32 files changed, 418 insertions, 172 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 73a65789271b..8ccee3d01822 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -693,7 +693,7 @@ static struct sk_buff **vlan_gro_receive(struct sk_buff **head,
 out_unlock:
         rcu_read_unlock();
 out:
-        NAPI_GRO_CB(skb)->flush |= flush;
+        skb_gro_flush_final(skb, pp, flush);
 
         return pp;
 }
diff --git a/net/9p/client.c b/net/9p/client.c
index 18c5271910dc..5c1343195292 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -225,7 +225,8 @@ static int parse_opts(char *opts, struct p9_client *clnt)
         }
 
 free_and_return:
-        v9fs_put_trans(clnt->trans_mod);
+        if (ret)
+                v9fs_put_trans(clnt->trans_mod);
         kfree(tmp_options);
         return ret;
 }
diff --git a/net/Makefile b/net/Makefile
index 13ec0d5415c7..bdaf53925acd 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -20,11 +20,7 @@ obj-$(CONFIG_TLS)		+= tls/
 obj-$(CONFIG_XFRM)              += xfrm/
 obj-$(CONFIG_UNIX)              += unix/
 obj-$(CONFIG_NET)               += ipv6/
-ifneq ($(CC_CAN_LINK),y)
-$(warning CC cannot link executables. Skipping bpfilter.)
-else
 obj-$(CONFIG_BPFILTER)          += bpfilter/
-endif
 obj-$(CONFIG_PACKET)            += packet/
 obj-$(CONFIG_NET_KEY)           += key/
 obj-$(CONFIG_BRIDGE)            += bridge/
diff --git a/net/bpfilter/Kconfig b/net/bpfilter/Kconfig
index a948b072c28f..76deb6615883 100644
--- a/net/bpfilter/Kconfig
+++ b/net/bpfilter/Kconfig
@@ -1,6 +1,5 @@
 menuconfig BPFILTER
         bool "BPF based packet filtering framework (BPFILTER)"
-        default n
         depends on NET && BPF && INET
         help
           This builds experimental bpfilter framework that is aiming to
@@ -9,6 +8,7 @@ menuconfig BPFILTER
 if BPFILTER
 config BPFILTER_UMH
         tristate "bpfilter kernel module with user mode helper"
+        depends on $(success,$(srctree)/scripts/cc-can-link.sh $(CC))
         default m
         help
           This builds bpfilter kernel module with embedded user mode helper
diff --git a/net/bpfilter/Makefile b/net/bpfilter/Makefile
index 051dc18b8ccb..39c6980b5d99 100644
--- a/net/bpfilter/Makefile
+++ b/net/bpfilter/Makefile
@@ -15,20 +15,7 @@ ifeq ($(CONFIG_BPFILTER_UMH), y)
 HOSTLDFLAGS += -static
 endif
 
-# a bit of elf magic to convert bpfilter_umh binary into a binary blob
-# inside bpfilter_umh.o elf file referenced by
-# _binary_net_bpfilter_bpfilter_umh_start symbol
-# which bpfilter_kern.c passes further into umh blob loader at run-time
-quiet_cmd_copy_umh = GEN $@
-      cmd_copy_umh = echo ':' > $(obj)/.bpfilter_umh.o.cmd; \
-      $(OBJCOPY) -I binary \
-          `LC_ALL=C $(OBJDUMP) -f net/bpfilter/bpfilter_umh \
-          |awk -F' |,' '/file format/{print "-O",$$NF} \
-          /^architecture:/{print "-B",$$2}'` \
-      --rename-section .data=.init.rodata $< $@
-
-$(obj)/bpfilter_umh.o: $(obj)/bpfilter_umh
-        $(call cmd,copy_umh)
+$(obj)/bpfilter_umh_blob.o: $(obj)/bpfilter_umh
 
 obj-$(CONFIG_BPFILTER_UMH) += bpfilter.o
-bpfilter-objs += bpfilter_kern.o bpfilter_umh.o
+bpfilter-objs += bpfilter_kern.o bpfilter_umh_blob.o
diff --git a/net/bpfilter/bpfilter_kern.c b/net/bpfilter/bpfilter_kern.c
index 09522573f611..f0fc182d3db7 100644
--- a/net/bpfilter/bpfilter_kern.c
+++ b/net/bpfilter/bpfilter_kern.c
@@ -10,11 +10,8 @@
 #include <linux/file.h>
 #include "msgfmt.h"
 
-#define UMH_start _binary_net_bpfilter_bpfilter_umh_start
-#define UMH_end _binary_net_bpfilter_bpfilter_umh_end
-
-extern char UMH_start;
-extern char UMH_end;
+extern char bpfilter_umh_start;
+extern char bpfilter_umh_end;
 
 static struct umh_info info;
 /* since ip_getsockopt() can run in parallel, serialize access to umh */
@@ -93,7 +90,9 @@ static int __init load_umh(void)
         int err;
 
         /* fork usermode process */
-        err = fork_usermode_blob(&UMH_start, &UMH_end - &UMH_start, &info);
+        err = fork_usermode_blob(&bpfilter_umh_start,
+                                 &bpfilter_umh_end - &bpfilter_umh_start,
+                                 &info);
         if (err)
                 return err;
         pr_info("Loaded bpfilter_umh pid %d\n", info.pid);
diff --git a/net/bpfilter/bpfilter_umh_blob.S b/net/bpfilter/bpfilter_umh_blob.S
new file mode 100644
index 000000000000..40311d10d2f2
--- /dev/null
+++ b/net/bpfilter/bpfilter_umh_blob.S
@@ -0,0 +1,7 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+        .section .init.rodata, "a"
+        .global bpfilter_umh_start
+bpfilter_umh_start:
+        .incbin "net/bpfilter/bpfilter_umh"
+        .global bpfilter_umh_end
+bpfilter_umh_end:
diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index a04e1e88bf3a..50537ff961a7 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -285,16 +285,9 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                 if (ifr->ifr_qlen < 0)
                         return -EINVAL;
                 if (dev->tx_queue_len ^ ifr->ifr_qlen) {
-                        unsigned int orig_len = dev->tx_queue_len;
-
-                        dev->tx_queue_len = ifr->ifr_qlen;
-                        err = call_netdevice_notifiers(
-                                        NETDEV_CHANGE_TX_QUEUE_LEN, dev);
-                        err = notifier_to_errno(err);
-                        if (err) {
-                                dev->tx_queue_len = orig_len;
+                        err = dev_change_tx_queue_len(dev, ifr->ifr_qlen);
+                        if (err)
                                 return err;
-                        }
                 }
                 return 0;
 
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 126ffc5bc630..f64aa13811ea 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -416,6 +416,14 @@ static struct fib_rule *rule_find(struct fib_rules_ops *ops,
                 if (rule->mark && r->mark != rule->mark)
                         continue;
 
+                if (rule->suppress_ifgroup != -1 &&
+                    r->suppress_ifgroup != rule->suppress_ifgroup)
+                        continue;
+
+                if (rule->suppress_prefixlen != -1 &&
+                    r->suppress_prefixlen != rule->suppress_prefixlen)
+                        continue;
+
                 if (rule->mark_mask && r->mark_mask != rule->mark_mask)
                         continue;
 
@@ -436,6 +444,9 @@ static struct fib_rule *rule_find(struct fib_rules_ops *ops,
                 if (rule->ip_proto && r->ip_proto != rule->ip_proto)
                         continue;
 
+                if (rule->proto && r->proto != rule->proto)
+                        continue;
+
                 if (fib_rule_port_range_set(&rule->sport_range) &&
                     !fib_rule_port_range_compare(&r->sport_range,
                                                  &rule->sport_range))
@@ -645,6 +656,73 @@ errout:
         return err;
 }
 
+static int rule_exists(struct fib_rules_ops *ops, struct fib_rule_hdr *frh,
+                       struct nlattr **tb, struct fib_rule *rule)
+{
+        struct fib_rule *r;
+
+        list_for_each_entry(r, &ops->rules_list, list) {
+                if (r->action != rule->action)
+                        continue;
+
+                if (r->table != rule->table)
+                        continue;
+
+                if (r->pref != rule->pref)
+                        continue;
+
+                if (memcmp(r->iifname, rule->iifname, IFNAMSIZ))
+                        continue;
+
+                if (memcmp(r->oifname, rule->oifname, IFNAMSIZ))
+                        continue;
+
+                if (r->mark != rule->mark)
+                        continue;
+
+                if (r->suppress_ifgroup != rule->suppress_ifgroup)
+                        continue;
+
+                if (r->suppress_prefixlen != rule->suppress_prefixlen)
+                        continue;
+
+                if (r->mark_mask != rule->mark_mask)
+                        continue;
+
+                if (r->tun_id != rule->tun_id)
+                        continue;
+
+                if (r->fr_net != rule->fr_net)
+                        continue;
+
+                if (r->l3mdev != rule->l3mdev)
+                        continue;
+
+                if (!uid_eq(r->uid_range.start, rule->uid_range.start) ||
+                    !uid_eq(r->uid_range.end, rule->uid_range.end))
+                        continue;
+
+                if (r->ip_proto != rule->ip_proto)
+                        continue;
+
+                if (r->proto != rule->proto)
+                        continue;
+
+                if (!fib_rule_port_range_compare(&r->sport_range,
+                                                 &rule->sport_range))
+                        continue;
+
+                if (!fib_rule_port_range_compare(&r->dport_range,
+                                                 &rule->dport_range))
+                        continue;
+
+                if (!ops->compare(r, frh, tb))
+                        continue;
+                return 1;
+        }
+        return 0;
+}
+
 int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                    struct netlink_ext_ack *extack)
 {
@@ -679,7 +757,7 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh,
                 goto errout;
 
         if ((nlh->nlmsg_flags & NLM_F_EXCL) &&
-            rule_find(ops, frh, tb, rule, user_priority)) {
+            rule_exists(ops, frh, tb, rule)) {
                 err = -EEXIST;
                 goto errout_free;
         }
diff --git a/net/core/filter.c b/net/core/filter.c
index e7f12e9f598c..0ca6907d7efe 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4073,8 +4073,9 @@ static int bpf_fib_set_fwd_params(struct bpf_fib_lookup *params,
         memcpy(params->smac, dev->dev_addr, ETH_ALEN);
         params->h_vlan_TCI = 0;
         params->h_vlan_proto = 0;
+        params->ifindex = dev->ifindex;
 
-        return dev->ifindex;
+        return 0;
 }
 #endif
 
@@ -4098,7 +4099,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
         /* verify forwarding is enabled on this interface */
         in_dev = __in_dev_get_rcu(dev);
         if (unlikely(!in_dev || !IN_DEV_FORWARD(in_dev)))
-                return 0;
+                return BPF_FIB_LKUP_RET_FWD_DISABLED;
 
         if (flags & BPF_FIB_LOOKUP_OUTPUT) {
                 fl4.flowi4_iif = 1;
@@ -4123,7 +4124,7 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
 
                 tb = fib_get_table(net, tbid);
                 if (unlikely(!tb))
-                        return 0;
+                        return BPF_FIB_LKUP_RET_NOT_FWDED;
 
                 err = fib_table_lookup(tb, &fl4, &res, FIB_LOOKUP_NOREF);
         } else {
@@ -4135,8 +4136,20 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
                 err = fib_lookup(net, &fl4, &res, FIB_LOOKUP_NOREF);
         }
 
-        if (err || res.type != RTN_UNICAST)
-                return 0;
+        if (err) {
+                /* map fib lookup errors to RTN_ type */
+                if (err == -EINVAL)
+                        return BPF_FIB_LKUP_RET_BLACKHOLE;
+                if (err == -EHOSTUNREACH)
+                        return BPF_FIB_LKUP_RET_UNREACHABLE;
+                if (err == -EACCES)
+                        return BPF_FIB_LKUP_RET_PROHIBIT;
+
+                return BPF_FIB_LKUP_RET_NOT_FWDED;
+        }
+
+        if (res.type != RTN_UNICAST)
+                return BPF_FIB_LKUP_RET_NOT_FWDED;
 
         if (res.fi->fib_nhs > 1)
                 fib_select_path(net, &res, &fl4, NULL);
@@ -4144,19 +4157,16 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
         if (check_mtu) {
                 mtu = ip_mtu_from_fib_result(&res, params->ipv4_dst);
                 if (params->tot_len > mtu)
-                        return 0;
+                        return BPF_FIB_LKUP_RET_FRAG_NEEDED;
         }
 
         nh = &res.fi->fib_nh[res.nh_sel];
 
         /* do not handle lwt encaps right now */
         if (nh->nh_lwtstate)
-                return 0;
+                return BPF_FIB_LKUP_RET_UNSUPP_LWT;
 
         dev = nh->nh_dev;
-        if (unlikely(!dev))
-                return 0;
-
         if (nh->nh_gw)
                 params->ipv4_dst = nh->nh_gw;
 
@@ -4166,10 +4176,10 @@ static int bpf_ipv4_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
          * rcu_read_lock_bh is not needed here
          */
         neigh = __ipv4_neigh_lookup_noref(dev, (__force u32)params->ipv4_dst);
-        if (neigh)
-                return bpf_fib_set_fwd_params(params, neigh, dev);
+        if (!neigh)
+                return BPF_FIB_LKUP_RET_NO_NEIGH;
 
-        return 0;
+        return bpf_fib_set_fwd_params(params, neigh, dev);
 }
 #endif
 
@@ -4190,7 +4200,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
 
         /* link local addresses are never forwarded */
         if (rt6_need_strict(dst) || rt6_need_strict(src))
-                return 0;
+                return BPF_FIB_LKUP_RET_NOT_FWDED;
 
         dev = dev_get_by_index_rcu(net, params->ifindex);
         if (unlikely(!dev))
@@ -4198,7 +4208,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
 
         idev = __in6_dev_get_safely(dev);
         if (unlikely(!idev || !net->ipv6.devconf_all->forwarding))
-                return 0;
+                return BPF_FIB_LKUP_RET_FWD_DISABLED;
 
         if (flags & BPF_FIB_LOOKUP_OUTPUT) {
                 fl6.flowi6_iif = 1;
@@ -4225,7 +4235,7 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
 
                 tb = ipv6_stub->fib6_get_table(net, tbid);
                 if (unlikely(!tb))
-                        return 0;
+                        return BPF_FIB_LKUP_RET_NOT_FWDED;
 
                 f6i = ipv6_stub->fib6_table_lookup(net, tb, oif, &fl6, strict);
         } else {
@@ -4238,11 +4248,23 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
         }
 
         if (unlikely(IS_ERR_OR_NULL(f6i) || f6i == net->ipv6.fib6_null_entry))
-                return 0;
+                return BPF_FIB_LKUP_RET_NOT_FWDED;
+
+        if (unlikely(f6i->fib6_flags & RTF_REJECT)) {
+                switch (f6i->fib6_type) {
+                case RTN_BLACKHOLE:
+                        return BPF_FIB_LKUP_RET_BLACKHOLE;
+                case RTN_UNREACHABLE:
+                        return BPF_FIB_LKUP_RET_UNREACHABLE;
+                case RTN_PROHIBIT:
+                        return BPF_FIB_LKUP_RET_PROHIBIT;
+                default:
+                        return BPF_FIB_LKUP_RET_NOT_FWDED;
+                }
+        }
 
-        if (unlikely(f6i->fib6_flags & RTF_REJECT ||
-            f6i->fib6_type != RTN_UNICAST))
-                return 0;
+        if (f6i->fib6_type != RTN_UNICAST)
+                return BPF_FIB_LKUP_RET_NOT_FWDED;
 
         if (f6i->fib6_nsiblings && fl6.flowi6_oif == 0)
                 f6i = ipv6_stub->fib6_multipath_select(net, f6i, &fl6,
@@ -4252,11 +4274,11 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
         if (check_mtu) {
                 mtu = ipv6_stub->ip6_mtu_from_fib6(f6i, dst, src);
                 if (params->tot_len > mtu)
-                        return 0;
+                        return BPF_FIB_LKUP_RET_FRAG_NEEDED;
         }
 
         if (f6i->fib6_nh.nh_lwtstate)
-                return 0;
+                return BPF_FIB_LKUP_RET_UNSUPP_LWT;
 
         if (f6i->fib6_flags & RTF_GATEWAY)
                 *dst = f6i->fib6_nh.nh_gw;
@@ -4270,10 +4292,10 @@ static int bpf_ipv6_fib_lookup(struct net *net, struct bpf_fib_lookup *params,
          */
         neigh = ___neigh_lookup_noref(ipv6_stub->nd_tbl, neigh_key_eq128,
                                       ndisc_hashfn, dst, dev);
-        if (neigh)
-                return bpf_fib_set_fwd_params(params, neigh, dev);
+        if (!neigh)
+                return BPF_FIB_LKUP_RET_NO_NEIGH;
 
-        return 0;
+        return bpf_fib_set_fwd_params(params, neigh, dev);
 }
 #endif
 
@@ -4315,7 +4337,7 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
            struct bpf_fib_lookup *, params, int, plen, u32, flags)
 {
         struct net *net = dev_net(skb->dev);
-        int index = -EAFNOSUPPORT;
+        int rc = -EAFNOSUPPORT;
 
         if (plen < sizeof(*params))
                 return -EINVAL;
@@ -4326,25 +4348,25 @@ BPF_CALL_4(bpf_skb_fib_lookup, struct sk_buff *, skb,
         switch (params->family) {
 #if IS_ENABLED(CONFIG_INET)
         case AF_INET:
-                index = bpf_ipv4_fib_lookup(net, params, flags, false);
+                rc = bpf_ipv4_fib_lookup(net, params, flags, false);
                 break;
 #endif
 #if IS_ENABLED(CONFIG_IPV6)
         case AF_INET6:
-                index = bpf_ipv6_fib_lookup(net, params, flags, false);
+                rc = bpf_ipv6_fib_lookup(net, params, flags, false);
                 break;
 #endif
         }
 
-        if (index > 0) {
+        if (!rc) {
                 struct net_device *dev;
 
-                dev = dev_get_by_index_rcu(net, index);
+                dev = dev_get_by_index_rcu(net, params->ifindex);
                 if (!is_skb_forwardable(dev, skb))
-                        index = 0;
+                        rc = BPF_FIB_LKUP_RET_FRAG_NEEDED;
         }
 
-        return index;
+        return rc;
 }
 
 static const struct bpf_func_proto bpf_skb_fib_lookup_proto = {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index c642304f178c..eba8dae22c25 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5276,8 +5276,7 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len,
                         if (npages >= 1 << order) {
                                 page = alloc_pages((gfp_mask & ~__GFP_DIRECT_RECLAIM) |
                                                    __GFP_COMP |
-                                                   __GFP_NOWARN |
-                                                   __GFP_NORETRY,
+                                                   __GFP_NOWARN,
                                                    order);
                                 if (page)
                                         goto fill_page;
diff --git a/net/core/sock.c b/net/core/sock.c
index bcc41829a16d..9e8f65585b81 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3243,7 +3243,8 @@ static int req_prot_init(const struct proto *prot)
 
         rsk_prot->slab = kmem_cache_create(rsk_prot->slab_name,
                                            rsk_prot->obj_size, 0,
-                                           prot->slab_flags, NULL);
+                                           SLAB_ACCOUNT | prot->slab_flags,
+                                           NULL);
 
         if (!rsk_prot->slab) {
                 pr_crit("%s: Can't create request sock SLAB cache!\n",
@@ -3258,7 +3259,8 @@ int proto_register(struct proto *prot, int alloc_slab)
         if (alloc_slab) {
                 prot->slab = kmem_cache_create_usercopy(prot->name,
                                         prot->obj_size, 0,
-                                        SLAB_HWCACHE_ALIGN | prot->slab_flags,
+                                        SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT |
+                                        prot->slab_flags,
                                         prot->useroffset, prot->usersize,
                                         NULL);
 
@@ -3281,6 +3283,7 @@ int proto_register(struct proto *prot, int alloc_slab)
                                 kmem_cache_create(prot->twsk_prot->twsk_slab_name,
                                                   prot->twsk_prot->twsk_obj_size,
                                                   0,
+                                                  SLAB_ACCOUNT |
                                                   prot->slab_flags,
                                                   NULL);
                         if (prot->twsk_prot->twsk_slab == NULL)
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index 1540db65241a..c9ec1603666b 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -448,9 +448,7 @@ next_proto:
 out_unlock:
         rcu_read_unlock();
 out:
-        NAPI_GRO_CB(skb)->flush |= flush;
-        skb_gro_remcsum_cleanup(skb, &grc);
-        skb->remcsum_offload = 0;
+        skb_gro_flush_final_remcsum(skb, pp, flush, &grc);
 
         return pp;
 }
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index 1859c473b21a..6a7d980105f6 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -223,7 +223,7 @@ static struct sk_buff **gre_gro_receive(struct sk_buff **head,
 out_unlock:
         rcu_read_unlock();
 out:
-        NAPI_GRO_CB(skb)->flush |= flush;
+        skb_gro_flush_final(skb, pp, flush);
 
         return pp;
 }
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index d06247ba08b2..af0a857d8352 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -265,8 +265,9 @@ static int proc_tcp_fastopen_key(struct ctl_table *table, int write,
             ipv4.sysctl_tcp_fastopen);
         struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
         struct tcp_fastopen_context *ctxt;
-        int ret;
         u32  user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */
+        __le32 key[4];
+        int ret, i;
 
         tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL);
         if (!tbl.data)
@@ -275,11 +276,14 @@ static int proc_tcp_fastopen_key(struct ctl_table *table, int write,
         rcu_read_lock();
         ctxt = rcu_dereference(net->ipv4.tcp_fastopen_ctx);
         if (ctxt)
-                memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
+                memcpy(key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH);
         else
-                memset(user_key, 0, sizeof(user_key));
+                memset(key, 0, sizeof(key));
         rcu_read_unlock();
 
+        for (i = 0; i < ARRAY_SIZE(key); i++)
+                user_key[i] = le32_to_cpu(key[i]);
+
         snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x",
                 user_key[0], user_key[1], user_key[2], user_key[3]);
         ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
@@ -290,13 +294,17 @@ static int proc_tcp_fastopen_key(struct ctl_table *table, int write,
                         ret = -EINVAL;
                         goto bad_key;
                 }
-                tcp_fastopen_reset_cipher(net, NULL, user_key,
+
+                for (i = 0; i < ARRAY_SIZE(user_key); i++)
+                        key[i] = cpu_to_le32(user_key[i]);
+
+                tcp_fastopen_reset_cipher(net, NULL, key,
                                           TCP_FASTOPEN_KEY_LENGTH);
         }
 
 bad_key:
         pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n",
-               user_key[0], user_key[1], user_key[2], user_key[3],
+                user_key[0], user_key[1], user_key[2], user_key[3],
                (char *)tbl.data, ret);
         kfree(tbl.data);
         return ret;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 355d3dffd021..8e5522c6833a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -265,7 +265,7 @@ static void __tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb)
                  * it is probably a retransmit.
                  */
                 if (tp->ecn_flags & TCP_ECN_SEEN)
-                        tcp_enter_quickack_mode(sk, 1);
+                        tcp_enter_quickack_mode(sk, 2);
                 break;
         case INET_ECN_CE:
                 if (tcp_ca_needs_ecn(sk))
@@ -273,7 +273,7 @@ static void __tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb)
 
                 if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
                         /* Better not delay acks, sender can have a very low cwnd */
-                        tcp_enter_quickack_mode(sk, 1);
+                        tcp_enter_quickack_mode(sk, 2);
                         tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
                 }
                 tp->ecn_flags |= TCP_ECN_SEEN;
@@ -3181,6 +3181,15 @@ static int tcp_clean_rtx_queue(struct sock *sk, u32 prior_fack,
 
                 if (tcp_is_reno(tp)) {
                         tcp_remove_reno_sacks(sk, pkts_acked);
+
+                        /* If any of the cumulatively ACKed segments was
+                         * retransmitted, non-SACK case cannot confirm that
+                         * progress was due to original transmission due to
+                         * lack of TCPCB_SACKED_ACKED bits even if some of
+                         * the packets may have been never retransmitted.
+                         */
+                        if (flag & FLAG_RETRANS_DATA_ACKED)
+                                flag &= ~FLAG_ORIG_SACK_ACKED;
                 } else {
                         int delta;
 
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 92dc9e5a7ff3..69c54540d5b4 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -394,7 +394,7 @@ unflush:
 out_unlock:
         rcu_read_unlock();
 out:
-        NAPI_GRO_CB(skb)->flush |= flush;
+        skb_gro_flush_final(skb, pp, flush);
         return pp;
 }
 EXPORT_SYMBOL(udp_gro_receive);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c134286d6a41..91580c62bb86 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4528,6 +4528,7 @@ static int modify_prefix_route(struct inet6_ifaddr *ifp,
                                unsigned long expires, u32 flags)
 {
         struct fib6_info *f6i;
+        u32 prio;
 
         f6i = addrconf_get_prefix_route(&ifp->addr,
                                         ifp->prefix_len,
@@ -4536,13 +4537,15 @@ static int modify_prefix_route(struct inet6_ifaddr *ifp,
         if (!f6i)
                 return -ENOENT;
 
-        if (f6i->fib6_metric != ifp->rt_priority) {
+        prio = ifp->rt_priority ? : IP6_RT_PRIO_ADDRCONF;
+        if (f6i->fib6_metric != prio) {
+                /* delete old one */
+                ip6_del_rt(dev_net(ifp->idev->dev), f6i);
+
                 /* add new one */
                 addrconf_prefix_route(&ifp->addr, ifp->prefix_len,
                                       ifp->rt_priority, ifp->idev->dev,
                                       expires, flags, GFP_KERNEL);
-                /* delete old one */
-                ip6_del_rt(dev_net(ifp->idev->dev), f6i);
         } else {
                 if (!expires)
                         fib6_clean_expires(f6i);
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 5e0332014c17..a452d99c9f52 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -107,7 +107,7 @@ static int nf_ct_frag6_sysctl_register(struct net *net)
         if (hdr == NULL)
                 goto err_reg;
 
-        net->nf_frag.sysctl.frags_hdr = hdr;
+        net->nf_frag_frags_hdr = hdr;
         return 0;
 
 err_reg:
@@ -121,8 +121,8 @@ static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
 {
         struct ctl_table *table;
 
-        table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg;
-        unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr);
+        table = net->nf_frag_frags_hdr->ctl_table_arg;
+        unregister_net_sysctl_table(net->nf_frag_frags_hdr);
         if (!net_eq(net, &init_net))
                 kfree(table);
 }
diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c
index 33fb35cbfac1..558fe8cc6d43 100644
--- a/net/ipv6/seg6_hmac.c
+++ b/net/ipv6/seg6_hmac.c
@@ -373,7 +373,7 @@ static int seg6_hmac_init_algo(void)
                         return -ENOMEM;
 
                 for_each_possible_cpu(cpu) {
-                        tfm = crypto_alloc_shash(algo->name, 0, GFP_KERNEL);
+                        tfm = crypto_alloc_shash(algo->name, 0, 0);
                         if (IS_ERR(tfm))
                                 return PTR_ERR(tfm);
                         p_tfm = per_cpu_ptr(algo->tfms, cpu);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 44b5dfe8727d..fa1f1e63a264 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -4845,7 +4845,9 @@ int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
         skb_reset_network_header(skb);
         skb_reset_mac_header(skb);
 
+        local_bh_disable();
         __ieee80211_subif_start_xmit(skb, skb->dev, flags);
+        local_bh_enable();
 
         return 0;
 }
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index d8383609fe28..510039862aa9 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -47,6 +47,8 @@ struct nf_conncount_tuple {
         struct hlist_node               node;
         struct nf_conntrack_tuple       tuple;
         struct nf_conntrack_zone        zone;
+        int                             cpu;
+        u32                             jiffies32;
 };
 
 struct nf_conncount_rb {
@@ -91,11 +93,42 @@ bool nf_conncount_add(struct hlist_head *head,
                 return false;
         conn->tuple = *tuple;
         conn->zone = *zone;
+        conn->cpu = raw_smp_processor_id();
+        conn->jiffies32 = (u32)jiffies;
         hlist_add_head(&conn->node, head);
         return true;
 }
 EXPORT_SYMBOL_GPL(nf_conncount_add);
 
+static const struct nf_conntrack_tuple_hash *
+find_or_evict(struct net *net, struct nf_conncount_tuple *conn)
+{
+        const struct nf_conntrack_tuple_hash *found;
+        unsigned long a, b;
+        int cpu = raw_smp_processor_id();
+        __s32 age;
+
+        found = nf_conntrack_find_get(net, &conn->zone, &conn->tuple);
+        if (found)
+                return found;
+        b = conn->jiffies32;
+        a = (u32)jiffies;
+
+        /* conn might have been added just before by another cpu and
+         * might still be unconfirmed.  In this case, nf_conntrack_find()
+         * returns no result.  Thus only evict if this cpu added the
+         * stale entry or if the entry is older than two jiffies.
+         */
+        age = a - b;
+        if (conn->cpu == cpu || age >= 2) {
+                hlist_del(&conn->node);
+                kmem_cache_free(conncount_conn_cachep, conn);
+                return ERR_PTR(-ENOENT);
+        }
+
+        return ERR_PTR(-EAGAIN);
+}
+
 unsigned int nf_conncount_lookup(struct net *net, struct hlist_head *head,
                                  const struct nf_conntrack_tuple *tuple,
                                  const struct nf_conntrack_zone *zone,
@@ -103,18 +136,27 @@ unsigned int nf_conncount_lookup(struct net *net, struct hlist_head *head,
 {
         const struct nf_conntrack_tuple_hash *found;
         struct nf_conncount_tuple *conn;
-        struct hlist_node *n;
         struct nf_conn *found_ct;
+        struct hlist_node *n;
         unsigned int length = 0;
 
         *addit = tuple ? true : false;
 
         /* check the saved connections */
         hlist_for_each_entry_safe(conn, n, head, node) {
-                found = nf_conntrack_find_get(net, &conn->zone, &conn->tuple);
-                if (found == NULL) {
-                        hlist_del(&conn->node);
-                        kmem_cache_free(conncount_conn_cachep, conn);
+                found = find_or_evict(net, conn);
+                if (IS_ERR(found)) {
+                        /* Not found, but might be about to be confirmed */
+                        if (PTR_ERR(found) == -EAGAIN) {
+                                length++;
+                                if (!tuple)
+                                        continue;
+
+                                if (nf_ct_tuple_equal(&conn->tuple, tuple) &&
+                                    nf_ct_zone_id(&conn->zone, conn->zone.dir) ==
+                                    nf_ct_zone_id(zone, zone->dir))
+                                        *addit = false;
+                        }
                         continue;
                 }
 
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 551a1eddf0fa..a75b11c39312 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -465,6 +465,11 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
 
         nf_ct_expect_iterate_destroy(expect_iter_me, NULL);
         nf_ct_iterate_destroy(unhelp, me);
+
+        /* Maybe someone has gotten the helper already when unhelp above.
+         * So need to wait it.
+         */
+        synchronize_rcu();
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);
 
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 426457047578..a61d6df6e5f6 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -424,6 +424,10 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write,
         if (write) {
                 struct ctl_table tmp = *table;
 
+                /* proc_dostring() can append to existing strings, so we need to
+                 * initialize it as an empty string.
+                 */
+                buf[0] = '\0';
                 tmp.data = buf;
                 r = proc_dostring(&tmp, write, buffer, lenp, ppos);
                 if (r)
@@ -442,14 +446,17 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write,
                 rcu_assign_pointer(net->nf.nf_loggers[tindex], logger);
                 mutex_unlock(&nf_log_mutex);
         } else {
+                struct ctl_table tmp = *table;
+
+                tmp.data = buf;
                 mutex_lock(&nf_log_mutex);
                 logger = nft_log_dereference(net->nf.nf_loggers[tindex]);
                 if (!logger)
-                        table->data = "NONE";
+                        strlcpy(buf, "NONE", sizeof(buf));
                 else
-                        table->data = logger->name;
-                r = proc_dostring(table, write, buffer, lenp, ppos);
+                        strlcpy(buf, logger->name, sizeof(buf));
                 mutex_unlock(&nf_log_mutex);
+                r = proc_dostring(&tmp, write, buffer, lenp, ppos);
         }
 
         return r;
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 4ccd2988f9db..ea4ba551abb2 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1243,6 +1243,9 @@ static int nfqnl_recv_unsupp(struct net *net, struct sock *ctnl,
 static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = {
         [NFQA_CFG_CMD]          = { .len = sizeof(struct nfqnl_msg_config_cmd) },
         [NFQA_CFG_PARAMS]       = { .len = sizeof(struct nfqnl_msg_config_params) },
+        [NFQA_CFG_QUEUE_MAXLEN] = { .type = NLA_U32 },
+        [NFQA_CFG_MASK]         = { .type = NLA_U32 },
+        [NFQA_CFG_FLAGS]        = { .type = NLA_U32 },
 };
 
 static const struct nf_queue_handler nfqh = {
diff --git a/net/rds/connection.c b/net/rds/connection.c
index abef75da89a7..cfb05953b0e5 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -659,11 +659,19 @@ static void rds_conn_info(struct socket *sock, unsigned int len,
 
 int rds_conn_init(void)
 {
+        int ret;
+
+        ret = rds_loop_net_init(); /* register pernet callback */
+        if (ret)
+                return ret;
+
         rds_conn_slab = kmem_cache_create("rds_connection",
                                           sizeof(struct rds_connection),
                                           0, 0, NULL);
-        if (!rds_conn_slab)
+        if (!rds_conn_slab) {
+                rds_loop_net_exit();
                 return -ENOMEM;
+        }
 
         rds_info_register_func(RDS_INFO_CONNECTIONS, rds_conn_info);
         rds_info_register_func(RDS_INFO_SEND_MESSAGES,
@@ -676,6 +684,7 @@ int rds_conn_init(void)
 
 void rds_conn_exit(void)
 {
+        rds_loop_net_exit(); /* unregister pernet callback */
         rds_loop_exit();
 
         WARN_ON(!hlist_empty(rds_conn_hash));
diff --git a/net/rds/loop.c b/net/rds/loop.c
index dac6218a460e..feea1f96ee2a 100644
--- a/net/rds/loop.c
+++ b/net/rds/loop.c
@@ -33,6 +33,8 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/in.h>
+#include <net/net_namespace.h>
+#include <net/netns/generic.h>
 
 #include "rds_single_path.h"
 #include "rds.h"
@@ -40,6 +42,17 @@
 
 static DEFINE_SPINLOCK(loop_conns_lock);
 static LIST_HEAD(loop_conns);
+static atomic_t rds_loop_unloading = ATOMIC_INIT(0);
+
+static void rds_loop_set_unloading(void)
+{
+        atomic_set(&rds_loop_unloading, 1);
+}
+
+static bool rds_loop_is_unloading(struct rds_connection *conn)
+{
+        return atomic_read(&rds_loop_unloading) != 0;
+}
 
 /*
  * This 'loopback' transport is a special case for flows that originate
@@ -165,6 +178,8 @@ void rds_loop_exit(void)
         struct rds_loop_connection *lc, *_lc;
         LIST_HEAD(tmp_list);
 
+        rds_loop_set_unloading();
+        synchronize_rcu();
         /* avoid calling conn_destroy with irqs off */
         spin_lock_irq(&loop_conns_lock);
         list_splice(&loop_conns, &tmp_list);
@@ -177,6 +192,46 @@ void rds_loop_exit(void)
         }
 }
 
+static void rds_loop_kill_conns(struct net *net)
+{
+        struct rds_loop_connection *lc, *_lc;
+        LIST_HEAD(tmp_list);
+
+        spin_lock_irq(&loop_conns_lock);
+        list_for_each_entry_safe(lc, _lc, &loop_conns, loop_node)  {
+                struct net *c_net = read_pnet(&lc->conn->c_net);
+
+                if (net != c_net)
+                        continue;
+                list_move_tail(&lc->loop_node, &tmp_list);
+        }
+        spin_unlock_irq(&loop_conns_lock);
+
+        list_for_each_entry_safe(lc, _lc, &tmp_list, loop_node) {
+                WARN_ON(lc->conn->c_passive);
+                rds_conn_destroy(lc->conn);
+        }
+}
+
+static void __net_exit rds_loop_exit_net(struct net *net)
+{
+        rds_loop_kill_conns(net);
+}
+
+static struct pernet_operations rds_loop_net_ops = {
+        .exit = rds_loop_exit_net,
+};
+
+int rds_loop_net_init(void)
+{
+        return register_pernet_device(&rds_loop_net_ops);
+}
+
+void rds_loop_net_exit(void)
+{
+        unregister_pernet_device(&rds_loop_net_ops);
+}
+
 /*
  * This is missing .xmit_* because loop doesn't go through generic
  * rds_send_xmit() and doesn't call rds_recv_incoming().  .listen_stop and
@@ -194,4 +249,5 @@ struct rds_transport rds_loop_transport = {
         .inc_free               = rds_loop_inc_free,
         .t_name                 = "loopback",
         .t_type                 = RDS_TRANS_LOOP,
+        .t_unloading            = rds_loop_is_unloading,
 };
diff --git a/net/rds/loop.h b/net/rds/loop.h
index 469fa4b2da4f..bbc8cdd030df 100644
--- a/net/rds/loop.h
+++ b/net/rds/loop.h
@@ -5,6 +5,8 @@
 /* loop.c */
 extern struct rds_transport rds_loop_transport;
 
+int rds_loop_net_init(void);
+void rds_loop_net_exit(void);
 void rds_loop_exit(void);
 
 #endif
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 973b4471b532..3c1405df936c 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -45,6 +45,7 @@ static DEFINE_MUTEX(smc_create_lgr_pending);	/* serialize link group
                                                  */
 
 static void smc_tcp_listen_work(struct work_struct *);
+static void smc_connect_work(struct work_struct *);
 
 static void smc_set_keepalive(struct sock *sk, int val)
 {
@@ -122,6 +123,12 @@ static int smc_release(struct socket *sock)
                 goto out;
 
         smc = smc_sk(sk);
+
+        /* cleanup for a dangling non-blocking connect */
+        flush_work(&smc->connect_work);
+        kfree(smc->connect_info);
+        smc->connect_info = NULL;
+
         if (sk->sk_state == SMC_LISTEN)
                 /* smc_close_non_accepted() is called and acquires
                  * sock lock for child sockets again
@@ -186,6 +193,7 @@ static struct sock *smc_sock_alloc(struct net *net, struct socket *sock,
         sk->sk_protocol = protocol;
         smc = smc_sk(sk);
         INIT_WORK(&smc->tcp_listen_work, smc_tcp_listen_work);
+        INIT_WORK(&smc->connect_work, smc_connect_work);
         INIT_DELAYED_WORK(&smc->conn.tx_work, smc_tx_work);
         INIT_LIST_HEAD(&smc->accept_q);
         spin_lock_init(&smc->accept_q_lock);
@@ -576,6 +584,35 @@ static int __smc_connect(struct smc_sock *smc)
         return 0;
 }
 
+static void smc_connect_work(struct work_struct *work)
+{
+        struct smc_sock *smc = container_of(work, struct smc_sock,
+                                            connect_work);
+        int rc;
+
+        lock_sock(&smc->sk);
+        rc = kernel_connect(smc->clcsock, &smc->connect_info->addr,
+                            smc->connect_info->alen, smc->connect_info->flags);
+        if (smc->clcsock->sk->sk_err) {
+                smc->sk.sk_err = smc->clcsock->sk->sk_err;
+                goto out;
+        }
+        if (rc < 0) {
+                smc->sk.sk_err = -rc;
+                goto out;
+        }
+
+        rc = __smc_connect(smc);
+        if (rc < 0)
+                smc->sk.sk_err = -rc;
+
+out:
+        smc->sk.sk_state_change(&smc->sk);
+        kfree(smc->connect_info);
+        smc->connect_info = NULL;
+        release_sock(&smc->sk);
+}
+
 static int smc_connect(struct socket *sock, struct sockaddr *addr,
                        int alen, int flags)
 {
@@ -605,15 +642,32 @@ static int smc_connect(struct socket *sock, struct sockaddr *addr,
 
         smc_copy_sock_settings_to_clc(smc);
         tcp_sk(smc->clcsock->sk)->syn_smc = 1;
-        rc = kernel_connect(smc->clcsock, addr, alen, flags);
-        if (rc)
-                goto out;
+        if (flags & O_NONBLOCK) {
+                if (smc->connect_info) {
+                        rc = -EALREADY;
+                        goto out;
+                }
+                smc->connect_info = kzalloc(alen + 2 * sizeof(int), GFP_KERNEL);
+                if (!smc->connect_info) {
+                        rc = -ENOMEM;
+                        goto out;
+                }
+                smc->connect_info->alen = alen;
+                smc->connect_info->flags = flags ^ O_NONBLOCK;
+                memcpy(&smc->connect_info->addr, addr, alen);
+                schedule_work(&smc->connect_work);
+                rc = -EINPROGRESS;
+        } else {
+                rc = kernel_connect(smc->clcsock, addr, alen, flags);
+                if (rc)
+                        goto out;
 
-        rc = __smc_connect(smc);
-        if (rc < 0)
-                goto out;
-        else
-                rc = 0; /* success cases including fallback */
+                rc = __smc_connect(smc);
+                if (rc < 0)
+                        goto out;
+                else
+                        rc = 0; /* success cases including fallback */
+        }
 
 out:
         release_sock(sk);
@@ -1279,40 +1333,20 @@ static __poll_t smc_poll(struct file *file, struct socket *sock,
         struct sock *sk = sock->sk;
         __poll_t mask = 0;
         struct smc_sock *smc;
-        int rc;
 
         if (!sk)
                 return EPOLLNVAL;
 
         smc = smc_sk(sock->sk);
-        sock_hold(sk);
-        lock_sock(sk);
         if ((sk->sk_state == SMC_INIT) || smc->use_fallback) {
                 /* delegate to CLC child sock */
-                release_sock(sk);
                 mask = smc->clcsock->ops->poll(file, smc->clcsock, wait);
-                lock_sock(sk);
                 sk->sk_err = smc->clcsock->sk->sk_err;
-                if (sk->sk_err) {
+                if (sk->sk_err)
                         mask |= EPOLLERR;
-                } else {
-                        /* if non-blocking connect finished ... */
-                        if (sk->sk_state == SMC_INIT &&
-                            mask & EPOLLOUT &&
-                            smc->clcsock->sk->sk_state != TCP_CLOSE) {
-                                rc = __smc_connect(smc);
-                                if (rc < 0)
-                                        mask |= EPOLLERR;
-                                /* success cases including fallback */
-                                mask |= EPOLLOUT | EPOLLWRNORM;
-                        }
-                }
         } else {
-                if (sk->sk_state != SMC_CLOSED) {
-                        release_sock(sk);
+                if (sk->sk_state != SMC_CLOSED)
                         sock_poll_wait(file, sk_sleep(sk), wait);
-                        lock_sock(sk);
-                }
                 if (sk->sk_err)
                         mask |= EPOLLERR;
                 if ((sk->sk_shutdown == SHUTDOWN_MASK) ||
@@ -1338,10 +1372,7 @@ static __poll_t smc_poll(struct file *file, struct socket *sock,
                 }
                 if (smc->conn.urg_state == SMC_URG_VALID)
                         mask |= EPOLLPRI;
-
         }
-        release_sock(sk);
-        sock_put(sk);
 
         return mask;
 }
diff --git a/net/smc/smc.h b/net/smc/smc.h
index 51ae1f10d81a..d7ca26570482 100644
--- a/net/smc/smc.h
+++ b/net/smc/smc.h
@@ -187,11 +187,19 @@ struct smc_connection {
         struct work_struct      close_work;     /* peer sent some closing */
 };
 
+struct smc_connect_info {
+        int                     flags;
+        int                     alen;
+        struct sockaddr         addr;
+};
+
 struct smc_sock {                               /* smc sock container */
         struct sock             sk;
         struct socket           *clcsock;       /* internal tcp socket */
         struct smc_connection   conn;           /* smc connection */
         struct smc_sock         *listen_smc;    /* listen parent */
+        struct smc_connect_info *connect_info;  /* connect address & flags */
+        struct work_struct      connect_work;   /* handle non-blocking connect*/
         struct work_struct      tcp_listen_work;/* handle tcp socket accepts */
         struct work_struct      smc_listen_work;/* prepare new accept socket */
         struct list_head        accept_q;       /* sockets to be accepted */
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index 373836615c57..625acb27efcc 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -35,7 +35,6 @@ struct _strp_msg {
          */
         struct strp_msg strp;
         int accum_len;
-        int early_eaten;
 };
 
 static inline struct _strp_msg *_strp_msg(struct sk_buff *skb)
@@ -115,20 +114,6 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
         head = strp->skb_head;
         if (head) {
                 /* Message already in progress */
-
-                stm = _strp_msg(head);
-                if (unlikely(stm->early_eaten)) {
-                        /* Already some number of bytes on the receive sock
-                         * data saved in skb_head, just indicate they
-                         * are consumed.
-                         */
-                        eaten = orig_len <= stm->early_eaten ?
-                                orig_len : stm->early_eaten;
-                        stm->early_eaten -= eaten;
-
-                        return eaten;
-                }
-
                 if (unlikely(orig_offset)) {
                         /* Getting data with a non-zero offset when a message is
                          * in progress is not expected. If it does happen, we
@@ -297,9 +282,9 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
                                 }
 
                                 stm->accum_len += cand_len;
+                                eaten += cand_len;
                                 strp->need_bytes = stm->strp.full_len -
                                                        stm->accum_len;
-                                stm->early_eaten = cand_len;
                                 STRP_STATS_ADD(strp->stats.bytes, cand_len);
                                 desc->count = 0; /* Stop reading socket */
                                 break;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index c7bbe5f0aae8..4eece06be1e7 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6231,7 +6231,7 @@ do {									    \
                                   nl80211_check_s32);
         /*
          * Check HT operation mode based on
-         * IEEE 802.11 2012 8.4.2.59 HT Operation element.
+         * IEEE 802.11-2016 9.4.2.57 HT Operation element.
          */
         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
@@ -6241,22 +6241,9 @@ do {									    \
                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
                         return -EINVAL;
 
-                if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
-                    (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
-                        return -EINVAL;
+                /* NON_HT_STA bit is reserved, but some programs set it */
+                ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
 
-                switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
-                case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
-                case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
-                        if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
-                                return -EINVAL;
-                        break;
-                case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
-                case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
-                        if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
-                                return -EINVAL;
-                        break;
-                }
                 cfg->ht_opmode = ht_opmode;
                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
         }
@@ -10962,9 +10949,12 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                                     rem) {
                         u8 *mask_pat;
 
-                        nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
-                                         nl80211_packet_pattern_policy,
-                                         info->extack);
+                        err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
+                                               nl80211_packet_pattern_policy,
+                                               info->extack);
+                        if (err)
+                                goto error;
+
                         err = -EINVAL;
                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
                             !pat_tb[NL80211_PKTPAT_PATTERN])
@@ -11213,8 +11203,11 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
                             rem) {
                 u8 *mask_pat;
 
-                nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
-                                 nl80211_packet_pattern_policy, NULL);
+                err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
+                                       nl80211_packet_pattern_policy, NULL);
+                if (err)
+                        return err;
+
                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
                     !pat_tb[NL80211_PKTPAT_PATTERN])
                         return -EINVAL;