31 files changed, 194 insertions, 184 deletions

diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 574f78824d8a..32bd3ead9ba1 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -595,7 +595,7 @@ static int br_afspec(struct net_bridge *br,
                 err = 0;
                 switch (nla_type(attr)) {
                 case IFLA_BRIDGE_VLAN_TUNNEL_INFO:
-                        if (!(p->flags & BR_VLAN_TUNNEL))
+                        if (!p || !(p->flags & BR_VLAN_TUNNEL))
                                 return -EINVAL;
                         err = br_parse_vlan_tunnel_info(attr, &tinfo_curr);
                         if (err)
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 0db8102995a5..6f12a5271219 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -179,7 +179,8 @@ static void br_stp_start(struct net_bridge *br)
                 br_debug(br, "using kernel STP\n");
 
                 /* To start timers on any ports left in blocking */
-                mod_timer(&br->hello_timer, jiffies + br->hello_time);
+                if (br->dev->flags & IFF_UP)
+                        mod_timer(&br->hello_timer, jiffies + br->hello_time);
                 br_port_state_selection(br);
         }
 
diff --git a/net/core/devlink.c b/net/core/devlink.c
index b0b87a292e7c..a0adfc31a3fe 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1680,8 +1680,10 @@ start_again:
 
         hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq,
                           &devlink_nl_family, NLM_F_MULTI, cmd);
-        if (!hdr)
+        if (!hdr) {
+                nlmsg_free(skb);
                 return -EMSGSIZE;
+        }
 
         if (devlink_nl_put_handle(skb, devlink))
                 goto nla_put_failure;
@@ -2098,8 +2100,10 @@ start_again:
 
         hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq,
                           &devlink_nl_family, NLM_F_MULTI, cmd);
-        if (!hdr)
+        if (!hdr) {
+                nlmsg_free(skb);
                 return -EMSGSIZE;
+        }
 
         if (devlink_nl_put_handle(skb, devlink))
                 goto nla_put_failure;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 346d3e85dfbc..b1be7c01efe2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3754,8 +3754,11 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk)
 
         spin_lock_irqsave(&q->lock, flags);
         skb = __skb_dequeue(q);
-        if (skb && (skb_next = skb_peek(q)))
+        if (skb && (skb_next = skb_peek(q))) {
                 icmp_next = is_icmp_err_skb(skb_next);
+                if (icmp_next)
+                        sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin;
+        }
         spin_unlock_irqrestore(&q->lock, flags);
 
         if (is_icmp_err_skb(skb) && !icmp_next)
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 26130ae438da..90038d45a547 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -223,6 +223,53 @@ static int dsa_switch_rcv(struct sk_buff *skb, struct net_device *dev,
         return 0;
 }
 
+#ifdef CONFIG_PM_SLEEP
+int dsa_switch_suspend(struct dsa_switch *ds)
+{
+        int i, ret = 0;
+
+        /* Suspend slave network devices */
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_port_initialized(ds, i))
+                        continue;
+
+                ret = dsa_slave_suspend(ds->ports[i].netdev);
+                if (ret)
+                        return ret;
+        }
+
+        if (ds->ops->suspend)
+                ret = ds->ops->suspend(ds);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dsa_switch_suspend);
+
+int dsa_switch_resume(struct dsa_switch *ds)
+{
+        int i, ret = 0;
+
+        if (ds->ops->resume)
+                ret = ds->ops->resume(ds);
+
+        if (ret)
+                return ret;
+
+        /* Resume slave network devices */
+        for (i = 0; i < ds->num_ports; i++) {
+                if (!dsa_is_port_initialized(ds, i))
+                        continue;
+
+                ret = dsa_slave_resume(ds->ports[i].netdev);
+                if (ret)
+                        return ret;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(dsa_switch_resume);
+#endif
+
 static struct packet_type dsa_pack_type __read_mostly = {
         .type   = cpu_to_be16(ETH_P_XDSA),
         .func   = dsa_switch_rcv,
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index 033b3bfb63dc..7796580e99ee 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -484,8 +484,10 @@ static void dsa_dst_unapply(struct dsa_switch_tree *dst)
                 dsa_ds_unapply(dst, ds);
         }
 
-        if (dst->cpu_switch)
+        if (dst->cpu_switch) {
                 dsa_cpu_port_ethtool_restore(dst->cpu_switch);
+                dst->cpu_switch = NULL;
+        }
 
         pr_info("DSA: tree %d unapplied\n", dst->tree);
         dst->applied = false;
diff --git a/net/dsa/legacy.c b/net/dsa/legacy.c
index ad345c8b0b06..7281098df04e 100644
--- a/net/dsa/legacy.c
+++ b/net/dsa/legacy.c
@@ -289,53 +289,6 @@ static void dsa_switch_destroy(struct dsa_switch *ds)
         dsa_switch_unregister_notifier(ds);
 }
 
-#ifdef CONFIG_PM_SLEEP
-int dsa_switch_suspend(struct dsa_switch *ds)
-{
-        int i, ret = 0;
-
-        /* Suspend slave network devices */
-        for (i = 0; i < ds->num_ports; i++) {
-                if (!dsa_is_port_initialized(ds, i))
-                        continue;
-
-                ret = dsa_slave_suspend(ds->ports[i].netdev);
-                if (ret)
-                        return ret;
-        }
-
-        if (ds->ops->suspend)
-                ret = ds->ops->suspend(ds);
-
-        return ret;
-}
-EXPORT_SYMBOL_GPL(dsa_switch_suspend);
-
-int dsa_switch_resume(struct dsa_switch *ds)
-{
-        int i, ret = 0;
-
-        if (ds->ops->resume)
-                ret = ds->ops->resume(ds);
-
-        if (ret)
-                return ret;
-
-        /* Resume slave network devices */
-        for (i = 0; i < ds->num_ports; i++) {
-                if (!dsa_is_port_initialized(ds, i))
-                        continue;
-
-                ret = dsa_slave_resume(ds->ports[i].netdev);
-                if (ret)
-                        return ret;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(dsa_switch_resume);
-#endif
-
 /* platform driver init and cleanup *****************************************/
 static int dev_is_class(struct device *dev, void *class)
 {
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f3dad1661343..58925b6597de 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1043,7 +1043,7 @@ static struct inet_protosw inetsw_array[] =
                 .type =       SOCK_DGRAM,
                 .protocol =   IPPROTO_ICMP,
                 .prot =       &ping_prot,
-                .ops =        &inet_dgram_ops,
+                .ops =        &inet_sockraw_ops,
                 .flags =      INET_PROTOSW_REUSE,
        },
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 59792d283ff8..b5ea036ca781 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2381,9 +2381,10 @@ static int tcp_repair_set_window(struct tcp_sock *tp, char __user *optbuf, int l
         return 0;
 }
 
-static int tcp_repair_options_est(struct tcp_sock *tp,
+static int tcp_repair_options_est(struct sock *sk,
                 struct tcp_repair_opt __user *optbuf, unsigned int len)
 {
+        struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_repair_opt opt;
 
         while (len >= sizeof(opt)) {
@@ -2396,6 +2397,7 @@ static int tcp_repair_options_est(struct tcp_sock *tp,
                 switch (opt.opt_code) {
                 case TCPOPT_MSS:
                         tp->rx_opt.mss_clamp = opt.opt_val;
+                        tcp_mtup_init(sk);
                         break;
                 case TCPOPT_WINDOW:
                         {
@@ -2555,7 +2557,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 if (!tp->repair)
                         err = -EINVAL;
                 else if (sk->sk_state == TCP_ESTABLISHED)
-                        err = tcp_repair_options_est(tp,
+                        err = tcp_repair_options_est(sk,
                                         (struct tcp_repair_opt __user *)optval,
                                         optlen);
                 else
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 6e3c512054a6..324c9bcc5456 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -180,6 +180,7 @@ void tcp_init_congestion_control(struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
 
+        tcp_sk(sk)->prior_ssthresh = 0;
         if (icsk->icsk_ca_ops->init)
                 icsk->icsk_ca_ops->init(sk);
         if (tcp_ca_needs_ecn(sk))
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index 37ac9de713c6..8d772fea1dde 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -1319,7 +1319,7 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
         struct ipv6hdr *ip6_hdr;
         struct ipv6_opt_hdr *hop;
         unsigned char buf[CALIPSO_MAX_BUFFER];
-        int len_delta, new_end, pad;
+        int len_delta, new_end, pad, payload;
         unsigned int start, end;
 
         ip6_hdr = ipv6_hdr(skb);
@@ -1346,6 +1346,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
         if (ret_val < 0)
                 return ret_val;
 
+        ip6_hdr = ipv6_hdr(skb); /* Reset as skb_cow() may have moved it */
+
         if (len_delta) {
                 if (len_delta > 0)
                         skb_push(skb, len_delta);
@@ -1355,6 +1357,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb,
                         sizeof(*ip6_hdr) + start);
                 skb_reset_network_header(skb);
                 ip6_hdr = ipv6_hdr(skb);
+                payload = ntohs(ip6_hdr->payload_len);
+                ip6_hdr->payload_len = htons(payload + len_delta);
         }
 
         hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 280268f1dd7b..cdb3728faca7 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -116,8 +116,10 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 
                 if (udpfrag) {
                         int err = ip6_find_1stfragopt(skb, &prevhdr);
-                        if (err < 0)
+                        if (err < 0) {
+                                kfree_skb_list(segs);
                                 return ERR_PTR(err);
+                        }
                         fptr = (struct frag_hdr *)((u8 *)ipv6h + err);
                         fptr->frag_off = htons(offset);
                         if (skb->next)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 7ae6c503f1ca..9b37f9747fc6 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1095,6 +1095,9 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
 
         if (!dst) {
 route_lookup:
+                /* add dsfield to flowlabel for route lookup */
+                fl6->flowlabel = ip6_make_flowinfo(dsfield, fl6->flowlabel);
+
                 dst = ip6_route_output(net, NULL, fl6);
 
                 if (dst->error)
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 9b522fa90e6d..ac826dd338ff 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -192,7 +192,7 @@ static struct inet_protosw pingv6_protosw = {
         .type =      SOCK_DGRAM,
         .protocol =  IPPROTO_ICMPV6,
         .prot =      &pingv6_prot,
-        .ops =       &inet6_dgram_ops,
+        .ops =       &inet6_sockraw_ops,
         .flags =     INET_PROTOSW_REUSE,
 };
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 1f992d9e261d..60be012fe708 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1338,7 +1338,7 @@ void raw6_proc_exit(void)
 #endif  /* CONFIG_PROC_FS */
 
 /* Same as inet6_dgram_ops, sans udp_poll.  */
-static const struct proto_ops inet6_sockraw_ops = {
+const struct proto_ops inet6_sockraw_ops = {
         .family            = PF_INET6,
         .owner             = THIS_MODULE,
         .release           = inet6_release,
diff --git a/net/ipv6/xfrm6_mode_ro.c b/net/ipv6/xfrm6_mode_ro.c
index 0e015906f9ca..07d36573f50b 100644
--- a/net/ipv6/xfrm6_mode_ro.c
+++ b/net/ipv6/xfrm6_mode_ro.c
@@ -47,6 +47,8 @@ static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
         iph = ipv6_hdr(skb);
 
         hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
         skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
         skb_set_network_header(skb, -x->props.header_len);
         skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c
index 7a92c0f31912..9ad07a91708e 100644
--- a/net/ipv6/xfrm6_mode_transport.c
+++ b/net/ipv6/xfrm6_mode_transport.c
@@ -30,6 +30,8 @@ static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb)
         skb_set_inner_transport_header(skb, skb_transport_offset(skb));
 
         hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        if (hdr_len < 0)
+                return hdr_len;
         skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
         skb_set_network_header(skb, -x->props.header_len);
         skb->transport_header = skb->network_header + hdr_len;
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 60e2a62f7bef..cf2392b2ac71 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -7,7 +7,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
- * Copyright(c) 2015 Intel Deutschland GmbH
+ * Copyright(c) 2015-2017 Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -741,46 +741,43 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
         ieee80211_agg_start_txq(sta, tid, true);
 }
 
-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
+void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
+                              struct tid_ampdu_tx *tid_tx)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct tid_ampdu_tx *tid_tx;
 
-        trace_api_start_tx_ba_cb(sdata, ra, tid);
+        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
+                return;
+
+        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
+                ieee80211_agg_tx_operational(local, sta, tid);
+}
+
+static struct tid_ampdu_tx *
+ieee80211_lookup_tid_tx(struct ieee80211_sub_if_data *sdata,
+                        const u8 *ra, u16 tid, struct sta_info **sta)
+{
+        struct tid_ampdu_tx *tid_tx;
 
         if (tid >= IEEE80211_NUM_TIDS) {
                 ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
                        tid, IEEE80211_NUM_TIDS);
-                return;
+                return NULL;
         }
 
-        mutex_lock(&local->sta_mtx);
-        sta = sta_info_get_bss(sdata, ra);
-        if (!sta) {
-                mutex_unlock(&local->sta_mtx);
+        *sta = sta_info_get_bss(sdata, ra);
+        if (!*sta) {
                 ht_dbg(sdata, "Could not find station: %pM\n", ra);
-                return;
+                return NULL;
         }
 
-        mutex_lock(&sta->ampdu_mlme.mtx);
-        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
+        tid_tx = rcu_dereference((*sta)->ampdu_mlme.tid_tx[tid]);
 
-        if (WARN_ON(!tid_tx)) {
+        if (WARN_ON(!tid_tx))
                 ht_dbg(sdata, "addBA was not requested!\n");
-                goto unlock;
-        }
 
-        if (WARN_ON(test_and_set_bit(HT_AGG_STATE_DRV_READY, &tid_tx->state)))
-                goto unlock;
-
-        if (test_bit(HT_AGG_STATE_RESPONSE_RECEIVED, &tid_tx->state))
-                ieee80211_agg_tx_operational(local, sta, tid);
-
- unlock:
-        mutex_unlock(&sta->ampdu_mlme.mtx);
-        mutex_unlock(&local->sta_mtx);
+        return tid_tx;
 }
 
 void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
@@ -788,19 +785,20 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
+        struct sta_info *sta;
+        struct tid_ampdu_tx *tid_tx;
 
-        if (unlikely(!skb))
-                return;
+        trace_api_start_tx_ba_cb(sdata, ra, tid);
 
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
+        rcu_read_lock();
+        tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
+        if (!tid_tx)
+                goto out;
 
-        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_START;
-        skb_queue_tail(&sdata->skb_queue, skb);
-        ieee80211_queue_work(&local->hw, &sdata->work);
+        set_bit(HT_AGG_STATE_START_CB, &tid_tx->state);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+ out:
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);
 
@@ -860,37 +858,18 @@ int ieee80211_stop_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);
 
-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
+void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx)
 {
-        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
-        struct ieee80211_local *local = sdata->local;
-        struct sta_info *sta;
-        struct tid_ampdu_tx *tid_tx;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
         bool send_delba = false;
 
-        trace_api_stop_tx_ba_cb(sdata, ra, tid);
-
-        if (tid >= IEEE80211_NUM_TIDS) {
-                ht_dbg(sdata, "Bad TID value: tid = %d (>= %d)\n",
-                       tid, IEEE80211_NUM_TIDS);
-                return;
-        }
-
-        ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n", ra, tid);
-
-        mutex_lock(&local->sta_mtx);
-
-        sta = sta_info_get_bss(sdata, ra);
-        if (!sta) {
-                ht_dbg(sdata, "Could not find station: %pM\n", ra);
-                goto unlock;
-        }
+        ht_dbg(sdata, "Stopping Tx BA session for %pM tid %d\n",
+               sta->sta.addr, tid);
 
-        mutex_lock(&sta->ampdu_mlme.mtx);
         spin_lock_bh(&sta->lock);
-        tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
 
-        if (!tid_tx || !test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
+        if (!test_bit(HT_AGG_STATE_STOPPING, &tid_tx->state)) {
                 ht_dbg(sdata,
                        "unexpected callback to A-MPDU stop for %pM tid %d\n",
                        sta->sta.addr, tid);
@@ -906,12 +885,8 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
         spin_unlock_bh(&sta->lock);
 
         if (send_delba)
-                ieee80211_send_delba(sdata, ra, tid,
+                ieee80211_send_delba(sdata, sta->sta.addr, tid,
                         WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);
-
-        mutex_unlock(&sta->ampdu_mlme.mtx);
- unlock:
-        mutex_unlock(&local->sta_mtx);
 }
 
 void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
@@ -919,19 +894,20 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 {
         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_ra_tid *ra_tid;
-        struct sk_buff *skb = dev_alloc_skb(0);
+        struct sta_info *sta;
+        struct tid_ampdu_tx *tid_tx;
 
-        if (unlikely(!skb))
-                return;
+        trace_api_stop_tx_ba_cb(sdata, ra, tid);
 
-        ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
-        memcpy(&ra_tid->ra, ra, ETH_ALEN);
-        ra_tid->tid = tid;
+        rcu_read_lock();
+        tid_tx = ieee80211_lookup_tid_tx(sdata, ra, tid, &sta);
+        if (!tid_tx)
+                goto out;
 
-        skb->pkt_type = IEEE80211_SDATA_QUEUE_AGG_STOP;
-        skb_queue_tail(&sdata->skb_queue, skb);
-        ieee80211_queue_work(&local->hw, &sdata->work);
+        set_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state);
+        ieee80211_queue_work(&local->hw, &sta->ampdu_mlme.work);
+ out:
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);
 
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index f4a528773563..6ca5442b1e03 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -7,6 +7,7 @@
  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
  * Copyright 2007-2010, Intel Corporation
+ * Copyright 2017       Intel Deutschland GmbH
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -289,8 +290,6 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
 {
         int i;
 
-        cancel_work_sync(&sta->ampdu_mlme.work);
-
         for (i = 0; i <  IEEE80211_NUM_TIDS; i++) {
                 __ieee80211_stop_tx_ba_session(sta, i, reason);
                 __ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
@@ -298,6 +297,9 @@ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
                                                reason != AGG_STOP_DESTROY_STA &&
                                                reason != AGG_STOP_PEER_REQUEST);
         }
+
+        /* stopping might queue the work again - so cancel only afterwards */
+        cancel_work_sync(&sta->ampdu_mlme.work);
 }
 
 void ieee80211_ba_session_work(struct work_struct *work)
@@ -352,10 +354,16 @@ void ieee80211_ba_session_work(struct work_struct *work)
                 spin_unlock_bh(&sta->lock);
 
                 tid_tx = rcu_dereference_protected_tid_tx(sta, tid);
-                if (tid_tx && test_and_clear_bit(HT_AGG_STATE_WANT_STOP,
-                                                 &tid_tx->state))
+                if (!tid_tx)
+                        continue;
+
+                if (test_and_clear_bit(HT_AGG_STATE_START_CB, &tid_tx->state))
+                        ieee80211_start_tx_ba_cb(sta, tid, tid_tx);
+                if (test_and_clear_bit(HT_AGG_STATE_WANT_STOP, &tid_tx->state))
                         ___ieee80211_stop_tx_ba_session(sta, tid,
                                                         AGG_STOP_LOCAL_REQUEST);
+                if (test_and_clear_bit(HT_AGG_STATE_STOP_CB, &tid_tx->state))
+                        ieee80211_stop_tx_ba_cb(sta, tid, tid_tx);
         }
         mutex_unlock(&sta->ampdu_mlme.mtx);
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index f8f6c148f554..665501ac358f 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1036,8 +1036,6 @@ struct ieee80211_rx_agg {
 
 enum sdata_queue_type {
         IEEE80211_SDATA_QUEUE_TYPE_FRAME        = 0,
-        IEEE80211_SDATA_QUEUE_AGG_START         = 1,
-        IEEE80211_SDATA_QUEUE_AGG_STOP          = 2,
         IEEE80211_SDATA_QUEUE_RX_AGG_START      = 3,
         IEEE80211_SDATA_QUEUE_RX_AGG_STOP       = 4,
 };
@@ -1427,12 +1425,6 @@ ieee80211_get_sband(struct ieee80211_sub_if_data *sdata)
         return local->hw.wiphy->bands[band];
 }
 
-/* this struct represents 802.11n's RA/TID combination */
-struct ieee80211_ra_tid {
-        u8 ra[ETH_ALEN];
-        u16 tid;
-};
-
 /* this struct holds the value parsing from channel switch IE  */
 struct ieee80211_csa_ie {
         struct cfg80211_chan_def chandef;
@@ -1794,8 +1786,10 @@ int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                    enum ieee80211_agg_stop_reason reason);
 int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
                                     enum ieee80211_agg_stop_reason reason);
-void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid);
-void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid);
+void ieee80211_start_tx_ba_cb(struct sta_info *sta, int tid,
+                              struct tid_ampdu_tx *tid_tx);
+void ieee80211_stop_tx_ba_cb(struct sta_info *sta, int tid,
+                             struct tid_ampdu_tx *tid_tx);
 void ieee80211_ba_session_work(struct work_struct *work);
 void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid);
 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 3bd5b81f5d81..8fae1a72e6a7 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1237,7 +1237,6 @@ static void ieee80211_iface_work(struct work_struct *work)
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct sta_info *sta;
-        struct ieee80211_ra_tid *ra_tid;
         struct ieee80211_rx_agg *rx_agg;
 
         if (!ieee80211_sdata_running(sdata))
@@ -1253,15 +1252,7 @@ static void ieee80211_iface_work(struct work_struct *work)
         while ((skb = skb_dequeue(&sdata->skb_queue))) {
                 struct ieee80211_mgmt *mgmt = (void *)skb->data;
 
-                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_START) {
-                        ra_tid = (void *)&skb->cb;
-                        ieee80211_start_tx_ba_cb(&sdata->vif, ra_tid->ra,
-                                                 ra_tid->tid);
-                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_AGG_STOP) {
-                        ra_tid = (void *)&skb->cb;
-                        ieee80211_stop_tx_ba_cb(&sdata->vif, ra_tid->ra,
-                                                ra_tid->tid);
-                } else if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) {
+                if (skb->pkt_type == IEEE80211_SDATA_QUEUE_RX_AGG_START) {
                         rx_agg = (void *)&skb->cb;
                         mutex_lock(&local->sta_mtx);
                         sta = sta_info_get_bss(sdata, rx_agg->addr);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7cdf7a835bb0..403e3cc58b57 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2155,7 +2155,7 @@ void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         struct ieee80211_sta_rx_stats *cpurxs;
 
                         cpurxs = per_cpu_ptr(sta->pcpu_rx_stats, cpu);
-                        sinfo->rx_packets += cpurxs->dropped;
+                        sinfo->rx_dropped_misc += cpurxs->dropped;
                 }
         }
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 5609cacb20d5..ea0747d6a6da 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -116,6 +116,8 @@ enum ieee80211_sta_info_flags {
 #define HT_AGG_STATE_STOPPING           3
 #define HT_AGG_STATE_WANT_START         4
 #define HT_AGG_STATE_WANT_STOP          5
+#define HT_AGG_STATE_START_CB           6
+#define HT_AGG_STATE_STOP_CB            7
 
 enum ieee80211_agg_stop_reason {
         AGG_STOP_DECLINED,
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 257ec66009da..7b05fd1497ce 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -1418,7 +1418,7 @@ static void mpls_ifup(struct net_device *dev, unsigned int flags)
                                 continue;
                         alive++;
                         nh_flags &= ~flags;
-                        WRITE_ONCE(nh->nh_flags, flags);
+                        WRITE_ONCE(nh->nh_flags, nh_flags);
                 } endfor_nexthops(rt);
 
                 WRITE_ONCE(rt->rt_nhn_alive, alive);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 9799a50bc604..a8be9b72e6cd 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -890,8 +890,13 @@ restart:
         }
 out:
         local_bh_enable();
-        if (last)
+        if (last) {
+                /* nf ct hash resize happened, now clear the leftover. */
+                if ((struct nf_conn *)cb->args[1] == last)
+                        cb->args[1] = 0;
+
                 nf_ct_put(last);
+        }
 
         while (i) {
                 i--;
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 13875d599a85..1c5b14a6cab3 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -512,16 +512,19 @@ static int sctp_error(struct net *net, struct nf_conn *tpl, struct sk_buff *skb,
                       u8 pf, unsigned int hooknum)
 {
         const struct sctphdr *sh;
-        struct sctphdr _sctph;
         const char *logmsg;
 
-        sh = skb_header_pointer(skb, dataoff, sizeof(_sctph), &_sctph);
-        if (!sh) {
+        if (skb->len < dataoff + sizeof(struct sctphdr)) {
                 logmsg = "nf_ct_sctp: short packet ";
                 goto out_invalid;
         }
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             skb->ip_summed == CHECKSUM_NONE) {
+                if (!skb_make_writable(skb, dataoff + sizeof(struct sctphdr))) {
+                        logmsg = "nf_ct_sctp: failed to read header ";
+                        goto out_invalid;
+                }
+                sh = (const struct sctphdr *)(skb->data + dataoff);
                 if (sh->checksum != sctp_compute_cksum(skb, dataoff)) {
                         logmsg = "nf_ct_sctp: bad CRC ";
                         goto out_invalid;
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index ef0be325a0c6..6c72922d20ca 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -566,7 +566,7 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
          * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
          * will delete entry from already-freed table.
          */
-        ct->status &= ~IPS_NAT_DONE_MASK;
+        clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
         rhltable_remove(&nf_nat_bysource_table, &ct->nat_bysource,
                         nf_nat_bysource_params);
 
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index e97e2fb53f0a..fbdbaa00dd5f 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -116,17 +116,17 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
                 else if (d > 0)
                         p = &parent->rb_right;
                 else {
-                        if (nft_set_elem_active(&rbe->ext, genmask)) {
-                                if (nft_rbtree_interval_end(rbe) &&
-                                    !nft_rbtree_interval_end(new))
-                                        p = &parent->rb_left;
-                                else if (!nft_rbtree_interval_end(rbe) &&
-                                         nft_rbtree_interval_end(new))
-                                        p = &parent->rb_right;
-                                else {
-                                        *ext = &rbe->ext;
-                                        return -EEXIST;
-                                }
+                        if (nft_rbtree_interval_end(rbe) &&
+                            !nft_rbtree_interval_end(new)) {
+                                p = &parent->rb_left;
+                        } else if (!nft_rbtree_interval_end(rbe) &&
+                                   nft_rbtree_interval_end(new)) {
+                                p = &parent->rb_right;
+                        } else if (nft_set_elem_active(&rbe->ext, genmask)) {
+                                *ext = &rbe->ext;
+                                return -EEXIST;
+                        } else {
+                                p = &parent->rb_left;
                         }
                 }
         }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index ee841f00a6ec..7586d446d7dc 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -62,6 +62,7 @@
 #include <asm/cacheflush.h>
 #include <linux/hash.h>
 #include <linux/genetlink.h>
+#include <linux/net_namespace.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -1415,7 +1416,8 @@ static void do_one_broadcast(struct sock *sk,
                 goto out;
         }
         NETLINK_CB(p->skb2).nsid = peernet2id(sock_net(sk), p->net);
-        NETLINK_CB(p->skb2).nsid_is_set = true;
+        if (NETLINK_CB(p->skb2).nsid != NETNSA_NSID_NOT_ASSIGNED)
+                NETLINK_CB(p->skb2).nsid_is_set = true;
         val = netlink_broadcast_deliver(sk, p->skb2);
         if (val < 0) {
                 netlink_overrun(sk);
diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c
index 24fedd4b117e..03f6b5840764 100644
--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -119,11 +119,9 @@ int xprt_rdma_bc_setup(struct rpc_xprt *xprt, unsigned int reqs)
 
         for (i = 0; i < (reqs << 1); i++) {
                 rqst = kzalloc(sizeof(*rqst), GFP_KERNEL);
-                if (!rqst) {
-                        pr_err("RPC:       %s: Failed to create bc rpc_rqst\n",
-                               __func__);
+                if (!rqst)
                         goto out_free;
-                }
+
                 dprintk("RPC:       %s: new rqst %p\n", __func__, rqst);
 
                 rqst->rq_xprt = &r_xprt->rx_xprt;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 16aff8ddc16f..d5b54c020dec 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2432,7 +2432,12 @@ static void xs_tcp_setup_socket(struct work_struct *work)
         case -ENETUNREACH:
         case -EADDRINUSE:
         case -ENOBUFS:
-                /* retry with existing socket, after a delay */
+                /*
+                 * xs_tcp_force_close() wakes tasks with -EIO.
+                 * We need to wake them first to ensure the
+                 * correct error code.
+                 */
+                xprt_wake_pending_tasks(xprt, status);
                 xs_tcp_force_close(xprt);
                 goto out;
         }