29 files changed, 246 insertions, 186 deletions
diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index fa2644d276ef..e31e1b20f7f4 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -13,27 +13,13 @@
 #include <net/sock.h>
 #include <net/tcp.h>
-static __always_inline u32 bpf_test_run_one(struct bpf_prog *prog, void *ctx,
+static int bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat,
-                struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE])
+                        u32 *retval, u32 *time)
-{
-        u32 ret;
-        preempt_disable();
-        rcu_read_lock();
-        bpf_cgroup_storage_set(storage);
-        ret = BPF_PROG_RUN(prog, ctx);
-        rcu_read_unlock();
-        preempt_enable();
-        return ret;
-}
-static int bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *ret,
-                        u32 *time)
 {
        struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = { 0 };
        enum bpf_cgroup_storage_type stype;
        u64 time_start, time_spent = 0;
+        int ret = 0;
        u32 i;
        for_each_cgroup_storage_type(stype) {
@@ -48,25 +34,42 @@ static int bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *ret,
        if (!repeat)
                repeat = 1;
+        rcu_read_lock();
+        preempt_disable();
        time_start = ktime_get_ns();
        for (i = 0; i < repeat; i++) {
-                *ret = bpf_test_run_one(prog, ctx, storage);
+                bpf_cgroup_storage_set(storage);
+                *retval = BPF_PROG_RUN(prog, ctx);
+                if (signal_pending(current)) {
+                        ret = -EINTR;
+                        break;
+                }
                if (need_resched()) {
-                        if (signal_pending(current))
-                                break;
                        time_spent += ktime_get_ns() - time_start;
+                        preempt_enable();
+                        rcu_read_unlock();
                        cond_resched();
+                        rcu_read_lock();
+                        preempt_disable();
                        time_start = ktime_get_ns();
                }
        }
        time_spent += ktime_get_ns() - time_start;
+        preempt_enable();
+        rcu_read_unlock();
        do_div(time_spent, repeat);
        *time = time_spent > U32_MAX ? U32_MAX : (u32)time_spent;
        for_each_cgroup_storage_type(stype)
                bpf_cgroup_storage_free(storage[stype]);
-        return 0;
+        return ret;
 }
 static int bpf_test_finish(const union bpf_attr *kattr,
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 3aeff0895669..ac92b2eb32b1 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1204,14 +1204,7 @@ static void br_multicast_query_received(struct net_bridge *br,
                return;
        br_multicast_update_query_timer(br, query, max_delay);
+        br_multicast_mark_router(br, port);
-        /* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules,
-         * the arrival port for IGMP Queries where the source address
-         * is 0.0.0.0 should not be added to router port list.
-         */
-        if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) ||
-            saddr->proto == htons(ETH_P_IPV6))
-                br_multicast_mark_router(br, port);
 }
 static void br_ip4_multicast_query(struct net_bridge *br,
diff --git a/net/compat.c b/net/compat.c
index 959d1c51826d..3d348198004f 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -388,8 +388,12 @@ static int __compat_sys_setsockopt(int fd, int level, int optname,
                                   char __user *optval, unsigned int optlen)
 {
        int err;
-        struct socket *sock = sockfd_lookup(fd, &err);
+        struct socket *sock;
+        if (optlen > INT_MAX)
+                return -EINVAL;
+        sock = sockfd_lookup(fd, &err);
        if (sock) {
                err = security_socket_setsockopt(sock, level, optname);
                if (err) {
diff --git a/net/dsa/port.c b/net/dsa/port.c
index 2d7e01b23572..2a2a878b5ce3 100644
--- a/net/dsa/port.c
+++ b/net/dsa/port.c
@@ -69,7 +69,6 @@ static void dsa_port_set_state_now(struct dsa_port *dp, u8 state)
 int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
 {
-        u8 stp_state = dp->bridge_dev ? BR_STATE_BLOCKING : BR_STATE_FORWARDING;
        struct dsa_switch *ds = dp->ds;
        int port = dp->index;
        int err;
@@ -80,7 +79,8 @@ int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
                        return err;
        }
-        dsa_port_set_state_now(dp, stp_state);
+        if (!dp->bridge_dev)
+                dsa_port_set_state_now(dp, BR_STATE_FORWARDING);
        return 0;
 }
@@ -90,7 +90,8 @@ void dsa_port_disable(struct dsa_port *dp, struct phy_device *phy)
        struct dsa_switch *ds = dp->ds;
        int port = dp->index;
-        dsa_port_set_state_now(dp, BR_STATE_DISABLED);
+        if (!dp->bridge_dev)
+                dsa_port_set_state_now(dp, BR_STATE_DISABLED);
        if (ds->ops->port_disable)
                ds->ops->port_disable(ds, port, phy);
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 5459f41fc26f..10e809b296ec 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -328,7 +328,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
                        skb->len += tailen;
                        skb->data_len += tailen;
                        skb->truesize += tailen;
-                        if (sk)
+                        if (sk && sk_fullsock(sk))
                                refcount_add(tailen, &sk->sk_wmem_alloc);
                        goto out;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 3978f807fa8b..6ae89f2b541b 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1457,9 +1457,23 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
        struct ip_tunnel_parm *p = &t->parms;
        __be16 o_flags = p->o_flags;
-        if ((t->erspan_ver == 1 || t->erspan_ver == 2) &&
+        if (t->erspan_ver == 1 || t->erspan_ver == 2) {
-            !t->collect_md)
+                if (!t->collect_md)
-                o_flags |= TUNNEL_KEY;
+                        o_flags |= TUNNEL_KEY;
+                if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver))
+                        goto nla_put_failure;
+                if (t->erspan_ver == 1) {
+                        if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index))
+                                goto nla_put_failure;
+                } else {
+                        if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir))
+                                goto nla_put_failure;
+                        if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid))
+                                goto nla_put_failure;
+                }
+        }
        if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
            nla_put_be16(skb, IFLA_GRE_IFLAGS,
@@ -1495,19 +1509,6 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
                        goto nla_put_failure;
        }
-        if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver))
-                goto nla_put_failure;
-        if (t->erspan_ver == 1) {
-                if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index))
-                        goto nla_put_failure;
-        } else if (t->erspan_ver == 2) {
-                if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir))
-                        goto nla_put_failure;
-                if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid))
-                        goto nla_put_failure;
-        }
        return 0;
 nla_put_failure:
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 730bc44dbad9..ccc78f3a4b60 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2347,6 +2347,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                        /* "skb_mstamp_ns" is used as a start point for the retransmit timer */
                        skb->skb_mstamp_ns = tp->tcp_wstamp_ns = tp->tcp_clock_cache;
                        list_move_tail(&skb->tcp_tsorted_anchor, &tp->tsorted_sent_queue);
+                        tcp_init_tso_segs(skb, mss_now);
                        goto repair; /* Skip network transmission */
                }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 5c3cd5d84a6f..372fdc5381a9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -562,10 +562,12 @@ static int __udp4_lib_err_encap_no_sk(struct sk_buff *skb, u32 info)
        for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) {
                int (*handler)(struct sk_buff *skb, u32 info);
+                const struct ip_tunnel_encap_ops *encap;
-                if (!iptun_encaps[i])
+                encap = rcu_dereference(iptun_encaps[i]);
+                if (!encap)
                        continue;
-                handler = rcu_dereference(iptun_encaps[i]->err_handler);
+                handler = encap->err_handler;
                if (handler && !handler(skb, info))
                        return 0;
        }
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 5afe9f83374d..239d4a65ad6e 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -296,7 +296,7 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
                        skb->len += tailen;
                        skb->data_len += tailen;
                        skb->truesize += tailen;
-                        if (sk)
+                        if (sk && sk_fullsock(sk))
                                refcount_add(tailen, &sk->sk_wmem_alloc);
                        goto out;
diff --git a/net/ipv6/fou6.c b/net/ipv6/fou6.c
index b858bd5280bf..867474abe269 100644
--- a/net/ipv6/fou6.c
+++ b/net/ipv6/fou6.c
@@ -72,7 +72,7 @@ static int gue6_build_header(struct sk_buff *skb, struct ip_tunnel_encap *e,
 static int gue6_err_proto_handler(int proto, struct sk_buff *skb,
                                  struct inet6_skb_parm *opt,
-                                  u8 type, u8 code, int offset, u32 info)
+                                  u8 type, u8 code, int offset, __be32 info)
 {
        const struct inet6_protocol *ipprot;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 43890898b0b5..26f25b6e2833 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1722,6 +1722,9 @@ static int ip6erspan_tap_validate(struct nlattr *tb[], struct nlattr *data[],
 static void ip6erspan_set_version(struct nlattr *data[],
                                  struct __ip6_tnl_parm *parms)
 {
+        if (!data)
+                return;
        parms->erspan_ver = 1;
        if (data[IFLA_GRE_ERSPAN_VER])
                parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
@@ -2104,9 +2107,23 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
        struct __ip6_tnl_parm *p = &t->parms;
        __be16 o_flags = p->o_flags;
-        if ((p->erspan_ver == 1 || p->erspan_ver == 2) &&
+        if (p->erspan_ver == 1 || p->erspan_ver == 2) {
-            !p->collect_md)
+                if (!p->collect_md)
-                o_flags |= TUNNEL_KEY;
+                        o_flags |= TUNNEL_KEY;
+                if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, p->erspan_ver))
+                        goto nla_put_failure;
+                if (p->erspan_ver == 1) {
+                        if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
+                                goto nla_put_failure;
+                } else {
+                        if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, p->dir))
+                                goto nla_put_failure;
+                        if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, p->hwid))
+                                goto nla_put_failure;
+                }
+        }
        if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
            nla_put_be16(skb, IFLA_GRE_IFLAGS,
@@ -2121,8 +2138,7 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
            nla_put_u8(skb, IFLA_GRE_ENCAP_LIMIT, p->encap_limit) ||
            nla_put_be32(skb, IFLA_GRE_FLOWINFO, p->flowinfo) ||
            nla_put_u32(skb, IFLA_GRE_FLAGS, p->flags) ||
-            nla_put_u32(skb, IFLA_GRE_FWMARK, p->fwmark) ||
+            nla_put_u32(skb, IFLA_GRE_FWMARK, p->fwmark))
-            nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
                goto nla_put_failure;
        if (nla_put_u16(skb, IFLA_GRE_ENCAP_TYPE,
@@ -2140,19 +2156,6 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
                        goto nla_put_failure;
        }
-        if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, p->erspan_ver))
-                goto nla_put_failure;
-        if (p->erspan_ver == 1) {
-                if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
-                        goto nla_put_failure;
-        } else if (p->erspan_ver == 2) {
-                if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, p->dir))
-                        goto nla_put_failure;
-                if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, p->hwid))
-                        goto nla_put_failure;
-        }
        return 0;
 nla_put_failure:
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 964491cf3672..ce15dc4ccbfa 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1274,18 +1274,29 @@ static DEFINE_SPINLOCK(rt6_exception_lock);
 static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
                                 struct rt6_exception *rt6_ex)
 {
+        struct fib6_info *from;
        struct net *net;
        if (!bucket || !rt6_ex)
                return;
        net = dev_net(rt6_ex->rt6i->dst.dev);
+        net->ipv6.rt6_stats->fib_rt_cache--;
+        /* purge completely the exception to allow releasing the held resources:
+         * some [sk] cache may keep the dst around for unlimited time
+         */
+        from = rcu_dereference_protected(rt6_ex->rt6i->from,
+                                         lockdep_is_held(&rt6_exception_lock));
+        rcu_assign_pointer(rt6_ex->rt6i->from, NULL);
+        fib6_info_release(from);
+        dst_dev_put(&rt6_ex->rt6i->dst);
        hlist_del_rcu(&rt6_ex->hlist);
        dst_release(&rt6_ex->rt6i->dst);
        kfree_rcu(rt6_ex, rcu);
        WARN_ON_ONCE(!bucket->depth);
        bucket->depth--;
-        net->ipv6.rt6_stats->fib_rt_cache--;
 }
 /* Remove oldest rt6_ex in bucket and free the memory
@@ -1599,15 +1610,15 @@ static int rt6_remove_exception_rt(struct rt6_info *rt)
 static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
 {
        struct rt6_exception_bucket *bucket;
-        struct fib6_info *from = rt->from;
        struct in6_addr *src_key = NULL;
        struct rt6_exception *rt6_ex;
+        struct fib6_info *from;
-        if (!from ||
-            !(rt->rt6i_flags & RTF_CACHE))
-                return;
        rcu_read_lock();
+        from = rcu_dereference(rt->from);
+        if (!from || !(rt->rt6i_flags & RTF_CACHE))
+                goto unlock;
        bucket = rcu_dereference(from->rt6i_exception_bucket);
 #ifdef CONFIG_IPV6_SUBTREES
@@ -1626,6 +1637,7 @@ static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
        if (rt6_ex)
                rt6_ex->stamp = jiffies;
+unlock:
        rcu_read_unlock();
 }
@@ -2742,20 +2754,24 @@ static int ip6_route_check_nh_onlink(struct net *net,
        u32 tbid = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN;
        const struct in6_addr *gw_addr = &cfg->fc_gateway;
        u32 flags = RTF_LOCAL | RTF_ANYCAST | RTF_REJECT;
+        struct fib6_info *from;
        struct rt6_info *grt;
        int err;
        err = 0;
        grt = ip6_nh_lookup_table(net, cfg, gw_addr, tbid, 0);
        if (grt) {
+                rcu_read_lock();
+                from = rcu_dereference(grt->from);
                if (!grt->dst.error &&
                    /* ignore match if it is the default route */
-                    grt->from && !ipv6_addr_any(&grt->from->fib6_dst.addr) &&
+                    from && !ipv6_addr_any(&from->fib6_dst.addr) &&
                    (grt->rt6i_flags & flags || dev != grt->dst.dev)) {
                        NL_SET_ERR_MSG(extack,
                                       "Nexthop has invalid gateway or device mismatch");
                        err = -EINVAL;
                }
+                rcu_read_unlock();
                ip6_rt_put(grt);
        }
@@ -4649,7 +4665,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
                table = rt->fib6_table->tb6_id;
        else
                table = RT6_TABLE_UNSPEC;
-        rtm->rtm_table = table;
+        rtm->rtm_table = table < 256 ? table : RT_TABLE_COMPAT;
        if (nla_put_u32(skb, RTA_TABLE, table))
                goto nla_put_failure;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 2596ffdeebea..b444483cdb2b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -288,8 +288,8 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
        int peeked, peeking, off;
        int err;
        int is_udplite = IS_UDPLITE(sk);
+        struct udp_mib __percpu *mib;
        bool checksum_valid = false;
-        struct udp_mib *mib;
        int is_udp4;
        if (flags & MSG_ERRQUEUE)
@@ -420,17 +420,19 @@ EXPORT_SYMBOL(udpv6_encap_enable);
 */
 static int __udp6_lib_err_encap_no_sk(struct sk_buff *skb,
                                      struct inet6_skb_parm *opt,
-                                      u8 type, u8 code, int offset, u32 info)
+                                      u8 type, u8 code, int offset, __be32 info)
 {
        int i;
        for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) {
                int (*handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                               u8 type, u8 code, int offset, u32 info);
+                               u8 type, u8 code, int offset, __be32 info);
+                const struct ip6_tnl_encap_ops *encap;
-                if (!ip6tun_encaps[i])
+                encap = rcu_dereference(ip6tun_encaps[i]);
+                if (!encap)
                        continue;
-                handler = rcu_dereference(ip6tun_encaps[i]->err_handler);
+                handler = encap->err_handler;
                if (handler && !handler(skb, opt, type, code, offset, info))
                        return 0;
        }
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index f5b4febeaa25..bc65db782bfb 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -344,8 +344,8 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
        unsigned int i;
-        xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
        xfrm_flush_gc();
+        xfrm_state_flush(net, IPSEC_PROTO_ANY, false, true);
        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
                WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byaddr[i]));
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 655c787f9d54..5651c29cb5bd 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -196,30 +196,22 @@ static int pfkey_release(struct socket *sock)
        return 0;
 }
-static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
+static int pfkey_broadcast_one(struct sk_buff *skb, gfp_t allocation,
-                               gfp_t allocation, struct sock *sk)
+                               struct sock *sk)
 {
        int err = -ENOBUFS;
-        sock_hold(sk);
+        if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
-        if (*skb2 == NULL) {
+                return err;
-                if (refcount_read(&skb->users) != 1) {
-                        *skb2 = skb_clone(skb, allocation);
+        skb = skb_clone(skb, allocation);
-                } else {
-                        *skb2 = skb;
+        if (skb) {
-                        refcount_inc(&skb->users);
+                skb_set_owner_r(skb, sk);
-                }
+                skb_queue_tail(&sk->sk_receive_queue, skb);
-        }
+                sk->sk_data_ready(sk);
-        if (*skb2 != NULL) {
+                err = 0;
-                if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) {
-                        skb_set_owner_r(*skb2, sk);
-                        skb_queue_tail(&sk->sk_receive_queue, *skb2);
-                        sk->sk_data_ready(sk);
-                        *skb2 = NULL;
-                        err = 0;
-                }
        }
-        sock_put(sk);
        return err;
 }
@@ -234,7 +226,6 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
 {
        struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id);
        struct sock *sk;
-        struct sk_buff *skb2 = NULL;
        int err = -ESRCH;
        /* XXX Do we need something like netlink_overrun?  I think
@@ -253,7 +244,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
                 * socket.
                 */
                if (pfk->promisc)
-                        pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk);
+                        pfkey_broadcast_one(skb, GFP_ATOMIC, sk);
                /* the exact target will be processed later */
                if (sk == one_sk)
@@ -268,7 +259,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
                                continue;
                }
-                err2 = pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk);
+                err2 = pfkey_broadcast_one(skb, GFP_ATOMIC, sk);
                /* Error is cleared after successful sending to at least one
                 * registered KM */
@@ -278,9 +269,8 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
        rcu_read_unlock();
        if (one_sk != NULL)
-                err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
+                err = pfkey_broadcast_one(skb, allocation, one_sk);
-        kfree_skb(skb2);
        kfree_skb(skb);
        return err;
 }
@@ -1783,7 +1773,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, const struct sadb_m
        if (proto == 0)
                return -EINVAL;
-        err = xfrm_state_flush(net, proto, true);
+        err = xfrm_state_flush(net, proto, true, false);
        err2 = unicast_flush_resp(sk, hdr);
        if (err || err2) {
                if (err == -ESRCH) /* empty table - go quietly */
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 87a729926734..977dea436ee8 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -615,13 +615,13 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
         * We need a bit of data queued to build aggregates properly, so
         * instruct the TCP stack to allow more than a single ms of data
         * to be queued in the stack. The value is a bit-shift of 1
-         * second, so 8 is ~4ms of queued data. Only affects local TCP
+         * second, so 7 is ~8ms of queued data. Only affects local TCP
         * sockets.
         * This is the default, anyhow - drivers may need to override it
         * for local reasons (longer buffers, longer completion time, or
         * similar).
         */
-        local->hw.tx_sk_pacing_shift = 8;
+        local->hw.tx_sk_pacing_shift = 7;
        /* set up some defaults */
        local->hw.queues = 1;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index bb4d71efb6fb..c2a6da5d80da 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2644,6 +2644,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
        struct ieee80211_sub_if_data *sdata = rx->sdata;
        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
        u16 ac, q, hdrlen;
+        int tailroom = 0;
        hdr = (struct ieee80211_hdr *) skb->data;
        hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -2732,8 +2733,12 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
        if (!ifmsh->mshcfg.dot11MeshForwarding)
                goto out;
+        if (sdata->crypto_tx_tailroom_needed_cnt)
+                tailroom = IEEE80211_ENCRYPT_TAILROOM;
        fwd_skb = skb_copy_expand(skb, local->tx_headroom +
-                                       sdata->encrypt_headroom, 0, GFP_ATOMIC);
+                                       sdata->encrypt_headroom,
+                                  tailroom, GFP_ATOMIC);
        if (!fwd_skb)
                goto out;
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 9fc76b19cd3c..db3473540303 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -132,7 +132,7 @@ static int pep_indicate(struct sock *sk, u8 id, u8 code,
        ph->utid = 0;
        ph->message_id = id;
        ph->pipe_handle = pn->pipe_handle;
-        ph->data[0] = code;
+        ph->error_code = code;
        return pn_skb_send(sk, skb, NULL);
 }
@@ -153,7 +153,7 @@ static int pipe_handler_request(struct sock *sk, u8 id, u8 code,
        ph->utid = id; /* whatever */
        ph->message_id = id;
        ph->pipe_handle = pn->pipe_handle;
-        ph->data[0] = code;
+        ph->error_code = code;
        return pn_skb_send(sk, skb, NULL);
 }
@@ -208,7 +208,7 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code,
        struct pnpipehdr *ph;
        struct sockaddr_pn dst;
        u8 data[4] = {
-                oph->data[0], /* PEP type */
+                oph->pep_type, /* PEP type */
                code, /* error code, at an unusual offset */
                PAD, PAD,
        };
@@ -221,7 +221,7 @@ static int pep_ctrlreq_error(struct sock *sk, struct sk_buff *oskb, u8 code,
        ph->utid = oph->utid;
        ph->message_id = PNS_PEP_CTRL_RESP;
        ph->pipe_handle = oph->pipe_handle;
-        ph->data[0] = oph->data[1]; /* CTRL id */
+        ph->data0 = oph->data[0]; /* CTRL id */
        pn_skb_get_src_sockaddr(oskb, &dst);
        return pn_skb_send(sk, skb, &dst);
@@ -272,17 +272,17 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
                return -EINVAL;
        hdr = pnp_hdr(skb);
-        if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
+        if (hdr->pep_type != PN_PEP_TYPE_COMMON) {
                net_dbg_ratelimited("Phonet unknown PEP type: %u\n",
-                                    (unsigned int)hdr->data[0]);
+                                    (unsigned int)hdr->pep_type);
                return -EOPNOTSUPP;
        }
-        switch (hdr->data[1]) {
+        switch (hdr->data[0]) {
        case PN_PEP_IND_FLOW_CONTROL:
                switch (pn->tx_fc) {
                case PN_LEGACY_FLOW_CONTROL:
-                        switch (hdr->data[4]) {
+                        switch (hdr->data[3]) {
                        case PEP_IND_BUSY:
                                atomic_set(&pn->tx_credits, 0);
                                break;
@@ -292,7 +292,7 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
                        }
                        break;
                case PN_ONE_CREDIT_FLOW_CONTROL:
-                        if (hdr->data[4] == PEP_IND_READY)
+                        if (hdr->data[3] == PEP_IND_READY)
                                atomic_set(&pn->tx_credits, wake = 1);
                        break;
                }
@@ -301,12 +301,12 @@ static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
        case PN_PEP_IND_ID_MCFC_GRANT_CREDITS:
                if (pn->tx_fc != PN_MULTI_CREDIT_FLOW_CONTROL)
                        break;
-                atomic_add(wake = hdr->data[4], &pn->tx_credits);
+                atomic_add(wake = hdr->data[3], &pn->tx_credits);
                break;
        default:
                net_dbg_ratelimited("Phonet unknown PEP indication: %u\n",
-                                    (unsigned int)hdr->data[1]);
+                                    (unsigned int)hdr->data[0]);
                return -EOPNOTSUPP;
        }
        if (wake)
@@ -318,7 +318,7 @@ static int pipe_rcv_created(struct sock *sk, struct sk_buff *skb)
 {
        struct pep_sock *pn = pep_sk(sk);
        struct pnpipehdr *hdr = pnp_hdr(skb);
-        u8 n_sb = hdr->data[0];
+        u8 n_sb = hdr->data0;
        pn->rx_fc = pn->tx_fc = PN_LEGACY_FLOW_CONTROL;
        __skb_pull(skb, sizeof(*hdr));
@@ -506,7 +506,7 @@ static int pep_connresp_rcv(struct sock *sk, struct sk_buff *skb)
                return -ECONNREFUSED;
        /* Parse sub-blocks */
-        n_sb = hdr->data[4];
+        n_sb = hdr->data[3];
        while (n_sb > 0) {
                u8 type, buf[6], len = sizeof(buf);
                const u8 *data = pep_get_sb(skb, &type, &len, buf);
@@ -739,7 +739,7 @@ static int pipe_do_remove(struct sock *sk)
        ph->utid = 0;
        ph->message_id = PNS_PIPE_REMOVE_REQ;
        ph->pipe_handle = pn->pipe_handle;
-        ph->data[0] = PAD;
+        ph->data0 = PAD;
        return pn_skb_send(sk, skb, NULL);
 }
@@ -817,7 +817,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp,
        peer_type = hdr->other_pep_type << 8;
        /* Parse sub-blocks (options) */
-        n_sb = hdr->data[4];
+        n_sb = hdr->data[3];
        while (n_sb > 0) {
                u8 type, buf[1], len = sizeof(buf);
                const u8 *data = pep_get_sb(skb, &type, &len, buf);
@@ -1109,7 +1109,7 @@ static int pipe_skb_send(struct sock *sk, struct sk_buff *skb)
        ph->utid = 0;
        if (pn->aligned) {
                ph->message_id = PNS_PIPE_ALIGNED_DATA;
-                ph->data[0] = 0; /* padding */
+                ph->data0 = 0; /* padding */
        } else
                ph->message_id = PNS_PIPE_DATA;
        ph->pipe_handle = pn->pipe_handle;
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 033696e6f74f..ad158d311ffa 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -207,7 +207,8 @@ void sctp_transport_reset_hb_timer(struct sctp_transport *transport)
        /* When a data chunk is sent, reset the heartbeat interval.  */
        expires = jiffies + sctp_transport_timeout(transport);
-        if (time_before(transport->hb_timer.expires, expires) &&
+        if ((time_before(transport->hb_timer.expires, expires) ||
+             !timer_pending(&transport->hb_timer)) &&
            !mod_timer(&transport->hb_timer,
                       expires + prandom_u32_max(transport->rto)))
                sctp_transport_hold(transport);
diff --git a/net/smc/smc.h b/net/smc/smc.h
index 5721416d0605..adbdf195eb08 100644
--- a/net/smc/smc.h
+++ b/net/smc/smc.h
@@ -113,9 +113,9 @@ struct smc_host_cdc_msg {		/* Connection Data Control message */
 } __aligned(8);
 enum smc_urg_state {
-        SMC_URG_VALID,                  /* data present */
+        SMC_URG_VALID   = 1,                    /* data present */
-        SMC_URG_NOTYET,                 /* data pending */
+        SMC_URG_NOTYET  = 2,                    /* data pending */
-        SMC_URG_READ                    /* data was already read */
+        SMC_URG_READ    = 3,                    /* data was already read */
 };
 struct smc_connection {
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 1217c90a363b..684f2125fc6b 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -388,7 +388,7 @@ static int tipc_sk_sock_err(struct socket *sock, long *timeout)
                rc_ = tipc_sk_sock_err((sock_), timeo_);                       \
                if (rc_)                                                       \
                        break;                                                 \
-                prepare_to_wait(sk_sleep(sk_), &wait_, TASK_INTERRUPTIBLE);    \
+                add_wait_queue(sk_sleep(sk_), &wait_);                         \
                release_sock(sk_);                                             \
                *(timeo_) = wait_woken(&wait_, TASK_INTERRUPTIBLE, *(timeo_)); \
                sched_annotate_sleep();                                        \
@@ -1677,7 +1677,7 @@ static void tipc_sk_send_ack(struct tipc_sock *tsk)
 static int tipc_wait_for_rcvmsg(struct socket *sock, long *timeop)
 {
        struct sock *sk = sock->sk;
-        DEFINE_WAIT(wait);
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
        long timeo = *timeop;
        int err = sock_error(sk);
@@ -1685,15 +1685,17 @@ static int tipc_wait_for_rcvmsg(struct socket *sock, long *timeop)
                return err;
        for (;;) {
-                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                if (timeo && skb_queue_empty(&sk->sk_receive_queue)) {
                        if (sk->sk_shutdown & RCV_SHUTDOWN) {
                                err = -ENOTCONN;
                                break;
                        }
+                        add_wait_queue(sk_sleep(sk), &wait);
                        release_sock(sk);
-                        timeo = schedule_timeout(timeo);
+                        timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
+                        sched_annotate_sleep();
                        lock_sock(sk);
+                        remove_wait_queue(sk_sleep(sk), &wait);
                }
                err = 0;
                if (!skb_queue_empty(&sk->sk_receive_queue))
@@ -1709,7 +1711,6 @@ static int tipc_wait_for_rcvmsg(struct socket *sock, long *timeop)
                if (err)
                        break;
        }
-        finish_wait(sk_sleep(sk), &wait);
        *timeop = timeo;
        return err;
 }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 74d1eed7cbd4..a95d479caeea 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -890,7 +890,7 @@ retry:
        addr->hash ^= sk->sk_type;
        __unix_remove_socket(sk);
-        u->addr = addr;
+        smp_store_release(&u->addr, addr);
        __unix_insert_socket(&unix_socket_table[addr->hash], sk);
        spin_unlock(&unix_table_lock);
        err = 0;
@@ -1060,7 +1060,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        err = 0;
        __unix_remove_socket(sk);
-        u->addr = addr;
+        smp_store_release(&u->addr, addr);
        __unix_insert_socket(list, sk);
 out_unlock:
@@ -1331,15 +1331,29 @@ restart:
        RCU_INIT_POINTER(newsk->sk_wq, &newu->peer_wq);
        otheru = unix_sk(other);
-        /* copy address information from listening to new sock*/
+        /* copy address information from listening to new sock
-        if (otheru->addr) {
+         *
-                refcount_inc(&otheru->addr->refcnt);
+         * The contents of *(otheru->addr) and otheru->path
-                newu->addr = otheru->addr;
+         * are seen fully set up here, since we have found
-        }
+         * otheru in hash under unix_table_lock.  Insertion
+         * into the hash chain we'd found it in had been done
+         * in an earlier critical area protected by unix_table_lock,
+         * the same one where we'd set *(otheru->addr) contents,
+         * as well as otheru->path and otheru->addr itself.
+         *
+         * Using smp_store_release() here to set newu->addr
+         * is enough to make those stores, as well as stores
+         * to newu->path visible to anyone who gets newu->addr
+         * by smp_load_acquire().  IOW, the same warranties
+         * as for unix_sock instances bound in unix_bind() or
+         * in unix_autobind().
+         */
        if (otheru->path.dentry) {
                path_get(&otheru->path);
                newu->path = otheru->path;
        }
+        refcount_inc(&otheru->addr->refcnt);
+        smp_store_release(&newu->addr, otheru->addr);
        /* Set credentials */
        copy_peercred(sk, other);
@@ -1453,7 +1467,7 @@ out:
 static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
 {
        struct sock *sk = sock->sk;
-        struct unix_sock *u;
+        struct unix_address *addr;
        DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr);
        int err = 0;
@@ -1468,19 +1482,15 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer)
                sock_hold(sk);
        }
-        u = unix_sk(sk);
+        addr = smp_load_acquire(&unix_sk(sk)->addr);
-        unix_state_lock(sk);
+        if (!addr) {
-        if (!u->addr) {
                sunaddr->sun_family = AF_UNIX;
                sunaddr->sun_path[0] = 0;
                err = sizeof(short);
        } else {
-                struct unix_address *addr = u->addr;
                err = addr->len;
                memcpy(sunaddr, addr->name, addr->len);
        }
-        unix_state_unlock(sk);
        sock_put(sk);
 out:
        return err;
@@ -2073,11 +2083,11 @@ static int unix_seqpacket_recvmsg(struct socket *sock, struct msghdr *msg,
 static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
 {
-        struct unix_sock *u = unix_sk(sk);
+        struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr);
-        if (u->addr) {
+        if (addr) {
-                msg->msg_namelen = u->addr->len;
+                msg->msg_namelen = addr->len;
-                memcpy(msg->msg_name, u->addr->name, u->addr->len);
+                memcpy(msg->msg_name, addr->name, addr->len);
        }
 }
@@ -2581,15 +2591,14 @@ static int unix_open_file(struct sock *sk)
        if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
                return -EPERM;
-        unix_state_lock(sk);
+        if (!smp_load_acquire(&unix_sk(sk)->addr))
+                return -ENOENT;
        path = unix_sk(sk)->path;
-        if (!path.dentry) {
+        if (!path.dentry)
-                unix_state_unlock(sk);
                return -ENOENT;
-        }
        path_get(&path);
-        unix_state_unlock(sk);
        fd = get_unused_fd_flags(O_CLOEXEC);
        if (fd < 0)
@@ -2830,7 +2839,7 @@ static int unix_seq_show(struct seq_file *seq, void *v)
                        (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING),
                        sock_i_ino(s));
-                if (u->addr) {
+                if (u->addr) {  // under unix_table_lock here
                        int i, len;
                        seq_putc(seq, ' ');
diff --git a/net/unix/diag.c b/net/unix/diag.c
index 384c84e83462..3183d9b8ab33 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -10,7 +10,8 @@
 static int sk_diag_dump_name(struct sock *sk, struct sk_buff *nlskb)
 {
-        struct unix_address *addr = unix_sk(sk)->addr;
+        /* might or might not have unix_table_lock */
+        struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr);
        if (!addr)
                return 0;
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index ec3a828672ef..eff31348e20b 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -679,8 +679,7 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
        int len, i, rc = 0;
-        if (!sock_flag(sk, SOCK_ZAPPED) ||
+        if (addr_len != sizeof(struct sockaddr_x25) ||
-            addr_len != sizeof(struct sockaddr_x25) ||
            addr->sx25_family != AF_X25) {
                rc = -EINVAL;
                goto out;
@@ -699,9 +698,13 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        }
        lock_sock(sk);
-        x25_sk(sk)->source_addr = addr->sx25_addr;
+        if (sock_flag(sk, SOCK_ZAPPED)) {
-        x25_insert_socket(sk);
+                x25_sk(sk)->source_addr = addr->sx25_addr;
-        sock_reset_flag(sk, SOCK_ZAPPED);
+                x25_insert_socket(sk);
+                sock_reset_flag(sk, SOCK_ZAPPED);
+        } else {
+                rc = -EINVAL;
+        }
        release_sock(sk);
        SOCK_DEBUG(sk, "x25_bind: socket is bound\n");
 out:
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 45f3b528dc09..85e4fe4f18cc 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -366,7 +366,6 @@ static int xsk_release(struct socket *sock)
        xskq_destroy(xs->rx);
        xskq_destroy(xs->tx);
-        xdp_put_umem(xs->umem);
        sock_orphan(sk);
        sock->sk = NULL;
@@ -718,6 +717,18 @@ static const struct proto_ops xsk_proto_ops = {
        .sendpage       = sock_no_sendpage,
 };
+static void xsk_destruct(struct sock *sk)
+{
+        struct xdp_sock *xs = xdp_sk(sk);
+        if (!sock_flag(sk, SOCK_DEAD))
+                return;
+        xdp_put_umem(xs->umem);
+        sk_refcnt_debug_dec(sk);
+}
 static int xsk_create(struct net *net, struct socket *sock, int protocol,
                      int kern)
 {
@@ -744,6 +755,9 @@ static int xsk_create(struct net *net, struct socket *sock, int protocol,
        sk->sk_family = PF_XDP;
+        sk->sk_destruct = xsk_destruct;
+        sk_refcnt_debug_inc(sk);
        sock_set_flag(sk, SOCK_RCU_FREE);
        xs = xdp_sk(sk);
diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
index 6be8c7df15bb..dbb3c1945b5c 100644
--- a/net/xfrm/xfrm_interface.c
+++ b/net/xfrm/xfrm_interface.c
@@ -76,10 +76,10 @@ static struct xfrm_if *xfrmi_decode_session(struct sk_buff *skb)
        int ifindex;
        struct xfrm_if *xi;
-        if (!skb->dev)
+        if (!secpath_exists(skb) || !skb->dev)
                return NULL;
-        xfrmn = net_generic(dev_net(skb->dev), xfrmi_net_id);
+        xfrmn = net_generic(xs_net(xfrm_input_state(skb)), xfrmi_net_id);
        ifindex = skb->dev->ifindex;
        for_each_xfrmi_rcu(xfrmn->xfrmi[0], xi) {
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index ba0a4048c846..8d1a898d0ba5 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -3314,8 +3314,10 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
        if (ifcb) {
                xi = ifcb->decode_session(skb);
-                if (xi)
+                if (xi) {
                        if_id = xi->p.if_id;
+                        net = xi->net;
+                }
        }
        rcu_read_unlock();
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 23c92891758a..1bb971f46fc6 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -432,7 +432,7 @@ void xfrm_state_free(struct xfrm_state *x)
 }
 EXPORT_SYMBOL(xfrm_state_free);
-static void xfrm_state_gc_destroy(struct xfrm_state *x)
+static void ___xfrm_state_destroy(struct xfrm_state *x)
 {
        tasklet_hrtimer_cancel(&x->mtimer);
        del_timer_sync(&x->rtimer);
@@ -474,7 +474,7 @@ static void xfrm_state_gc_task(struct work_struct *work)
        synchronize_rcu();
        hlist_for_each_entry_safe(x, tmp, &gc_list, gclist)
-                xfrm_state_gc_destroy(x);
+                ___xfrm_state_destroy(x);
 }
 static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)
@@ -598,14 +598,19 @@ struct xfrm_state *xfrm_state_alloc(struct net *net)
 }
 EXPORT_SYMBOL(xfrm_state_alloc);
-void __xfrm_state_destroy(struct xfrm_state *x)
+void __xfrm_state_destroy(struct xfrm_state *x, bool sync)
 {
        WARN_ON(x->km.state != XFRM_STATE_DEAD);
-        spin_lock_bh(&xfrm_state_gc_lock);
+        if (sync) {
-        hlist_add_head(&x->gclist, &xfrm_state_gc_list);
+                synchronize_rcu();
-        spin_unlock_bh(&xfrm_state_gc_lock);
+                ___xfrm_state_destroy(x);
-        schedule_work(&xfrm_state_gc_work);
+        } else {
+                spin_lock_bh(&xfrm_state_gc_lock);
+                hlist_add_head(&x->gclist, &xfrm_state_gc_list);
+                spin_unlock_bh(&xfrm_state_gc_lock);
+                schedule_work(&xfrm_state_gc_work);
+        }
 }
 EXPORT_SYMBOL(__xfrm_state_destroy);
@@ -708,7 +713,7 @@ xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool
 }
 #endif
-int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
+int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync)
 {
        int i, err = 0, cnt = 0;
@@ -730,7 +735,10 @@ restart:
                                err = xfrm_state_delete(x);
                                xfrm_audit_state_delete(x, err ? 0 : 1,
                                                        task_valid);
-                                xfrm_state_put(x);
+                                if (sync)
+                                        xfrm_state_put_sync(x);
+                                else
+                                        xfrm_state_put(x);
                                if (!err)
                                        cnt++;
@@ -2215,7 +2223,7 @@ void xfrm_state_delete_tunnel(struct xfrm_state *x)
                if (atomic_read(&t->tunnel_users) == 2)
                        xfrm_state_delete(t);
                atomic_dec(&t->tunnel_users);
-                xfrm_state_put(t);
+                xfrm_state_put_sync(t);
                x->tunnel = NULL;
        }
 }
@@ -2375,8 +2383,8 @@ void xfrm_state_fini(struct net *net)
        unsigned int sz;
        flush_work(&net->xfrm.state_hash_work);
-        xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
        flush_work(&xfrm_state_gc_work);
+        xfrm_state_flush(net, IPSEC_PROTO_ANY, false, true);
        WARN_ON(!list_empty(&net->xfrm.state_all));
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index c6d26afcf89d..a131f9ff979e 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1932,7 +1932,7 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
        struct xfrm_usersa_flush *p = nlmsg_data(nlh);
        int err;
-        err = xfrm_state_flush(net, p->proto, true);
+        err = xfrm_state_flush(net, p->proto, true, false);
        if (err) {
                if (err == -ESRCH) /* empty table */
                        return 0;