29 files changed, 143 insertions, 71 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index a5aa1c7444e6..559a91271f82 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7149,16 +7149,19 @@ int dev_change_tx_queue_len(struct net_device *dev, unsigned long new_len)
                 dev->tx_queue_len = new_len;
                 res = call_netdevice_notifiers(NETDEV_CHANGE_TX_QUEUE_LEN, dev);
                 res = notifier_to_errno(res);
-                if (res) {
-                        netdev_err(dev,
-                                   "refused to change device tx_queue_len\n");
-                        dev->tx_queue_len = orig_len;
-                        return res;
-                }
-                return dev_qdisc_change_tx_queue_len(dev);
+                if (res)
+                        goto err_rollback;
+                res = dev_qdisc_change_tx_queue_len(dev);
+                if (res)
+                        goto err_rollback;
         }
 
         return 0;
+
+err_rollback:
+        netdev_err(dev, "refused to change device tx_queue_len\n");
+        dev->tx_queue_len = orig_len;
+        return res;
 }
 
 /**
diff --git a/net/core/filter.c b/net/core/filter.c
index 06da770f543f..9dfd145eedcc 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1712,24 +1712,26 @@ static const struct bpf_func_proto bpf_skb_load_bytes_proto = {
 BPF_CALL_5(bpf_skb_load_bytes_relative, const struct sk_buff *, skb,
            u32, offset, void *, to, u32, len, u32, start_header)
 {
+        u8 *end = skb_tail_pointer(skb);
+        u8 *net = skb_network_header(skb);
+        u8 *mac = skb_mac_header(skb);
         u8 *ptr;
 
-        if (unlikely(offset > 0xffff || len > skb_headlen(skb)))
+        if (unlikely(offset > 0xffff || len > (end - mac)))
                 goto err_clear;
 
         switch (start_header) {
         case BPF_HDR_START_MAC:
-                ptr = skb_mac_header(skb) + offset;
+                ptr = mac + offset;
                 break;
         case BPF_HDR_START_NET:
-                ptr = skb_network_header(skb) + offset;
+                ptr = net + offset;
                 break;
         default:
                 goto err_clear;
         }
 
-        if (likely(ptr >= skb_mac_header(skb) &&
-                   ptr + len <= skb_tail_pointer(skb))) {
+        if (likely(ptr >= mac && ptr + len <= end)) {
                 memcpy(to, ptr, len);
                 return 0;
         }
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index e7e626fb87bb..e45098593dc0 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -217,7 +217,7 @@ static int bpf_parse_prog(struct nlattr *attr, struct bpf_lwt_prog *prog,
         if (!tb[LWT_BPF_PROG_FD] || !tb[LWT_BPF_PROG_NAME])
                 return -EINVAL;
 
-        prog->name = nla_memdup(tb[LWT_BPF_PROG_NAME], GFP_KERNEL);
+        prog->name = nla_memdup(tb[LWT_BPF_PROG_NAME], GFP_ATOMIC);
         if (!prog->name)
                 return -ENOMEM;
 
diff --git a/net/core/xdp.c b/net/core/xdp.c
index 9d1f22072d5d..6771f1855b96 100644
--- a/net/core/xdp.c
+++ b/net/core/xdp.c
@@ -345,7 +345,8 @@ static void __xdp_return(void *data, struct xdp_mem_info *mem, bool napi_direct,
                 rcu_read_lock();
                 /* mem->id is valid, checked in xdp_rxq_info_reg_mem_model() */
                 xa = rhashtable_lookup(mem_id_ht, &mem->id, mem_id_rht_params);
-                xa->zc_alloc->free(xa->zc_alloc, handle);
+                if (!WARN_ON_ONCE(!xa))
+                        xa->zc_alloc->free(xa->zc_alloc, handle);
                 rcu_read_unlock();
         default:
                 /* Not possible, checked in xdp_rxq_info_reg_mem_model() */
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 1e3b6a6d8a40..732369c80644 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1248,6 +1248,9 @@ int dsa_slave_suspend(struct net_device *slave_dev)
 {
         struct dsa_port *dp = dsa_slave_to_port(slave_dev);
 
+        if (!netif_running(slave_dev))
+                return 0;
+
         netif_device_detach(slave_dev);
 
         rtnl_lock();
@@ -1261,6 +1264,9 @@ int dsa_slave_resume(struct net_device *slave_dev)
 {
         struct dsa_port *dp = dsa_slave_to_port(slave_dev);
 
+        if (!netif_running(slave_dev))
+                return 0;
+
         netif_device_attach(slave_dev);
 
         rtnl_lock();
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index e46cdd310e5f..2998b0e47d4b 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -292,19 +292,19 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
                 return ip_hdr(skb)->daddr;
 
         in_dev = __in_dev_get_rcu(dev);
-        BUG_ON(!in_dev);
 
         net = dev_net(dev);
 
         scope = RT_SCOPE_UNIVERSE;
         if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
+                bool vmark = in_dev && IN_DEV_SRC_VMARK(in_dev);
                 struct flowi4 fl4 = {
                         .flowi4_iif = LOOPBACK_IFINDEX,
                         .flowi4_oif = l3mdev_master_ifindex_rcu(dev),
                         .daddr = ip_hdr(skb)->saddr,
                         .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
                         .flowi4_scope = scope,
-                        .flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0,
+                        .flowi4_mark = vmark ? skb->mark : 0,
                 };
                 if (!fib_lookup(net, &fl4, &res, 0))
                         return FIB_RES_PREFSRC(net, res);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 28fef7d15959..75151be21413 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1387,7 +1387,8 @@ static void ip_mc_hash_remove(struct in_device *in_dev,
 /*
  *      A socket has joined a multicast group on device dev.
  */
-void __ip_mc_inc_group(struct in_device *in_dev, __be32 addr, unsigned int mode)
+static void __ip_mc_inc_group(struct in_device *in_dev, __be32 addr,
+                              unsigned int mode)
 {
         struct ip_mc_list *im;
 #ifdef CONFIG_IP_MULTICAST
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 1e4cf3ab560f..0d70608cc2e1 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -157,9 +157,6 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
 {
         struct inet_frag_queue *q;
 
-        if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh)
-                return NULL;
-
         q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC);
         if (!q)
                 return NULL;
@@ -204,6 +201,9 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key)
 {
         struct inet_frag_queue *fq;
 
+        if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh)
+                return NULL;
+
         rcu_read_lock();
 
         fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 8e9528ebaa8e..d14d741fb05e 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -383,11 +383,16 @@ found:
                 int i = end - next->ip_defrag_offset; /* overlap is 'i' bytes */
 
                 if (i < next->len) {
+                        int delta = -next->truesize;
+
                         /* Eat head of the next overlapped fragment
                          * and leave the loop. The next ones cannot overlap.
                          */
                         if (!pskb_pull(next, i))
                                 goto err;
+                        delta += next->truesize;
+                        if (delta)
+                                add_frag_mem_limit(qp->q.net, delta);
                         next->ip_defrag_offset += i;
                         qp->q.meat -= i;
                         if (next->ip_summed != CHECKSUM_UNNECESSARY)
diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
index 58e2f479ffb4..4bfff3c87e8e 100644
--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -354,6 +354,10 @@ static u32 bbr_target_cwnd(struct sock *sk, u32 bw, int gain)
         /* Reduce delayed ACKs by rounding up cwnd to the next even number. */
         cwnd = (cwnd + 1) & ~1U;
 
+        /* Ensure gain cycling gets inflight above BDP even for small BDPs. */
+        if (bbr->mode == BBR_PROBE_BW && gain > BBR_UNIT)
+                cwnd += 2;
+
         return cwnd;
 }
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3bcd30a2ba06..f9dcb29be12d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -246,8 +246,15 @@ static void tcp_ecn_queue_cwr(struct tcp_sock *tp)
 
 static void tcp_ecn_accept_cwr(struct tcp_sock *tp, const struct sk_buff *skb)
 {
-        if (tcp_hdr(skb)->cwr)
+        if (tcp_hdr(skb)->cwr) {
                 tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
+
+                /* If the sender is telling us it has entered CWR, then its
+                 * cwnd may be very low (even just 1 packet), so we should ACK
+                 * immediately.
+                 */
+                tcp_enter_quickack_mode((struct sock *)tp, 2);
+        }
 }
 
 static void tcp_ecn_withdraw_cwr(struct tcp_sock *tp)
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 97513f35bcc5..88a7579c23bd 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -669,8 +669,10 @@ skip_cow:
 
         sg_init_table(sg, nfrags);
         ret = skb_to_sgvec(skb, sg, 0, skb->len);
-        if (unlikely(ret < 0))
+        if (unlikely(ret < 0)) {
+                kfree(tmp);
                 goto out;
+        }
 
         skb->ip_summed = CHECKSUM_NONE;
 
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index b7f28deddaea..c72ae3a4fe09 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -480,10 +480,6 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
                 goto tx_err_dst_release;
         }
 
-        skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
-        skb_dst_set(skb, dst);
-        skb->dev = skb_dst(skb)->dev;
-
         mtu = dst_mtu(dst);
         if (!skb->ignore_df && skb->len > mtu) {
                 skb_dst_update_pmtu(skb, mtu);
@@ -498,9 +494,14 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
                                   htonl(mtu));
                 }
 
-                return -EMSGSIZE;
+                err = -EMSGSIZE;
+                goto tx_err_dst_release;
         }
 
+        skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
+        skb_dst_set(skb, dst);
+        skb->dev = skb_dst(skb)->dev;
+
         err = dst_output(t->net, skb->sk, skb);
         if (net_xmit_eval(err) == 0) {
                 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index e398797878a9..cf6cca260e7b 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1201,13 +1201,18 @@ static int pppol2tp_tunnel_ioctl(struct l2tp_tunnel *tunnel,
                                 l2tp_session_get(sock_net(sk), tunnel,
                                                  stats.session_id);
 
-                        if (session && session->pwtype == L2TP_PWTYPE_PPP) {
-                                err = pppol2tp_session_ioctl(session, cmd,
-                                                             arg);
+                        if (!session) {
+                                err = -EBADR;
+                                break;
+                        }
+                        if (session->pwtype != L2TP_PWTYPE_PPP) {
                                 l2tp_session_dec_refcount(session);
-                        } else {
                                 err = -EBADR;
+                                break;
                         }
+
+                        err = pppol2tp_session_ioctl(session, cmd, arg);
+                        l2tp_session_dec_refcount(session);
                         break;
                 }
 #ifdef CONFIG_XFRM
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 393573a99a5a..56704d95f82d 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -63,6 +63,7 @@
 #include <linux/hash.h>
 #include <linux/genetlink.h>
 #include <linux/net_namespace.h>
+#include <linux/nospec.h>
 
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
@@ -679,6 +680,7 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol,
 
         if (protocol < 0 || protocol >= MAX_LINKS)
                 return -EPROTONOSUPPORT;
+        protocol = array_index_nospec(protocol, MAX_LINKS);
 
         netlink_lock_table();
 #ifdef CONFIG_MODULES
@@ -1009,6 +1011,11 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                         return err;
         }
 
+        if (nlk->ngroups == 0)
+                groups = 0;
+        else if (nlk->ngroups < 8*sizeof(groups))
+                groups &= (1UL << nlk->ngroups) - 1;
+
         bound = nlk->bound;
         if (bound) {
                 /* Ensure nlk->portid is up-to-date. */
diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c
index b891a91577f8..c038e021a591 100644
--- a/net/openvswitch/meter.c
+++ b/net/openvswitch/meter.c
@@ -211,6 +211,7 @@ static struct dp_meter *dp_meter_create(struct nlattr **a)
         if (!meter)
                 return ERR_PTR(-ENOMEM);
 
+        meter->id = nla_get_u32(a[OVS_METER_ATTR_ID]);
         meter->used = div_u64(ktime_get_ns(), 1000 * 1000);
         meter->kbps = a[OVS_METER_ATTR_KBPS] ? 1 : 0;
         meter->keep_stats = !a[OVS_METER_ATTR_CLEAR];
@@ -280,6 +281,10 @@ static int ovs_meter_cmd_set(struct sk_buff *skb, struct genl_info *info)
         u32 meter_id;
         bool failed;
 
+        if (!a[OVS_METER_ATTR_ID]) {
+                return -ENODEV;
+        }
+
         meter = dp_meter_create(a);
         if (IS_ERR_OR_NULL(meter))
                 return PTR_ERR(meter);
@@ -298,11 +303,6 @@ static int ovs_meter_cmd_set(struct sk_buff *skb, struct genl_info *info)
                 goto exit_unlock;
         }
 
-        if (!a[OVS_METER_ATTR_ID]) {
-                err = -ENODEV;
-                goto exit_unlock;
-        }
-
         meter_id = nla_get_u32(a[OVS_METER_ATTR_ID]);
 
         /* Cannot fail after this. */
diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c
index 48332a6ed738..d152e48ea371 100644
--- a/net/rds/ib_frmr.c
+++ b/net/rds/ib_frmr.c
@@ -344,6 +344,11 @@ struct rds_ib_mr *rds_ib_reg_frmr(struct rds_ib_device *rds_ibdev,
         struct rds_ib_frmr *frmr;
         int ret;
 
+        if (!ic) {
+                /* TODO: Add FRWR support for RDS_GET_MR using proxy qp*/
+                return ERR_PTR(-EOPNOTSUPP);
+        }
+
         do {
                 if (ibmr)
                         rds_ib_free_frmr(ibmr, true);
diff --git a/net/rds/ib_mr.h b/net/rds/ib_mr.h
index 0ea4ab017a8c..655f01d427fe 100644
--- a/net/rds/ib_mr.h
+++ b/net/rds/ib_mr.h
@@ -115,7 +115,8 @@ void rds_ib_get_mr_info(struct rds_ib_device *rds_ibdev,
                         struct rds_info_rdma_connection *iinfo);
 void rds_ib_destroy_mr_pool(struct rds_ib_mr_pool *);
 void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
-                    struct rds_sock *rs, u32 *key_ret);
+                    struct rds_sock *rs, u32 *key_ret,
+                    struct rds_connection *conn);
 void rds_ib_sync_mr(void *trans_private, int dir);
 void rds_ib_free_mr(void *trans_private, int invalidate);
 void rds_ib_flush_mrs(void);
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index e678699268a2..2e49a40a5e11 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -537,11 +537,12 @@ void rds_ib_flush_mrs(void)
 }
 
 void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
-                    struct rds_sock *rs, u32 *key_ret)
+                    struct rds_sock *rs, u32 *key_ret,
+                    struct rds_connection *conn)
 {
         struct rds_ib_device *rds_ibdev;
         struct rds_ib_mr *ibmr = NULL;
-        struct rds_ib_connection *ic = rs->rs_conn->c_transport_data;
+        struct rds_ib_connection *ic = NULL;
         int ret;
 
         rds_ibdev = rds_ib_get_device(rs->rs_bound_addr);
@@ -550,6 +551,9 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
                 goto out;
         }
 
+        if (conn)
+                ic = conn->c_transport_data;
+
         if (!rds_ibdev->mr_8k_pool || !rds_ibdev->mr_1m_pool) {
                 ret = -ENODEV;
                 goto out;
@@ -559,17 +563,18 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
                 ibmr = rds_ib_reg_frmr(rds_ibdev, ic, sg, nents, key_ret);
         else
                 ibmr = rds_ib_reg_fmr(rds_ibdev, sg, nents, key_ret);
-        if (ibmr)
-                rds_ibdev = NULL;
-
- out:
-        if (!ibmr)
+        if (IS_ERR(ibmr)) {
+                ret = PTR_ERR(ibmr);
                 pr_warn("RDS/IB: rds_ib_get_mr failed (errno=%d)\n", ret);
+        } else {
+                return ibmr;
+        }
 
+ out:
         if (rds_ibdev)
                 rds_ib_dev_put(rds_ibdev);
 
-        return ibmr;
+        return ERR_PTR(ret);
 }
 
 void rds_ib_destroy_mr_pool(struct rds_ib_mr_pool *pool)
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 634cfcb7bba6..80920e47f2c7 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -170,7 +170,8 @@ static int rds_pin_pages(unsigned long user_addr, unsigned int nr_pages,
 }
 
 static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
-                                u64 *cookie_ret, struct rds_mr **mr_ret)
+                          u64 *cookie_ret, struct rds_mr **mr_ret,
+                          struct rds_conn_path *cp)
 {
         struct rds_mr *mr = NULL, *found;
         unsigned int nr_pages;
@@ -269,7 +270,8 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
          * Note that dma_map() implies that pending writes are
          * flushed to RAM, so no dma_sync is needed here. */
         trans_private = rs->rs_transport->get_mr(sg, nents, rs,
-                                                 &mr->r_key);
+                                                 &mr->r_key,
+                                                 cp ? cp->cp_conn : NULL);
 
         if (IS_ERR(trans_private)) {
                 for (i = 0 ; i < nents; i++)
@@ -330,7 +332,7 @@ int rds_get_mr(struct rds_sock *rs, char __user *optval, int optlen)
                            sizeof(struct rds_get_mr_args)))
                 return -EFAULT;
 
-        return __rds_rdma_map(rs, &args, NULL, NULL);
+        return __rds_rdma_map(rs, &args, NULL, NULL, NULL);
 }
 
 int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen)
@@ -354,7 +356,7 @@ int rds_get_mr_for_dest(struct rds_sock *rs, char __user *optval, int optlen)
         new_args.cookie_addr = args.cookie_addr;
         new_args.flags = args.flags;
 
-        return __rds_rdma_map(rs, &new_args, NULL, NULL);
+        return __rds_rdma_map(rs, &new_args, NULL, NULL, NULL);
 }
 
 /*
@@ -782,7 +784,8 @@ int rds_cmsg_rdma_map(struct rds_sock *rs, struct rds_message *rm,
             rm->m_rdma_cookie != 0)
                 return -EINVAL;
 
-        return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie, &rm->rdma.op_rdma_mr);
+        return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie,
+                              &rm->rdma.op_rdma_mr, rm->m_conn_path);
 }
 
 /*
diff --git a/net/rds/rds.h b/net/rds/rds.h
index f2272fb8cd45..60b3b787fbdb 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -464,6 +464,8 @@ struct rds_message {
                         struct scatterlist      *op_sg;
                 } data;
         };
+
+        struct rds_conn_path *m_conn_path;
 };
 
 /*
@@ -544,7 +546,8 @@ struct rds_transport {
                                         unsigned int avail);
         void (*exit)(void);
         void *(*get_mr)(struct scatterlist *sg, unsigned long nr_sg,
-                        struct rds_sock *rs, u32 *key_ret);
+                        struct rds_sock *rs, u32 *key_ret,
+                        struct rds_connection *conn);
         void (*sync_mr)(void *trans_private, int direction);
         void (*free_mr)(void *trans_private, int invalidate);
         void (*flush_mrs)(void);
diff --git a/net/rds/send.c b/net/rds/send.c
index 94c7f74909be..59f17a2335f4 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -1169,6 +1169,13 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
                 rs->rs_conn = conn;
         }
 
+        if (conn->c_trans->t_mp_capable)
+                cpath = &conn->c_path[rds_send_mprds_hash(rs, conn)];
+        else
+                cpath = &conn->c_path[0];
+
+        rm->m_conn_path = cpath;
+
         /* Parse any control messages the user may have included. */
         ret = rds_cmsg_send(rs, rm, msg, &allocated_mr);
         if (ret) {
@@ -1192,11 +1199,6 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len)
                 goto out;
         }
 
-        if (conn->c_trans->t_mp_capable)
-                cpath = &conn->c_path[rds_send_mprds_hash(rs, conn)];
-        else
-                cpath = &conn->c_path[0];
-
         if (rds_destroy_pending(conn)) {
                 ret = -EAGAIN;
                 goto out;
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index a9a9be5519b9..9d1e298b784c 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -116,9 +116,9 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx,
                 while (*pp) {
                         parent = *pp;
                         xcall = rb_entry(parent, struct rxrpc_call, sock_node);
-                        if (user_call_ID < call->user_call_ID)
+                        if (user_call_ID < xcall->user_call_ID)
                                 pp = &(*pp)->rb_left;
-                        else if (user_call_ID > call->user_call_ID)
+                        else if (user_call_ID > xcall->user_call_ID)
                                 pp = &(*pp)->rb_right;
                         else
                                 goto id_in_use;
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index a7e8d63fc8ae..9bde1e4ca288 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -233,7 +233,8 @@ static void smc_cdc_msg_recv_action(struct smc_sock *smc,
                         /* force immediate tx of current consumer cursor, but
                          * under send_lock to guarantee arrival in seqno-order
                          */
-                        smc_tx_sndbuf_nonempty(conn);
+                        if (smc->sk.sk_state != SMC_INIT)
+                                smc_tx_sndbuf_nonempty(conn);
                 }
         }
 
diff --git a/net/socket.c b/net/socket.c
index 85633622c94d..8c24d5dc4bc8 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -89,6 +89,7 @@
 #include <linux/magic.h>
 #include <linux/slab.h>
 #include <linux/xattr.h>
+#include <linux/nospec.h>
 
 #include <linux/uaccess.h>
 #include <asm/unistd.h>
@@ -2522,6 +2523,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
 
         if (call < 1 || call > SYS_SENDMMSG)
                 return -EINVAL;
+        call = array_index_nospec(call, SYS_SENDMMSG + 1);
 
         len = nargs[call];
         if (len > sizeof(a))
@@ -2688,7 +2690,8 @@ EXPORT_SYMBOL(sock_unregister);
 
 bool sock_is_registered(int family)
 {
-        return family < NPROTO && rcu_access_pointer(net_families[family]);
+        return family < NPROTO &&
+                rcu_access_pointer(net_families[array_index_nospec(family, NPROTO)]);
 }
 
 static int __init sock_init(void)
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 72335c2e8108..4e937cd7c17d 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -84,10 +84,8 @@ static int __xsk_rcv_zc(struct xdp_sock *xs, struct xdp_buff *xdp, u32 len)
 {
         int err = xskq_produce_batch_desc(xs->rx, (u64)xdp->handle, len);
 
-        if (err) {
-                xdp_return_buff(xdp);
+        if (err)
                 xs->rx_dropped++;
-        }
 
         return err;
 }
diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
index 52ecaf770642..8a64b150be54 100644
--- a/net/xdp/xsk_queue.h
+++ b/net/xdp/xsk_queue.h
@@ -250,7 +250,7 @@ static inline bool xskq_full_desc(struct xsk_queue *q)
 
 static inline bool xskq_empty_desc(struct xsk_queue *q)
 {
-        return xskq_nb_free(q, q->prod_tail, 1) == q->nentries;
+        return xskq_nb_free(q, q->prod_tail, q->nentries) == q->nentries;
 }
 
 void xskq_set_umem(struct xsk_queue *q, struct xdp_umem_props *umem_props);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 5f48251c1319..7c5e8978aeaa 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2286,6 +2286,9 @@ struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,
         if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE)
                 return make_blackhole(net, dst_orig->ops->family, dst_orig);
 
+        if (IS_ERR(dst))
+                dst_release(dst_orig);
+
         return dst;
 }
 EXPORT_SYMBOL(xfrm_lookup_route);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 080035f056d9..33878e6e0d0a 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1025,10 +1025,12 @@ static inline int xfrm_nlmsg_multicast(struct net *net, struct sk_buff *skb,
 {
         struct sock *nlsk = rcu_dereference(net->xfrm.nlsk);
 
-        if (nlsk)
-                return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
-        else
-                return -1;
+        if (!nlsk) {
+                kfree_skb(skb);
+                return -EPIPE;
+        }
+
+        return nlmsg_multicast(nlsk, skb, pid, group, GFP_ATOMIC);
 }
 
 static inline unsigned int xfrm_spdinfo_msgsize(void)
@@ -1671,9 +1673,11 @@ static inline unsigned int userpolicy_type_attrsize(void)
 #ifdef CONFIG_XFRM_SUB_POLICY
 static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
 {
-        struct xfrm_userpolicy_type upt = {
-                .type = type,
-        };
+        struct xfrm_userpolicy_type upt;
+
+        /* Sadly there are two holes in struct xfrm_userpolicy_type */
+        memset(&upt, 0, sizeof(upt));
+        upt.type = type;
 
         return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
 }