&local->active_txq_lock[txq->ac]);
+        spin_lock_bh(&local->active_txq_lock[txq->ac]);
 
         if (list_empty(&txqi->schedule_order) &&
-            (!skb_queue_empty(&txqi->frags) || txqi->tin.backlog_packets)) {
+            (force || !skb_queue_empty(&txqi->frags) ||
+             txqi->tin.backlog_packets)) {
                 /* If airtime accounting is active, always enqueue STAs at the
                  * head of the list to ensure that they only get moved to the
                  * back by the airtime DRR scheduler once they have a negative
@@ -3706,20 +3716,10 @@ void ieee80211_return_txq(struct ieee80211_hw *hw,
                         list_add_tail(&txqi->schedule_order,
                                       &local->active_txqs[txq->ac]);
         }
-}
-EXPORT_SYMBOL(ieee80211_return_txq);
 
-void ieee80211_schedule_txq(struct ieee80211_hw *hw,
-                            struct ieee80211_txq *txq)
-        __acquires(txq_lock) __releases(txq_lock)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-
-        spin_lock_bh(&local->active_txq_lock[txq->ac]);
-        ieee80211_return_txq(hw, txq);
         spin_unlock_bh(&local->active_txq_lock[txq->ac]);
 }
-EXPORT_SYMBOL(ieee80211_schedule_txq);
+EXPORT_SYMBOL(__ieee80211_schedule_txq);
 
 bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
                                 struct ieee80211_txq *txq)
@@ -3729,7 +3729,7 @@ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
         struct sta_info *sta;
         u8 ac = txq->ac;
 
-        lockdep_assert_held(&local->active_txq_lock[ac]);
+        spin_lock_bh(&local->active_txq_lock[ac]);
 
         if (!txqi->txq.sta)
                 goto out;
@@ -3759,34 +3759,27 @@ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
 
         sta->airtime[ac].deficit += sta->airtime_weight;
         list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
+        spin_unlock_bh(&local->active_txq_lock[ac]);
 
         return false;
 out:
         if (!list_empty(&txqi->schedule_order))
                 list_del_init(&txqi->schedule_order);
+        spin_unlock_bh(&local->active_txq_lock[ac]);
 
         return true;
 }
 EXPORT_SYMBOL(ieee80211_txq_may_transmit);
 
 void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
-        __acquires(txq_lock)
 {
         struct ieee80211_local *local = hw_to_local(hw);
 
         spin_lock_bh(&local->active_txq_lock[ac]);
         local->schedule_round[ac]++;
-}
-EXPORT_SYMBOL(ieee80211_txq_schedule_start);
-
-void ieee80211_txq_schedule_end(struct ieee80211_hw *hw, u8 ac)
-        __releases(txq_lock)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-
         spin_unlock_bh(&local->active_txq_lock[ac]);
 }
-EXPORT_SYMBOL(ieee80211_txq_schedule_end);
+EXPORT_SYMBOL(ieee80211_txq_schedule_start);
 
 void __ieee80211_subif_start_xmit(struct sk_buff *skb,
                                   struct net_device *dev,
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index f28e937320a3..216ab915dd54 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -988,7 +988,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
         struct netlink_sock *nlk = nlk_sk(sk);
         struct sockaddr_nl *nladdr = (struct sockaddr_nl *)addr;
         int err = 0;
-        unsigned long groups = nladdr->nl_groups;
+        unsigned long groups;
         bool bound;
 
         if (addr_len < sizeof(struct sockaddr_nl))
@@ -996,6 +996,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
 
         if (nladdr->nl_family != AF_NETLINK)
                 return -EINVAL;
+        groups = nladdr->nl_groups;
 
         /* Only superuser is allowed to listen multicasts */
         if (groups) {
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 1d3144d19903..71ffd1a6dc7c 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1392,18 +1392,22 @@ static int __init nr_proto_init(void)
         int i;
         int rc = proto_register(&nr_proto, 0);
 
-        if (rc != 0)
-                goto out;
+        if (rc)
+                return rc;
 
         if (nr_ndevs > 0x7fffffff/sizeof(struct net_device *)) {
-                printk(KERN_ERR "NET/ROM: nr_proto_init - nr_ndevs parameter to large\n");
-                return -1;
+                pr_err("NET/ROM: %s - nr_ndevs parameter too large\n",
+                       __func__);
+                rc = -EINVAL;
+                goto unregister_proto;
         }
 
         dev_nr = kcalloc(nr_ndevs, sizeof(struct net_device *), GFP_KERNEL);
-        if (dev_nr == NULL) {
-                printk(KERN_ERR "NET/ROM: nr_proto_init - unable to allocate device array\n");
-                return -1;
+        if (!dev_nr) {
+                pr_err("NET/ROM: %s - unable to allocate device array\n",
+                       __func__);
+                rc = -ENOMEM;
+                goto unregister_proto;
         }
 
         for (i = 0; i < nr_ndevs; i++) {
@@ -1413,13 +1417,13 @@ static int __init nr_proto_init(void)
                 sprintf(name, "nr%d", i);
                 dev = alloc_netdev(0, name, NET_NAME_UNKNOWN, nr_setup);
                 if (!dev) {
-                        printk(KERN_ERR "NET/ROM: nr_proto_init - unable to allocate device structure\n");
+                        rc = -ENOMEM;
                         goto fail;
                 }
 
                 dev->base_addr = i;
-                if (register_netdev(dev)) {
-                        printk(KERN_ERR "NET/ROM: nr_proto_init - unable to register network device\n");
+                rc = register_netdev(dev);
+                if (rc) {
                         free_netdev(dev);
                         goto fail;
                 }
@@ -1427,36 +1431,64 @@ static int __init nr_proto_init(void)
                 dev_nr[i] = dev;
         }
 
-        if (sock_register(&nr_family_ops)) {
-                printk(KERN_ERR "NET/ROM: nr_proto_init - unable to register socket family\n");
+        rc = sock_register(&nr_family_ops);
+        if (rc)
                 goto fail;
-        }
 
-        register_netdevice_notifier(&nr_dev_notifier);
+        rc = register_netdevice_notifier(&nr_dev_notifier);
+        if (rc)
+                goto out_sock;
 
         ax25_register_pid(&nr_pid);
         ax25_linkfail_register(&nr_linkfail_notifier);
 
 #ifdef CONFIG_SYSCTL
-        nr_register_sysctl();
+        rc = nr_register_sysctl();
+        if (rc)
+                goto out_sysctl;
 #endif
 
         nr_loopback_init();
 
-        proc_create_seq("nr", 0444, init_net.proc_net, &nr_info_seqops);
-        proc_create_seq("nr_neigh", 0444, init_net.proc_net, &nr_neigh_seqops);
-        proc_create_seq("nr_nodes", 0444, init_net.proc_net, &nr_node_seqops);
-out:
-        return rc;
+        rc = -ENOMEM;
+        if (!proc_create_seq("nr", 0444, init_net.proc_net, &nr_info_seqops))
+                goto proc_remove1;
+        if (!proc_create_seq("nr_neigh", 0444, init_net.proc_net,
+                             &nr_neigh_seqops))
+                goto proc_remove2;
+        if (!proc_create_seq("nr_nodes", 0444, init_net.proc_net,
+                             &nr_node_seqops))
+                goto proc_remove3;
+
+        return 0;
+
+proc_remove3:
+        remove_proc_entry("nr_neigh", init_net.proc_net);
+proc_remove2:
+        remove_proc_entry("nr", init_net.proc_net);
+proc_remove1:
+
+        nr_loopback_clear();
+        nr_rt_free();
+
+#ifdef CONFIG_SYSCTL
+        nr_unregister_sysctl();
+out_sysctl:
+#endif
+        ax25_linkfail_release(&nr_linkfail_notifier);
+        ax25_protocol_release(AX25_P_NETROM);
+        unregister_netdevice_notifier(&nr_dev_notifier);
+out_sock:
+        sock_unregister(PF_NETROM);
 fail:
         while (--i >= 0) {
                 unregister_netdev(dev_nr[i]);
                 free_netdev(dev_nr[i]);
         }
         kfree(dev_nr);
+unregister_proto:
         proto_unregister(&nr_proto);
-        rc = -1;
-        goto out;
+        return rc;
 }
 
 module_init(nr_proto_init);
diff --git a/net/netrom/nr_loopback.c b/net/netrom/nr_loopback.c
index 215ad22a9647..93d13f019981 100644
--- a/net/netrom/nr_loopback.c
+++ b/net/netrom/nr_loopback.c
@@ -70,7 +70,7 @@ static void nr_loopback_timer(struct timer_list *unused)
         }
 }
 
-void __exit nr_loopback_clear(void)
+void nr_loopback_clear(void)
 {
         del_timer_sync(&loopback_timer);
         skb_queue_purge(&loopback_queue);
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 6485f593e2f0..b76aa668a94b 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -953,7 +953,7 @@ const struct seq_operations nr_neigh_seqops = {
 /*
  *      Free all memory associated with the nodes and routes lists.
  */
-void __exit nr_rt_free(void)
+void nr_rt_free(void)
 {
         struct nr_neigh *s = NULL;
         struct nr_node  *t = NULL;
diff --git a/net/netrom/sysctl_net_netrom.c b/net/netrom/sysctl_net_netrom.c
index ba1c368b3f18..771011b84270 100644
--- a/net/netrom/sysctl_net_netrom.c
+++ b/net/netrom/sysctl_net_netrom.c
@@ -146,9 +146,12 @@ static struct ctl_table nr_table[] = {
         { }
 };
 
-void __init nr_register_sysctl(void)
+int __init nr_register_sysctl(void)
 {
         nr_table_header = register_net_sysctl(&init_net, "net/netrom", nr_table);
+        if (!nr_table_header)
+                return -ENOMEM;
+        return 0;
 }
 
 void nr_unregister_sysctl(void)
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index d6cc97fbbbb0..2b969f99ef13 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -543,6 +543,9 @@ static int rds_connect(struct socket *sock, struct sockaddr *uaddr,
         struct rds_sock *rs = rds_sk_to_rs(sk);
         int ret = 0;
 
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return -EINVAL;
+
         lock_sock(sk);
 
         switch (uaddr->sa_family) {
diff --git a/net/rds/bind.c b/net/rds/bind.c
index 17c9d9f0c848..0f4398e7f2a7 100644
--- a/net/rds/bind.c
+++ b/net/rds/bind.c
@@ -173,6 +173,8 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         /* We allow an RDS socket to be bound to either IPv4 or IPv6
          * address.
          */
+        if (addr_len < offsetofend(struct sockaddr, sa_family))
+                return -EINVAL;
         if (uaddr->sa_family == AF_INET) {
                 struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;
 
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 96f2952bbdfd..ae8c5d7f3bf1 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -135,7 +135,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
         struct sockaddr_rxrpc *srx = (struct sockaddr_rxrpc *)saddr;
         struct rxrpc_local *local;
         struct rxrpc_sock *rx = rxrpc_sk(sock->sk);
-        u16 service_id = srx->srx_service;
+        u16 service_id;
         int ret;
 
         _enter("%p,%p,%d", rx, saddr, len);
@@ -143,6 +143,7 @@ static int rxrpc_bind(struct socket *sock, struct sockaddr *saddr, int len)
         ret = rxrpc_validate_address(rx, srx, len);
         if (ret < 0)
                 goto error;
+        service_id = srx->srx_service;
 
         lock_sock(&rx->sk);
 
@@ -370,18 +371,22 @@ EXPORT_SYMBOL(rxrpc_kernel_end_call);
  * rxrpc_kernel_check_life - Check to see whether a call is still alive
  * @sock: The socket the call is on
  * @call: The call to check
+ * @_life: Where to store the life value
  *
  * Allow a kernel service to find out whether a call is still alive - ie. we're
- * getting ACKs from the server.  Returns a number representing the life state
- * which can be compared to that returned by a previous call.
+ * getting ACKs from the server.  Passes back in *_life a number representing
+ * the life state which can be compared to that returned by a previous call and
+ * return true if the call is still alive.
  *
  * If the life state stalls, rxrpc_kernel_probe_life() should be called and
  * then 2RTT waited.
  */
-u32 rxrpc_kernel_check_life(const struct socket *sock,
-                            const struct rxrpc_call *call)
+bool rxrpc_kernel_check_life(const struct socket *sock,
+                             const struct rxrpc_call *call,
+                             u32 *_life)
 {
-        return call->acks_latest;
+        *_life = call->acks_latest;
+        return call->state != RXRPC_CALL_COMPLETE;
 }
 EXPORT_SYMBOL(rxrpc_kernel_check_life);
 
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 4b1a534d290a..062ca9dc29b8 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -654,6 +654,7 @@ struct rxrpc_call {
         u8                      ackr_reason;    /* reason to ACK */
         u16                     ackr_skew;      /* skew on packet being ACK'd */
         rxrpc_serial_t          ackr_serial;    /* serial of packet being ACK'd */
+        rxrpc_serial_t          ackr_first_seq; /* first sequence number received */
         rxrpc_seq_t             ackr_prev_seq;  /* previous sequence number received */
         rxrpc_seq_t             ackr_consumed;  /* Highest packet shown consumed */
         rxrpc_seq_t             ackr_seen;      /* Highest packet shown seen */
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index b6fca8ebb117..8d31fb4c51e1 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -153,7 +153,8 @@ static void rxrpc_conn_retransmit_call(struct rxrpc_connection *conn,
  * pass a connection-level abort onto all calls on that connection
  */
 static void rxrpc_abort_calls(struct rxrpc_connection *conn,
-                              enum rxrpc_call_completion compl)
+                              enum rxrpc_call_completion compl,
+                              rxrpc_serial_t serial)
 {
         struct rxrpc_call *call;
         int i;
@@ -173,6 +174,9 @@ static void rxrpc_abort_calls(struct rxrpc_connection *conn,
                                                   call->call_id, 0,
                                                   conn->abort_code,
                                                   conn->error);
+                        else
+                                trace_rxrpc_rx_abort(call, serial,
+                                                     conn->abort_code);
                         if (rxrpc_set_call_completion(call, compl,
                                                       conn->abort_code,
                                                       conn->error))
@@ -213,8 +217,6 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
         conn->state = RXRPC_CONN_LOCALLY_ABORTED;
         spin_unlock_bh(&conn->state_lock);
 
-        rxrpc_abort_calls(conn, RXRPC_CALL_LOCALLY_ABORTED);
-
         msg.msg_name    = &conn->params.peer->srx.transport;
         msg.msg_namelen = conn->params.peer->srx.transport_len;
         msg.msg_control = NULL;
@@ -242,6 +244,7 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
         len = iov[0].iov_len + iov[1].iov_len;
 
         serial = atomic_inc_return(&conn->serial);
+        rxrpc_abort_calls(conn, RXRPC_CALL_LOCALLY_ABORTED, serial);
         whdr.serial = htonl(serial);
         _proto("Tx CONN ABORT %%%u { %d }", serial, conn->abort_code);
 
@@ -321,7 +324,7 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
                 conn->error = -ECONNABORTED;
                 conn->abort_code = abort_code;
                 conn->state = RXRPC_CONN_REMOTELY_ABORTED;
-                rxrpc_abort_calls(conn, RXRPC_CALL_REMOTELY_ABORTED);
+                rxrpc_abort_calls(conn, RXRPC_CALL_REMOTELY_ABORTED, sp->hdr.serial);
                 return -ECONNABORTED;
 
         case RXRPC_PACKET_TYPE_CHALLENGE:
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 9128aa0e40aa..4c6f9d0a00e7 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -837,7 +837,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
                 u8 acks[RXRPC_MAXACKS];
         } buf;
         rxrpc_serial_t acked_serial;
-        rxrpc_seq_t first_soft_ack, hard_ack;
+        rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt;
         int nr_acks, offset, ioffset;
 
         _enter("");
@@ -851,13 +851,14 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
 
         acked_serial = ntohl(buf.ack.serial);
         first_soft_ack = ntohl(buf.ack.firstPacket);
+        prev_pkt = ntohl(buf.ack.previousPacket);
         hard_ack = first_soft_ack - 1;
         nr_acks = buf.ack.nAcks;
         summary.ack_reason = (buf.ack.reason < RXRPC_ACK__INVALID ?
                               buf.ack.reason : RXRPC_ACK__INVALID);
 
         trace_rxrpc_rx_ack(call, sp->hdr.serial, acked_serial,
-                           first_soft_ack, ntohl(buf.ack.previousPacket),
+                           first_soft_ack, prev_pkt,
                            summary.ack_reason, nr_acks);
 
         if (buf.ack.reason == RXRPC_ACK_PING_RESPONSE)
@@ -878,8 +879,9 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
                                   rxrpc_propose_ack_respond_to_ack);
         }
 
-        /* Discard any out-of-order or duplicate ACKs. */
-        if (before_eq(sp->hdr.serial, call->acks_latest))
+        /* Discard any out-of-order or duplicate ACKs (outside lock). */
+        if (before(first_soft_ack, call->ackr_first_seq) ||
+            before(prev_pkt, call->ackr_prev_seq))
                 return;
 
         buf.info.rxMTU = 0;
@@ -890,12 +892,16 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb,
 
         spin_lock(&call->input_lock);
 
-        /* Discard any out-of-order or duplicate ACKs. */
-        if (before_eq(sp->hdr.serial, call->acks_latest))
+        /* Discard any out-of-order or duplicate ACKs (inside lock). */
+        if (before(first_soft_ack, call->ackr_first_seq) ||
+            before(prev_pkt, call->ackr_prev_seq))
                 goto out;
         call->acks_latest_ts = skb->tstamp;
         call->acks_latest = sp->hdr.serial;
 
+        call->ackr_first_seq = first_soft_ack;
+        call->ackr_prev_seq = prev_pkt;
+
         /* Parse rwind and mtu sizes if provided. */
         if (buf.info.rxMTU)
                 rxrpc_input_ackinfo(call, skb, &buf.info);
diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
index bc05af89fc38..6e84d878053c 100644
--- a/net/rxrpc/peer_event.c
+++ b/net/rxrpc/peer_event.c
@@ -157,6 +157,11 @@ void rxrpc_error_report(struct sock *sk)
 
         _enter("%p{%d}", sk, local->debug_id);
 
+        /* Clear the outstanding error value on the socket so that it doesn't
+         * cause kernel_sendmsg() to return it later.
+         */
+        sock_error(sk);
+
         skb = sock_dequeue_err_skb(sk);
         if (!skb) {
                 _leave("UDP socket errqueue empty");
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 46c9312085b1..bec64deb7b0a 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -152,12 +152,13 @@ static void rxrpc_notify_end_tx(struct rxrpc_sock *rx, struct rxrpc_call *call,
 }
 
 /*
- * Queue a DATA packet for transmission, set the resend timeout and send the
- * packet immediately
+ * Queue a DATA packet for transmission, set the resend timeout and send
+ * the packet immediately.  Returns the error from rxrpc_send_data_packet()
+ * in case the caller wants to do something with it.
  */
-static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
-                               struct sk_buff *skb, bool last,
-                               rxrpc_notify_end_tx_t notify_end_tx)
+static int rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
+                              struct sk_buff *skb, bool last,
+                              rxrpc_notify_end_tx_t notify_end_tx)
 {
         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
         unsigned long now;
@@ -250,7 +251,8 @@ static void rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
 
 out:
         rxrpc_free_skb(skb, rxrpc_skb_tx_freed);
-        _leave("");
+        _leave(" = %d", ret);
+        return ret;
 }
 
 /*
@@ -423,9 +425,10 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
                         if (ret < 0)
                                 goto out;
 
-                        rxrpc_queue_packet(rx, call, skb,
-                                           !msg_data_left(msg) && !more,
-                                           notify_end_tx);
+                        ret = rxrpc_queue_packet(rx, call, skb,
+                                                 !msg_data_left(msg) && !more,
+                                                 notify_end_tx);
+                        /* Should check for failure here */
                         skb = NULL;
                 }
         } while (msg_data_left(msg) > 0);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9874e60c9b0d..4583fa914e62 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4847,7 +4847,8 @@ static int sctp_connect(struct sock *sk, struct sockaddr *addr,
         }
 
         /* Validate addr_len before calling common connect/connectx routine. */
-        af = sctp_get_af_specific(addr->sa_family);
+        af = addr_len < offsetofend(struct sockaddr, sa_family) ? NULL :
+                sctp_get_af_specific(addr->sa_family);
         if (!af || addr_len < af->sockaddr_len) {
                 err = -EINVAL;
         } else {
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 77ef53596d18..6f869ef49b32 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -167,10 +167,9 @@ static int smc_release(struct socket *sock)
 
         if (sk->sk_state == SMC_CLOSED) {
                 if (smc->clcsock) {
-                        mutex_lock(&smc->clcsock_release_lock);
-                        sock_release(smc->clcsock);
-                        smc->clcsock = NULL;
-                        mutex_unlock(&smc->clcsock_release_lock);
+                        release_sock(sk);
+                        smc_clcsock_release(smc);
+                        lock_sock(sk);
                 }
                 if (!smc->use_fallback)
                         smc_conn_free(&smc->conn);
@@ -446,10 +445,19 @@ static void smc_link_save_peer_info(struct smc_link *link,
         link->peer_mtu = clc->qp_mtu;
 }
 
+static void smc_switch_to_fallback(struct smc_sock *smc)
+{
+        smc->use_fallback = true;
+        if (smc->sk.sk_socket && smc->sk.sk_socket->file) {
+                smc->clcsock->file = smc->sk.sk_socket->file;
+                smc->clcsock->file->private_data = smc->clcsock;
+        }
+}
+
 /* fall back during connect */
 static int smc_connect_fallback(struct smc_sock *smc, int reason_code)
 {
-        smc->use_fallback = true;
+        smc_switch_to_fallback(smc);
         smc->fallback_rsn = reason_code;
         smc_copy_sock_settings_to_clc(smc);
         if (smc->sk.sk_state == SMC_INIT)
@@ -775,10 +783,14 @@ static void smc_connect_work(struct work_struct *work)
                 smc->sk.sk_err = -rc;
 
 out:
-        if (smc->sk.sk_err)
-                smc->sk.sk_state_change(&smc->sk);
-        else
-                smc->sk.sk_write_space(&smc->sk);
+        if (!sock_flag(&smc->sk, SOCK_DEAD)) {
+                if (smc->sk.sk_err) {
+                        smc->sk.sk_state_change(&smc->sk);
+                } else { /* allow polling before and after fallback decision */
+                        smc->clcsock->sk->sk_write_space(smc->clcsock->sk);
+                        smc->sk.sk_write_space(&smc->sk);
+                }
+        }
         kfree(smc->connect_info);
         smc->connect_info = NULL;
         release_sock(&smc->sk);
@@ -872,11 +884,11 @@ static int smc_clcsock_accept(struct smc_sock *lsmc, struct smc_sock **new_smc)
         if  (rc < 0)
                 lsk->sk_err = -rc;
         if (rc < 0 || lsk->sk_state == SMC_CLOSED) {
+                new_sk->sk_prot->unhash(new_sk);
                 if (new_clcsock)
                         sock_release(new_clcsock);
                 new_sk->sk_state = SMC_CLOSED;
                 sock_set_flag(new_sk, SOCK_DEAD);
-                new_sk->sk_prot->unhash(new_sk);
                 sock_put(new_sk); /* final */
                 *new_smc = NULL;
                 goto out;
@@ -927,16 +939,21 @@ struct sock *smc_accept_dequeue(struct sock *parent,
 
                 smc_accept_unlink(new_sk);
                 if (new_sk->sk_state == SMC_CLOSED) {
+                        new_sk->sk_prot->unhash(new_sk);
                         if (isk->clcsock) {
                                 sock_release(isk->clcsock);
                                 isk->clcsock = NULL;
                         }
-                        new_sk->sk_prot->unhash(new_sk);
                         sock_put(new_sk); /* final */
                         continue;
                 }
-                if (new_sock)
+                if (new_sock) {
                         sock_graft(new_sk, new_sock);
+                        if (isk->use_fallback) {
+                                smc_sk(new_sk)->clcsock->file = new_sock->file;
+                                isk->clcsock->file->private_data = isk->clcsock;
+                        }
+                }
                 return new_sk;
         }
         return NULL;
@@ -956,6 +973,7 @@ void smc_close_non_accepted(struct sock *sk)
                 sock_set_flag(sk, SOCK_DEAD);
                 sk->sk_shutdown |= SHUTDOWN_MASK;
         }
+        sk->sk_prot->unhash(sk);
         if (smc->clcsock) {
                 struct socket *tcp;
 
@@ -971,7 +989,6 @@ void smc_close_non_accepted(struct sock *sk)
                         smc_conn_free(&smc->conn);
         }
         release_sock(sk);
-        sk->sk_prot->unhash(sk);
         sock_put(sk); /* final sock_put */
 }
 
@@ -1037,13 +1054,13 @@ static void smc_listen_out(struct smc_sock *new_smc)
         struct smc_sock *lsmc = new_smc->listen_smc;
         struct sock *newsmcsk = &new_smc->sk;
 
-        lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);
         if (lsmc->sk.sk_state == SMC_LISTEN) {
+                lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);
                 smc_accept_enqueue(&lsmc->sk, newsmcsk);
+                release_sock(&lsmc->sk);
         } else { /* no longer listening */
                 smc_close_non_accepted(newsmcsk);
         }
-        release_sock(&lsmc->sk);
 
         /* Wake up accept */
         lsmc->sk.sk_data_ready(&lsmc->sk);
@@ -1087,7 +1104,7 @@ static void smc_listen_decline(struct smc_sock *new_smc, int reason_code,
                 return;
         }
         smc_conn_free(&new_smc->conn);
-        new_smc->use_fallback = true;
+        smc_switch_to_fallback(new_smc);
         new_smc->fallback_rsn = reason_code;
         if (reason_code && reason_code != SMC_CLC_DECL_PEERDECL) {
                 if (smc_clc_send_decline(new_smc, reason_code) < 0) {
@@ -1237,6 +1254,9 @@ static void smc_listen_work(struct work_struct *work)
         int rc = 0;
         u8 ibport;
 
+        if (new_smc->listen_smc->sk.sk_state != SMC_LISTEN)
+                return smc_listen_out_err(new_smc);
+
         if (new_smc->use_fallback) {
                 smc_listen_out_connected(new_smc);
                 return;
@@ -1244,7 +1264,7 @@ static void smc_listen_work(struct work_struct *work)
 
         /* check if peer is smc capable */
         if (!tcp_sk(newclcsock->sk)->syn_smc) {
-                new_smc->use_fallback = true;
+                smc_switch_to_fallback(new_smc);
                 new_smc->fallback_rsn = SMC_CLC_DECL_PEERNOSMC;
                 smc_listen_out_connected(new_smc);
                 return;
@@ -1501,7 +1521,7 @@ static int smc_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 
         if (msg->msg_flags & MSG_FASTOPEN) {
                 if (sk->sk_state == SMC_INIT) {
-                        smc->use_fallback = true;
+                        smc_switch_to_fallback(smc);
                         smc->fallback_rsn = SMC_CLC_DECL_OPTUNSUPP;
                 } else {
                         rc = -EINVAL;
@@ -1703,7 +1723,7 @@ static int smc_setsockopt(struct socket *sock, int level, int optname,
         case TCP_FASTOPEN_NO_COOKIE:
                 /* option not supported by SMC */
                 if (sk->sk_state == SMC_INIT) {
-                        smc->use_fallback = true;
+                        smc_switch_to_fallback(smc);
                         smc->fallback_rsn = SMC_CLC_DECL_OPTUNSUPP;
                 } else {
                         if (!smc->use_fallback)
diff --git a/net/smc/smc_close.c b/net/smc/smc_close.c
index 2ad37e998509..fc06720b53c1 100644
--- a/net/smc/smc_close.c
+++ b/net/smc/smc_close.c
@@ -21,6 +21,22 @@
 
 #define SMC_CLOSE_WAIT_LISTEN_CLCSOCK_TIME      (5 * HZ)
 
+/* release the clcsock that is assigned to the smc_sock */
+void smc_clcsock_release(struct smc_sock *smc)
+{
+        struct socket *tcp;
+
+        if (smc->listen_smc && current_work() != &smc->smc_listen_work)
+                cancel_work_sync(&smc->smc_listen_work);
+        mutex_lock(&smc->clcsock_release_lock);
+        if (smc->clcsock) {
+                tcp = smc->clcsock;
+                smc->clcsock = NULL;
+                sock_release(tcp);
+        }
+        mutex_unlock(&smc->clcsock_release_lock);
+}
+
 static void smc_close_cleanup_listen(struct sock *parent)
 {
         struct sock *sk;
@@ -321,6 +337,7 @@ static void smc_close_passive_work(struct work_struct *work)
                                                    close_work);
         struct smc_sock *smc = container_of(conn, struct smc_sock, conn);
         struct smc_cdc_conn_state_flags *rxflags;
+        bool release_clcsock = false;
         struct sock *sk = &smc->sk;
         int old_state;
 
@@ -400,13 +417,13 @@ wakeup:
                 if ((sk->sk_state == SMC_CLOSED) &&
                     (sock_flag(sk, SOCK_DEAD) || !sk->sk_socket)) {
                         smc_conn_free(conn);
-                        if (smc->clcsock) {
-                                sock_release(smc->clcsock);
-                                smc->clcsock = NULL;
-                        }
+                        if (smc->clcsock)
+                                release_clcsock = true;
                 }
         }
         release_sock(sk);
+        if (release_clcsock)
+                smc_clcsock_release(smc);
         sock_put(sk); /* sock_hold done by schedulers of close_work */
 }
 
diff --git a/net/smc/smc_close.h b/net/smc/smc_close.h
index 19eb6a211c23..e0e3b5df25d2 100644
--- a/net/smc/smc_close.h
+++ b/net/smc/smc_close.h
@@ -23,5 +23,6 @@ void smc_close_wake_tx_prepared(struct smc_sock *smc);
 int smc_close_active(struct smc_sock *smc);
 int smc_close_shutdown_write(struct smc_sock *smc);
 void smc_close_init(struct smc_sock *smc);
+void smc_clcsock_release(struct smc_sock *smc);
 
 #endif /* SMC_CLOSE_H */
diff --git a/net/smc/smc_ism.c b/net/smc/smc_ism.c
index 2fff79db1a59..e89e918b88e0 100644
--- a/net/smc/smc_ism.c
+++ b/net/smc/smc_ism.c
@@ -289,6 +289,11 @@ struct smcd_dev *smcd_alloc_dev(struct device *parent, const char *name,
         INIT_LIST_HEAD(&smcd->vlan);
         smcd->event_wq = alloc_ordered_workqueue("ism_evt_wq-%s)",
                                                  WQ_MEM_RECLAIM, name);
+        if (!smcd->event_wq) {
+                kfree(smcd->conn);
+                kfree(smcd);
+                return NULL;
+        }
         return smcd;
 }
 EXPORT_SYMBOL_GPL(smcd_alloc_dev);
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
index 8d2f6296279c..0285c7f9e79b 100644
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
@@ -603,7 +603,8 @@ static int smc_pnet_flush(struct sk_buff *skb, struct genl_info *info)
 {
         struct net *net = genl_info_net(info);
 
-        return smc_pnet_remove_by_pnetid(net, NULL);
+        smc_pnet_remove_by_pnetid(net, NULL);
+        return 0;
 }
 
 /* SMC_PNETID generic netlink operation definition */
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index 860dcfb95ee4..fa6c977b4c41 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -140,13 +140,11 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
                         /* We are going to append to the frags_list of head.
                          * Need to unshare the frag_list.
                          */
-                        if (skb_has_frag_list(head)) {
-                                err = skb_unclone(head, GFP_ATOMIC);
-                                if (err) {
-                                        STRP_STATS_INCR(strp->stats.mem_fail);
-                                        desc->error = err;
-                                        return 0;
-                                }
+                        err = skb_unclone(head, GFP_ATOMIC);
+                        if (err) {
+                                STRP_STATS_INCR(strp->stats.mem_fail);
+                                desc->error = err;
+                                return 0;
                         }
 
                         if (unlikely(skb_shinfo(head)->frag_list)) {
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 341ecd796aa4..131aa2f0fd27 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -869,6 +869,8 @@ void tipc_link_reset(struct tipc_link *l)
         __skb_queue_head_init(&list);
 
         l->in_session = false;
+        /* Force re-synch of peer session number before establishing */
+        l->peer_session--;
         l->session++;
         l->mtu = l->advertised_mtu;
 
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index bff241f03525..89993afe0fbd 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -909,7 +909,8 @@ static int tipc_nl_service_list(struct net *net, struct tipc_nl_msg *msg,
         for (; i < TIPC_NAMETBL_SIZE; i++) {
                 head = &tn->nametbl->services[i];
 
-                if (*last_type) {
+                if (*last_type ||
+                    (!i && *last_key && (*last_lower == *last_key))) {
                         service = tipc_service_find(net, *last_type);
                         if (!service)
                                 return -EPIPE;
diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
index 3481e4906bd6..9df82a573aa7 100644
--- a/net/tipc/sysctl.c
+++ b/net/tipc/sysctl.c
@@ -38,6 +38,8 @@
 
 #include <linux/sysctl.h>
 
+static int zero;
+static int one = 1;
 static struct ctl_table_header *tipc_ctl_hdr;
 
 static struct ctl_table tipc_table[] = {
@@ -46,14 +48,16 @@ static struct ctl_table tipc_table[] = {
                 .data           = &sysctl_tipc_rmem,
                 .maxlen         = sizeof(sysctl_tipc_rmem),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
         },
         {
                 .procname       = "named_timeout",
                 .data           = &sysctl_tipc_named_timeout,
                 .maxlen         = sizeof(sysctl_tipc_named_timeout),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
         },
         {
                 .procname       = "sk_filter",
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index 135a7ee9db03..9f3bdbc1e593 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -52,8 +52,11 @@ static DEFINE_SPINLOCK(tls_device_lock);
 
 static void tls_device_free_ctx(struct tls_context *ctx)
 {
-        if (ctx->tx_conf == TLS_HW)
+        if (ctx->tx_conf == TLS_HW) {
                 kfree(tls_offload_ctx_tx(ctx));
+                kfree(ctx->tx.rec_seq);
+                kfree(ctx->tx.iv);
+        }
 
         if (ctx->rx_conf == TLS_HW)
                 kfree(tls_offload_ctx_rx(ctx));
@@ -216,6 +219,13 @@ void tls_device_sk_destruct(struct sock *sk)
 }
 EXPORT_SYMBOL(tls_device_sk_destruct);
 
+void tls_device_free_resources_tx(struct sock *sk)
+{
+        struct tls_context *tls_ctx = tls_get_ctx(sk);
+
+        tls_free_partial_record(sk, tls_ctx);
+}
+
 static void tls_append_frag(struct tls_record_info *record,
                             struct page_frag *pfrag,
                             int size)
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index df921a2904b9..9547cea0ce3b 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -208,6 +208,26 @@ int tls_push_partial_record(struct sock *sk, struct tls_context *ctx,
         return tls_push_sg(sk, ctx, sg, offset, flags);
 }
 
+bool tls_free_partial_record(struct sock *sk, struct tls_context *ctx)
+{
+        struct scatterlist *sg;
+
+        sg = ctx->partially_sent_record;
+        if (!sg)
+                return false;
+
+        while (1) {
+                put_page(sg_page(sg));
+                sk_mem_uncharge(sk, sg->length);
+
+                if (sg_is_last(sg))
+                        break;
+                sg++;
+        }
+        ctx->partially_sent_record = NULL;
+        return true;
+}
+
 static void tls_write_space(struct sock *sk)
 {
         struct tls_context *ctx = tls_get_ctx(sk);
@@ -267,6 +287,10 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
                 kfree(ctx->tx.rec_seq);
                 kfree(ctx->tx.iv);
                 tls_sw_free_resources_tx(sk);
+#ifdef CONFIG_TLS_DEVICE
+        } else if (ctx->tx_conf == TLS_HW) {
+                tls_device_free_resources_tx(sk);
+#endif
         }
 
         if (ctx->rx_conf == TLS_SW) {
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 20b191227969..b50ced862f6f 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -2052,20 +2052,7 @@ void tls_sw_free_resources_tx(struct sock *sk)
         /* Free up un-sent records in tx_list. First, free
          * the partially sent record if any at head of tx_list.
          */
-        if (tls_ctx->partially_sent_record) {
-                struct scatterlist *sg = tls_ctx->partially_sent_record;
-
-                while (1) {
-                        put_page(sg_page(sg));
-                        sk_mem_uncharge(sk, sg->length);
-
-                        if (sg_is_last(sg))
-                                break;
-                        sg++;
-                }
-
-                tls_ctx->partially_sent_record = NULL;
-
+        if (tls_free_partial_record(sk, tls_ctx)) {
                 rec = list_first_entry(&ctx->tx_list,
                                        struct tls_rec, list);
                 list_del(&rec->list);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 25a9e3b5c154..47e30a58566c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -13650,7 +13650,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_UNS_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_DEAUTHENTICATE,
@@ -13701,7 +13702,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_UNS_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
@@ -13709,7 +13711,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_DISCONNECT,
@@ -13738,7 +13741,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_UNS_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_DEL_PMKSA,
@@ -14090,7 +14094,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_UNS_ADMIN_PERM,
                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_SET_QOS_MAP,
@@ -14145,7 +14150,8 @@ static const struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_set_pmk,
                 .policy = nl80211_policy,
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
-                                  NL80211_FLAG_NEED_RTNL,
+                                  NL80211_FLAG_NEED_RTNL |
+                                  NL80211_FLAG_CLEAR_SKB,
         },
         {
                 .cmd = NL80211_CMD_DEL_PMK,
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 2f1bf91eb226..0ba778f371cb 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1309,6 +1309,16 @@ reg_intersect_dfs_region(const enum nl80211_dfs_regions dfs_region1,
         return dfs_region1;
 }
 
+static void reg_wmm_rules_intersect(const struct ieee80211_wmm_ac *wmm_ac1,
+                                    const struct ieee80211_wmm_ac *wmm_ac2,
+                                    struct ieee80211_wmm_ac *intersect)
+{
+        intersect->cw_min = max_t(u16, wmm_ac1->cw_min, wmm_ac2->cw_min);
+        intersect->cw_max = max_t(u16, wmm_ac1->cw_max, wmm_ac2->cw_max);
+        intersect->cot = min_t(u16, wmm_ac1->cot, wmm_ac2->cot);
+        intersect->aifsn = max_t(u8, wmm_ac1->aifsn, wmm_ac2->aifsn);
+}
+
 /*
  * Helper for regdom_intersect(), this does the real
  * mathematical intersection fun
@@ -1323,6 +1333,8 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
         struct ieee80211_freq_range *freq_range;
         const struct ieee80211_power_rule *power_rule1, *power_rule2;
         struct ieee80211_power_rule *power_rule;
+        const struct ieee80211_wmm_rule *wmm_rule1, *wmm_rule2;
+        struct ieee80211_wmm_rule *wmm_rule;
         u32 freq_diff, max_bandwidth1, max_bandwidth2;
 
         freq_range1 = &rule1->freq_range;
@@ -1333,6 +1345,10 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
         power_rule2 = &rule2->power_rule;
         power_rule = &intersected_rule->power_rule;
 
+        wmm_rule1 = &rule1->wmm_rule;
+        wmm_rule2 = &rule2->wmm_rule;
+        wmm_rule = &intersected_rule->wmm_rule;
+
         freq_range->start_freq_khz = max(freq_range1->start_freq_khz,
                                          freq_range2->start_freq_khz);
         freq_range->end_freq_khz = min(freq_range1->end_freq_khz,
@@ -1376,6 +1392,29 @@ static int reg_rules_intersect(const struct ieee80211_regdomain *rd1,
         intersected_rule->dfs_cac_ms = max(rule1->dfs_cac_ms,
                                            rule2->dfs_cac_ms);
 
+        if (rule1->has_wmm && rule2->has_wmm) {
+                u8 ac;
+
+                for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+                        reg_wmm_rules_intersect(&wmm_rule1->client[ac],
+                                                &wmm_rule2->client[ac],
+                                                &wmm_rule->client[ac]);
+                        reg_wmm_rules_intersect(&wmm_rule1->ap[ac],
+                                                &wmm_rule2->ap[ac],
+                                                &wmm_rule->ap[ac]);
+                }
+
+                intersected_rule->has_wmm = true;
+        } else if (rule1->has_wmm) {
+                *wmm_rule = *wmm_rule1;
+                intersected_rule->has_wmm = true;
+        } else if (rule2->has_wmm) {
+                *wmm_rule = *wmm_rule2;
+                intersected_rule->has_wmm = true;
+        } else {
+                intersected_rule->has_wmm = false;
+        }
+
         if (!is_valid_reg_rule(intersected_rule))
                 return -EINVAL;
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 287518c6caa4..04d888628f29 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -190,10 +190,9 @@ static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen,
         /* copy subelement as we need to change its content to
          * mark an ie after it is processed.
          */
-        sub_copy = kmalloc(subie_len, gfp);
+        sub_copy = kmemdup(subelement, subie_len, gfp);
         if (!sub_copy)
                 return 0;
-        memcpy(sub_copy, subelement, subie_len);
 
         pos = &new_ie[0];
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index e4b8db5e81ec..75899b62bdc9 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1220,9 +1220,11 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)
         else if (rate->bw == RATE_INFO_BW_HE_RU &&
                  rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_26)
                 result = rates_26[rate->he_gi];
-        else if (WARN(1, "invalid HE MCS: bw:%d, ru:%d\n",
-                      rate->bw, rate->he_ru_alloc))
+        else {
+                WARN(1, "invalid HE MCS: bw:%d, ru:%d\n",
+                     rate->bw, rate->he_ru_alloc);
                 return 0;
+        }
 
         /* now scale to the appropriate MCS */
         tmp = result;