21 files changed, 131 insertions, 102 deletions

diff --git a/net/atm/lec.c b/net/atm/lec.c
index 019557d0a11d..09cfe87f0a44 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -1059,7 +1059,9 @@ static void __exit lane_module_cleanup(void)
 {
         int i;
 
+#ifdef CONFIG_PROC_FS
         remove_proc_entry("lec", atm_proc_root);
+#endif
 
         deregister_atm_ioctl(&lane_ioctl_ops);
 
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 8e0c0635ee97..fb55327dcfea 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -75,6 +75,7 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
         struct nlattr *nla;
         struct sk_buff *skb;
         unsigned long flags;
+        void *msg_header;
 
         al = sizeof(struct net_dm_alert_msg);
         al += dm_hit_limit * sizeof(struct net_dm_drop_point);
@@ -82,21 +83,41 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
 
         skb = genlmsg_new(al, GFP_KERNEL);
 
-        if (skb) {
-                genlmsg_put(skb, 0, 0, &net_drop_monitor_family,
-                                0, NET_DM_CMD_ALERT);
-                nla = nla_reserve(skb, NLA_UNSPEC,
-                                  sizeof(struct net_dm_alert_msg));
-                msg = nla_data(nla);
-                memset(msg, 0, al);
-        } else {
-                mod_timer(&data->send_timer, jiffies + HZ / 10);
+        if (!skb)
+                goto err;
+
+        msg_header = genlmsg_put(skb, 0, 0, &net_drop_monitor_family,
+                                 0, NET_DM_CMD_ALERT);
+        if (!msg_header) {
+                nlmsg_free(skb);
+                skb = NULL;
+                goto err;
+        }
+        nla = nla_reserve(skb, NLA_UNSPEC,
+                          sizeof(struct net_dm_alert_msg));
+        if (!nla) {
+                nlmsg_free(skb);
+                skb = NULL;
+                goto err;
         }
+        msg = nla_data(nla);
+        memset(msg, 0, al);
+        goto out;
 
+err:
+        mod_timer(&data->send_timer, jiffies + HZ / 10);
+out:
         spin_lock_irqsave(&data->lock, flags);
         swap(data->skb, skb);
         spin_unlock_irqrestore(&data->lock, flags);
 
+        if (skb) {
+                struct nlmsghdr *nlh = (struct nlmsghdr *)skb->data;
+                struct genlmsghdr *gnlh = (struct genlmsghdr *)nlmsg_data(nlh);
+
+                genlmsg_end(skb, genlmsg_data(gnlh));
+        }
+
         return skb;
 }
 
diff --git a/net/core/filter.c b/net/core/filter.c
index e6c412b94dec..1969b3f118c1 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2972,12 +2972,6 @@ void bpf_warn_invalid_xdp_action(u32 act)
 }
 EXPORT_SYMBOL_GPL(bpf_warn_invalid_xdp_action);
 
-void bpf_warn_invalid_xdp_buffer(void)
-{
-        WARN_ONCE(1, "Illegal XDP buffer encountered, expect throughput degradation\n");
-}
-EXPORT_SYMBOL_GPL(bpf_warn_invalid_xdp_buffer);
-
 static u32 sk_filter_convert_ctx_access(enum bpf_access_type type, int dst_reg,
                                         int src_reg, int ctx_off,
                                         struct bpf_insn *insn_buf,
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index d6447dc10371..fe4e1531976c 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -468,8 +468,9 @@ ip_proto_again:
                         if (hdr->flags & GRE_ACK)
                                 offset += sizeof(((struct pptp_gre_header *)0)->ack);
 
-                        ppp_hdr = skb_header_pointer(skb, nhoff + offset,
-                                                     sizeof(_ppp_hdr), _ppp_hdr);
+                        ppp_hdr = __skb_header_pointer(skb, nhoff + offset,
+                                                     sizeof(_ppp_hdr),
+                                                     data, hlen, _ppp_hdr);
                         if (!ppp_hdr)
                                 goto out_bad;
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 18b5aae99bec..75e3ea7bda08 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3898,6 +3898,9 @@ static int rtnl_stats_get(struct sk_buff *skb, struct nlmsghdr *nlh)
         u32 filter_mask;
         int err;
 
+        if (nlmsg_len(nlh) < sizeof(*ifsm))
+                return -EINVAL;
+
         ifsm = nlmsg_data(nlh);
         if (ifsm->ifindex > 0)
                 dev = __dev_get_by_index(net, ifsm->ifindex);
@@ -3947,6 +3950,9 @@ static int rtnl_stats_dump(struct sk_buff *skb, struct netlink_callback *cb)
 
         cb->seq = net->dev_base_seq;
 
+        if (nlmsg_len(cb->nlh) < sizeof(*ifsm))
+                return -EINVAL;
+
         ifsm = nlmsg_data(cb->nlh);
         filter_mask = ifsm->filter_mask;
         if (!filter_mask)
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 3ff8938893ec..eae0332b0e8c 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -85,7 +85,7 @@ struct fib_table *fib_new_table(struct net *net, u32 id)
         if (tb)
                 return tb;
 
-        if (id == RT_TABLE_LOCAL)
+        if (id == RT_TABLE_LOCAL && !net->ipv4.fib_has_custom_rules)
                 alias = fib_new_table(net, RT_TABLE_MAIN);
 
         tb = fib_trie_table(id, alias);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 68d622133f53..5b15459955f8 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -219,9 +219,14 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
 static void igmp_gq_start_timer(struct in_device *in_dev)
 {
         int tv = prandom_u32() % in_dev->mr_maxdelay;
+        unsigned long exp = jiffies + tv + 2;
+
+        if (in_dev->mr_gq_running &&
+            time_after_eq(exp, (in_dev->mr_gq_timer).expires))
+                return;
 
         in_dev->mr_gq_running = 1;
-        if (!mod_timer(&in_dev->mr_gq_timer, jiffies+tv+2))
+        if (!mod_timer(&in_dev->mr_gq_timer, exp))
                 in_dev_hold(in_dev);
 }
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 57e1405e8282..53ae0c6315ad 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1225,8 +1225,14 @@ void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
                  * which has interface index (iif) as the first member of the
                  * underlying inet{6}_skb_parm struct. This code then overlays
                  * PKTINFO_SKB_CB and in_pktinfo also has iif as the first
-                 * element so the iif is picked up from the prior IPCB
+                 * element so the iif is picked up from the prior IPCB. If iif
+                 * is the loopback interface, then return the sending interface
+                 * (e.g., process binds socket to eth0 for Tx which is
+                 * redirected to loopback in the rtable/dst).
                  */
+                if (pktinfo->ipi_ifindex == LOOPBACK_IFINDEX)
+                        pktinfo->ipi_ifindex = inet_iif(skb);
+
                 pktinfo->ipi_spec_dst.s_addr = fib_compute_spec_dst(skb);
         } else {
                 pktinfo->ipi_ifindex = 0;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a82a11747b3f..0fcac8e7a2b2 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1914,7 +1914,8 @@ local_input:
                 }
         }
 
-        rth = rt_dst_alloc(net->loopback_dev, flags | RTCF_LOCAL, res.type,
+        rth = rt_dst_alloc(l3mdev_master_dev_rcu(dev) ? : net->loopback_dev,
+                           flags | RTCF_LOCAL, res.type,
                            IN_DEV_CONF_GET(in_dev, NOPOLICY), false, do_cache);
         if (!rth)
                 goto e_nobufs;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 80bc36b25de2..22cbd61079b5 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -433,13 +433,6 @@ static struct ctl_table ipv4_table[] = {
                 .extra2         = &tcp_adv_win_scale_max,
         },
         {
-                .procname       = "tcp_tw_reuse",
-                .data           = &sysctl_tcp_tw_reuse,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
                 .procname       = "tcp_frto",
                 .data           = &sysctl_tcp_frto,
                 .maxlen         = sizeof(int),
@@ -960,6 +953,13 @@ static struct ctl_table ipv4_net_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
+        {
+                .procname       = "tcp_tw_reuse",
+                .data           = &init_net.ipv4.sysctl_tcp_tw_reuse,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
         {
                 .procname       = "fib_multipath_use_neigh",
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 30d81f533ada..fe9da4fb96bf 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -84,7 +84,6 @@
 #include <crypto/hash.h>
 #include <linux/scatterlist.h>
 
-int sysctl_tcp_tw_reuse __read_mostly;
 int sysctl_tcp_low_latency __read_mostly;
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -120,7 +119,7 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
            and use initial timestamp retrieved from peer table.
          */
         if (tcptw->tw_ts_recent_stamp &&
-            (!twp || (sysctl_tcp_tw_reuse &&
+            (!twp || (sock_net(sk)->ipv4.sysctl_tcp_tw_reuse &&
                              get_seconds() - tcptw->tw_ts_recent_stamp > 1))) {
                 tp->write_seq = tcptw->tw_snd_nxt + 65535 + 2;
                 if (tp->write_seq == 0)
@@ -2456,6 +2455,7 @@ static int __net_init tcp_sk_init(struct net *net)
         net->ipv4.sysctl_tcp_orphan_retries = 0;
         net->ipv4.sysctl_tcp_fin_timeout = TCP_FIN_TIMEOUT;
         net->ipv4.sysctl_tcp_notsent_lowat = UINT_MAX;
+        net->ipv4.sysctl_tcp_tw_reuse = 0;
 
         return 0;
 fail:
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 70d0de404197..38122d04fadc 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1373,7 +1373,7 @@ emsgsize:
          */
 
         cork->length += length;
-        if (((length > mtu) ||
+        if ((((length + fragheaderlen) > mtu) ||
              (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 8938b6ba57a0..3d73278b86ca 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -47,7 +47,8 @@ static inline struct l2tp_ip_sock *l2tp_ip_sk(const struct sock *sk)
         return (struct l2tp_ip_sock *)sk;
 }
 
-static struct sock *__l2tp_ip_bind_lookup(struct net *net, __be32 laddr, int dif, u32 tunnel_id)
+static struct sock *__l2tp_ip_bind_lookup(const struct net *net, __be32 laddr,
+                                          __be32 raddr, int dif, u32 tunnel_id)
 {
         struct sock *sk;
 
@@ -61,6 +62,7 @@ static struct sock *__l2tp_ip_bind_lookup(struct net *net, __be32 laddr, int dif
                 if ((l2tp->conn_id == tunnel_id) &&
                     net_eq(sock_net(sk), net) &&
                     !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
+                    (!inet->inet_daddr || !raddr || inet->inet_daddr == raddr) &&
                     (!sk->sk_bound_dev_if || !dif ||
                      sk->sk_bound_dev_if == dif))
                         goto found;
@@ -71,15 +73,6 @@ found:
         return sk;
 }
 
-static inline struct sock *l2tp_ip_bind_lookup(struct net *net, __be32 laddr, int dif, u32 tunnel_id)
-{
-        struct sock *sk = __l2tp_ip_bind_lookup(net, laddr, dif, tunnel_id);
-        if (sk)
-                sock_hold(sk);
-
-        return sk;
-}
-
 /* When processing receive frames, there are two cases to
  * consider. Data frames consist of a non-zero session-id and an
  * optional cookie. Control frames consist of a regular L2TP header
@@ -183,8 +176,8 @@ pass_up:
                 struct iphdr *iph = (struct iphdr *) skb_network_header(skb);
 
                 read_lock_bh(&l2tp_ip_lock);
-                sk = __l2tp_ip_bind_lookup(net, iph->daddr, inet_iif(skb),
-                                           tunnel_id);
+                sk = __l2tp_ip_bind_lookup(net, iph->daddr, iph->saddr,
+                                           inet_iif(skb), tunnel_id);
                 if (!sk) {
                         read_unlock_bh(&l2tp_ip_lock);
                         goto discard;
@@ -280,7 +273,7 @@ static int l2tp_ip_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 inet->inet_saddr = 0;  /* Use device */
 
         write_lock_bh(&l2tp_ip_lock);
-        if (__l2tp_ip_bind_lookup(net, addr->l2tp_addr.s_addr,
+        if (__l2tp_ip_bind_lookup(net, addr->l2tp_addr.s_addr, 0,
                                   sk->sk_bound_dev_if, addr->l2tp_conn_id)) {
                 write_unlock_bh(&l2tp_ip_lock);
                 ret = -EADDRINUSE;
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index f092ac441fdd..331ccf5a7bad 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -59,12 +59,14 @@ static inline struct l2tp_ip6_sock *l2tp_ip6_sk(const struct sock *sk)
 
 static struct sock *__l2tp_ip6_bind_lookup(struct net *net,
                                            struct in6_addr *laddr,
+                                           const struct in6_addr *raddr,
                                            int dif, u32 tunnel_id)
 {
         struct sock *sk;
 
         sk_for_each_bound(sk, &l2tp_ip6_bind_table) {
-                const struct in6_addr *addr = inet6_rcv_saddr(sk);
+                const struct in6_addr *sk_laddr = inet6_rcv_saddr(sk);
+                const struct in6_addr *sk_raddr = &sk->sk_v6_daddr;
                 struct l2tp_ip6_sock *l2tp = l2tp_ip6_sk(sk);
 
                 if (l2tp == NULL)
@@ -72,7 +74,8 @@ static struct sock *__l2tp_ip6_bind_lookup(struct net *net,
 
                 if ((l2tp->conn_id == tunnel_id) &&
                     net_eq(sock_net(sk), net) &&
-                    (!addr || ipv6_addr_equal(addr, laddr)) &&
+                    (!sk_laddr || ipv6_addr_any(sk_laddr) || ipv6_addr_equal(sk_laddr, laddr)) &&
+                    (!raddr || ipv6_addr_any(sk_raddr) || ipv6_addr_equal(sk_raddr, raddr)) &&
                     (!sk->sk_bound_dev_if || !dif ||
                      sk->sk_bound_dev_if == dif))
                         goto found;
@@ -83,17 +86,6 @@ found:
         return sk;
 }
 
-static inline struct sock *l2tp_ip6_bind_lookup(struct net *net,
-                                                struct in6_addr *laddr,
-                                                int dif, u32 tunnel_id)
-{
-        struct sock *sk = __l2tp_ip6_bind_lookup(net, laddr, dif, tunnel_id);
-        if (sk)
-                sock_hold(sk);
-
-        return sk;
-}
-
 /* When processing receive frames, there are two cases to
  * consider. Data frames consist of a non-zero session-id and an
  * optional cookie. Control frames consist of a regular L2TP header
@@ -197,8 +189,8 @@ pass_up:
                 struct ipv6hdr *iph = ipv6_hdr(skb);
 
                 read_lock_bh(&l2tp_ip6_lock);
-                sk = __l2tp_ip6_bind_lookup(net, &iph->daddr, inet6_iif(skb),
-                                            tunnel_id);
+                sk = __l2tp_ip6_bind_lookup(net, &iph->daddr, &iph->saddr,
+                                            inet6_iif(skb), tunnel_id);
                 if (!sk) {
                         read_unlock_bh(&l2tp_ip6_lock);
                         goto discard;
@@ -330,7 +322,7 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         rcu_read_unlock();
 
         write_lock_bh(&l2tp_ip6_lock);
-        if (__l2tp_ip6_bind_lookup(net, &addr->l2tp_addr, bound_dev_if,
+        if (__l2tp_ip6_bind_lookup(net, &addr->l2tp_addr, NULL, bound_dev_if,
                                    addr->l2tp_conn_id)) {
                 write_unlock_bh(&l2tp_ip6_lock);
                 err = -EADDRINUSE;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 2c21b7039136..0d8b716e509e 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3287,7 +3287,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
         int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
         int hw_headroom = sdata->local->hw.extra_tx_headroom;
         struct ethhdr eth;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_tx_info *info;
         struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
         struct ieee80211_tx_data tx;
         ieee80211_tx_result r;
@@ -3351,6 +3351,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
         memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
         memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
 
+        info = IEEE80211_SKB_CB(skb);
         memset(info, 0, sizeof(*info));
         info->band = fast_tx->band;
         info->control.vif = &sdata->vif;
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 2d4c4d3911c0..9c62b6325f7a 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -606,7 +606,6 @@ static int ovs_packet_cmd_execute(struct sk_buff *skb, struct genl_info *info)
         rcu_assign_pointer(flow->sf_acts, acts);
         packet->priority = flow->key.phy.priority;
         packet->mark = flow->key.phy.skb_mark;
-        packet->protocol = flow->key.eth.type;
 
         rcu_read_lock();
         dp = get_dp_rcu(net, ovs_header->dp_ifindex);
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 08aa926cd5cf..2c0a00f7f1b7 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -312,7 +312,8 @@ static bool icmp6hdr_ok(struct sk_buff *skb)
  * Returns 0 if it encounters a non-vlan or incomplete packet.
  * Returns 1 after successfully parsing vlan tag.
  */
-static int parse_vlan_tag(struct sk_buff *skb, struct vlan_head *key_vh)
+static int parse_vlan_tag(struct sk_buff *skb, struct vlan_head *key_vh,
+                          bool untag_vlan)
 {
         struct vlan_head *vh = (struct vlan_head *)skb->data;
 
@@ -330,7 +331,20 @@ static int parse_vlan_tag(struct sk_buff *skb, struct vlan_head *key_vh)
         key_vh->tci = vh->tci | htons(VLAN_TAG_PRESENT);
         key_vh->tpid = vh->tpid;
 
-        __skb_pull(skb, sizeof(struct vlan_head));
+        if (unlikely(untag_vlan)) {
+                int offset = skb->data - skb_mac_header(skb);
+                u16 tci;
+                int err;
+
+                __skb_push(skb, offset);
+                err = __skb_vlan_pop(skb, &tci);
+                __skb_pull(skb, offset);
+                if (err)
+                        return err;
+                __vlan_hwaccel_put_tag(skb, key_vh->tpid, tci);
+        } else {
+                __skb_pull(skb, sizeof(struct vlan_head));
+        }
         return 1;
 }
 
@@ -351,13 +365,13 @@ static int parse_vlan(struct sk_buff *skb, struct sw_flow_key *key)
                 key->eth.vlan.tpid = skb->vlan_proto;
         } else {
                 /* Parse outer vlan tag in the non-accelerated case. */
-                res = parse_vlan_tag(skb, &key->eth.vlan);
+                res = parse_vlan_tag(skb, &key->eth.vlan, true);
                 if (res <= 0)
                         return res;
         }
 
         /* Parse inner vlan tag. */
-        res = parse_vlan_tag(skb, &key->eth.cvlan);
+        res = parse_vlan_tag(skb, &key->eth.cvlan, false);
         if (res <= 0)
                 return res;
 
@@ -800,29 +814,15 @@ int ovs_flow_key_extract_userspace(struct net *net, const struct nlattr *attr,
         if (err)
                 return err;
 
-        if (ovs_key_mac_proto(key) == MAC_PROTO_NONE) {
-                /* key_extract assumes that skb->protocol is set-up for
-                 * layer 3 packets which is the case for other callers,
-                 * in particular packets recieved from the network stack.
-                 * Here the correct value can be set from the metadata
-                 * extracted above.
-                 */
-                skb->protocol = key->eth.type;
-        } else {
-                struct ethhdr *eth;
-
-                skb_reset_mac_header(skb);
-                eth = eth_hdr(skb);
-
-                /* Normally, setting the skb 'protocol' field would be
-                 * handled by a call to eth_type_trans(), but it assumes
-                 * there's a sending device, which we may not have.
-                 */
-                if (eth_proto_is_802_3(eth->h_proto))
-                        skb->protocol = eth->h_proto;
-                else
-                        skb->protocol = htons(ETH_P_802_2);
-        }
+        /* key_extract assumes that skb->protocol is set-up for
+         * layer 3 packets which is the case for other callers,
+         * in particular packets received from the network stack.
+         * Here the correct value can be set from the metadata
+         * extracted above.
+         * For L2 packet key eth type would be zero. skb protocol
+         * would be set to correct value later during key-extact.
+         */
 
+        skb->protocol = key->eth.type;
         return key_extract(skb, key);
 }
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 3fbba79a4ef0..1ecdf809b5fa 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -148,13 +148,15 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n)
         unsigned long cl;
         unsigned long fh;
         int err;
-        int tp_created = 0;
+        int tp_created;
 
         if ((n->nlmsg_type != RTM_GETTFILTER) &&
             !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
                 return -EPERM;
 
 replay:
+        tp_created = 0;
+
         err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL);
         if (err < 0)
                 return err;
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 333f8e268431..970db7a41684 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -153,10 +153,14 @@ static int fl_classify(struct sk_buff *skb, const struct tcf_proto *tp,
 
                 switch (ip_tunnel_info_af(info)) {
                 case AF_INET:
+                        skb_key.enc_control.addr_type =
+                                FLOW_DISSECTOR_KEY_IPV4_ADDRS;
                         skb_key.enc_ipv4.src = key->u.ipv4.src;
                         skb_key.enc_ipv4.dst = key->u.ipv4.dst;
                         break;
                 case AF_INET6:
+                        skb_key.enc_control.addr_type =
+                                FLOW_DISSECTOR_KEY_IPV6_ADDRS;
                         skb_key.enc_ipv6.src = key->u.ipv6.src;
                         skb_key.enc_ipv6.dst = key->u.ipv6.dst;
                         break;
diff --git a/net/socket.c b/net/socket.c
index 8487bf136e5c..a8c2307590b8 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -537,7 +537,7 @@ int sockfs_setattr(struct dentry *dentry, struct iattr *iattr)
 {
         int err = simple_setattr(dentry, iattr);
 
-        if (!err) {
+        if (!err && (iattr->ia_valid & ATTR_UID)) {
                 struct socket *sock = SOCKET_I(d_inode(dentry));
 
                 sock->sk->sk_uid = iattr->ia_uid;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 333c5dae0072..800caaa699a1 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -441,15 +441,19 @@ static void __tipc_shutdown(struct socket *sock, int error)
         while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
                 if (TIPC_SKB_CB(skb)->bytes_read) {
                         kfree_skb(skb);
-                } else {
-                        if (!tipc_sk_type_connectionless(sk) &&
-                            sk->sk_state != TIPC_DISCONNECTING) {
-                                tipc_set_sk_state(sk, TIPC_DISCONNECTING);
-                                tipc_node_remove_conn(net, dnode, tsk->portid);
-                        }
-                        tipc_sk_respond(sk, skb, error);
+                        continue;
+                }
+                if (!tipc_sk_type_connectionless(sk) &&
+                    sk->sk_state != TIPC_DISCONNECTING) {
+                        tipc_set_sk_state(sk, TIPC_DISCONNECTING);
+                        tipc_node_remove_conn(net, dnode, tsk->portid);
                 }
+                tipc_sk_respond(sk, skb, error);
         }
+
+        if (tipc_sk_type_connectionless(sk))
+                return;
+
         if (sk->sk_state != TIPC_DISCONNECTING) {
                 skb = tipc_msg_create(TIPC_CRITICAL_IMPORTANCE,
                                       TIPC_CONN_MSG, SHORT_H_SIZE, 0, dnode,
@@ -457,10 +461,8 @@ static void __tipc_shutdown(struct socket *sock, int error)
                                       tsk->portid, error);
                 if (skb)
                         tipc_node_xmit_skb(net, skb, dnode, tsk->portid);
-                if (!tipc_sk_type_connectionless(sk)) {
-                        tipc_node_remove_conn(net, dnode, tsk->portid);
-                        tipc_set_sk_state(sk, TIPC_DISCONNECTING);
-                }
+                tipc_node_remove_conn(net, dnode, tsk->portid);
+                tipc_set_sk_state(sk, TIPC_DISCONNECTING);
         }
 }