29 files changed, 123 insertions, 100 deletions

diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index f963f6b1884f..5ba0c844d508 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -146,7 +146,7 @@ void br_fdb_cleanup(unsigned long _data)
         unsigned long next_timer = jiffies + br->ageing_time;
         int i;
 
-        spin_lock_bh(&br->hash_lock);
+        spin_lock(&br->hash_lock);
         for (i = 0; i < BR_HASH_SIZE; i++) {
                 struct net_bridge_fdb_entry *f;
                 struct hlist_node *h, *n;
@@ -162,7 +162,7 @@ void br_fdb_cleanup(unsigned long _data)
                                 next_timer = this_timer;
                 }
         }
-        spin_unlock_bh(&br->hash_lock);
+        spin_unlock(&br->hash_lock);
 
         mod_timer(&br->gc_timer, round_jiffies_up(next_timer));
 }
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 61570ee76fe6..673728add60b 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -146,15 +146,17 @@ void caif_flow_cb(struct sk_buff *skb)
         spin_lock_bh(&caifd->flow_lock);
         send_xoff = caifd->xoff;
         caifd->xoff = 0;
-        if (!WARN_ON(caifd->xoff_skb_dtor == NULL)) {
-                WARN_ON(caifd->xoff_skb != skb);
-                dtor = caifd->xoff_skb_dtor;
-                caifd->xoff_skb = NULL;
-                caifd->xoff_skb_dtor = NULL;
-        }
+        dtor = caifd->xoff_skb_dtor;
+
+        if (WARN_ON(caifd->xoff_skb != skb))
+                skb = NULL;
+
+        caifd->xoff_skb = NULL;
+        caifd->xoff_skb_dtor = NULL;
+
         spin_unlock_bh(&caifd->flow_lock);
 
-        if (dtor)
+        if (dtor && skb)
                 dtor(skb);
 
         if (send_xoff)
diff --git a/net/caif/caif_usb.c b/net/caif/caif_usb.c
index 5fc9eca8cd41..fd7cbf5aa895 100644
--- a/net/caif/caif_usb.c
+++ b/net/caif/caif_usb.c
@@ -11,7 +11,6 @@
 #include <linux/module.h>
 #include <linux/netdevice.h>
 #include <linux/slab.h>
-#include <linux/netdevice.h>
 #include <linux/mii.h>
 #include <linux/usb.h>
 #include <linux/usb/usbnet.h>
@@ -27,7 +26,7 @@ MODULE_LICENSE("GPL");
 #define CFUSB_ALIGNMENT 4       /* Number of bytes to align. */
 #define CFUSB_MAX_HEADLEN (CFUSB_PAD_DESCR_SZ + CFUSB_ALIGNMENT-1)
 #define STE_USB_VID 0x04cc      /* USB Product ID for ST-Ericsson */
-#define STE_USB_PID_CAIF 0x2306 /* Product id for CAIF Modems */
+#define STE_USB_PID_CAIF 0x230f /* Product id for CAIF Modems */
 
 struct cfusbl {
         struct cflayer layer;
diff --git a/net/core/dev.c b/net/core/dev.c
index f494675471a9..115dee1d985d 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1887,6 +1887,23 @@ void skb_set_dev(struct sk_buff *skb, struct net_device *dev)
 EXPORT_SYMBOL(skb_set_dev);
 #endif /* CONFIG_NET_NS */
 
+static void skb_warn_bad_offload(const struct sk_buff *skb)
+{
+        static const netdev_features_t null_features = 0;
+        struct net_device *dev = skb->dev;
+        const char *driver = "";
+
+        if (dev && dev->dev.parent)
+                driver = dev_driver_string(dev->dev.parent);
+
+        WARN(1, "%s: caps=(%pNF, %pNF) len=%d data_len=%d gso_size=%d "
+             "gso_type=%d ip_summed=%d\n",
+             driver, dev ? &dev->features : &null_features,
+             skb->sk ? &skb->sk->sk_route_caps : &null_features,
+             skb->len, skb->data_len, skb_shinfo(skb)->gso_size,
+             skb_shinfo(skb)->gso_type, skb->ip_summed);
+}
+
 /*
  * Invalidate hardware checksum when packet is to be mangled, and
  * complete checksum manually on outgoing path.
@@ -1900,8 +1917,8 @@ int skb_checksum_help(struct sk_buff *skb)
                 goto out_set_summed;
 
         if (unlikely(skb_shinfo(skb)->gso_size)) {
-                /* Let GSO fix up the checksum. */
-                goto out_set_summed;
+                skb_warn_bad_offload(skb);
+                return -EINVAL;
         }
 
         offset = skb_checksum_start_offset(skb);
@@ -1961,16 +1978,7 @@ struct sk_buff *skb_gso_segment(struct sk_buff *skb,
         __skb_pull(skb, skb->mac_len);
 
         if (unlikely(skb->ip_summed != CHECKSUM_PARTIAL)) {
-                struct net_device *dev = skb->dev;
-                struct ethtool_drvinfo info = {};
-
-                if (dev && dev->ethtool_ops && dev->ethtool_ops->get_drvinfo)
-                        dev->ethtool_ops->get_drvinfo(dev, &info);
-
-                WARN(1, "%s: caps=(%pNF, %pNF) len=%d data_len=%d ip_summed=%d\n",
-                     info.driver, dev ? &dev->features : NULL,
-                     skb->sk ? &skb->sk->sk_route_caps : NULL,
-                     skb->len, skb->data_len, skb->ip_summed);
+                skb_warn_bad_offload(skb);
 
                 if (skb_header_cloned(skb) &&
                     (err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index f3dbd4f596a4..a1727cda03d7 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -929,7 +929,7 @@ static ssize_t bql_show_inflight(struct netdev_queue *queue,
 }
 
 static struct netdev_queue_attribute bql_inflight_attribute =
-        __ATTR(inflight, S_IRUGO | S_IWUSR, bql_show_inflight, NULL);
+        __ATTR(inflight, S_IRUGO, bql_show_inflight, NULL);
 
 #define BQL_ATTR(NAME, FIELD)                                           \
 static ssize_t bql_show_ ## NAME(struct netdev_queue *queue,            \
diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
index 6fd44606fdd1..99b2596531bb 100644
--- a/net/core/secure_seq.c
+++ b/net/core/secure_seq.c
@@ -46,7 +46,7 @@ __u32 secure_tcpv6_sequence_number(const __be32 *saddr, const __be32 *daddr,
 
         memcpy(hash, saddr, 16);
         for (i = 0; i < 4; i++)
-                secret[i] = net_secret[i] + daddr[i];
+                secret[i] = net_secret[i] + (__force u32)daddr[i];
         secret[4] = net_secret[4] +
                 (((__force u16)sport << 16) + (__force u16)dport);
         for (i = 5; i < MD5_MESSAGE_BYTES / 4; i++)
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 86f13c67ea85..bf4a9c4808e1 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -136,7 +136,7 @@ static int addr_compare(const struct inetpeer_addr *a,
         for (i = 0; i < n; i++) {
                 if (a->addr.a6[i] == b->addr.a6[i])
                         continue;
-                if (a->addr.a6[i] < b->addr.a6[i])
+                if ((__force u32)a->addr.a6[i] < (__force u32)b->addr.a6[i])
                         return -1;
                 return 1;
         }
@@ -447,6 +447,7 @@ relookup:
                 p->rate_last = 0;
                 p->pmtu_expires = 0;
                 p->pmtu_orig = 0;
+                p->redirect_genid = 0;
                 memset(&p->redirect_learned, 0, sizeof(p->redirect_learned));
 
 
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 7e4ec9fc2cef..6e412a60a91f 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -141,7 +141,7 @@ __be32 ic_servaddr = NONE;	/* Boot server IP address */
 __be32 root_server_addr = NONE; /* Address of NFS server */
 u8 root_server_path[256] = { 0, };      /* Path to mount as root */
 
-u32 ic_dev_xid;         /* Device under configuration */
+__be32 ic_dev_xid;              /* Device under configuration */
 
 /* vendor class identifier */
 static char vendor_class_identifier[253] __initdata;
@@ -859,9 +859,9 @@ static int __init ic_bootp_string(char *dest, char *src, int len, int max)
  */
 static void __init ic_do_bootp_ext(u8 *ext)
 {
-       u8 servers;
-       int i;
-        u16 mtu;
+        u8 servers;
+        int i;
+        __be16 mtu;
 
 #ifdef IPCONFIG_DEBUG
         u8 *c;
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 43d4c3b22369..aea5a199c37a 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -140,13 +140,14 @@ static void ping_v4_unhash(struct sock *sk)
                 write_lock_bh(&ping_table.lock);
                 hlist_nulls_del(&sk->sk_nulls_node);
                 sock_put(sk);
-                isk->inet_num = isk->inet_sport = 0;
+                isk->inet_num = 0;
+                isk->inet_sport = 0;
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
                 write_unlock_bh(&ping_table.lock);
         }
 }
 
-static struct sock *ping_v4_lookup(struct net *net, u32 saddr, u32 daddr,
+static struct sock *ping_v4_lookup(struct net *net, __be32 saddr, __be32 daddr,
                                    u16 ident, int dif)
 {
         struct hlist_nulls_head *hslot = ping_hashslot(&ping_table, net, ident);
@@ -154,15 +155,15 @@ static struct sock *ping_v4_lookup(struct net *net, u32 saddr, u32 daddr,
         struct inet_sock *isk;
         struct hlist_nulls_node *hnode;
 
-        pr_debug("try to find: num = %d, daddr = %ld, dif = %d\n",
-                         (int)ident, (unsigned long)daddr, dif);
+        pr_debug("try to find: num = %d, daddr = %pI4, dif = %d\n",
+                         (int)ident, &daddr, dif);
         read_lock_bh(&ping_table.lock);
 
         ping_portaddr_for_each_entry(sk, hnode, hslot) {
                 isk = inet_sk(sk);
 
-                pr_debug("found: %p: num = %d, daddr = %ld, dif = %d\n", sk,
-                         (int)isk->inet_num, (unsigned long)isk->inet_rcv_saddr,
+                pr_debug("found: %p: num = %d, daddr = %pI4, dif = %d\n", sk,
+                         (int)isk->inet_num, &isk->inet_rcv_saddr,
                          sk->sk_bound_dev_if);
 
                 pr_debug("iterate\n");
@@ -254,7 +255,7 @@ static int ping_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 sk, addr->sin_addr.s_addr, ntohs(addr->sin_port));
 
         chk_addr_ret = inet_addr_type(sock_net(sk), addr->sin_addr.s_addr);
-        if (addr->sin_addr.s_addr == INADDR_ANY)
+        if (addr->sin_addr.s_addr == htonl(INADDR_ANY))
                 chk_addr_ret = RTN_LOCAL;
 
         if ((sysctl_ip_nonlocal_bind == 0 &&
@@ -278,9 +279,9 @@ static int ping_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 goto out;
         }
 
-        pr_debug("after bind(): num = %d, daddr = %ld, dif = %d\n",
+        pr_debug("after bind(): num = %d, daddr = %pI4, dif = %d\n",
                 (int)isk->inet_num,
-                (unsigned long) isk->inet_rcv_saddr,
+                &isk->inet_rcv_saddr,
                 (int)sk->sk_bound_dev_if);
 
         err = 0;
@@ -407,7 +408,7 @@ out:
 struct pingfakehdr {
         struct icmphdr icmph;
         struct iovec *iov;
-        u32 wcheck;
+        __wsum wcheck;
 };
 
 static int ping_getfrag(void *from, char * to,
@@ -459,7 +460,7 @@ static int ping_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct rtable *rt = NULL;
         struct ip_options_data opt_copy;
         int free = 0;
-        u32 saddr, daddr, faddr;
+        __be32 saddr, daddr, faddr;
         u8  tos;
         int err;
 
@@ -696,8 +697,8 @@ void ping_rcv(struct sk_buff *skb)
         struct net *net = dev_net(skb->dev);
         struct iphdr *iph = ip_hdr(skb);
         struct icmphdr *icmph = icmp_hdr(skb);
-        u32 saddr = iph->saddr;
-        u32 daddr = iph->daddr;
+        __be32 saddr = iph->saddr;
+        __be32 daddr = iph->daddr;
 
         /* We assume the packet has already been checked by icmp_rcv */
 
diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
index e5e18cb8a586..8a949f19deb6 100644
--- a/net/ipv4/udp_diag.c
+++ b/net/ipv4/udp_diag.c
@@ -15,7 +15,6 @@
 #include <linux/udp.h>
 #include <net/udp.h>
 #include <net/udplite.h>
-#include <linux/inet_diag.h>
 #include <linux/sock_diag.h>
 
 static int sk_diag_dump(struct sock *sk, struct sk_buff *skb,
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index ae08aee1773c..251e7cd75e89 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -575,7 +575,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
         }
         if (np->rxopt.bits.rxorigdstaddr) {
                 struct sockaddr_in6 sin6;
-                u16 *ports = (u16 *) skb_transport_header(skb);
+                __be16 *ports = (__be16 *) skb_transport_header(skb);
 
                 if (skb_transport_offset(skb) + 4 <= skb->len) {
                         /* All current transport protocols have the port numbers in the
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index fdeb6d03da81..da2e92d05c15 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -237,8 +237,8 @@ static int snmp6_dev_seq_show(struct seq_file *seq, void *v)
         struct inet6_dev *idev = (struct inet6_dev *)seq->private;
 
         seq_printf(seq, "%-32s\t%u\n", "ifIndex", idev->dev->ifindex);
-        snmp6_seq_show_item(seq, (void __percpu **)idev->stats.ipv6, NULL,
-                            snmp6_ipstats_list);
+        snmp6_seq_show_item64(seq, (void __percpu **)idev->stats.ipv6,
+                            snmp6_ipstats_list, offsetof(struct ipstats_mib, syncp));
         snmp6_seq_show_item(seq, NULL, idev->stats.icmpv6dev->mibs,
                             snmp6_icmp6_list);
         snmp6_seq_show_icmpv6msg(seq, idev->stats.icmpv6msgdev->mibs);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 07361dfa8085..8c2e3ab58f2a 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1091,6 +1091,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         else {
                 neigh = ip6_neigh_lookup(&rt->dst, &fl6->daddr);
                 if (IS_ERR(neigh)) {
+                        in6_dev_put(idev);
                         dst_free(&rt->dst);
                         return ERR_CAST(neigh);
                 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index e60df48fa4d4..296620d6ca0c 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -791,7 +791,7 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                 if (set & BIT(NL80211_STA_FLAG_AUTHORIZED))
                         ret = sta_info_move_state_checked(sta,
                                         IEEE80211_STA_AUTHORIZED);
-                else
+                else if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
                         ret = sta_info_move_state_checked(sta,
                                         IEEE80211_STA_ASSOC);
                 if (ret)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index f407427c642f..751409120769 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1979,6 +1979,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 mesh_path_error_tx(ifmsh->mshcfg.element_ttl, fwd_hdr->addr3,
                                     0, reason, fwd_hdr->addr2, sdata);
                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
+                kfree_skb(fwd_skb);
                 return RX_DROP_MONITOR;
         }
 
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 3c428d4839c7..ff11f6bf8266 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -238,9 +238,11 @@ static void sta_unblock(struct work_struct *wk)
         if (sta->dead)
                 return;
 
-        if (!test_sta_flag(sta, WLAN_STA_PS_STA))
+        if (!test_sta_flag(sta, WLAN_STA_PS_STA)) {
+                local_bh_disable();
                 ieee80211_sta_ps_deliver_wakeup(sta);
-        else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL)) {
+                local_bh_enable();
+        } else if (test_and_clear_sta_flag(sta, WLAN_STA_PSPOLL)) {
                 clear_sta_flag(sta, WLAN_STA_PS_DRIVER);
 
                 local_bh_disable();
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index edcd1c7ab83f..e05667cd5e76 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1001,8 +1001,6 @@ ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-
         if (!tx->key)
                 return TX_CONTINUE;
 
@@ -1017,13 +1015,7 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
         case WLAN_CIPHER_SUITE_AES_CMAC:
                 return ieee80211_crypto_aes_cmac_encrypt(tx);
         default:
-                /* handle hw-only algorithm */
-                if (info->control.hw_key) {
-                        ieee80211_tx_set_protected(tx);
-                        return TX_CONTINUE;
-                }
-                break;
-
+                return ieee80211_crypto_hw_encrypt(tx);
         }
 
         return TX_DROP;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 422b79851ec5..b758350919ff 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -643,3 +643,22 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)
 
         return RX_CONTINUE;
 }
+
+ieee80211_tx_result
+ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx)
+{
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *info = NULL;
+
+        skb_queue_walk(&tx->skbs, skb) {
+                info  = IEEE80211_SKB_CB(skb);
+
+                /* handle hw-only algorithm */
+                if (!info->control.hw_key)
+                        return TX_DROP;
+        }
+
+        ieee80211_tx_set_protected(tx);
+
+        return TX_CONTINUE;
+}
diff --git a/net/mac80211/wpa.h b/net/mac80211/wpa.h
index baba0608313e..07e33f899c71 100644
--- a/net/mac80211/wpa.h
+++ b/net/mac80211/wpa.h
@@ -32,5 +32,7 @@ ieee80211_tx_result
 ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx);
 ieee80211_rx_result
 ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx);
+ieee80211_tx_result
+ieee80211_crypto_hw_encrypt(struct ieee80211_tx_data *tx);
 
 #endif /* WPA_H */
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 86137b558f45..32dbf0fa89db 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -77,35 +77,42 @@ find_set_type(const char *name, u8 family, u8 revision)
 }
 
 /* Unlock, try to load a set type module and lock again */
-static int
-try_to_load_type(const char *name)
+static bool
+load_settype(const char *name)
 {
         nfnl_unlock();
         pr_debug("try to load ip_set_%s\n", name);
         if (request_module("ip_set_%s", name) < 0) {
                 pr_warning("Can't find ip_set type %s\n", name);
                 nfnl_lock();
-                return -IPSET_ERR_FIND_TYPE;
+                return false;
         }
         nfnl_lock();
-        return -EAGAIN;
+        return true;
 }
 
 /* Find a set type and reference it */
+#define find_set_type_get(name, family, revision, found)        \
+        __find_set_type_get(name, family, revision, found, false)
+
 static int
-find_set_type_get(const char *name, u8 family, u8 revision,
-                  struct ip_set_type **found)
+__find_set_type_get(const char *name, u8 family, u8 revision,
+                    struct ip_set_type **found, bool retry)
 {
         struct ip_set_type *type;
         int err;
 
+        if (retry && !load_settype(name))
+                return -IPSET_ERR_FIND_TYPE;
+
         rcu_read_lock();
         *found = find_set_type(name, family, revision);
         if (*found) {
                 err = !try_module_get((*found)->me) ? -EFAULT : 0;
                 goto unlock;
         }
-        /* Make sure the type is loaded but we don't support the revision */
+        /* Make sure the type is already loaded
+         * but we don't support the revision */
         list_for_each_entry_rcu(type, &ip_set_type_list, list)
                 if (STREQ(type->name, name)) {
                         err = -IPSET_ERR_FIND_TYPE;
@@ -113,7 +120,8 @@ find_set_type_get(const char *name, u8 family, u8 revision,
                 }
         rcu_read_unlock();
 
-        return try_to_load_type(name);
+        return retry ? -IPSET_ERR_FIND_TYPE :
+                __find_set_type_get(name, family, revision, found, true);
 
 unlock:
         rcu_read_unlock();
@@ -124,12 +132,19 @@ unlock:
  * If we succeeded, the supported minimal and maximum revisions are
  * filled out.
  */
+#define find_set_type_minmax(name, family, min, max) \
+        __find_set_type_minmax(name, family, min, max, false)
+
 static int
-find_set_type_minmax(const char *name, u8 family, u8 *min, u8 *max)
+__find_set_type_minmax(const char *name, u8 family, u8 *min, u8 *max,
+                       bool retry)
 {
         struct ip_set_type *type;
         bool found = false;
 
+        if (retry && !load_settype(name))
+                return -IPSET_ERR_FIND_TYPE;
+
         *min = 255; *max = 0;
         rcu_read_lock();
         list_for_each_entry_rcu(type, &ip_set_type_list, list)
@@ -145,7 +160,8 @@ find_set_type_minmax(const char *name, u8 family, u8 *min, u8 *max)
         if (found)
                 return 0;
 
-        return try_to_load_type(name);
+        return retry ? -IPSET_ERR_FIND_TYPE :
+                __find_set_type_minmax(name, family, min, max, true);
 }
 
 #define family_name(f)  ((f) == AF_INET ? "inet" : \
@@ -1126,6 +1142,7 @@ release_refcount:
         if (ret || !cb->args[2]) {
                 pr_debug("release set %s\n", ip_set_list[index]->name);
                 ip_set_put_byindex(index);
+                cb->args[2] = 0;
         }
 out:
         if (nlh) {
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 299fec91f741..bbe23baa19b6 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -121,18 +121,6 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
         int ret = 0;
 
         if (tmpl != NULL) {
-                /* we've got a userspace helper. */
-                if (tmpl->status & IPS_USERSPACE_HELPER) {
-                        help = nf_ct_helper_ext_add(ct, flags);
-                        if (help == NULL) {
-                                ret = -ENOMEM;
-                                goto out;
-                        }
-                        rcu_assign_pointer(help->helper, NULL);
-                        __set_bit(IPS_USERSPACE_HELPER_BIT, &ct->status);
-                        ret = 0;
-                        goto out;
-                }
                 help = nfct_help(tmpl);
                 if (help != NULL)
                         helper = help->helper;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 2a4834b83332..9307b033c0c9 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2042,10 +2042,6 @@ ctnetlink_create_expect(struct net *net, u16 zone,
         }
         help = nfct_help(ct);
         if (!help) {
-                err = -EOPNOTSUPP;
-                goto out;
-        }
-        if (test_bit(IPS_USERSPACE_HELPER_BIT, &ct->status)) {
                 if (!cda[CTA_EXPECT_TIMEOUT]) {
                         err = -EINVAL;
                         goto out;
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 8e87123f1373..0221d10de75a 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -62,8 +62,8 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par)
         int ret = 0;
         u8 proto;
 
-        if (info->flags & ~(XT_CT_NOTRACK | XT_CT_USERSPACE_HELPER))
-                return -EOPNOTSUPP;
+        if (info->flags & ~XT_CT_NOTRACK)
+                return -EINVAL;
 
         if (info->flags & XT_CT_NOTRACK) {
                 ct = nf_ct_untracked_get();
@@ -92,9 +92,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par)
                                   GFP_KERNEL))
                 goto err3;
 
-        if (info->flags & XT_CT_USERSPACE_HELPER) {
-                __set_bit(IPS_USERSPACE_HELPER_BIT, &ct->status);
-        } else if (info->helper[0]) {
+        if (info->helper[0]) {
                 ret = -ENOENT;
                 proto = xt_ct_find_proto(par);
                 if (!proto) {
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 8e4992101875..d95f9c963cde 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -445,7 +445,6 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
 {
         __be16 _ports[2], *ports;
         u8 nexthdr;
-        __be16 frag_off;
         int poff;
 
         memset(dst, 0, sizeof(*dst));
@@ -466,6 +465,9 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
                 break;
 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
         case NFPROTO_IPV6:
+        {
+                __be16 frag_off;
+
                 if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP) {
                         memcpy(&dst->ip6.dst, &ipv6_hdr(skb)->daddr,
                                sizeof(dst->ip6.dst));
@@ -485,6 +487,7 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
                 if ((int)protoff < 0)
                         return -1;
                 break;
+        }
 #endif
         default:
                 BUG();
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 9a2725114e99..ce64c18b8c79 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2011 Nicira Networks.
+ * Copyright (c) 2007-2012 Nicira Networks.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of version 2 of the GNU General Public
@@ -36,7 +36,6 @@
 #include <linux/rcupdate.h>
 #include <linux/tcp.h>
 #include <linux/udp.h>
-#include <linux/version.h>
 #include <linux/ethtool.h>
 #include <linux/wait.h>
 #include <asm/system.h>
@@ -1397,9 +1396,8 @@ static int ovs_dp_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int i = 0;
 
         list_for_each_entry(dp, &dps, list_node) {
-                if (i < skip)
-                        continue;
-                if (ovs_dp_cmd_fill_info(dp, skb, NETLINK_CB(cb->skb).pid,
+                if (i >= skip &&
+                    ovs_dp_cmd_fill_info(dp, skb, NETLINK_CB(cb->skb).pid,
                                          cb->nlh->nlmsg_seq, NLM_F_MULTI,
                                          OVS_DP_CMD_NEW) < 0)
                         break;
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index 5b9f884b7055..c73370cc1f02 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -25,7 +25,6 @@
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <linux/u64_stats_sync.h>
-#include <linux/version.h>
 
 #include "flow.h"
 
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index fe7f020a843e..1252c3081ef1 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -32,7 +32,6 @@
 #include <linux/in.h>
 #include <linux/rcupdate.h>
 #include <linux/if_arp.h>
-#include <linux/if_ether.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/tcp.h>
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 8fc28b86f2b3..322b8d206693 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -23,7 +23,6 @@
 #include <linux/etherdevice.h>
 #include <linux/ethtool.h>
 #include <linux/skbuff.h>
-#include <linux/version.h>
 
 #include "datapath.h"
 #include "vport-internal_dev.h"
diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c
index 7f0ef3794c51..6c066ba25dc7 100644
--- a/net/openvswitch/vport.c
+++ b/net/openvswitch/vport.c
@@ -27,7 +27,6 @@
 #include <linux/rcupdate.h>
 #include <linux/rtnetlink.h>
 #include <linux/compat.h>
-#include <linux/version.h>
 
 #include "vport.h"
 #include "vport-internal_dev.h"