23 files changed, 224 insertions, 146 deletions

diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index e23449094188..9cb7044d0801 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -582,7 +582,7 @@ int br_set_ageing_time(struct net_bridge *br, u32 ageing_time)
         int err;
 
         err = switchdev_port_attr_set(br->dev, &attr);
-        if (err)
+        if (err && err != -EOPNOTSUPP)
                 return err;
 
         br->ageing_time = t;
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 67b2e27999aa..8570bc7744c2 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1521,6 +1521,8 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
         if (copy_from_user(&tmp, user, sizeof(tmp)))
                 return -EFAULT;
 
+        tmp.name[sizeof(tmp.name) - 1] = '\0';
+
         t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
         if (!t)
                 return ret;
@@ -2332,6 +2334,8 @@ static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
         if (copy_from_user(&tmp, user, sizeof(tmp)))
                 return -EFAULT;
 
+        tmp.name[sizeof(tmp.name) - 1] = '\0';
+
         t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
         if (!t)
                 return ret;
diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index adc8d7221dbb..77f7e7a9ebe1 100644
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -40,7 +40,8 @@ static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
 /* We cannot use oldskb->dev, it can be either bridge device (NF_BRIDGE INPUT)
  * or the bridge port (NF_BRIDGE PREROUTING).
  */
-static void nft_reject_br_send_v4_tcp_reset(struct sk_buff *oldskb,
+static void nft_reject_br_send_v4_tcp_reset(struct net *net,
+                                            struct sk_buff *oldskb,
                                             const struct net_device *dev,
                                             int hook)
 {
@@ -48,7 +49,6 @@ static void nft_reject_br_send_v4_tcp_reset(struct sk_buff *oldskb,
         struct iphdr *niph;
         const struct tcphdr *oth;
         struct tcphdr _oth;
-        struct net *net = sock_net(oldskb->sk);
 
         if (!nft_bridge_iphdr_validate(oldskb))
                 return;
@@ -75,7 +75,8 @@ static void nft_reject_br_send_v4_tcp_reset(struct sk_buff *oldskb,
         br_deliver(br_port_get_rcu(dev), nskb);
 }
 
-static void nft_reject_br_send_v4_unreach(struct sk_buff *oldskb,
+static void nft_reject_br_send_v4_unreach(struct net *net,
+                                          struct sk_buff *oldskb,
                                           const struct net_device *dev,
                                           int hook, u8 code)
 {
@@ -86,7 +87,6 @@ static void nft_reject_br_send_v4_unreach(struct sk_buff *oldskb,
         void *payload;
         __wsum csum;
         u8 proto;
-        struct net *net = sock_net(oldskb->sk);
 
         if (oldskb->csum_bad || !nft_bridge_iphdr_validate(oldskb))
                 return;
@@ -273,17 +273,17 @@ static void nft_reject_bridge_eval(const struct nft_expr *expr,
         case htons(ETH_P_IP):
                 switch (priv->type) {
                 case NFT_REJECT_ICMP_UNREACH:
-                        nft_reject_br_send_v4_unreach(pkt->skb, pkt->in,
-                                                      pkt->hook,
+                        nft_reject_br_send_v4_unreach(pkt->net, pkt->skb,
+                                                      pkt->in, pkt->hook,
                                                       priv->icmp_code);
                         break;
                 case NFT_REJECT_TCP_RST:
-                        nft_reject_br_send_v4_tcp_reset(pkt->skb, pkt->in,
-                                                        pkt->hook);
+                        nft_reject_br_send_v4_tcp_reset(pkt->net, pkt->skb,
+                                                        pkt->in, pkt->hook);
                         break;
                 case NFT_REJECT_ICMPX_UNREACH:
-                        nft_reject_br_send_v4_unreach(pkt->skb, pkt->in,
-                                                      pkt->hook,
+                        nft_reject_br_send_v4_unreach(pkt->net, pkt->skb,
+                                                      pkt->in, pkt->hook,
                                                       nft_reject_icmp_code(priv->icmp_code));
                         break;
                 }
diff --git a/net/core/filter.c b/net/core/filter.c
index b7177d01ecb0..ca7f832b2980 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1149,7 +1149,8 @@ void bpf_prog_destroy(struct bpf_prog *fp)
 }
 EXPORT_SYMBOL_GPL(bpf_prog_destroy);
 
-static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk)
+static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk,
+                            bool locked)
 {
         struct sk_filter *fp, *old_fp;
 
@@ -1165,10 +1166,8 @@ static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk)
                 return -ENOMEM;
         }
 
-        old_fp = rcu_dereference_protected(sk->sk_filter,
-                                           sock_owned_by_user(sk));
+        old_fp = rcu_dereference_protected(sk->sk_filter, locked);
         rcu_assign_pointer(sk->sk_filter, fp);
-
         if (old_fp)
                 sk_filter_uncharge(sk, old_fp);
 
@@ -1247,7 +1246,8 @@ struct bpf_prog *__get_filter(struct sock_fprog *fprog, struct sock *sk)
  * occurs or there is insufficient memory for the filter a negative
  * errno code is returned. On success the return is zero.
  */
-int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
+int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk,
+                       bool locked)
 {
         struct bpf_prog *prog = __get_filter(fprog, sk);
         int err;
@@ -1255,7 +1255,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
         if (IS_ERR(prog))
                 return PTR_ERR(prog);
 
-        err = __sk_attach_prog(prog, sk);
+        err = __sk_attach_prog(prog, sk, locked);
         if (err < 0) {
                 __bpf_prog_release(prog);
                 return err;
@@ -1263,7 +1263,12 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(sk_attach_filter);
+EXPORT_SYMBOL_GPL(__sk_attach_filter);
+
+int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
+{
+        return __sk_attach_filter(fprog, sk, sock_owned_by_user(sk));
+}
 
 int sk_reuseport_attach_filter(struct sock_fprog *fprog, struct sock *sk)
 {
@@ -1309,7 +1314,7 @@ int sk_attach_bpf(u32 ufd, struct sock *sk)
         if (IS_ERR(prog))
                 return PTR_ERR(prog);
 
-        err = __sk_attach_prog(prog, sk);
+        err = __sk_attach_prog(prog, sk, sock_owned_by_user(sk));
         if (err < 0) {
                 bpf_prog_put(prog);
                 return err;
@@ -1764,6 +1769,7 @@ static u64 bpf_skb_get_tunnel_key(u64 r1, u64 r2, u64 size, u64 flags, u64 r5)
         if (unlikely(size != sizeof(struct bpf_tunnel_key))) {
                 switch (size) {
                 case offsetof(struct bpf_tunnel_key, tunnel_label):
+                case offsetof(struct bpf_tunnel_key, tunnel_ext):
                         goto set_compat;
                 case offsetof(struct bpf_tunnel_key, remote_ipv6[1]):
                         /* Fixup deprecated structure layouts here, so we have
@@ -1849,6 +1855,7 @@ static u64 bpf_skb_set_tunnel_key(u64 r1, u64 r2, u64 size, u64 flags, u64 r5)
         if (unlikely(size != sizeof(struct bpf_tunnel_key))) {
                 switch (size) {
                 case offsetof(struct bpf_tunnel_key, tunnel_label):
+                case offsetof(struct bpf_tunnel_key, tunnel_ext):
                 case offsetof(struct bpf_tunnel_key, remote_ipv6[1]):
                         /* Fixup deprecated structure layouts here, so we have
                          * a common path later on.
@@ -1861,7 +1868,8 @@ static u64 bpf_skb_set_tunnel_key(u64 r1, u64 r2, u64 size, u64 flags, u64 r5)
                         return -EINVAL;
                 }
         }
-        if (unlikely(!(flags & BPF_F_TUNINFO_IPV6) && from->tunnel_label))
+        if (unlikely((!(flags & BPF_F_TUNINFO_IPV6) && from->tunnel_label) ||
+                     from->tunnel_ext))
                 return -EINVAL;
 
         skb_dst_drop(skb);
@@ -2247,7 +2255,7 @@ static int __init register_sk_filter_ops(void)
 }
 late_initcall(register_sk_filter_ops);
 
-int sk_detach_filter(struct sock *sk)
+int __sk_detach_filter(struct sock *sk, bool locked)
 {
         int ret = -ENOENT;
         struct sk_filter *filter;
@@ -2255,8 +2263,7 @@ int sk_detach_filter(struct sock *sk)
         if (sock_flag(sk, SOCK_FILTER_LOCKED))
                 return -EPERM;
 
-        filter = rcu_dereference_protected(sk->sk_filter,
-                                           sock_owned_by_user(sk));
+        filter = rcu_dereference_protected(sk->sk_filter, locked);
         if (filter) {
                 RCU_INIT_POINTER(sk->sk_filter, NULL);
                 sk_filter_uncharge(sk, filter);
@@ -2265,7 +2272,12 @@ int sk_detach_filter(struct sock *sk)
 
         return ret;
 }
-EXPORT_SYMBOL_GPL(sk_detach_filter);
+EXPORT_SYMBOL_GPL(__sk_detach_filter);
+
+int sk_detach_filter(struct sock *sk)
+{
+        return __sk_detach_filter(sk, sock_owned_by_user(sk));
+}
 
 int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf,
                   unsigned int len)
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 94acfc89ad97..a57bd17805b4 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -603,7 +603,6 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev)
         const struct net_device_ops *ops;
         int err;
 
-        np->dev = ndev;
         strlcpy(np->dev_name, ndev->name, IFNAMSIZ);
         INIT_WORK(&np->cleanup_work, netpoll_async_cleanup);
 
@@ -670,6 +669,7 @@ int netpoll_setup(struct netpoll *np)
                 goto unlock;
         }
         dev_hold(ndev);
+        np->dev = ndev;
 
         if (netdev_master_upper_dev_get(ndev)) {
                 np_err(np, "%s is a slave device, aborting\n", np->dev_name);
@@ -770,6 +770,7 @@ int netpoll_setup(struct netpoll *np)
         return 0;
 
 put:
+        np->dev = NULL;
         dev_put(ndev);
 unlock:
         rtnl_unlock();
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f2066772d0f3..a75f7e94b445 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -909,6 +909,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
                + rtnl_link_get_af_size(dev, ext_filter_mask) /* IFLA_AF_SPEC */
                + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_PORT_ID */
                + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_SWITCH_ID */
+               + nla_total_size(IFNAMSIZ) /* IFLA_PHYS_PORT_NAME */
                + nla_total_size(1); /* IFLA_PROTO_DOWN */
 
 }
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index a0586b4a197d..5a94aea280d3 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -195,6 +195,14 @@ static struct sk_buff **fou_gro_receive(struct sk_buff **head,
         u8 proto = NAPI_GRO_CB(skb)->proto;
         const struct net_offload **offloads;
 
+        /* We can clear the encap_mark for FOU as we are essentially doing
+         * one of two possible things.  We are either adding an L4 tunnel
+         * header to the outer L3 tunnel header, or we are are simply
+         * treating the GRE tunnel header as though it is a UDP protocol
+         * specific header such as VXLAN or GENEVE.
+         */
+        NAPI_GRO_CB(skb)->encap_mark = 0;
+
         rcu_read_lock();
         offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
         ops = rcu_dereference(offloads[proto]);
@@ -352,6 +360,14 @@ static struct sk_buff **gue_gro_receive(struct sk_buff **head,
                 }
         }
 
+        /* We can clear the encap_mark for GUE as we are essentially doing
+         * one of two possible things.  We are either adding an L4 tunnel
+         * header to the outer L3 tunnel header, or we are are simply
+         * treating the GRE tunnel header as though it is a UDP protocol
+         * specific header such as VXLAN or GENEVE.
+         */
+        NAPI_GRO_CB(skb)->encap_mark = 0;
+
         rcu_read_lock();
         offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
         ops = rcu_dereference(offloads[guehdr->proto_ctype]);
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 02dd990af542..6165f30c4d72 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -372,8 +372,8 @@ static int ip6_tun_fill_encap_info(struct sk_buff *skb,
         if (nla_put_be64(skb, LWTUNNEL_IP6_ID, tun_info->key.tun_id) ||
             nla_put_in6_addr(skb, LWTUNNEL_IP6_DST, &tun_info->key.u.ipv6.dst) ||
             nla_put_in6_addr(skb, LWTUNNEL_IP6_SRC, &tun_info->key.u.ipv6.src) ||
-            nla_put_u8(skb, LWTUNNEL_IP6_HOPLIMIT, tun_info->key.tos) ||
-            nla_put_u8(skb, LWTUNNEL_IP6_TC, tun_info->key.ttl) ||
+            nla_put_u8(skb, LWTUNNEL_IP6_TC, tun_info->key.tos) ||
+            nla_put_u8(skb, LWTUNNEL_IP6_HOPLIMIT, tun_info->key.ttl) ||
             nla_put_be16(skb, LWTUNNEL_IP6_FLAGS, tun_info->key.tun_flags))
                 return -ENOMEM;
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index bf081927e06b..4133b0f513af 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -359,11 +359,12 @@ unsigned int arpt_do_table(struct sk_buff *skb,
 }
 
 /* All zeroes == unconditional rule. */
-static inline bool unconditional(const struct arpt_arp *arp)
+static inline bool unconditional(const struct arpt_entry *e)
 {
         static const struct arpt_arp uncond;
 
-        return memcmp(arp, &uncond, sizeof(uncond)) == 0;
+        return e->target_offset == sizeof(struct arpt_entry) &&
+               memcmp(&e->arp, &uncond, sizeof(uncond)) == 0;
 }
 
 /* Figures out from what hook each rule can be called: returns 0 if
@@ -402,11 +403,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
                                 |= ((1 << hook) | (1 << NF_ARP_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct arpt_entry) &&
+                        if ((unconditional(e) &&
                              (strcmp(t->target.u.user.name,
                                      XT_STANDARD_TARGET) == 0) &&
-                             t->verdict < 0 && unconditional(&e->arp)) ||
-                            visited) {
+                             t->verdict < 0) || visited) {
                                 unsigned int oldpos, size;
 
                                 if ((strcmp(t->target.u.user.name,
@@ -474,14 +474,12 @@ next:
         return 1;
 }
 
-static inline int check_entry(const struct arpt_entry *e, const char *name)
+static inline int check_entry(const struct arpt_entry *e)
 {
         const struct xt_entry_target *t;
 
-        if (!arp_checkentry(&e->arp)) {
-                duprintf("arp_tables: arp check failed %p %s.\n", e, name);
+        if (!arp_checkentry(&e->arp))
                 return -EINVAL;
-        }
 
         if (e->target_offset + sizeof(struct xt_entry_target) > e->next_offset)
                 return -EINVAL;
@@ -522,10 +520,6 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size)
         struct xt_target *target;
         int ret;
 
-        ret = check_entry(e, name);
-        if (ret)
-                return ret;
-
         e->counters.pcnt = xt_percpu_counter_alloc();
         if (IS_ERR_VALUE(e->counters.pcnt))
                 return -ENOMEM;
@@ -557,7 +551,7 @@ static bool check_underflow(const struct arpt_entry *e)
         const struct xt_entry_target *t;
         unsigned int verdict;
 
-        if (!unconditional(&e->arp))
+        if (!unconditional(e))
                 return false;
         t = arpt_get_target_c(e);
         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
@@ -576,9 +570,11 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
                                              unsigned int valid_hooks)
 {
         unsigned int h;
+        int err;
 
         if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
-            (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
+            (unsigned char *)e + sizeof(struct arpt_entry) >= limit ||
+            (unsigned char *)e + e->next_offset > limit) {
                 duprintf("Bad offset %p\n", e);
                 return -EINVAL;
         }
@@ -590,6 +586,10 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
                 return -EINVAL;
         }
 
+        err = check_entry(e);
+        if (err)
+                return err;
+
         /* Check hooks & underflows */
         for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
                 if (!(valid_hooks & (1 << h)))
@@ -598,9 +598,9 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
                         newinfo->hook_entry[h] = hook_entries[h];
                 if ((unsigned char *)e - base == underflows[h]) {
                         if (!check_underflow(e)) {
-                                pr_err("Underflows must be unconditional and "
-                                       "use the STANDARD target with "
-                                       "ACCEPT/DROP\n");
+                                pr_debug("Underflows must be unconditional and "
+                                         "use the STANDARD target with "
+                                         "ACCEPT/DROP\n");
                                 return -EINVAL;
                         }
                         newinfo->underflow[h] = underflows[h];
@@ -969,6 +969,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
                          sizeof(struct arpt_get_entries) + get.size);
                 return -EINVAL;
         }
+        get.name[sizeof(get.name) - 1] = '\0';
 
         t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
         if (!IS_ERR_OR_NULL(t)) {
@@ -1233,7 +1234,8 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
         if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 ||
-            (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
+            (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit ||
+            (unsigned char *)e + e->next_offset > limit) {
                 duprintf("Bad offset %p, limit = %p\n", e, limit);
                 return -EINVAL;
         }
@@ -1246,7 +1248,7 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
         }
 
         /* For purposes of check_entry casting the compat entry is fine */
-        ret = check_entry((struct arpt_entry *)e, name);
+        ret = check_entry((struct arpt_entry *)e);
         if (ret)
                 return ret;
 
@@ -1662,6 +1664,7 @@ static int compat_get_entries(struct net *net,
                          *len, sizeof(get) + get.size);
                 return -EINVAL;
         }
+        get.name[sizeof(get.name) - 1] = '\0';
 
         xt_compat_lock(NFPROTO_ARP);
         t = xt_find_table_lock(net, NFPROTO_ARP, get.name);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index e53f8d6f326d..631c100a1338 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -168,11 +168,12 @@ get_entry(const void *base, unsigned int offset)
 
 /* All zeroes == unconditional rule. */
 /* Mildly perf critical (only if packet tracing is on) */
-static inline bool unconditional(const struct ipt_ip *ip)
+static inline bool unconditional(const struct ipt_entry *e)
 {
         static const struct ipt_ip uncond;
 
-        return memcmp(ip, &uncond, sizeof(uncond)) == 0;
+        return e->target_offset == sizeof(struct ipt_entry) &&
+               memcmp(&e->ip, &uncond, sizeof(uncond)) == 0;
 #undef FWINV
 }
 
@@ -229,11 +230,10 @@ get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
         } else if (s == e) {
                 (*rulenum)++;
 
-                if (s->target_offset == sizeof(struct ipt_entry) &&
+                if (unconditional(s) &&
                     strcmp(t->target.u.kernel.target->name,
                            XT_STANDARD_TARGET) == 0 &&
-                   t->verdict < 0 &&
-                   unconditional(&s->ip)) {
+                   t->verdict < 0) {
                         /* Tail of chains: STANDARD target (return/policy) */
                         *comment = *chainname == hookname
                                 ? comments[NF_IP_TRACE_COMMENT_POLICY]
@@ -476,11 +476,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct ipt_entry) &&
+                        if ((unconditional(e) &&
                              (strcmp(t->target.u.user.name,
                                      XT_STANDARD_TARGET) == 0) &&
-                             t->verdict < 0 && unconditional(&e->ip)) ||
-                            visited) {
+                             t->verdict < 0) || visited) {
                                 unsigned int oldpos, size;
 
                                 if ((strcmp(t->target.u.user.name,
@@ -569,14 +568,12 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net)
 }
 
 static int
-check_entry(const struct ipt_entry *e, const char *name)
+check_entry(const struct ipt_entry *e)
 {
         const struct xt_entry_target *t;
 
-        if (!ip_checkentry(&e->ip)) {
-                duprintf("ip check failed %p %s.\n", e, name);
+        if (!ip_checkentry(&e->ip))
                 return -EINVAL;
-        }
 
         if (e->target_offset + sizeof(struct xt_entry_target) >
             e->next_offset)
@@ -666,10 +663,6 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
         struct xt_mtchk_param mtpar;
         struct xt_entry_match *ematch;
 
-        ret = check_entry(e, name);
-        if (ret)
-                return ret;
-
         e->counters.pcnt = xt_percpu_counter_alloc();
         if (IS_ERR_VALUE(e->counters.pcnt))
                 return -ENOMEM;
@@ -721,7 +714,7 @@ static bool check_underflow(const struct ipt_entry *e)
         const struct xt_entry_target *t;
         unsigned int verdict;
 
-        if (!unconditional(&e->ip))
+        if (!unconditional(e))
                 return false;
         t = ipt_get_target_c(e);
         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
@@ -741,9 +734,11 @@ check_entry_size_and_hooks(struct ipt_entry *e,
                            unsigned int valid_hooks)
 {
         unsigned int h;
+        int err;
 
         if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
-            (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
+            (unsigned char *)e + sizeof(struct ipt_entry) >= limit ||
+            (unsigned char *)e + e->next_offset > limit) {
                 duprintf("Bad offset %p\n", e);
                 return -EINVAL;
         }
@@ -755,6 +750,10 @@ check_entry_size_and_hooks(struct ipt_entry *e,
                 return -EINVAL;
         }
 
+        err = check_entry(e);
+        if (err)
+                return err;
+
         /* Check hooks & underflows */
         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
                 if (!(valid_hooks & (1 << h)))
@@ -763,9 +762,9 @@ check_entry_size_and_hooks(struct ipt_entry *e,
                         newinfo->hook_entry[h] = hook_entries[h];
                 if ((unsigned char *)e - base == underflows[h]) {
                         if (!check_underflow(e)) {
-                                pr_err("Underflows must be unconditional and "
-                                       "use the STANDARD target with "
-                                       "ACCEPT/DROP\n");
+                                pr_debug("Underflows must be unconditional and "
+                                         "use the STANDARD target with "
+                                         "ACCEPT/DROP\n");
                                 return -EINVAL;
                         }
                         newinfo->underflow[h] = underflows[h];
@@ -1157,6 +1156,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr,
                          *len, sizeof(get) + get.size);
                 return -EINVAL;
         }
+        get.name[sizeof(get.name) - 1] = '\0';
 
         t = xt_find_table_lock(net, AF_INET, get.name);
         if (!IS_ERR_OR_NULL(t)) {
@@ -1493,7 +1493,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
         if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
-            (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
+            (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit ||
+            (unsigned char *)e + e->next_offset > limit) {
                 duprintf("Bad offset %p, limit = %p\n", e, limit);
                 return -EINVAL;
         }
@@ -1506,7 +1507,7 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
         }
 
         /* For purposes of check_entry casting the compat entry is fine */
-        ret = check_entry((struct ipt_entry *)e, name);
+        ret = check_entry((struct ipt_entry *)e);
         if (ret)
                 return ret;
 
@@ -1935,6 +1936,7 @@ compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
                          *len, sizeof(get) + get.size);
                 return -EINVAL;
         }
+        get.name[sizeof(get.name) - 1] = '\0';
 
         xt_compat_lock(AF_INET);
         t = xt_find_table_lock(net, AF_INET, get.name);
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 7b8fbb352877..db5b87509446 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -18,10 +18,10 @@
 #include <net/netfilter/nf_conntrack_synproxy.h>
 
 static struct iphdr *
-synproxy_build_ip(struct sk_buff *skb, __be32 saddr, __be32 daddr)
+synproxy_build_ip(struct net *net, struct sk_buff *skb, __be32 saddr,
+                  __be32 daddr)
 {
         struct iphdr *iph;
-        struct net *net = sock_net(skb->sk);
 
         skb_reset_network_header(skb);
         iph = (struct iphdr *)skb_put(skb, sizeof(*iph));
@@ -40,14 +40,12 @@ synproxy_build_ip(struct sk_buff *skb, __be32 saddr, __be32 daddr)
 }
 
 static void
-synproxy_send_tcp(const struct synproxy_net *snet,
+synproxy_send_tcp(struct net *net,
                   const struct sk_buff *skb, struct sk_buff *nskb,
                   struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
                   struct iphdr *niph, struct tcphdr *nth,
                   unsigned int tcp_hdr_size)
 {
-        struct net *net = nf_ct_net(snet->tmpl);
-
         nth->check = ~tcp_v4_check(tcp_hdr_size, niph->saddr, niph->daddr, 0);
         nskb->ip_summed   = CHECKSUM_PARTIAL;
         nskb->csum_start  = (unsigned char *)nth - nskb->head;
@@ -72,7 +70,7 @@ free_nskb:
 }
 
 static void
-synproxy_send_client_synack(const struct synproxy_net *snet,
+synproxy_send_client_synack(struct net *net,
                             const struct sk_buff *skb, const struct tcphdr *th,
                             const struct synproxy_options *opts)
 {
@@ -91,7 +89,7 @@ synproxy_send_client_synack(const struct synproxy_net *snet,
                 return;
         skb_reserve(nskb, MAX_TCP_HEADER);
 
-        niph = synproxy_build_ip(nskb, iph->daddr, iph->saddr);
+        niph = synproxy_build_ip(net, nskb, iph->daddr, iph->saddr);
 
         skb_reset_transport_header(nskb);
         nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
@@ -109,15 +107,16 @@ synproxy_send_client_synack(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+        synproxy_send_tcp(net, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
                           niph, nth, tcp_hdr_size);
 }
 
 static void
-synproxy_send_server_syn(const struct synproxy_net *snet,
+synproxy_send_server_syn(struct net *net,
                          const struct sk_buff *skb, const struct tcphdr *th,
                          const struct synproxy_options *opts, u32 recv_seq)
 {
+        struct synproxy_net *snet = synproxy_pernet(net);
         struct sk_buff *nskb;
         struct iphdr *iph, *niph;
         struct tcphdr *nth;
@@ -132,7 +131,7 @@ synproxy_send_server_syn(const struct synproxy_net *snet,
                 return;
         skb_reserve(nskb, MAX_TCP_HEADER);
 
-        niph = synproxy_build_ip(nskb, iph->saddr, iph->daddr);
+        niph = synproxy_build_ip(net, nskb, iph->saddr, iph->daddr);
 
         skb_reset_transport_header(nskb);
         nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
@@ -153,12 +152,12 @@ synproxy_send_server_syn(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(snet, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
+        synproxy_send_tcp(net, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
                           niph, nth, tcp_hdr_size);
 }
 
 static void
-synproxy_send_server_ack(const struct synproxy_net *snet,
+synproxy_send_server_ack(struct net *net,
                          const struct ip_ct_tcp *state,
                          const struct sk_buff *skb, const struct tcphdr *th,
                          const struct synproxy_options *opts)
@@ -177,7 +176,7 @@ synproxy_send_server_ack(const struct synproxy_net *snet,
                 return;
         skb_reserve(nskb, MAX_TCP_HEADER);
 
-        niph = synproxy_build_ip(nskb, iph->daddr, iph->saddr);
+        niph = synproxy_build_ip(net, nskb, iph->daddr, iph->saddr);
 
         skb_reset_transport_header(nskb);
         nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
@@ -193,11 +192,11 @@ synproxy_send_server_ack(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(snet, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+        synproxy_send_tcp(net, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
 }
 
 static void
-synproxy_send_client_ack(const struct synproxy_net *snet,
+synproxy_send_client_ack(struct net *net,
                          const struct sk_buff *skb, const struct tcphdr *th,
                          const struct synproxy_options *opts)
 {
@@ -215,7 +214,7 @@ synproxy_send_client_ack(const struct synproxy_net *snet,
                 return;
         skb_reserve(nskb, MAX_TCP_HEADER);
 
-        niph = synproxy_build_ip(nskb, iph->saddr, iph->daddr);
+        niph = synproxy_build_ip(net, nskb, iph->saddr, iph->daddr);
 
         skb_reset_transport_header(nskb);
         nth = (struct tcphdr *)skb_put(nskb, tcp_hdr_size);
@@ -231,15 +230,16 @@ synproxy_send_client_ack(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+        synproxy_send_tcp(net, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
                           niph, nth, tcp_hdr_size);
 }
 
 static bool
-synproxy_recv_client_ack(const struct synproxy_net *snet,
+synproxy_recv_client_ack(struct net *net,
                          const struct sk_buff *skb, const struct tcphdr *th,
                          struct synproxy_options *opts, u32 recv_seq)
 {
+        struct synproxy_net *snet = synproxy_pernet(net);
         int mss;
 
         mss = __cookie_v4_check(ip_hdr(skb), th, ntohl(th->ack_seq) - 1);
@@ -255,7 +255,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
         if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
                 synproxy_check_timestamp_cookie(opts);
 
-        synproxy_send_server_syn(snet, skb, th, opts, recv_seq);
+        synproxy_send_server_syn(net, skb, th, opts, recv_seq);
         return true;
 }
 
@@ -263,7 +263,8 @@ static unsigned int
 synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct xt_synproxy_info *info = par->targinfo;
-        struct synproxy_net *snet = synproxy_pernet(par->net);
+        struct net *net = par->net;
+        struct synproxy_net *snet = synproxy_pernet(net);
         struct synproxy_options opts = {};
         struct tcphdr *th, _th;
 
@@ -292,12 +293,12 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
                                           XT_SYNPROXY_OPT_SACK_PERM |
                                           XT_SYNPROXY_OPT_ECN);
 
-                synproxy_send_client_synack(snet, skb, th, &opts);
+                synproxy_send_client_synack(net, skb, th, &opts);
                 return NF_DROP;
 
         } else if (th->ack && !(th->fin || th->rst || th->syn)) {
                 /* ACK from client */
-                synproxy_recv_client_ack(snet, skb, th, &opts, ntohl(th->seq));
+                synproxy_recv_client_ack(net, skb, th, &opts, ntohl(th->seq));
                 return NF_DROP;
         }
 
@@ -308,7 +309,8 @@ static unsigned int ipv4_synproxy_hook(void *priv,
                                        struct sk_buff *skb,
                                        const struct nf_hook_state *nhs)
 {
-        struct synproxy_net *snet = synproxy_pernet(nhs->net);
+        struct net *net = nhs->net;
+        struct synproxy_net *snet = synproxy_pernet(net);
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct;
         struct nf_conn_synproxy *synproxy;
@@ -365,7 +367,7 @@ static unsigned int ipv4_synproxy_hook(void *priv,
                          * therefore we need to add 1 to make the SYN sequence
                          * number match the one of first SYN.
                          */
-                        if (synproxy_recv_client_ack(snet, skb, th, &opts,
+                        if (synproxy_recv_client_ack(net, skb, th, &opts,
                                                      ntohl(th->seq) + 1))
                                 this_cpu_inc(snet->stats->cookie_retrans);
 
@@ -391,12 +393,12 @@ static unsigned int ipv4_synproxy_hook(void *priv,
                                   XT_SYNPROXY_OPT_SACK_PERM);
 
                 swap(opts.tsval, opts.tsecr);
-                synproxy_send_server_ack(snet, state, skb, th, &opts);
+                synproxy_send_server_ack(net, state, skb, th, &opts);
 
                 nf_ct_seqadj_init(ct, ctinfo, synproxy->isn - ntohl(th->seq));
 
                 swap(opts.tsval, opts.tsecr);
-                synproxy_send_client_ack(snet, skb, th, &opts);
+                synproxy_send_client_ack(net, skb, th, &opts);
 
                 consume_skb(skb);
                 return NF_STOLEN;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 84f9baf7aee8..86b67b70b626 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -198,11 +198,12 @@ get_entry(const void *base, unsigned int offset)
 
 /* All zeroes == unconditional rule. */
 /* Mildly perf critical (only if packet tracing is on) */
-static inline bool unconditional(const struct ip6t_ip6 *ipv6)
+static inline bool unconditional(const struct ip6t_entry *e)
 {
         static const struct ip6t_ip6 uncond;
 
-        return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
+        return e->target_offset == sizeof(struct ip6t_entry) &&
+               memcmp(&e->ipv6, &uncond, sizeof(uncond)) == 0;
 }
 
 static inline const struct xt_entry_target *
@@ -258,11 +259,10 @@ get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
         } else if (s == e) {
                 (*rulenum)++;
 
-                if (s->target_offset == sizeof(struct ip6t_entry) &&
+                if (unconditional(s) &&
                     strcmp(t->target.u.kernel.target->name,
                            XT_STANDARD_TARGET) == 0 &&
-                    t->verdict < 0 &&
-                    unconditional(&s->ipv6)) {
+                    t->verdict < 0) {
                         /* Tail of chains: STANDARD target (return/policy) */
                         *comment = *chainname == hookname
                                 ? comments[NF_IP6_TRACE_COMMENT_POLICY]
@@ -488,11 +488,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct ip6t_entry) &&
+                        if ((unconditional(e) &&
                              (strcmp(t->target.u.user.name,
                                      XT_STANDARD_TARGET) == 0) &&
-                             t->verdict < 0 &&
-                             unconditional(&e->ipv6)) || visited) {
+                             t->verdict < 0) || visited) {
                                 unsigned int oldpos, size;
 
                                 if ((strcmp(t->target.u.user.name,
@@ -581,14 +580,12 @@ static void cleanup_match(struct xt_entry_match *m, struct net *net)
 }
 
 static int
-check_entry(const struct ip6t_entry *e, const char *name)
+check_entry(const struct ip6t_entry *e)
 {
         const struct xt_entry_target *t;
 
-        if (!ip6_checkentry(&e->ipv6)) {
-                duprintf("ip_tables: ip check failed %p %s.\n", e, name);
+        if (!ip6_checkentry(&e->ipv6))
                 return -EINVAL;
-        }
 
         if (e->target_offset + sizeof(struct xt_entry_target) >
             e->next_offset)
@@ -679,10 +676,6 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
         struct xt_mtchk_param mtpar;
         struct xt_entry_match *ematch;
 
-        ret = check_entry(e, name);
-        if (ret)
-                return ret;
-
         e->counters.pcnt = xt_percpu_counter_alloc();
         if (IS_ERR_VALUE(e->counters.pcnt))
                 return -ENOMEM;
@@ -733,7 +726,7 @@ static bool check_underflow(const struct ip6t_entry *e)
         const struct xt_entry_target *t;
         unsigned int verdict;
 
-        if (!unconditional(&e->ipv6))
+        if (!unconditional(e))
                 return false;
         t = ip6t_get_target_c(e);
         if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
@@ -753,9 +746,11 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
                            unsigned int valid_hooks)
 {
         unsigned int h;
+        int err;
 
         if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
-            (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
+            (unsigned char *)e + sizeof(struct ip6t_entry) >= limit ||
+            (unsigned char *)e + e->next_offset > limit) {
                 duprintf("Bad offset %p\n", e);
                 return -EINVAL;
         }
@@ -767,6 +762,10 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
                 return -EINVAL;
         }
 
+        err = check_entry(e);
+        if (err)
+                return err;
+
         /* Check hooks & underflows */
         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
                 if (!(valid_hooks & (1 << h)))
@@ -775,9 +774,9 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
                         newinfo->hook_entry[h] = hook_entries[h];
                 if ((unsigned char *)e - base == underflows[h]) {
                         if (!check_underflow(e)) {
-                                pr_err("Underflows must be unconditional and "
-                                       "use the STANDARD target with "
-                                       "ACCEPT/DROP\n");
+                                pr_debug("Underflows must be unconditional and "
+                                         "use the STANDARD target with "
+                                         "ACCEPT/DROP\n");
                                 return -EINVAL;
                         }
                         newinfo->underflow[h] = underflows[h];
@@ -1169,6 +1168,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
                          *len, sizeof(get) + get.size);
                 return -EINVAL;
         }
+        get.name[sizeof(get.name) - 1] = '\0';
 
         t = xt_find_table_lock(net, AF_INET6, get.name);
         if (!IS_ERR_OR_NULL(t)) {
@@ -1505,7 +1505,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
         if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
-            (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
+            (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit ||
+            (unsigned char *)e + e->next_offset > limit) {
                 duprintf("Bad offset %p, limit = %p\n", e, limit);
                 return -EINVAL;
         }
@@ -1518,7 +1519,7 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
         }
 
         /* For purposes of check_entry casting the compat entry is fine */
-        ret = check_entry((struct ip6t_entry *)e, name);
+        ret = check_entry((struct ip6t_entry *)e);
         if (ret)
                 return ret;
 
@@ -1944,6 +1945,7 @@ compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
                          *len, sizeof(get) + get.size);
                 return -EINVAL;
         }
+        get.name[sizeof(get.name) - 1] = '\0';
 
         xt_compat_lock(AF_INET6);
         t = xt_find_table_lock(net, AF_INET6, get.name);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index fd25e447a5fa..8125931106be 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -843,8 +843,8 @@ start_lookup:
                 flush_stack(stack, count, skb, count - 1);
         } else {
                 if (!inner_flushed)
-                        UDP_INC_STATS_BH(net, UDP_MIB_IGNOREDMULTI,
-                                         proto == IPPROTO_UDPLITE);
+                        UDP6_INC_STATS_BH(net, UDP_MIB_IGNOREDMULTI,
+                                          proto == IPPROTO_UDPLITE);
                 consume_skb(skb);
         }
         return 0;
diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h b/net/netfilter/ipset/ip_set_bitmap_gen.h
index b0bc475f641e..2e8e7e5fb4a6 100644
--- a/net/netfilter/ipset/ip_set_bitmap_gen.h
+++ b/net/netfilter/ipset/ip_set_bitmap_gen.h
@@ -95,7 +95,7 @@ mtype_head(struct ip_set *set, struct sk_buff *skb)
         if (!nested)
                 goto nla_put_failure;
         if (mtype_do_head(skb, map) ||
-            nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) ||
+            nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref)) ||
             nla_put_net32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize)))
                 goto nla_put_failure;
         if (unlikely(ip_set_put_flags(skb, set)))
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 7e6568cad494..a748b0c2c981 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -497,6 +497,26 @@ __ip_set_put(struct ip_set *set)
         write_unlock_bh(&ip_set_ref_lock);
 }
 
+/* set->ref can be swapped out by ip_set_swap, netlink events (like dump) need
+ * a separate reference counter
+ */
+static inline void
+__ip_set_get_netlink(struct ip_set *set)
+{
+        write_lock_bh(&ip_set_ref_lock);
+        set->ref_netlink++;
+        write_unlock_bh(&ip_set_ref_lock);
+}
+
+static inline void
+__ip_set_put_netlink(struct ip_set *set)
+{
+        write_lock_bh(&ip_set_ref_lock);
+        BUG_ON(set->ref_netlink == 0);
+        set->ref_netlink--;
+        write_unlock_bh(&ip_set_ref_lock);
+}
+
 /* Add, del and test set entries from kernel.
  *
  * The set behind the index must exist and must be referenced
@@ -1002,7 +1022,7 @@ static int ip_set_destroy(struct net *net, struct sock *ctnl,
         if (!attr[IPSET_ATTR_SETNAME]) {
                 for (i = 0; i < inst->ip_set_max; i++) {
                         s = ip_set(inst, i);
-                        if (s && s->ref) {
+                        if (s && (s->ref || s->ref_netlink)) {
                                 ret = -IPSET_ERR_BUSY;
                                 goto out;
                         }
@@ -1024,7 +1044,7 @@ static int ip_set_destroy(struct net *net, struct sock *ctnl,
                 if (!s) {
                         ret = -ENOENT;
                         goto out;
-                } else if (s->ref) {
+                } else if (s->ref || s->ref_netlink) {
                         ret = -IPSET_ERR_BUSY;
                         goto out;
                 }
@@ -1171,6 +1191,9 @@ static int ip_set_swap(struct net *net, struct sock *ctnl, struct sk_buff *skb,
               from->family == to->family))
                 return -IPSET_ERR_TYPE_MISMATCH;
 
+        if (from->ref_netlink || to->ref_netlink)
+                return -EBUSY;
+
         strncpy(from_name, from->name, IPSET_MAXNAMELEN);
         strncpy(from->name, to->name, IPSET_MAXNAMELEN);
         strncpy(to->name, from_name, IPSET_MAXNAMELEN);
@@ -1206,7 +1229,7 @@ ip_set_dump_done(struct netlink_callback *cb)
                 if (set->variant->uref)
                         set->variant->uref(set, cb, false);
                 pr_debug("release set %s\n", set->name);
-                __ip_set_put_byindex(inst, index);
+                __ip_set_put_netlink(set);
         }
         return 0;
 }
@@ -1328,7 +1351,7 @@ dump_last:
                 if (!cb->args[IPSET_CB_ARG0]) {
                         /* Start listing: make sure set won't be destroyed */
                         pr_debug("reference set\n");
-                        set->ref++;
+                        set->ref_netlink++;
                 }
                 write_unlock_bh(&ip_set_ref_lock);
                 nlh = start_msg(skb, NETLINK_CB(cb->skb).portid,
@@ -1396,7 +1419,7 @@ release_refcount:
                 if (set->variant->uref)
                         set->variant->uref(set, cb, false);
                 pr_debug("release set %s\n", set->name);
-                __ip_set_put_byindex(inst, index);
+                __ip_set_put_netlink(set);
                 cb->args[IPSET_CB_ARG0] = 0;
         }
 out:
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index e5336ab36d67..d32fd6b036bf 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -1082,7 +1082,7 @@ mtype_head(struct ip_set *set, struct sk_buff *skb)
         if (nla_put_u32(skb, IPSET_ATTR_MARKMASK, h->markmask))
                 goto nla_put_failure;
 #endif
-        if (nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) ||
+        if (nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref)) ||
             nla_put_net32(skb, IPSET_ATTR_MEMSIZE, htonl(memsize)))
                 goto nla_put_failure;
         if (unlikely(ip_set_put_flags(skb, set)))
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index 24c6c1962aea..a2a89e4e0a14 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -458,7 +458,7 @@ list_set_head(struct ip_set *set, struct sk_buff *skb)
         if (!nested)
                 goto nla_put_failure;
         if (nla_put_net32(skb, IPSET_ATTR_SIZE, htonl(map->size)) ||
-            nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1)) ||
+            nla_put_net32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref)) ||
             nla_put_net32(skb, IPSET_ATTR_MEMSIZE,
                           htonl(sizeof(*map) + n * set->dsize)))
                 goto nla_put_failure;
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 75429997ed41..cb5b630a645b 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -582,7 +582,12 @@ __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue,
         /* nfnetlink_unicast will either free the nskb or add it to a socket */
         err = nfnetlink_unicast(nskb, net, queue->peer_portid, MSG_DONTWAIT);
         if (err < 0) {
-                queue->queue_user_dropped++;
+                if (queue->flags & NFQA_CFG_F_FAIL_OPEN) {
+                        failopen = 1;
+                        err = 0;
+                } else {
+                        queue->queue_user_dropped++;
+                }
                 goto err_out_unlock;
         }
 
diff --git a/net/openvswitch/Kconfig b/net/openvswitch/Kconfig
index 234a73344c6e..ce947292ae77 100644
--- a/net/openvswitch/Kconfig
+++ b/net/openvswitch/Kconfig
@@ -7,7 +7,9 @@ config OPENVSWITCH
         depends on INET
         depends on !NF_CONNTRACK || \
                    (NF_CONNTRACK && ((!NF_DEFRAG_IPV6 || NF_DEFRAG_IPV6) && \
-                                     (!NF_NAT || NF_NAT)))
+                                     (!NF_NAT || NF_NAT) && \
+                                     (!NF_NAT_IPV4 || NF_NAT_IPV4) && \
+                                     (!NF_NAT_IPV6 || NF_NAT_IPV6)))
         select LIBCRC32C
         select MPLS
         select NET_MPLS_GSO
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index dc5eb29fe7d6..1b9d286756be 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -535,14 +535,15 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
         switch (ctinfo) {
         case IP_CT_RELATED:
         case IP_CT_RELATED_REPLY:
-                if (skb->protocol == htons(ETH_P_IP) &&
+                if (IS_ENABLED(CONFIG_NF_NAT_IPV4) &&
+                    skb->protocol == htons(ETH_P_IP) &&
                     ip_hdr(skb)->protocol == IPPROTO_ICMP) {
                         if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
                                                            hooknum))
                                 err = NF_DROP;
                         goto push;
-#if IS_ENABLED(CONFIG_NF_NAT_IPV6)
-                } else if (skb->protocol == htons(ETH_P_IPV6)) {
+                } else if (IS_ENABLED(CONFIG_NF_NAT_IPV6) &&
+                           skb->protocol == htons(ETH_P_IPV6)) {
                         __be16 frag_off;
                         u8 nexthdr = ipv6_hdr(skb)->nexthdr;
                         int hdrlen = ipv6_skip_exthdr(skb,
@@ -557,7 +558,6 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
                                         err = NF_DROP;
                                 goto push;
                         }
-#endif
                 }
                 /* Non-ICMP, fall thru to initialize if needed. */
         case IP_CT_NEW:
@@ -664,11 +664,12 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
 
         /* Determine NAT type.
          * Check if the NAT type can be deduced from the tracked connection.
-         * Make sure expected traffic is NATted only when committing.
+         * Make sure new expected connections (IP_CT_RELATED) are NATted only
+         * when committing.
          */
         if (info->nat & OVS_CT_NAT && ctinfo != IP_CT_NEW &&
             ct->status & IPS_NAT_MASK &&
-            (!(ct->status & IPS_EXPECTED_BIT) || info->commit)) {
+            (ctinfo != IP_CT_RELATED || info->commit)) {
                 /* NAT an established or related connection like before. */
                 if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY)
                         /* This is the REPLY direction for a connection
@@ -968,7 +969,8 @@ static int parse_nat(const struct nlattr *attr,
                         break;
 
                 case OVS_NAT_ATTR_IP_MIN:
-                        nla_memcpy(&info->range.min_addr, a, nla_len(a));
+                        nla_memcpy(&info->range.min_addr, a,
+                                   sizeof(info->range.min_addr));
                         info->range.flags |= NF_NAT_RANGE_MAP_IPS;
                         break;
 
@@ -1238,7 +1240,8 @@ static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
         }
 
         if (info->range.flags & NF_NAT_RANGE_MAP_IPS) {
-                if (info->family == NFPROTO_IPV4) {
+                if (IS_ENABLED(CONFIG_NF_NAT_IPV4) &&
+                    info->family == NFPROTO_IPV4) {
                         if (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MIN,
                                             info->range.min_addr.ip) ||
                             (info->range.max_addr.ip
@@ -1246,8 +1249,8 @@ static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
                              (nla_put_in_addr(skb, OVS_NAT_ATTR_IP_MAX,
                                               info->range.max_addr.ip))))
                                 return false;
-#if IS_ENABLED(CONFIG_NF_NAT_IPV6)
-                } else if (info->family == NFPROTO_IPV6) {
+                } else if (IS_ENABLED(CONFIG_NF_NAT_IPV6) &&
+                           info->family == NFPROTO_IPV6) {
                         if (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MIN,
                                              &info->range.min_addr.in6) ||
                             (memcmp(&info->range.max_addr.in6,
@@ -1256,7 +1259,6 @@ static bool ovs_ct_nat_to_attr(const struct ovs_conntrack_info *info,
                              (nla_put_in6_addr(skb, OVS_NAT_ATTR_IP_MAX,
                                                &info->range.max_addr.in6))))
                                 return false;
-#endif
                 } else {
                         return false;
                 }
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 736c004abfbc..97745351d58c 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -401,7 +401,7 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
         sk = chunk->skb->sk;
 
         /* Allocate the new skb.  */
-        nskb = alloc_skb(packet->size + MAX_HEADER, GFP_ATOMIC);
+        nskb = alloc_skb(packet->size + MAX_HEADER, gfp);
         if (!nskb)
                 goto nomem;
 
@@ -523,8 +523,8 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
          */
         if (auth)
                 sctp_auth_calculate_hmac(asoc, nskb,
-                                        (struct sctp_auth_chunk *)auth,
-                                        GFP_ATOMIC);
+                                         (struct sctp_auth_chunk *)auth,
+                                         gfp);
 
         /* 2) Calculate the Adler-32 checksum of the whole packet,
          *    including the SCTP common header and all the
diff --git a/net/switchdev/switchdev.c b/net/switchdev/switchdev.c
index 8b5833c1ff2e..2b9b98f1c2ff 100644
--- a/net/switchdev/switchdev.c
+++ b/net/switchdev/switchdev.c
@@ -1079,7 +1079,7 @@ nla_put_failure:
  *      @filter_dev: filter device
  *      @idx:
  *
- *      Delete FDB entry from switch device.
+ *      Dump FDB entries from switch device.
  */
 int switchdev_port_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
                             struct net_device *dev,
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index ad7f5b3f9b61..1c4ad477ce93 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -292,12 +292,15 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                 XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
 
                 skb_dst_force(skb);
+                dev_hold(skb->dev);
 
                 nexthdr = x->type->input(x, skb);
 
                 if (nexthdr == -EINPROGRESS)
                         return 0;
 resume:
+                dev_put(skb->dev);
+
                 spin_lock(&x->lock);
                 if (nexthdr <= 0) {
                         if (nexthdr == -EBADMSG) {