51 files changed, 535 insertions, 303 deletions

diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index fc1835c6bb40..00f9e144cc97 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -251,7 +251,7 @@ batadv_frag_merge_packets(struct hlist_head *chain, struct sk_buff *skb)
         kfree(entry);
 
         /* Make room for the rest of the fragments. */
-        if (pskb_expand_head(skb_out, 0, size - skb->len, GFP_ATOMIC) < 0) {
+        if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
                 kfree_skb(skb_out);
                 skb_out = NULL;
                 goto free;
@@ -434,7 +434,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
          * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE
          */
         mtu = min_t(unsigned, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
-        max_fragment_size = (mtu - header_size - ETH_HLEN);
+        max_fragment_size = mtu - header_size;
         max_packet_size = max_fragment_size * BATADV_FRAG_MAX_FRAGMENTS;
 
         /* Don't even try to fragment, if we need more than 16 fragments */
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index 90cff585b37d..e0bcf9e84273 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -810,7 +810,7 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
                 goto out;
 
         gw_node = batadv_gw_node_get(bat_priv, orig_dst_node);
-        if (!gw_node->bandwidth_down == 0)
+        if (!gw_node)
                 goto out;
 
         switch (atomic_read(&bat_priv->gw_mode)) {
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index ab6bb2af1d45..b24e4bb64fb5 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -685,11 +685,13 @@ static void batadv_mcast_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
                 if (orig_initialized)
                         atomic_dec(&bat_priv->mcast.num_disabled);
                 orig->capabilities |= BATADV_ORIG_CAPA_HAS_MCAST;
-        /* If mcast support is being switched off increase the disabled
-         * mcast node counter.
+        /* If mcast support is being switched off or if this is an initial
+         * OGM without mcast support then increase the disabled mcast
+         * node counter.
          */
         } else if (!orig_mcast_enabled &&
-                   orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST) {
+                   (orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST ||
+                    !orig_initialized)) {
                 atomic_inc(&bat_priv->mcast.num_disabled);
                 orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_MCAST;
         }
@@ -738,7 +740,8 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig)
 {
         struct batadv_priv *bat_priv = orig->bat_priv;
 
-        if (!(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST))
+        if (!(orig->capabilities & BATADV_ORIG_CAPA_HAS_MCAST) &&
+            orig->capa_initialized & BATADV_ORIG_CAPA_HAS_MCAST)
                 atomic_dec(&bat_priv->mcast.num_disabled);
 
         batadv_mcast_want_unsnoop_update(bat_priv, orig, BATADV_NO_FLAGS);
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index 8d04d174669e..fab47f1f3ef9 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -133,7 +133,7 @@ int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
         if (!bat_priv->nc.decoding_hash)
                 goto err;
 
-        batadv_hash_set_lock_class(bat_priv->nc.coding_hash,
+        batadv_hash_set_lock_class(bat_priv->nc.decoding_hash,
                                    &batadv_nc_decoding_hash_lock_class_key);
 
         INIT_DELAYED_WORK(&bat_priv->nc.work, batadv_nc_worker);
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 6a484514cd3e..bea8198d0198 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -570,9 +570,6 @@ static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
 
         batadv_frag_purge_orig(orig_node, NULL);
 
-        batadv_tt_global_del_orig(orig_node->bat_priv, orig_node, -1,
-                                  "originator timed out");
-
         if (orig_node->bat_priv->bat_algo_ops->bat_orig_free)
                 orig_node->bat_priv->bat_algo_ops->bat_orig_free(orig_node);
 
@@ -678,6 +675,7 @@ struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
         atomic_set(&orig_node->last_ttvn, 0);
         orig_node->tt_buff = NULL;
         orig_node->tt_buff_len = 0;
+        orig_node->last_seen = jiffies;
         reset_time = jiffies - 1 - msecs_to_jiffies(BATADV_RESET_PROTECTION_MS);
         orig_node->bcast_seqno_reset = reset_time;
 #ifdef CONFIG_BATMAN_ADV_MCAST
@@ -977,6 +975,9 @@ static void _batadv_purge_orig(struct batadv_priv *bat_priv)
                         if (batadv_purge_orig_node(bat_priv, orig_node)) {
                                 batadv_gw_node_delete(bat_priv, orig_node);
                                 hlist_del_rcu(&orig_node->hash_entry);
+                                batadv_tt_global_del_orig(orig_node->bat_priv,
+                                                          orig_node, -1,
+                                                          "originator timed out");
                                 batadv_orig_node_free_ref(orig_node);
                                 continue;
                         }
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 35f76f2f7824..6648f321864d 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -443,11 +443,13 @@ batadv_find_router(struct batadv_priv *bat_priv,
 
         router = batadv_orig_router_get(orig_node, recv_if);
 
+        if (!router)
+                return router;
+
         /* only consider bonding for recv_if == BATADV_IF_DEFAULT (first hop)
          * and if activated.
          */
-        if (recv_if == BATADV_IF_DEFAULT || !atomic_read(&bat_priv->bonding) ||
-            !router)
+        if (!(recv_if == BATADV_IF_DEFAULT && atomic_read(&bat_priv->bonding)))
                 return router;
 
         /* bonding: loop through the list of possible routers found
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 76617be1e797..c989253737f0 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -390,7 +390,6 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
 
 drop:
         dev->stats.rx_dropped++;
-        kfree_skb(skb);
         return NET_RX_DROP;
 }
 
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 85bcc21e84d2..ce82722d049b 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -533,6 +533,9 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
 
         BT_DBG("");
 
+        if (!l2cap_is_socket(sock))
+                return -EBADFD;
+
         baswap((void *) dst, &l2cap_pi(sock->sk)->chan->dst);
         baswap((void *) src, &l2cap_pi(sock->sk)->chan->src);
 
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 67fe5e84e68f..278a194e6af4 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -334,6 +334,9 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
 
         BT_DBG("");
 
+        if (!l2cap_is_socket(sock))
+                return -EBADFD;
+
         session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);
         if (!session)
                 return -ENOMEM;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 79d84b88b8f0..fe18825cc8a4 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -661,7 +661,7 @@ static void hci_req_add_le_create_conn(struct hci_request *req,
         memset(&cp, 0, sizeof(cp));
 
         /* Update random address, but set require_privacy to false so
-         * that we never connect with an unresolvable address.
+         * that we never connect with an non-resolvable address.
          */
         if (hci_update_random_address(req, false, &own_addr_type))
                 return;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 93f92a085506..5dcacf9607e4 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1373,8 +1373,6 @@ static void hci_init1_req(struct hci_request *req, unsigned long opt)
 
 static void bredr_setup(struct hci_request *req)
 {
-        struct hci_dev *hdev = req->hdev;
-
         __le16 param;
         __u8 flt_type;
 
@@ -1403,14 +1401,6 @@ static void bredr_setup(struct hci_request *req)
         /* Connection accept timeout ~20 secs */
         param = cpu_to_le16(0x7d00);
         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
-
-        /* AVM Berlin (31), aka "BlueFRITZ!", reports version 1.2,
-         * but it does not support page scan related HCI commands.
-         */
-        if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1) {
-                hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
-                hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
-        }
 }
 
 static void le_setup(struct hci_request *req)
@@ -1718,6 +1708,16 @@ static void hci_init3_req(struct hci_request *req, unsigned long opt)
         if (hdev->commands[5] & 0x10)
                 hci_setup_link_policy(req);
 
+        if (hdev->commands[8] & 0x01)
+                hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
+
+        /* Some older Broadcom based Bluetooth 1.2 controllers do not
+         * support the Read Page Scan Type command. Check support for
+         * this command in the bit mask of supported commands.
+         */
+        if (hdev->commands[13] & 0x01)
+                hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
+
         if (lmp_le_capable(hdev)) {
                 u8 events[8];
 
@@ -2634,6 +2634,12 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         drain_workqueue(hdev->workqueue);
 
         hci_dev_lock(hdev);
+
+        if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
+                if (hdev->dev_type == HCI_BREDR)
+                        mgmt_powered(hdev, 0);
+        }
+
         hci_inquiry_cache_flush(hdev);
         hci_pend_le_actions_clear(hdev);
         hci_conn_hash_flush(hdev);
@@ -2681,14 +2687,6 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         hdev->flags &= BIT(HCI_RAW);
         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 
-        if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
-                if (hdev->dev_type == HCI_BREDR) {
-                        hci_dev_lock(hdev);
-                        mgmt_powered(hdev, 0);
-                        hci_dev_unlock(hdev);
-                }
-        }
-
         /* Controller radio is available but is currently powered down */
         hdev->amp_status = AMP_STATUS_POWERED_DOWN;
 
@@ -3083,7 +3081,9 @@ static void hci_power_on(struct work_struct *work)
 
         err = hci_dev_do_open(hdev);
         if (err < 0) {
+                hci_dev_lock(hdev);
                 mgmt_set_powered_failed(hdev, err);
+                hci_dev_unlock(hdev);
                 return;
         }
 
@@ -3959,17 +3959,29 @@ int hci_update_random_address(struct hci_request *req, bool require_privacy,
         }
 
         /* In case of required privacy without resolvable private address,
-         * use an unresolvable private address. This is useful for active
+         * use an non-resolvable private address. This is useful for active
          * scanning and non-connectable advertising.
          */
         if (require_privacy) {
-                bdaddr_t urpa;
+                bdaddr_t nrpa;
+
+                while (true) {
+                        /* The non-resolvable private address is generated
+                         * from random six bytes with the two most significant
+                         * bits cleared.
+                         */
+                        get_random_bytes(&nrpa, 6);
+                        nrpa.b[5] &= 0x3f;
 
-                get_random_bytes(&urpa, 6);
-                urpa.b[5] &= 0x3f;      /* Clear two most significant bits */
+                        /* The non-resolvable private address shall not be
+                         * equal to the public address.
+                         */
+                        if (bacmp(&hdev->bdaddr, &nrpa))
+                                break;
+                }
 
                 *own_addr_type = ADDR_LE_DEV_RANDOM;
-                set_random_addr(req, &urpa);
+                set_random_addr(req, &nrpa);
                 return 0;
         }
 
@@ -5625,7 +5637,7 @@ void hci_req_add_le_passive_scan(struct hci_request *req)
         u8 filter_policy;
 
         /* Set require_privacy to false since no SCAN_REQ are send
-         * during passive scanning. Not using an unresolvable address
+         * during passive scanning. Not using an non-resolvable address
          * here is important so that peer devices using direct
          * advertising with our address will be correctly reported
          * by the controller.
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 322abbbbcef9..3f2e8b830cbd 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -242,7 +242,8 @@ static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
         if (rp->status)
                 return;
 
-        if (test_bit(HCI_SETUP, &hdev->dev_flags))
+        if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
+            test_bit(HCI_CONFIG, &hdev->dev_flags))
                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 }
 
@@ -257,6 +258,8 @@ static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
         if (!sent)
                 return;
 
+        hci_dev_lock(hdev);
+
         if (!status) {
                 __u8 param = *((__u8 *) sent);
 
@@ -268,6 +271,8 @@ static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 
         if (test_bit(HCI_MGMT, &hdev->dev_flags))
                 mgmt_auth_enable_complete(hdev, status);
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
@@ -443,6 +448,8 @@ static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
         if (!sent)
                 return;
 
+        hci_dev_lock(hdev);
+
         if (!status) {
                 if (sent->mode)
                         hdev->features[1][0] |= LMP_HOST_SSP;
@@ -458,6 +465,8 @@ static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
                 else
                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
         }
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
@@ -471,6 +480,8 @@ static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
         if (!sent)
                 return;
 
+        hci_dev_lock(hdev);
+
         if (!status) {
                 if (sent->support)
                         hdev->features[1][0] |= LMP_HOST_SC;
@@ -486,6 +497,8 @@ static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
                 else
                         clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
         }
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
@@ -497,7 +510,8 @@ static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
         if (rp->status)
                 return;
 
-        if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
+        if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
+            test_bit(HCI_CONFIG, &hdev->dev_flags)) {
                 hdev->hci_ver = rp->hci_ver;
                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
                 hdev->lmp_ver = rp->lmp_ver;
@@ -516,7 +530,8 @@ static void hci_cc_read_local_commands(struct hci_dev *hdev,
         if (rp->status)
                 return;
 
-        if (test_bit(HCI_SETUP, &hdev->dev_flags))
+        if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
+            test_bit(HCI_CONFIG, &hdev->dev_flags))
                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 }
 
@@ -1135,6 +1150,8 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
         if (!cp)
                 return;
 
+        hci_dev_lock(hdev);
+
         switch (cp->enable) {
         case LE_SCAN_ENABLE:
                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
@@ -1184,6 +1201,8 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
                 break;
         }
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
@@ -1278,6 +1297,8 @@ static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
         if (!sent)
                 return;
 
+        hci_dev_lock(hdev);
+
         if (sent->le) {
                 hdev->features[1][0] |= LMP_HOST_LE;
                 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
@@ -1291,6 +1312,8 @@ static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
         else
                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
@@ -2174,7 +2197,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 return;
         }
 
-        if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
+        /* Require HCI_CONNECTABLE or a whitelist entry to accept the
+         * connection. These features are only touched through mgmt so
+         * only do the checks if HCI_MGMT is set.
+         */
+        if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
+            !test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
                                     BDADDR_BREDR)) {
                     hci_reject_conn(hdev, &ev->bdaddr);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index cc25d0b74b36..07348e142f16 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -1314,13 +1314,14 @@ int hidp_connection_add(struct hidp_connadd_req *req,
 {
         struct hidp_session *session;
         struct l2cap_conn *conn;
-        struct l2cap_chan *chan = l2cap_pi(ctrl_sock->sk)->chan;
+        struct l2cap_chan *chan;
         int ret;
 
         ret = hidp_verify_sockets(ctrl_sock, intr_sock);
         if (ret)
                 return ret;
 
+        chan = l2cap_pi(ctrl_sock->sk)->chan;
         conn = NULL;
         l2cap_chan_lock(chan);
         if (chan->conn)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a2b6dfa38a0c..d04dc0095736 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -6966,8 +6966,9 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
             test_bit(HCI_HS_ENABLED, &hcon->hdev->dev_flags))
                 conn->local_fixed_chan |= L2CAP_FC_A2MP;
 
-        if (bredr_sc_enabled(hcon->hdev) &&
-            test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
+        if (test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags) &&
+            (bredr_sc_enabled(hcon->hdev) ||
+             test_bit(HCI_FORCE_LESC, &hcon->hdev->dbg_flags)))
                 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
 
         mutex_init(&conn->ident_lock);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 7384f1161336..693ce8bcd06e 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2199,12 +2199,14 @@ static void le_enable_complete(struct hci_dev *hdev, u8 status)
 {
         struct cmd_lookup match = { NULL, hdev };
 
+        hci_dev_lock(hdev);
+
         if (status) {
                 u8 mgmt_err = mgmt_status(status);
 
                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
                                      &mgmt_err);
-                return;
+                goto unlock;
         }
 
         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
@@ -2222,17 +2224,16 @@ static void le_enable_complete(struct hci_dev *hdev, u8 status)
         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
                 struct hci_request req;
 
-                hci_dev_lock(hdev);
-
                 hci_req_init(&req, hdev);
                 update_adv_data(&req);
                 update_scan_rsp_data(&req);
                 hci_req_run(&req, NULL);
 
                 hci_update_background_scan(hdev);
-
-                hci_dev_unlock(hdev);
         }
+
+unlock:
+        hci_dev_unlock(hdev);
 }
 
 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
@@ -3114,14 +3115,13 @@ static void pairing_complete(struct pending_cmd *cmd, u8 status)
         conn->disconn_cfm_cb = NULL;
 
         hci_conn_drop(conn);
-        hci_conn_put(conn);
-
-        mgmt_pending_remove(cmd);
 
         /* The device is paired so there is no need to remove
          * its connection parameters anymore.
          */
         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
+
+        hci_conn_put(conn);
 }
 
 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
@@ -3130,8 +3130,10 @@ void mgmt_smp_complete(struct hci_conn *conn, bool complete)
         struct pending_cmd *cmd;
 
         cmd = find_pairing(conn);
-        if (cmd)
+        if (cmd) {
                 cmd->cmd_complete(cmd, status);
+                mgmt_pending_remove(cmd);
+        }
 }
 
 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
@@ -3141,10 +3143,13 @@ static void pairing_complete_cb(struct hci_conn *conn, u8 status)
         BT_DBG("status %u", status);
 
         cmd = find_pairing(conn);
-        if (!cmd)
+        if (!cmd) {
                 BT_DBG("Unable to find a pending command");
-        else
-                cmd->cmd_complete(cmd, mgmt_status(status));
+                return;
+        }
+
+        cmd->cmd_complete(cmd, mgmt_status(status));
+        mgmt_pending_remove(cmd);
 }
 
 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
@@ -3157,10 +3162,13 @@ static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
                 return;
 
         cmd = find_pairing(conn);
-        if (!cmd)
+        if (!cmd) {
                 BT_DBG("Unable to find a pending command");
-        else
-                cmd->cmd_complete(cmd, mgmt_status(status));
+                return;
+        }
+
+        cmd->cmd_complete(cmd, mgmt_status(status));
+        mgmt_pending_remove(cmd);
 }
 
 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
@@ -3274,8 +3282,10 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         cmd->user_data = hci_conn_get(conn);
 
         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
-            hci_conn_security(conn, sec_level, auth_type, true))
-                pairing_complete(cmd, 0);
+            hci_conn_security(conn, sec_level, auth_type, true)) {
+                cmd->cmd_complete(cmd, 0);
+                mgmt_pending_remove(cmd);
+        }
 
         err = 0;
 
@@ -3317,7 +3327,8 @@ static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                 goto unlock;
         }
 
-        pairing_complete(cmd, MGMT_STATUS_CANCELLED);
+        cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
+        mgmt_pending_remove(cmd);
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
                            addr, sizeof(*addr));
@@ -3791,7 +3802,7 @@ static bool trigger_discovery(struct hci_request *req, u8 *status)
 
                 /* All active scans will be done with either a resolvable
                  * private address (when privacy feature has been enabled)
-                 * or unresolvable private address.
+                 * or non-resolvable private address.
                  */
                 err = hci_update_random_address(req, true, &own_addr_type);
                 if (err < 0) {
@@ -4279,12 +4290,14 @@ static void set_advertising_complete(struct hci_dev *hdev, u8 status)
 {
         struct cmd_lookup match = { NULL, hdev };
 
+        hci_dev_lock(hdev);
+
         if (status) {
                 u8 mgmt_err = mgmt_status(status);
 
                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
                                      cmd_status_rsp, &mgmt_err);
-                return;
+                goto unlock;
         }
 
         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
@@ -4299,6 +4312,9 @@ static void set_advertising_complete(struct hci_dev *hdev, u8 status)
 
         if (match.sk)
                 sock_put(match.sk);
+
+unlock:
+        hci_dev_unlock(hdev);
 }
 
 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
@@ -6081,6 +6097,11 @@ static int powered_update_hci(struct hci_dev *hdev)
                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
         }
 
+        if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
+                u8 sc = 0x01;
+                hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, sizeof(sc), &sc);
+        }
+
         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
             lmp_bredr_capable(hdev)) {
                 struct hci_cp_write_le_host_supported cp;
@@ -6130,8 +6151,7 @@ static int powered_update_hci(struct hci_dev *hdev)
 int mgmt_powered(struct hci_dev *hdev, u8 powered)
 {
         struct cmd_lookup match = { NULL, hdev };
-        u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
-        u8 zero_cod[] = { 0, 0, 0 };
+        u8 status, zero_cod[] = { 0, 0, 0 };
         int err;
 
         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
@@ -6147,7 +6167,20 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
         }
 
         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
-        mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status_not_powered);
+
+        /* If the power off is because of hdev unregistration let
+         * use the appropriate INVALID_INDEX status. Otherwise use
+         * NOT_POWERED. We cover both scenarios here since later in
+         * mgmt_index_removed() any hci_conn callbacks will have already
+         * been triggered, potentially causing misleading DISCONNECTED
+         * status responses.
+         */
+        if (test_bit(HCI_UNREGISTER, &hdev->dev_flags))
+                status = MGMT_STATUS_INVALID_INDEX;
+        else
+                status = MGMT_STATUS_NOT_POWERED;
+
+        mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
 
         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
@@ -6681,8 +6714,10 @@ void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
                     cmd ? cmd->sk : NULL);
 
-        if (cmd)
-                pairing_complete(cmd, status);
+        if (cmd) {
+                cmd->cmd_complete(cmd, status);
+                mgmt_pending_remove(cmd);
+        }
 }
 
 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
@@ -7046,13 +7081,15 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                  * kept and checking possible scan response data
                  * will be skipped.
                  */
-                if (hdev->discovery.uuid_count > 0) {
+                if (hdev->discovery.uuid_count > 0)
                         match = eir_has_uuids(eir, eir_len,
                                               hdev->discovery.uuid_count,
                                               hdev->discovery.uuids);
-                        if (!match)
-                                return;
-                }
+                else
+                        match = true;
+
+                if (!match && !scan_rsp_len)
+                        return;
 
                 /* Copy EIR or advertising data into event */
                 memcpy(ev->eir, eir, eir_len);
@@ -7061,8 +7098,10 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                  * provided, results with empty EIR or advertising data
                  * should be dropped since they do not match any UUID.
                  */
-                if (hdev->discovery.uuid_count > 0)
+                if (hdev->discovery.uuid_count > 0 && !scan_rsp_len)
                         return;
+
+                match = false;
         }
 
         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 6a46252fe66f..b67749bb55bf 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -1673,7 +1673,8 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
         /* SMP over BR/EDR requires special treatment */
         if (conn->hcon->type == ACL_LINK) {
                 /* We must have a BR/EDR SC link */
-                if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags))
+                if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags) &&
+                    !test_bit(HCI_FORCE_LESC, &hdev->dbg_flags))
                         return SMP_CROSS_TRANSP_NOT_ALLOWED;
 
                 set_bit(SMP_FLAG_SC, &smp->flags);
@@ -2927,7 +2928,7 @@ static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid)
         tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, 0);
         if (IS_ERR(tfm_aes)) {
                 BT_ERR("Unable to create crypto context");
-                return ERR_PTR(PTR_ERR(tfm_aes));
+                return ERR_CAST(tfm_aes);
         }
 
 create_chan:
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 15845814a0f2..ba6eb17226da 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -676,7 +676,7 @@ static int calcu_signature(struct ceph_x_authorizer *au,
         int ret;
         char tmp_enc[40];
         __le32 tmp[5] = {
-                16u, msg->hdr.crc, msg->footer.front_crc,
+                cpu_to_le32(16), msg->hdr.crc, msg->footer.front_crc,
                 msg->footer.middle_crc, msg->footer.data_crc,
         };
         ret = ceph_x_encrypt(&au->session_key, &tmp, sizeof(tmp),
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index a83062ceeec9..f2148e22b148 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -717,7 +717,7 @@ static int get_poolop_reply_buf(const char *src, size_t src_len,
         if (src_len != sizeof(u32) + dst_len)
                 return -EINVAL;
 
-        buf_len = le32_to_cpu(*(u32 *)src);
+        buf_len = le32_to_cpu(*(__le32 *)src);
         if (buf_len != dst_len)
                 return -EINVAL;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index f411c28d0a66..683d493aa1bf 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1694,6 +1694,7 @@ int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
 
         skb_scrub_packet(skb, true);
         skb->protocol = eth_type_trans(skb, dev);
+        skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
 
         return 0;
 }
@@ -2522,7 +2523,7 @@ static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
 /* If MPLS offload request, verify we are testing hardware MPLS features
  * instead of standard features for the netdev.
  */
-#ifdef CONFIG_NET_MPLS_GSO
+#if IS_ENABLED(CONFIG_NET_MPLS_GSO)
 static netdev_features_t net_mpls_features(struct sk_buff *skb,
                                            netdev_features_t features,
                                            __be16 type)
@@ -2562,7 +2563,7 @@ static netdev_features_t harmonize_features(struct sk_buff *skb,
 
 netdev_features_t netif_skb_features(struct sk_buff *skb)
 {
-        const struct net_device *dev = skb->dev;
+        struct net_device *dev = skb->dev;
         netdev_features_t features = dev->features;
         u16 gso_segs = skb_shinfo(skb)->gso_segs;
         __be16 protocol = skb->protocol;
@@ -2570,11 +2571,21 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
         if (gso_segs > dev->gso_max_segs || gso_segs < dev->gso_min_segs)
                 features &= ~NETIF_F_GSO_MASK;
 
-        if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD)) {
-                struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
-                protocol = veh->h_vlan_encapsulated_proto;
-        } else if (!vlan_tx_tag_present(skb)) {
-                return harmonize_features(skb, features);
+        /* If encapsulation offload request, verify we are testing
+         * hardware encapsulation features instead of standard
+         * features for the netdev
+         */
+        if (skb->encapsulation)
+                features &= dev->hw_enc_features;
+
+        if (!vlan_tx_tag_present(skb)) {
+                if (unlikely(protocol == htons(ETH_P_8021Q) ||
+                             protocol == htons(ETH_P_8021AD))) {
+                        struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+                        protocol = veh->h_vlan_encapsulated_proto;
+                } else {
+                        goto finalize;
+                }
         }
 
         features = netdev_intersect_features(features,
@@ -2591,6 +2602,11 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
                                                      NETIF_F_HW_VLAN_CTAG_TX |
                                                      NETIF_F_HW_VLAN_STAG_TX);
 
+finalize:
+        if (dev->netdev_ops->ndo_features_check)
+                features &= dev->netdev_ops->ndo_features_check(skb, dev,
+                                                                features);
+
         return harmonize_features(skb, features);
 }
 EXPORT_SYMBOL(netif_skb_features);
@@ -2661,19 +2677,12 @@ static struct sk_buff *validate_xmit_skb(struct sk_buff *skb, struct net_device
         if (unlikely(!skb))
                 goto out_null;
 
-        /* If encapsulation offload request, verify we are testing
-         * hardware encapsulation features instead of standard
-         * features for the netdev
-         */
-        if (skb->encapsulation)
-                features &= dev->hw_enc_features;
-
         if (netif_needs_gso(dev, skb, features)) {
                 struct sk_buff *segs;
 
                 segs = skb_gso_segment(skb, features);
                 if (IS_ERR(segs)) {
-                        segs = NULL;
+                        goto out_kfree_skb;
                 } else if (segs) {
                         consume_skb(skb);
                         skb = segs;
@@ -4557,6 +4566,68 @@ void netif_napi_del(struct napi_struct *napi)
 }
 EXPORT_SYMBOL(netif_napi_del);
 
+static int napi_poll(struct napi_struct *n, struct list_head *repoll)
+{
+        void *have;
+        int work, weight;
+
+        list_del_init(&n->poll_list);
+
+        have = netpoll_poll_lock(n);
+
+        weight = n->weight;
+
+        /* This NAPI_STATE_SCHED test is for avoiding a race
+         * with netpoll's poll_napi().  Only the entity which
+         * obtains the lock and sees NAPI_STATE_SCHED set will
+         * actually make the ->poll() call.  Therefore we avoid
+         * accidentally calling ->poll() when NAPI is not scheduled.
+         */
+        work = 0;
+        if (test_bit(NAPI_STATE_SCHED, &n->state)) {
+                work = n->poll(n, weight);
+                trace_napi_poll(n);
+        }
+
+        WARN_ON_ONCE(work > weight);
+
+        if (likely(work < weight))
+                goto out_unlock;
+
+        /* Drivers must not modify the NAPI state if they
+         * consume the entire weight.  In such cases this code
+         * still "owns" the NAPI instance and therefore can
+         * move the instance around on the list at-will.
+         */
+        if (unlikely(napi_disable_pending(n))) {
+                napi_complete(n);
+                goto out_unlock;
+        }
+
+        if (n->gro_list) {
+                /* flush too old packets
+                 * If HZ < 1000, flush all packets.
+                 */
+                napi_gro_flush(n, HZ >= 1000);
+        }
+
+        /* Some drivers may have called napi_schedule
+         * prior to exhausting their budget.
+         */
+        if (unlikely(!list_empty(&n->poll_list))) {
+                pr_warn_once("%s: Budget exhausted after napi rescheduled\n",
+                             n->dev ? n->dev->name : "backlog");
+                goto out_unlock;
+        }
+
+        list_add_tail(&n->poll_list, repoll);
+
+out_unlock:
+        netpoll_poll_unlock(have);
+
+        return work;
+}
+
 static void net_rx_action(struct softirq_action *h)
 {
         struct softnet_data *sd = this_cpu_ptr(&softnet_data);
@@ -4564,74 +4635,34 @@ static void net_rx_action(struct softirq_action *h)
         int budget = netdev_budget;
         LIST_HEAD(list);
         LIST_HEAD(repoll);
-        void *have;
 
         local_irq_disable();
         list_splice_init(&sd->poll_list, &list);
         local_irq_enable();
 
-        while (!list_empty(&list)) {
+        for (;;) {
                 struct napi_struct *n;
-                int work, weight;
-
-                /* If softirq window is exhausted then punt.
-                 * Allow this to run for 2 jiffies since which will allow
-                 * an average latency of 1.5/HZ.
-                 */
-                if (unlikely(budget <= 0 || time_after_eq(jiffies, time_limit)))
-                        goto softnet_break;
-
-
-                n = list_first_entry(&list, struct napi_struct, poll_list);
-                list_del_init(&n->poll_list);
 
-                have = netpoll_poll_lock(n);
-
-                weight = n->weight;
-
-                /* This NAPI_STATE_SCHED test is for avoiding a race
-                 * with netpoll's poll_napi().  Only the entity which
-                 * obtains the lock and sees NAPI_STATE_SCHED set will
-                 * actually make the ->poll() call.  Therefore we avoid
-                 * accidentally calling ->poll() when NAPI is not scheduled.
-                 */
-                work = 0;
-                if (test_bit(NAPI_STATE_SCHED, &n->state)) {
-                        work = n->poll(n, weight);
-                        trace_napi_poll(n);
+                if (list_empty(&list)) {
+                        if (!sd_has_rps_ipi_waiting(sd) && list_empty(&repoll))
+                                return;
+                        break;
                 }
 
-                WARN_ON_ONCE(work > weight);
-
-                budget -= work;
+                n = list_first_entry(&list, struct napi_struct, poll_list);
+                budget -= napi_poll(n, &repoll);
 
-                /* Drivers must not modify the NAPI state if they
-                 * consume the entire weight.  In such cases this code
-                 * still "owns" the NAPI instance and therefore can
-                 * move the instance around on the list at-will.
+                /* If softirq window is exhausted then punt.
+                 * Allow this to run for 2 jiffies since which will allow
+                 * an average latency of 1.5/HZ.
                  */
-                if (unlikely(work == weight)) {
-                        if (unlikely(napi_disable_pending(n))) {
-                                napi_complete(n);
-                        } else {
-                                if (n->gro_list) {
-                                        /* flush too old packets
-                                         * If HZ < 1000, flush all packets.
-                                         */
-                                        napi_gro_flush(n, HZ >= 1000);
-                                }
-                                list_add_tail(&n->poll_list, &repoll);
-                        }
+                if (unlikely(budget <= 0 ||
+                             time_after_eq(jiffies, time_limit))) {
+                        sd->time_squeeze++;
+                        break;
                 }
-
-                netpoll_poll_unlock(have);
         }
 
-        if (!sd_has_rps_ipi_waiting(sd) &&
-            list_empty(&list) &&
-            list_empty(&repoll))
-                return;
-out:
         local_irq_disable();
 
         list_splice_tail_init(&sd->poll_list, &list);
@@ -4641,12 +4672,6 @@ out:
                 __raise_softirq_irqoff(NET_RX_SOFTIRQ);
 
         net_rps_action_and_irq_enable(sd);
-
-        return;
-
-softnet_break:
-        sd->time_squeeze++;
-        goto out;
 }
 
 struct netdev_adjacent {
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d06107d36ec8..9cf6fe9ddc0c 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2368,6 +2368,11 @@ int ndo_dflt_fdb_add(struct ndmsg *ndm,
                 return err;
         }
 
+        if (vid) {
+                pr_info("%s: vlans aren't supported yet for dev_uc|mc_add()\n", dev->name);
+                return err;
+        }
+
         if (is_unicast_ether_addr(addr) || is_link_local_ether_addr(addr))
                 err = dev_uc_add_excl(dev, addr);
         else if (is_multicast_ether_addr(addr))
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ae13ef6b3ea7..395c15b82087 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4148,6 +4148,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
         skb->ignore_df = 0;
         skb_dst_drop(skb);
         skb->mark = 0;
+        skb_init_secmark(skb);
         secpath_reset(skb);
         nf_reset(skb);
         nf_reset_trace(skb);
diff --git a/net/ipv4/geneve.c b/net/ipv4/geneve.c
index a457232f0131..394a200f93c1 100644
--- a/net/ipv4/geneve.c
+++ b/net/ipv4/geneve.c
@@ -122,14 +122,18 @@ int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
         int err;
 
         skb = udp_tunnel_handle_offloads(skb, !gs->sock->sk->sk_no_check_tx);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
 
         min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
                         + GENEVE_BASE_HLEN + opt_len + sizeof(struct iphdr)
                         + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
 
         err = skb_cow_head(skb, min_headroom);
-        if (unlikely(err))
+        if (unlikely(err)) {
+                kfree_skb(skb);
                 return err;
+        }
 
         skb = vlan_hwaccel_push_inside(skb);
         if (unlikely(!skb))
@@ -159,6 +163,15 @@ static void geneve_notify_add_rx_port(struct geneve_sock *gs)
         }
 }
 
+static void geneve_notify_del_rx_port(struct geneve_sock *gs)
+{
+        struct sock *sk = gs->sock->sk;
+        sa_family_t sa_family = sk->sk_family;
+
+        if (sa_family == AF_INET)
+                udp_del_offload(&gs->udp_offloads);
+}
+
 /* Callback from net/ipv4/udp.c to receive packets */
 static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 {
@@ -287,6 +300,7 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port,
                                     geneve_rcv_t *rcv, void *data,
                                     bool no_share, bool ipv6)
 {
+        struct geneve_net *gn = net_generic(net, geneve_net_id);
         struct geneve_sock *gs;
 
         gs = geneve_socket_create(net, port, rcv, data, ipv6);
@@ -296,15 +310,15 @@ struct geneve_sock *geneve_sock_add(struct net *net, __be16 port,
         if (no_share)   /* Return error if sharing is not allowed. */
                 return ERR_PTR(-EINVAL);
 
+        spin_lock(&gn->sock_lock);
         gs = geneve_find_sock(net, port);
-        if (gs) {
-                if (gs->rcv == rcv)
-                        atomic_inc(&gs->refcnt);
-                else
+        if (gs && ((gs->rcv != rcv) ||
+                   !atomic_add_unless(&gs->refcnt, 1, 0)))
                         gs = ERR_PTR(-EBUSY);
-        } else {
+        spin_unlock(&gn->sock_lock);
+
+        if (!gs)
                 gs = ERR_PTR(-EINVAL);
-        }
 
         return gs;
 }
@@ -312,9 +326,17 @@ EXPORT_SYMBOL_GPL(geneve_sock_add);
 
 void geneve_sock_release(struct geneve_sock *gs)
 {
+        struct net *net = sock_net(gs->sock->sk);
+        struct geneve_net *gn = net_generic(net, geneve_net_id);
+
         if (!atomic_dec_and_test(&gs->refcnt))
                 return;
 
+        spin_lock(&gn->sock_lock);
+        hlist_del_rcu(&gs->hlist);
+        geneve_notify_del_rx_port(gs);
+        spin_unlock(&gn->sock_lock);
+
         queue_work(geneve_wq, &gs->del_work);
 }
 EXPORT_SYMBOL_GPL(geneve_sock_release);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index ac8491245e5b..4f4bf5b99686 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -252,10 +252,6 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
         struct ip_tunnel *tunnel = netdev_priv(dev);
         const struct iphdr *tnl_params;
 
-        skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM));
-        if (IS_ERR(skb))
-                goto out;
-
         if (dev->header_ops) {
                 /* Need space for new headers */
                 if (skb_cow_head(skb, dev->needed_headroom -
@@ -268,6 +264,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
                  * to gre header.
                  */
                 skb_pull(skb, tunnel->hlen + sizeof(struct iphdr));
+                skb_reset_mac_header(skb);
         } else {
                 if (skb_cow_head(skb, dev->needed_headroom))
                         goto free_skb;
@@ -275,6 +272,10 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
                 tnl_params = &tunnel->parms.iph;
         }
 
+        skb = gre_handle_offloads(skb, !!(tunnel->parms.o_flags&TUNNEL_CSUM));
+        if (IS_ERR(skb))
+                goto out;
+
         __gre_xmit(skb, dev, tnl_params, skb->protocol);
 
         return NETDEV_TX_OK;
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 63e745aadab6..d3e447936720 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -514,6 +514,9 @@ const struct ip_tunnel_encap_ops __rcu *
 int ip_tunnel_encap_add_ops(const struct ip_tunnel_encap_ops *ops,
                             unsigned int num)
 {
+        if (num >= MAX_IPTUN_ENCAP_OPS)
+                return -ERANGE;
+
         return !cmpxchg((const struct ip_tunnel_encap_ops **)
                         &iptun_encaps[num],
                         NULL, ops) ? 0 : -1;
@@ -525,6 +528,9 @@ int ip_tunnel_encap_del_ops(const struct ip_tunnel_encap_ops *ops,
 {
         int ret;
 
+        if (num >= MAX_IPTUN_ENCAP_OPS)
+                return -ERANGE;
+
         ret = (cmpxchg((const struct ip_tunnel_encap_ops **)
                        &iptun_encaps[num],
                        ops, NULL) == ops) ? 0 : -1;
@@ -567,6 +573,9 @@ int ip_tunnel_encap(struct sk_buff *skb, struct ip_tunnel *t,
         if (t->encap.type == TUNNEL_ENCAP_NONE)
                 return 0;
 
+        if (t->encap.type >= MAX_IPTUN_ENCAP_OPS)
+                return -EINVAL;
+
         rcu_read_lock();
         ops = rcu_dereference(iptun_encaps[t->encap.type]);
         if (likely(ops && ops->build_header))
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7f18262e2326..65caf8b95e17 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2019,7 +2019,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
                         break;
 
-                if (tso_segs == 1) {
+                if (tso_segs == 1 || !max_segs) {
                         if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
                                                      (tcp_skb_is_last(sk, skb) ?
                                                       nonagle : TCP_NAGLE_PUSH))))
@@ -2032,7 +2032,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 }
 
                 limit = mss_now;
-                if (tso_segs > 1 && !tcp_urg_mode(tp))
+                if (tso_segs > 1 && max_segs && !tcp_urg_mode(tp))
                         limit = tcp_mss_split_point(sk, skb, mss_now,
                                                     min_t(unsigned int,
                                                           cwnd_quota,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 5ff87805258e..9c0b54e87b47 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1387,6 +1387,28 @@ ipv6_pktoptions:
         return 0;
 }
 
+static void tcp_v6_fill_cb(struct sk_buff *skb, const struct ipv6hdr *hdr,
+                           const struct tcphdr *th)
+{
+        /* This is tricky: we move IP6CB at its correct location into
+         * TCP_SKB_CB(). It must be done after xfrm6_policy_check(), because
+         * _decode_session6() uses IP6CB().
+         * barrier() makes sure compiler won't play aliasing games.
+         */
+        memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
+                sizeof(struct inet6_skb_parm));
+        barrier();
+
+        TCP_SKB_CB(skb)->seq = ntohl(th->seq);
+        TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
+                                    skb->len - th->doff*4);
+        TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
+        TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
+        TCP_SKB_CB(skb)->tcp_tw_isn = 0;
+        TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
+        TCP_SKB_CB(skb)->sacked = 0;
+}
+
 static int tcp_v6_rcv(struct sk_buff *skb)
 {
         const struct tcphdr *th;
@@ -1418,24 +1440,9 @@ static int tcp_v6_rcv(struct sk_buff *skb)
 
         th = tcp_hdr(skb);
         hdr = ipv6_hdr(skb);
-        /* This is tricky : We move IPCB at its correct location into TCP_SKB_CB()
-         * barrier() makes sure compiler wont play fool^Waliasing games.
-         */
-        memmove(&TCP_SKB_CB(skb)->header.h6, IP6CB(skb),
-                sizeof(struct inet6_skb_parm));
-        barrier();
-
-        TCP_SKB_CB(skb)->seq = ntohl(th->seq);
-        TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
-                                    skb->len - th->doff*4);
-        TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
-        TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
-        TCP_SKB_CB(skb)->tcp_tw_isn = 0;
-        TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
-        TCP_SKB_CB(skb)->sacked = 0;
 
         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
-                                tcp_v6_iif(skb));
+                                inet6_iif(skb));
         if (!sk)
                 goto no_tcp_socket;
 
@@ -1451,6 +1458,8 @@ process:
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;
 
+        tcp_v6_fill_cb(skb, hdr, th);
+
 #ifdef CONFIG_TCP_MD5SIG
         if (tcp_v6_inbound_md5_hash(sk, skb))
                 goto discard_and_relse;
@@ -1482,6 +1491,8 @@ no_tcp_socket:
         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
                 goto discard_it;
 
+        tcp_v6_fill_cb(skb, hdr, th);
+
         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
 csum_error:
                 TCP_INC_STATS_BH(net, TCP_MIB_CSUMERRORS);
@@ -1505,6 +1516,8 @@ do_time_wait:
                 goto discard_it;
         }
 
+        tcp_v6_fill_cb(skb, hdr, th);
+
         if (skb->len < (th->doff<<2)) {
                 inet_twsk_put(inet_twsk(sk));
                 goto bad_packet;
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 5d6dae9e4aac..da1c12c34487 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -1011,6 +1011,10 @@ ieee80211_vif_use_reserved_reassign(struct ieee80211_sub_if_data *sdata)
 
         ieee80211_vif_update_chandef(sdata, &sdata->reserved_chandef);
 
+        ieee80211_recalc_smps_chanctx(local, new_ctx);
+        ieee80211_recalc_radar_chanctx(local, new_ctx);
+        ieee80211_recalc_chanctx_min_def(local, new_ctx);
+
         if (changed)
                 ieee80211_bss_info_change_notify(sdata, changed);
 
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 434a91ad12c8..bd4e46ec32bd 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -140,7 +140,9 @@ static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
         if (!ret) {
                 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
 
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                         sdata->crypto_tx_tailroom_needed_cnt--;
 
                 WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
@@ -188,7 +190,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
         sta = key->sta;
         sdata = key->sdata;
 
-        if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+        if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+              (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+              (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                 increment_tailroom_need_count(sdata);
 
         ret = drv_set_key(key->local, DISABLE_KEY, sdata,
@@ -656,7 +660,7 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
         int i;
 
         mutex_lock(&local->key_mtx);
-        for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
+        for (i = 0; i < ARRAY_SIZE(sta->gtk); i++) {
                 key = key_mtx_dereference(local, sta->gtk[i]);
                 if (!key)
                         continue;
@@ -884,7 +888,9 @@ void ieee80211_remove_key(struct ieee80211_key_conf *keyconf)
         if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
                 key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
 
-                if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
+                if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
+                      (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
                         increment_tailroom_need_count(key->sdata);
         }
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 75a9bf50207e..2c36c4765f47 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -174,6 +174,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
         if (!(ht_cap->cap_info &
               cpu_to_le16(IEEE80211_HT_CAP_SUP_WIDTH_20_40))) {
                 ret = IEEE80211_STA_DISABLE_40MHZ;
+                vht_chandef = *chandef;
                 goto out;
         }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 49c23bdf08bb..683b10f46505 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1761,14 +1761,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
         sc = le16_to_cpu(hdr->seq_ctrl);
         frag = sc & IEEE80211_SCTL_FRAG;
 
-        if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
-                goto out;
-
         if (is_multicast_ether_addr(hdr->addr1)) {
                 rx->local->dot11MulticastReceivedFrameCount++;
-                goto out;
+                goto out_no_led;
         }
 
+        if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
+                goto out;
+
         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
 
         if (skb_linearize(rx->skb))
@@ -1859,9 +1859,10 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
         status->rx_flags |= IEEE80211_RX_FRAGMENTED;
 
  out:
+        ieee80211_led_rx(rx->local);
+ out_no_led:
         if (rx->sta)
                 rx->sta->rx_packets++;
-        ieee80211_led_rx(rx->local);
         return RX_CONTINUE;
 }
 
diff --git a/net/mpls/mpls_gso.c b/net/mpls/mpls_gso.c
index ca27837974fe..349295d21946 100644
--- a/net/mpls/mpls_gso.c
+++ b/net/mpls/mpls_gso.c
@@ -31,10 +31,7 @@ static struct sk_buff *mpls_gso_segment(struct sk_buff *skb,
                                   SKB_GSO_TCPV6 |
                                   SKB_GSO_UDP |
                                   SKB_GSO_DODGY |
-                                  SKB_GSO_TCP_ECN |
-                                  SKB_GSO_GRE |
-                                  SKB_GSO_GRE_CSUM |
-                                  SKB_GSO_IPIP)))
+                                  SKB_GSO_TCP_ECN)))
                 goto out;
 
         /* Setup inner SKB. */
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 13c2e17bbe27..cde4a6702fa3 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -463,7 +463,7 @@ static void nfnetlink_rcv(struct sk_buff *skb)
 }
 
 #ifdef CONFIG_MODULES
-static int nfnetlink_bind(int group)
+static int nfnetlink_bind(struct net *net, int group)
 {
         const struct nfnetlink_subsystem *ss;
         int type;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index ef5f77b44ec7..84ea76ca3f1f 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -525,14 +525,14 @@ out:
         return err;
 }
 
-static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr)
+static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len)
 {
 #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
         struct page *p_start, *p_end;
 
         /* First page is flushed through netlink_{get,set}_status */
         p_start = pgvec_to_page(hdr + PAGE_SIZE);
-        p_end   = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + hdr->nm_len - 1);
+        p_end   = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1);
         while (p_start <= p_end) {
                 flush_dcache_page(p_start);
                 p_start++;
@@ -550,9 +550,9 @@ static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr)
 static void netlink_set_status(struct nl_mmap_hdr *hdr,
                                enum nl_mmap_status status)
 {
+        smp_mb();
         hdr->nm_status = status;
         flush_dcache_page(pgvec_to_page(hdr));
-        smp_wmb();
 }
 
 static struct nl_mmap_hdr *
@@ -714,24 +714,16 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
         struct nl_mmap_hdr *hdr;
         struct sk_buff *skb;
         unsigned int maxlen;
-        bool excl = true;
         int err = 0, len = 0;
 
-        /* Netlink messages are validated by the receiver before processing.
-         * In order to avoid userspace changing the contents of the message
-         * after validation, the socket and the ring may only be used by a
-         * single process, otherwise we fall back to copying.
-         */
-        if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 ||
-            atomic_read(&nlk->mapped) > 1)
-                excl = false;
-
         mutex_lock(&nlk->pg_vec_lock);
 
         ring   = &nlk->tx_ring;
         maxlen = ring->frame_size - NL_MMAP_HDRLEN;
 
         do {
+                unsigned int nm_len;
+
                 hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
                 if (hdr == NULL) {
                         if (!(msg->msg_flags & MSG_DONTWAIT) &&
@@ -739,35 +731,23 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
                                 schedule();
                         continue;
                 }
-                if (hdr->nm_len > maxlen) {
+
+                nm_len = ACCESS_ONCE(hdr->nm_len);
+                if (nm_len > maxlen) {
                         err = -EINVAL;
                         goto out;
                 }
 
-                netlink_frame_flush_dcache(hdr);
+                netlink_frame_flush_dcache(hdr, nm_len);
 
-                if (likely(dst_portid == 0 && dst_group == 0 && excl)) {
-                        skb = alloc_skb_head(GFP_KERNEL);
-                        if (skb == NULL) {
-                                err = -ENOBUFS;
-                                goto out;
-                        }
-                        sock_hold(sk);
-                        netlink_ring_setup_skb(skb, sk, ring, hdr);
-                        NETLINK_CB(skb).flags |= NETLINK_SKB_TX;
-                        __skb_put(skb, hdr->nm_len);
-                        netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
-                        atomic_inc(&ring->pending);
-                } else {
-                        skb = alloc_skb(hdr->nm_len, GFP_KERNEL);
-                        if (skb == NULL) {
-                                err = -ENOBUFS;
-                                goto out;
-                        }
-                        __skb_put(skb, hdr->nm_len);
-                        memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, hdr->nm_len);
-                        netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
+                skb = alloc_skb(nm_len, GFP_KERNEL);
+                if (skb == NULL) {
+                        err = -ENOBUFS;
+                        goto out;
                 }
+                __skb_put(skb, nm_len);
+                memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len);
+                netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
 
                 netlink_increment_head(ring);
 
@@ -813,7 +793,7 @@ static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb)
         hdr->nm_pid     = NETLINK_CB(skb).creds.pid;
         hdr->nm_uid     = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
         hdr->nm_gid     = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
-        netlink_frame_flush_dcache(hdr);
+        netlink_frame_flush_dcache(hdr, hdr->nm_len);
         netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
 
         NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
@@ -1111,8 +1091,10 @@ static void netlink_remove(struct sock *sk)
         mutex_unlock(&nl_sk_hash_lock);
 
         netlink_table_grab();
-        if (nlk_sk(sk)->subscriptions)
+        if (nlk_sk(sk)->subscriptions) {
                 __sk_del_bind_node(sk);
+                netlink_update_listeners(sk);
+        }
         netlink_table_ungrab();
 }
 
@@ -1159,8 +1141,8 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol,
         struct module *module = NULL;
         struct mutex *cb_mutex;
         struct netlink_sock *nlk;
-        int (*bind)(int group);
-        void (*unbind)(int group);
+        int (*bind)(struct net *net, int group);
+        void (*unbind)(struct net *net, int group);
         int err = 0;
 
         sock->state = SS_UNCONNECTED;
@@ -1246,8 +1228,8 @@ static int netlink_release(struct socket *sock)
 
         module_put(nlk->module);
 
-        netlink_table_grab();
         if (netlink_is_kernel(sk)) {
+                netlink_table_grab();
                 BUG_ON(nl_table[sk->sk_protocol].registered == 0);
                 if (--nl_table[sk->sk_protocol].registered == 0) {
                         struct listeners *old;
@@ -1261,11 +1243,16 @@ static int netlink_release(struct socket *sock)
                         nl_table[sk->sk_protocol].flags = 0;
                         nl_table[sk->sk_protocol].registered = 0;
                 }
-        } else if (nlk->subscriptions) {
-                netlink_update_listeners(sk);
+                netlink_table_ungrab();
         }
-        netlink_table_ungrab();
 
+        if (nlk->netlink_unbind) {
+                int i;
+
+                for (i = 0; i < nlk->ngroups; i++)
+                        if (test_bit(i, nlk->groups))
+                                nlk->netlink_unbind(sock_net(sk), i + 1);
+        }
         kfree(nlk->groups);
         nlk->groups = NULL;
 
@@ -1430,9 +1417,10 @@ static int netlink_realloc_groups(struct sock *sk)
         return err;
 }
 
-static void netlink_unbind(int group, long unsigned int groups,
-                           struct netlink_sock *nlk)
+static void netlink_undo_bind(int group, long unsigned int groups,
+                              struct sock *sk)
 {
+        struct netlink_sock *nlk = nlk_sk(sk);
         int undo;
 
         if (!nlk->netlink_unbind)
@@ -1440,7 +1428,7 @@ static void netlink_unbind(int group, long unsigned int groups,
 
         for (undo = 0; undo < group; undo++)
                 if (test_bit(undo, &groups))
-                        nlk->netlink_unbind(undo);
+                        nlk->netlink_unbind(sock_net(sk), undo);
 }
 
 static int netlink_bind(struct socket *sock, struct sockaddr *addr,
@@ -1478,10 +1466,10 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                 for (group = 0; group < nlk->ngroups; group++) {
                         if (!test_bit(group, &groups))
                                 continue;
-                        err = nlk->netlink_bind(group);
+                        err = nlk->netlink_bind(net, group);
                         if (!err)
                                 continue;
-                        netlink_unbind(group, groups, nlk);
+                        netlink_undo_bind(group, groups, sk);
                         return err;
                 }
         }
@@ -1491,7 +1479,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                         netlink_insert(sk, net, nladdr->nl_pid) :
                         netlink_autobind(sock);
                 if (err) {
-                        netlink_unbind(nlk->ngroups, groups, nlk);
+                        netlink_undo_bind(nlk->ngroups, groups, sk);
                         return err;
                 }
         }
@@ -2142,7 +2130,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
                 if (!val || val - 1 >= nlk->ngroups)
                         return -EINVAL;
                 if (optname == NETLINK_ADD_MEMBERSHIP && nlk->netlink_bind) {
-                        err = nlk->netlink_bind(val);
+                        err = nlk->netlink_bind(sock_net(sk), val);
                         if (err)
                                 return err;
                 }
@@ -2151,7 +2139,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
                                          optname == NETLINK_ADD_MEMBERSHIP);
                 netlink_table_ungrab();
                 if (optname == NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind)
-                        nlk->netlink_unbind(val);
+                        nlk->netlink_unbind(sock_net(sk), val);
 
                 err = 0;
                 break;
diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h
index b20a1731759b..f123a88496f8 100644
--- a/net/netlink/af_netlink.h
+++ b/net/netlink/af_netlink.h
@@ -39,8 +39,8 @@ struct netlink_sock {
         struct mutex            *cb_mutex;
         struct mutex            cb_def_mutex;
         void                    (*netlink_rcv)(struct sk_buff *skb);
-        int                     (*netlink_bind)(int group);
-        void                    (*netlink_unbind)(int group);
+        int                     (*netlink_bind)(struct net *net, int group);
+        void                    (*netlink_unbind)(struct net *net, int group);
         struct module           *module;
 #ifdef CONFIG_NETLINK_MMAP
         struct mutex            pg_vec_lock;
@@ -65,8 +65,8 @@ struct netlink_table {
         unsigned int            groups;
         struct mutex            *cb_mutex;
         struct module           *module;
-        int                     (*bind)(int group);
-        void                    (*unbind)(int group);
+        int                     (*bind)(struct net *net, int group);
+        void                    (*unbind)(struct net *net, int group);
         bool                    (*compare)(struct net *net, struct sock *sock);
         int                     registered;
 };
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 76393f2f4b22..2e11061ef885 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -983,11 +983,67 @@ static struct genl_multicast_group genl_ctrl_groups[] = {
         { .name = "notify", },
 };
 
+static int genl_bind(struct net *net, int group)
+{
+        int i, err = 0;
+
+        down_read(&cb_lock);
+        for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
+                struct genl_family *f;
+
+                list_for_each_entry(f, genl_family_chain(i), family_list) {
+                        if (group >= f->mcgrp_offset &&
+                            group < f->mcgrp_offset + f->n_mcgrps) {
+                                int fam_grp = group - f->mcgrp_offset;
+
+                                if (!f->netnsok && net != &init_net)
+                                        err = -ENOENT;
+                                else if (f->mcast_bind)
+                                        err = f->mcast_bind(net, fam_grp);
+                                else
+                                        err = 0;
+                                break;
+                        }
+                }
+        }
+        up_read(&cb_lock);
+
+        return err;
+}
+
+static void genl_unbind(struct net *net, int group)
+{
+        int i;
+        bool found = false;
+
+        down_read(&cb_lock);
+        for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
+                struct genl_family *f;
+
+                list_for_each_entry(f, genl_family_chain(i), family_list) {
+                        if (group >= f->mcgrp_offset &&
+                            group < f->mcgrp_offset + f->n_mcgrps) {
+                                int fam_grp = group - f->mcgrp_offset;
+
+                                if (f->mcast_unbind)
+                                        f->mcast_unbind(net, fam_grp);
+                                found = true;
+                                break;
+                        }
+                }
+        }
+        up_read(&cb_lock);
+
+        WARN_ON(!found);
+}
+
 static int __net_init genl_pernet_init(struct net *net)
 {
         struct netlink_kernel_cfg cfg = {
                 .input          = genl_rcv,
                 .flags          = NL_CFG_F_NONROOT_RECV,
+                .bind           = genl_bind,
+                .unbind         = genl_unbind,
         };
 
         /* we'll bump the group number right afterwards */
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 764fdc39c63b..770064c83711 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -147,7 +147,8 @@ static int push_mpls(struct sk_buff *skb, struct sw_flow_key *key,
         hdr = eth_hdr(skb);
         hdr->h_proto = mpls->mpls_ethertype;
 
-        skb_set_inner_protocol(skb, skb->protocol);
+        if (!skb->inner_protocol)
+                skb_set_inner_protocol(skb, skb->protocol);
         skb->protocol = mpls->mpls_ethertype;
 
         invalidate_flow_key(key);
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 332b5a031739..4e9a5f035cbc 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -83,8 +83,7 @@ static bool ovs_must_notify(struct genl_family *family, struct genl_info *info,
                             unsigned int group)
 {
         return info->nlhdr->nlmsg_flags & NLM_F_ECHO ||
-               genl_has_listeners(family, genl_info_net(info)->genl_sock,
-                                  group);
+               genl_has_listeners(family, genl_info_net(info), group);
 }
 
 static void ovs_notify(struct genl_family *family,
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 70bef2ab7f2b..da2fae0873a5 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -70,6 +70,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
 {
         struct flow_stats *stats;
         int node = numa_node_id();
+        int len = skb->len + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
 
         stats = rcu_dereference(flow->stats[node]);
 
@@ -105,7 +106,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
                                 if (likely(new_stats)) {
                                         new_stats->used = jiffies;
                                         new_stats->packet_count = 1;
-                                        new_stats->byte_count = skb->len;
+                                        new_stats->byte_count = len;
                                         new_stats->tcp_flags = tcp_flags;
                                         spin_lock_init(&new_stats->lock);
 
@@ -120,7 +121,7 @@ void ovs_flow_stats_update(struct sw_flow *flow, __be16 tcp_flags,
 
         stats->used = jiffies;
         stats->packet_count++;
-        stats->byte_count += skb->len;
+        stats->byte_count += len;
         stats->tcp_flags |= tcp_flags;
 unlock:
         spin_unlock(&stats->lock);
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 9645a21d9eaa..d1eecf707613 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -1753,7 +1753,6 @@ static int __ovs_nla_copy_actions(const struct nlattr *attr,
                                   __be16 eth_type, __be16 vlan_tci, bool log)
 {
         const struct nlattr *a;
-        bool out_tnl_port = false;
         int rem, err;
 
         if (depth >= SAMPLE_ACTION_DEPTH)
@@ -1796,8 +1795,6 @@ static int __ovs_nla_copy_actions(const struct nlattr *attr,
                 case OVS_ACTION_ATTR_OUTPUT:
                         if (nla_get_u32(a) >= DP_MAX_PORTS)
                                 return -EINVAL;
-                        out_tnl_port = false;
-
                         break;
 
                 case OVS_ACTION_ATTR_HASH: {
@@ -1832,12 +1829,6 @@ static int __ovs_nla_copy_actions(const struct nlattr *attr,
                 case OVS_ACTION_ATTR_PUSH_MPLS: {
                         const struct ovs_action_push_mpls *mpls = nla_data(a);
 
-                        /* Networking stack do not allow simultaneous Tunnel
-                         * and MPLS GSO.
-                         */
-                        if (out_tnl_port)
-                                return -EINVAL;
-
                         if (!eth_p_mpls(mpls->mpls_ethertype))
                                 return -EINVAL;
                         /* Prohibit push MPLS other than to a white list
@@ -1873,11 +1864,9 @@ static int __ovs_nla_copy_actions(const struct nlattr *attr,
 
                 case OVS_ACTION_ATTR_SET:
                         err = validate_set(a, key, sfa,
-                                           &out_tnl_port, eth_type, log);
+                                           &skip_copy, eth_type, log);
                         if (err)
                                 return err;
-
-                        skip_copy = out_tnl_port;
                         break;
 
                 case OVS_ACTION_ATTR_SAMPLE:
diff --git a/net/openvswitch/vport-geneve.c b/net/openvswitch/vport-geneve.c
index 347fa2325b22..484864dd0e68 100644
--- a/net/openvswitch/vport-geneve.c
+++ b/net/openvswitch/vport-geneve.c
@@ -219,7 +219,10 @@ static int geneve_tnl_send(struct vport *vport, struct sk_buff *skb)
                               false);
         if (err < 0)
                 ip_rt_put(rt);
+        return err;
+
 error:
+        kfree_skb(skb);
         return err;
 }
 
diff --git a/net/openvswitch/vport-gre.c b/net/openvswitch/vport-gre.c
index 6b69df545b1d..d4168c442db5 100644
--- a/net/openvswitch/vport-gre.c
+++ b/net/openvswitch/vport-gre.c
@@ -73,7 +73,7 @@ static struct sk_buff *__build_header(struct sk_buff *skb,
 
         skb = gre_handle_offloads(skb, !!(tun_key->tun_flags & TUNNEL_CSUM));
         if (IS_ERR(skb))
-                return NULL;
+                return skb;
 
         tpi.flags = filter_tnl_flags(tun_key->tun_flags);
         tpi.proto = htons(ETH_P_TEB);
@@ -144,7 +144,7 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
 
         if (unlikely(!OVS_CB(skb)->egress_tun_info)) {
                 err = -EINVAL;
-                goto error;
+                goto err_free_skb;
         }
 
         tun_key = &OVS_CB(skb)->egress_tun_info->tunnel;
@@ -157,8 +157,10 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
         fl.flowi4_proto = IPPROTO_GRE;
 
         rt = ip_route_output_key(net, &fl);
-        if (IS_ERR(rt))
-                return PTR_ERR(rt);
+        if (IS_ERR(rt)) {
+                err = PTR_ERR(rt);
+                goto err_free_skb;
+        }
 
         tunnel_hlen = ip_gre_calc_hlen(tun_key->tun_flags);
 
@@ -183,8 +185,9 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
 
         /* Push Tunnel header. */
         skb = __build_header(skb, tunnel_hlen);
-        if (unlikely(!skb)) {
-                err = 0;
+        if (IS_ERR(skb)) {
+                err = PTR_ERR(skb);
+                skb = NULL;
                 goto err_free_rt;
         }
 
@@ -198,7 +201,8 @@ static int gre_tnl_send(struct vport *vport, struct sk_buff *skb)
                              tun_key->ipv4_tos, tun_key->ipv4_ttl, df, false);
 err_free_rt:
         ip_rt_put(rt);
-error:
+err_free_skb:
+        kfree_skb(skb);
         return err;
 }
 
diff --git a/net/openvswitch/vport-vxlan.c b/net/openvswitch/vport-vxlan.c
index 38f95a52241b..d7c46b301024 100644
--- a/net/openvswitch/vport-vxlan.c
+++ b/net/openvswitch/vport-vxlan.c
@@ -187,7 +187,9 @@ static int vxlan_tnl_send(struct vport *vport, struct sk_buff *skb)
                              false);
         if (err < 0)
                 ip_rt_put(rt);
+        return err;
 error:
+        kfree_skb(skb);
         return err;
 }
 
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index 9584526c0778..2034c6d9cb5a 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -480,7 +480,7 @@ void ovs_vport_receive(struct vport *vport, struct sk_buff *skb,
         stats = this_cpu_ptr(vport->percpu_stats);
         u64_stats_update_begin(&stats->syncp);
         stats->rx_packets++;
-        stats->rx_bytes += skb->len;
+        stats->rx_bytes += skb->len + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
         u64_stats_update_end(&stats->syncp);
 
         OVS_CB(skb)->input_vport = vport;
@@ -519,10 +519,9 @@ int ovs_vport_send(struct vport *vport, struct sk_buff *skb)
                 u64_stats_update_end(&stats->syncp);
         } else if (sent < 0) {
                 ovs_vport_record_error(vport, VPORT_E_TX_ERROR);
-                kfree_skb(skb);
-        } else
+        } else {
                 ovs_vport_record_error(vport, VPORT_E_TX_DROPPED);
-
+        }
         return sent;
 }
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index e52a44785681..6880f34a529a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -785,6 +785,7 @@ static void prb_close_block(struct tpacket_kbdq_core *pkc1,
 
         struct tpacket3_hdr *last_pkt;
         struct tpacket_hdr_v1 *h1 = &pbd1->hdr.bh1;
+        struct sock *sk = &po->sk;
 
         if (po->stats.stats3.tp_drops)
                 status |= TP_STATUS_LOSING;
@@ -809,6 +810,8 @@ static void prb_close_block(struct tpacket_kbdq_core *pkc1,
         /* Flush the block */
         prb_flush_block(pkc1, pbd1, status);
 
+        sk->sk_data_ready(sk);
+
         pkc1->kactive_blk_num = GET_NEXT_PRB_BLK_NUM(pkc1);
 }
 
@@ -2052,12 +2055,12 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
         smp_wmb();
 #endif
 
-        if (po->tp_version <= TPACKET_V2)
+        if (po->tp_version <= TPACKET_V2) {
                 __packet_set_status(po, h.raw, status);
-        else
+                sk->sk_data_ready(sk);
+        } else {
                 prb_clear_blk_fill_status(&po->rx_ring);
-
-        sk->sk_data_ready(sk);
+        }
 
 drop_n_restore:
         if (skb_head != skb->data && skb_shared(skb)) {
diff --git a/net/rds/message.c b/net/rds/message.c
index ff2202218187..5a21e6f5986f 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -325,7 +325,8 @@ int rds_message_inc_copy_to_user(struct rds_incoming *inc, struct iov_iter *to)
         copied = 0;
 
         while (iov_iter_count(to) && copied < len) {
-                to_copy = min(iov_iter_count(to), sg->length - vec_off);
+                to_copy = min_t(unsigned long, iov_iter_count(to),
+                                sg->length - vec_off);
                 to_copy = min_t(unsigned long, to_copy, len - copied);
 
                 rds_stats_add(s_copy_to_user, to_copy);
diff --git a/net/socket.c b/net/socket.c
index 70bbde65e4ca..a2c33a4dc7ba 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -372,7 +372,6 @@ struct file *sock_alloc_file(struct socket *sock, int flags, const char *dname)
         path.mnt = mntget(sock_mnt);
 
         d_instantiate(path.dentry, SOCK_INODE(sock));
-        SOCK_INODE(sock)->i_fop = &socket_file_ops;
 
         file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
                   &socket_file_ops);
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 1cb61242e55e..4439ac4c1b53 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -606,7 +606,7 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
         struct kvec *head = buf->head;
         struct kvec *tail = buf->tail;
         int fraglen;
-        int new, old;
+        int new;
 
         if (len > buf->len) {
                 WARN_ON_ONCE(1);
@@ -629,8 +629,8 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
         buf->len -= fraglen;
 
         new = buf->page_base + buf->page_len;
-        old = new + fraglen;
-        xdr->page_ptr -= (old >> PAGE_SHIFT) - (new >> PAGE_SHIFT);
+
+        xdr->page_ptr = buf->pages + (new >> PAGE_SHIFT);
 
         if (buf->page_len) {
                 xdr->p = page_address(*xdr->page_ptr);
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 22ba971741e5..29c8675f9a11 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -175,7 +175,7 @@ config CFG80211_INTERNAL_REGDB
           Most distributions have a CRDA package.  So if unsure, say N.
 
 config CFG80211_WEXT
-        bool
+        bool "cfg80211 wireless extensions compatibility"
         depends on CFG80211
         select WEXT_CORE
         help
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index 85506f1d0789..7aaf7415dc4c 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -603,7 +603,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
 {
         struct ieee80211_sta_ht_cap *ht_cap;
         struct ieee80211_sta_vht_cap *vht_cap;
-        u32 width, control_freq;
+        u32 width, control_freq, cap;
 
         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
                 return false;
@@ -643,7 +643,8 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
                         return false;
                 break;
         case NL80211_CHAN_WIDTH_80P80:
-                if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ))
+                cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
+                if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
                         return false;
         case NL80211_CHAN_WIDTH_80:
                 if (!vht_cap->vht_supported)
@@ -654,7 +655,9 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
         case NL80211_CHAN_WIDTH_160:
                 if (!vht_cap->vht_supported)
                         return false;
-                if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ))
+                cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
+                if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ &&
+                    cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
                         return false;
                 prohibited_flags |= IEEE80211_CHAN_NO_160MHZ;
                 width = 160;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index a17d6bc6b22c..7ca4b5133123 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6002,7 +6002,7 @@ nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
                 }
 
                 /* there was no other matchset, so the RSSI one is alone */
-                if (i == 0)
+                if (i == 0 && n_match_sets)
                         request->match_sets[0].rssi_thold = default_match_rssi;
 
                 request->min_rssi_thold = INT_MAX;
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 47be6163381c..7b8309840d4e 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1549,9 +1549,15 @@ static bool reg_wdev_chan_valid(struct wiphy *wiphy, struct wireless_dev *wdev)
                 ret = cfg80211_reg_can_beacon(wiphy,
                                               &wdev->chandef, wdev->iftype);
                 break;
+        case NL80211_IFTYPE_ADHOC:
+                if (!wdev->ssid_len)
+                        goto out;
+
+                ret = cfg80211_reg_can_beacon(wiphy,
+                                              &wdev->chandef, wdev->iftype);
+                break;
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_P2P_CLIENT:
-        case NL80211_IFTYPE_ADHOC:
                 if (!wdev->current_bss ||
                     !wdev->current_bss->pub.channel)
                         goto out;
@@ -1907,7 +1913,7 @@ static enum reg_request_treatment
 reg_process_hint_driver(struct wiphy *wiphy,
                         struct regulatory_request *driver_request)
 {
-        const struct ieee80211_regdomain *regd;
+        const struct ieee80211_regdomain *regd, *tmp;
         enum reg_request_treatment treatment;
 
         treatment = __reg_process_hint_driver(driver_request);
@@ -1927,7 +1933,10 @@ reg_process_hint_driver(struct wiphy *wiphy,
                         reg_free_request(driver_request);
                         return REG_REQ_IGNORE;
                 }
+
+                tmp = get_wiphy_regdom(wiphy);
                 rcu_assign_pointer(wiphy->regd, regd);
+                rcu_free_regdom(tmp);
         }
 
 
@@ -1986,11 +1995,8 @@ __reg_process_hint_country_ie(struct wiphy *wiphy,
                         return REG_REQ_IGNORE;
                 return REG_REQ_ALREADY_SET;
         }
-        /*
-         * Two consecutive Country IE hints on the same wiphy.
-         * This should be picked up early by the driver/stack
-         */
-        if (WARN_ON(regdom_changes(country_ie_request->alpha2)))
+
+        if (regdom_changes(country_ie_request->alpha2))
                 return REG_REQ_OK;
         return REG_REQ_ALREADY_SET;
 }