Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Validate iov ranges before feeding them into iov_iter_init(), from
    Al Viro.

 2) We changed copy_from_msghdr_from_user() to zero out the msg_namelen
    is a NULL pointer is given for the msg_name.  Do the same in the
    compat code too.  From Catalin Marinas.

 3) Fix partially initialized tuples in netfilter conntrack helper, from
    Ian Wilson.

 4) Missing continue; statement in nft_hash walker can lead to crashes,
    from Herbert Xu.

 5) tproxy_tg6_check looks for IP6T_INV_PROTO in ->flags instead of
    ->invflags, fix from Pablo Neira Ayuso.

 6) Incorrect memory account of TCP FINs can result in negative socket
    memory accounting values.  Fix from Josh Hunt.

 7) Don't allow virtual functions to enable VLAN promiscuous mode in
    be2net driver, from Vasundhara Volam.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  netfilter: nft_compat: set IP6T_F_PROTO flag if protocol is set
  cx82310_eth: wait for firmware to become ready
  net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom
  net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour
  be2net: use PCI MMIO read instead of config read for errors
  be2net: restrict MODIFY_EQ_DELAY cmd to a max of 8 EQs
  be2net: Prevent VFs from enabling VLAN promiscuous mode
  tcp: fix tcp fin memory accounting
  ipv6: fix backtracking for throw routes
  net: ethernet: pcnet32: Setup the SRAM and NOUFLO on Am79C97{3, 5}
  ipv6: call ipv6_proxy_select_ident instead of ipv6_select_ident in udp6_ufo_fragment
  netfilter: xt_TPROXY: fix invflags check in tproxy_tg6_check()
  netfilter: restore rule tracing via nfnetlink_log
  netfilter: nf_tables: allow to change chain policy without hook if it exists
  netfilter: Fix potential crash in nft_hash walker
  netfilter: Zero the tuple in nfnl_cthelper_parse_tuple()

21 files changed, 238 insertions, 75 deletions

diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index 11d6e6561df1..15a8190a6f75 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1543,7 +1543,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
 {
         struct pcnet32_private *lp;
         int i, media;
-        int fdx, mii, fset, dxsuflo;
+        int fdx, mii, fset, dxsuflo, sram;
         int chip_version;
         char *chipname;
         struct net_device *dev;
@@ -1580,7 +1580,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
         }
 
         /* initialize variables */
-        fdx = mii = fset = dxsuflo = 0;
+        fdx = mii = fset = dxsuflo = sram = 0;
         chip_version = (chip_version >> 12) & 0xffff;
 
         switch (chip_version) {
@@ -1613,6 +1613,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 chipname = "PCnet/FAST III 79C973";     /* PCI */
                 fdx = 1;
                 mii = 1;
+                sram = 1;
                 break;
         case 0x2626:
                 chipname = "PCnet/Home 79C978"; /* PCI */
@@ -1636,6 +1637,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 chipname = "PCnet/FAST III 79C975";     /* PCI */
                 fdx = 1;
                 mii = 1;
+                sram = 1;
                 break;
         case 0x2628:
                 chipname = "PCnet/PRO 79C976";
@@ -1664,6 +1666,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
                 dxsuflo = 1;
         }
 
+        /*
+         * The Am79C973/Am79C975 controllers come with 12K of SRAM
+         * which we can use for the Tx/Rx buffers but most importantly,
+         * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
+         * Tx fifo underflows.
+         */
+        if (sram) {
+                /*
+                 * The SRAM is being configured in two steps. First we
+                 * set the SRAM size in the BCR25:SRAM_SIZE bits. According
+                 * to the datasheet, each bit corresponds to a 512-byte
+                 * page so we can have at most 24 pages. The SRAM_SIZE
+                 * holds the value of the upper 8 bits of the 16-bit SRAM size.
+                 * The low 8-bits start at 0x00 and end at 0xff. So the
+                 * address range is from 0x0000 up to 0x17ff. Therefore,
+                 * the SRAM_SIZE is set to 0x17. The next step is to set
+                 * the BCR26:SRAM_BND midway through so the Tx and Rx
+                 * buffers can share the SRAM equally.
+                 */
+                a->write_bcr(ioaddr, 25, 0x17);
+                a->write_bcr(ioaddr, 26, 0xc);
+                /* And finally enable the NOUFLO bit */
+                a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
+        }
+
         dev = alloc_etherdev(sizeof(*lp));
         if (!dev) {
                 ret = -ENOMEM;
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 27de37aa90af..27b9fe99a9bd 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -354,6 +354,7 @@ struct be_vf_cfg {
         u16 vlan_tag;
         u32 tx_rate;
         u32 plink_tracking;
+        u32 privileges;
 };
 
 enum vf_state {
@@ -423,6 +424,7 @@ struct be_adapter {
 
         u8 __iomem *csr;        /* CSR BAR used only for BE2/3 */
         u8 __iomem *db;         /* Door Bell */
+        u8 __iomem *pcicfg;     /* On SH,BEx only. Shadow of PCI config space */
 
         struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
         struct be_dma_mem mbox_mem;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 36916cfa70f9..7f05f309e935 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -1902,15 +1902,11 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 {
         int num_eqs, i = 0;
 
-        if (lancer_chip(adapter) && num > 8) {
-                while (num) {
-                        num_eqs = min(num, 8);
-                        __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
-                        i += num_eqs;
-                        num -= num_eqs;
-                }
-        } else {
-                __be_cmd_modify_eqd(adapter, set_eqd, num);
+        while (num) {
+                num_eqs = min(num, 8);
+                __be_cmd_modify_eqd(adapter, &set_eqd[i], num_eqs);
+                i += num_eqs;
+                num -= num_eqs;
         }
 
         return 0;
@@ -1918,7 +1914,7 @@ int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *set_eqd,
 
 /* Uses sycnhronous mcc */
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num)
+                       u32 num, u32 domain)
 {
         struct be_mcc_wrb *wrb;
         struct be_cmd_req_vlan_config *req;
@@ -1936,6 +1932,7 @@ int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
         be_wrb_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_COMMON,
                                OPCODE_COMMON_NTWK_VLAN_CONFIG, sizeof(*req),
                                wrb, NULL);
+        req->hdr.domain = domain;
 
         req->interface_id = if_id;
         req->untagged = BE_IF_FLAGS_UNTAGGED & be_if_cap_flags(adapter) ? 1 : 0;
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h
index db761e8e42a3..a7634a3f052a 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.h
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.h
@@ -2256,7 +2256,7 @@ int lancer_cmd_get_pport_stats(struct be_adapter *adapter,
 int be_cmd_get_fw_ver(struct be_adapter *adapter);
 int be_cmd_modify_eqd(struct be_adapter *adapter, struct be_set_eqd *, int num);
 int be_cmd_vlan_config(struct be_adapter *adapter, u32 if_id, u16 *vtag_array,
-                       u32 num);
+                       u32 num, u32 domain);
 int be_cmd_rx_filter(struct be_adapter *adapter, u32 flags, u32 status);
 int be_cmd_set_flow_control(struct be_adapter *adapter, u32 tx_fc, u32 rx_fc);
 int be_cmd_get_flow_control(struct be_adapter *adapter, u32 *tx_fc, u32 *rx_fc);
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 0a816859aca5..e6b790f0d9dc 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1171,7 +1171,7 @@ static int be_vid_config(struct be_adapter *adapter)
         for_each_set_bit(i, adapter->vids, VLAN_N_VID)
                 vids[num++] = cpu_to_le16(i);
 
-        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num);
+        status = be_cmd_vlan_config(adapter, adapter->if_handle, vids, num, 0);
         if (status) {
                 dev_err(dev, "Setting HW VLAN filtering failed\n");
                 /* Set to VLAN promisc mode as setting VLAN filter failed */
@@ -1380,11 +1380,67 @@ static int be_get_vf_config(struct net_device *netdev, int vf,
         return 0;
 }
 
+static int be_set_vf_tvt(struct be_adapter *adapter, int vf, u16 vlan)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        u16 vids[BE_NUM_VLANS_SUPPORTED];
+        int vf_if_id = vf_cfg->if_handle;
+        int status;
+
+        /* Enable Transparent VLAN Tagging */
+        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1, vf_if_id, 0);
+        if (status)
+                return status;
+
+        /* Clear pre-programmed VLAN filters on VF if any, if TVT is enabled */
+        vids[0] = 0;
+        status = be_cmd_vlan_config(adapter, vf_if_id, vids, 1, vf + 1);
+        if (!status)
+                dev_info(&adapter->pdev->dev,
+                         "Cleared guest VLANs on VF%d", vf);
+
+        /* After TVT is enabled, disallow VFs to program VLAN filters */
+        if (vf_cfg->privileges & BE_PRIV_FILTMGMT) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges &
+                                                  ~BE_PRIV_FILTMGMT, vf + 1);
+                if (!status)
+                        vf_cfg->privileges &= ~BE_PRIV_FILTMGMT;
+        }
+        return 0;
+}
+
+static int be_clear_vf_tvt(struct be_adapter *adapter, int vf)
+{
+        struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
+        struct device *dev = &adapter->pdev->dev;
+        int status;
+
+        /* Reset Transparent VLAN Tagging. */
+        status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID, vf + 1,
+                                       vf_cfg->if_handle, 0);
+        if (status)
+                return status;
+
+        /* Allow VFs to program VLAN filtering */
+        if (!(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
+                status = be_cmd_set_fn_privileges(adapter, vf_cfg->privileges |
+                                                  BE_PRIV_FILTMGMT, vf + 1);
+                if (!status) {
+                        vf_cfg->privileges |= BE_PRIV_FILTMGMT;
+                        dev_info(dev, "VF%d: FILTMGMT priv enabled", vf);
+                }
+        }
+
+        dev_info(dev,
+                 "Disable/re-enable i/f in VM to clear Transparent VLAN tag");
+        return 0;
+}
+
 static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
         struct be_vf_cfg *vf_cfg = &adapter->vf_cfg[vf];
-        int status = 0;
+        int status;
 
         if (!sriov_enabled(adapter))
                 return -EPERM;
@@ -1394,24 +1450,19 @@ static int be_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
 
         if (vlan || qos) {
                 vlan |= qos << VLAN_PRIO_SHIFT;
-                if (vf_cfg->vlan_tag != vlan)
-                        status = be_cmd_set_hsw_config(adapter, vlan, vf + 1,
-                                                       vf_cfg->if_handle, 0);
+                status = be_set_vf_tvt(adapter, vf, vlan);
         } else {
-                /* Reset Transparent Vlan Tagging. */
-                status = be_cmd_set_hsw_config(adapter, BE_RESET_VLAN_TAG_ID,
-                                               vf + 1, vf_cfg->if_handle, 0);
+                status = be_clear_vf_tvt(adapter, vf);
         }
 
         if (status) {
                 dev_err(&adapter->pdev->dev,
-                        "VLAN %d config on VF %d failed : %#x\n", vlan,
-                        vf, status);
+                        "VLAN %d config on VF %d failed : %#x\n", vlan, vf,
+                        status);
                 return be_cmd_status(status);
         }
 
         vf_cfg->vlan_tag = vlan;
-
         return 0;
 }
 
@@ -2772,14 +2823,12 @@ void be_detect_error(struct be_adapter *adapter)
                         }
                 }
         } else {
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_LOW, &ue_lo);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_HIGH, &ue_hi);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_LOW_MASK, &ue_lo_mask);
-                pci_read_config_dword(adapter->pdev,
-                                      PCICFG_UE_STATUS_HI_MASK, &ue_hi_mask);
+                ue_lo = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_LOW);
+                ue_hi = ioread32(adapter->pcicfg + PCICFG_UE_STATUS_HIGH);
+                ue_lo_mask = ioread32(adapter->pcicfg +
+                                      PCICFG_UE_STATUS_LOW_MASK);
+                ue_hi_mask = ioread32(adapter->pcicfg +
+                                      PCICFG_UE_STATUS_HI_MASK);
 
                 ue_lo = (ue_lo & ~ue_lo_mask);
                 ue_hi = (ue_hi & ~ue_hi_mask);
@@ -3339,7 +3388,6 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
                         u32 cap_flags, u32 vf)
 {
         u32 en_flags;
-        int status;
 
         en_flags = BE_IF_FLAGS_UNTAGGED | BE_IF_FLAGS_BROADCAST |
                    BE_IF_FLAGS_MULTICAST | BE_IF_FLAGS_PASS_L3L4_ERRORS |
@@ -3347,10 +3395,7 @@ static int be_if_create(struct be_adapter *adapter, u32 *if_handle,
 
         en_flags &= cap_flags;
 
-        status = be_cmd_if_create(adapter, cap_flags, en_flags,
-                                  if_handle, vf);
-
-        return status;
+        return be_cmd_if_create(adapter, cap_flags, en_flags, if_handle, vf);
 }
 
 static int be_vfs_if_create(struct be_adapter *adapter)
@@ -3368,8 +3413,13 @@ static int be_vfs_if_create(struct be_adapter *adapter)
                 if (!BE3_chip(adapter)) {
                         status = be_cmd_get_profile_config(adapter, &res,
                                                            vf + 1);
-                        if (!status)
+                        if (!status) {
                                 cap_flags = res.if_cap_flags;
+                                /* Prevent VFs from enabling VLAN promiscuous
+                                 * mode
+                                 */
+                                cap_flags &= ~BE_IF_FLAGS_VLAN_PROMISCUOUS;
+                        }
                 }
 
                 status = be_if_create(adapter, &vf_cfg->if_handle,
@@ -3403,7 +3453,6 @@ static int be_vf_setup(struct be_adapter *adapter)
         struct device *dev = &adapter->pdev->dev;
         struct be_vf_cfg *vf_cfg;
         int status, old_vfs, vf;
-        u32 privileges;
 
         old_vfs = pci_num_vf(adapter->pdev);
 
@@ -3433,15 +3482,18 @@ static int be_vf_setup(struct be_adapter *adapter)
 
         for_all_vfs(adapter, vf_cfg, vf) {
                 /* Allow VFs to programs MAC/VLAN filters */
-                status = be_cmd_get_fn_privileges(adapter, &privileges, vf + 1);
-                if (!status && !(privileges & BE_PRIV_FILTMGMT)) {
+                status = be_cmd_get_fn_privileges(adapter, &vf_cfg->privileges,
+                                                  vf + 1);
+                if (!status && !(vf_cfg->privileges & BE_PRIV_FILTMGMT)) {
                         status = be_cmd_set_fn_privileges(adapter,
-                                                          privileges |
+                                                          vf_cfg->privileges |
                                                           BE_PRIV_FILTMGMT,
                                                           vf + 1);
-                        if (!status)
+                        if (!status) {
+                                vf_cfg->privileges |= BE_PRIV_FILTMGMT;
                                 dev_info(dev, "VF%d has FILTMGMT privilege\n",
                                          vf);
+                        }
                 }
 
                 /* Allow full available bandwidth */
@@ -4820,24 +4872,37 @@ static int be_roce_map_pci_bars(struct be_adapter *adapter)
 
 static int be_map_pci_bars(struct be_adapter *adapter)
 {
+        struct pci_dev *pdev = adapter->pdev;
         u8 __iomem *addr;
 
         if (BEx_chip(adapter) && be_physfn(adapter)) {
-                adapter->csr = pci_iomap(adapter->pdev, 2, 0);
+                adapter->csr = pci_iomap(pdev, 2, 0);
                 if (!adapter->csr)
                         return -ENOMEM;
         }
 
-        addr = pci_iomap(adapter->pdev, db_bar(adapter), 0);
+        addr = pci_iomap(pdev, db_bar(adapter), 0);
         if (!addr)
                 goto pci_map_err;
         adapter->db = addr;
 
+        if (skyhawk_chip(adapter) || BEx_chip(adapter)) {
+                if (be_physfn(adapter)) {
+                        /* PCICFG is the 2nd BAR in BE2 */
+                        addr = pci_iomap(pdev, BE2_chip(adapter) ? 1 : 0, 0);
+                        if (!addr)
+                                goto pci_map_err;
+                        adapter->pcicfg = addr;
+                } else {
+                        adapter->pcicfg = adapter->db + SRIOV_VF_PCICFG_OFFSET;
+                }
+        }
+
         be_roce_map_pci_bars(adapter);
         return 0;
 
 pci_map_err:
-        dev_err(&adapter->pdev->dev, "Error in mapping PCI BARs\n");
+        dev_err(&pdev->dev, "Error in mapping PCI BARs\n");
         be_unmap_pci_bars(adapter);
         return -ENOMEM;
 }
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index fe48f4c51373..1762ad3910b2 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -46,8 +46,7 @@ enum cx82310_status {
 };
 
 #define CMD_PACKET_SIZE 64
-/* first command after power on can take around 8 seconds */
-#define CMD_TIMEOUT     15000
+#define CMD_TIMEOUT     100
 #define CMD_REPLY_RETRY 5
 
 #define CX82310_MTU     1514
@@ -78,8 +77,9 @@ static int cx82310_cmd(struct usbnet *dev, enum cx82310_cmd cmd, bool reply,
         ret = usb_bulk_msg(udev, usb_sndbulkpipe(udev, CMD_EP), buf,
                            CMD_PACKET_SIZE, &actual_len, CMD_TIMEOUT);
         if (ret < 0) {
-                dev_err(&dev->udev->dev, "send command %#x: error %d\n",
-                        cmd, ret);
+                if (cmd != CMD_GET_LINK_STATUS)
+                        dev_err(&dev->udev->dev, "send command %#x: error %d\n",
+                                cmd, ret);
                 goto end;
         }
 
@@ -90,8 +90,10 @@ static int cx82310_cmd(struct usbnet *dev, enum cx82310_cmd cmd, bool reply,
                                            buf, CMD_PACKET_SIZE, &actual_len,
                                            CMD_TIMEOUT);
                         if (ret < 0) {
-                                dev_err(&dev->udev->dev,
-                                        "reply receive error %d\n", ret);
+                                if (cmd != CMD_GET_LINK_STATUS)
+                                        dev_err(&dev->udev->dev,
+                                                "reply receive error %d\n",
+                                                ret);
                                 goto end;
                         }
                         if (actual_len > 0)
@@ -134,6 +136,8 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
         int ret;
         char buf[15];
         struct usb_device *udev = dev->udev;
+        u8 link[3];
+        int timeout = 50;
 
         /* avoid ADSL modems - continue only if iProduct is "USB NET CARD" */
         if (usb_string(udev, udev->descriptor.iProduct, buf, sizeof(buf)) > 0
@@ -160,6 +164,20 @@ static int cx82310_bind(struct usbnet *dev, struct usb_interface *intf)
         if (!dev->partial_data)
                 return -ENOMEM;
 
+        /* wait for firmware to become ready (indicated by the link being up) */
+        while (--timeout) {
+                ret = cx82310_cmd(dev, CMD_GET_LINK_STATUS, true, NULL, 0,
+                                  link, sizeof(link));
+                /* the command can time out during boot - it's not an error */
+                if (!ret && link[0] == 1 && link[2] == 1)
+                        break;
+                msleep(500);
+        };
+        if (!timeout) {
+                dev_err(&udev->dev, "firmware not ready in time\n");
+                return -ETIMEDOUT;
+        }
+
         /* enable ethernet mode (?) */
         ret = cx82310_cmd(dev, CMD_ETHERNET_MODE, true, "\x01", 1, NULL, 0);
         if (ret) {
diff --git a/include/net/netfilter/nf_log.h b/include/net/netfilter/nf_log.h
index 534e1f2ac4fc..57639fca223a 100644
--- a/include/net/netfilter/nf_log.h
+++ b/include/net/netfilter/nf_log.h
@@ -79,6 +79,16 @@ void nf_log_packet(struct net *net,
                    const struct nf_loginfo *li,
                    const char *fmt, ...);
 
+__printf(8, 9)
+void nf_log_trace(struct net *net,
+                  u_int8_t pf,
+                  unsigned int hooknum,
+                  const struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  const struct nf_loginfo *li,
+                  const char *fmt, ...);
+
 struct nf_log_buf;
 
 struct nf_log_buf *nf_log_buf_open(void);
diff --git a/net/compat.c b/net/compat.c
index 94d3d5e97883..f7bd286a8280 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -49,6 +49,13 @@ ssize_t get_compat_msghdr(struct msghdr *kmsg,
             __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
             __get_user(kmsg->msg_flags, &umsg->msg_flags))
                 return -EFAULT;
+
+        if (!uaddr)
+                kmsg->msg_namelen = 0;
+
+        if (kmsg->msg_namelen < 0)
+                return -EINVAL;
+
         if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
                 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
         kmsg->msg_control = compat_ptr(tmp3);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 99e810f84671..cf5e82f39d3b 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -272,9 +272,9 @@ static void trace_packet(const struct sk_buff *skb,
                     &chainname, &comment, &rulenum) != 0)
                         break;
 
-        nf_log_packet(net, AF_INET, hook, skb, in, out, &trace_loginfo,
-                      "TRACE: %s:%s:%s:%u ",
-                      tablename, chainname, comment, rulenum);
+        nf_log_trace(net, AF_INET, hook, skb, in, out, &trace_loginfo,
+                     "TRACE: %s:%s:%s:%u ",
+                     tablename, chainname, comment, rulenum);
 }
 #endif
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a2a796c5536b..1db253e36045 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2773,15 +2773,11 @@ void tcp_send_fin(struct sock *sk)
         } else {
                 /* Socket is locked, keep trying until memory is available. */
                 for (;;) {
-                        skb = alloc_skb_fclone(MAX_TCP_HEADER,
-                                               sk->sk_allocation);
+                        skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
                         if (skb)
                                 break;
                         yield();
                 }
-
-                /* Reserve space for headers and prepare control bits. */
-                skb_reserve(skb, MAX_TCP_HEADER);
                 /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
                 tcp_init_nondata_skb(skb, tp->write_seq,
                                      TCPHDR_ACK | TCPHDR_FIN);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index b4d5e1d97c1b..27ca79682efb 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -104,6 +104,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                                 goto again;
                         flp6->saddr = saddr;
                 }
+                err = rt->dst.error;
                 goto out;
         }
 again:
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index e080fbbbc0e5..bb00c6f2a885 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -298,9 +298,9 @@ static void trace_packet(const struct sk_buff *skb,
                     &chainname, &comment, &rulenum) != 0)
                         break;
 
-        nf_log_packet(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
-                      "TRACE: %s:%s:%s:%u ",
-                      tablename, chainname, comment, rulenum);
+        nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,
+                     "TRACE: %s:%s:%s:%u ",
+                     tablename, chainname, comment, rulenum);
 }
 #endif
 
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index ab889bb16b3c..be2c0ba82c85 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -112,11 +112,9 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
                 fptr->nexthdr = nexthdr;
                 fptr->reserved = 0;
-                if (skb_shinfo(skb)->ip6_frag_id)
-                        fptr->identification = skb_shinfo(skb)->ip6_frag_id;
-                else
-                        ipv6_select_ident(fptr,
-                                          (struct rt6_info *)skb_dst(skb));
+                if (!skb_shinfo(skb)->ip6_frag_id)
+                        ipv6_proxy_select_ident(skb);
+                fptr->identification = skb_shinfo(skb)->ip6_frag_id;
 
                 /* Fragment the skb. ipv6 header and the remaining fields of the
                  * fragment header are updated in ipv6_gso_segment()
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 0d8448f19dfe..675d12c69e32 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -212,6 +212,30 @@ void nf_log_packet(struct net *net,
 }
 EXPORT_SYMBOL(nf_log_packet);
 
+void nf_log_trace(struct net *net,
+                  u_int8_t pf,
+                  unsigned int hooknum,
+                  const struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  const struct nf_loginfo *loginfo, const char *fmt, ...)
+{
+        va_list args;
+        char prefix[NF_LOG_PREFIXLEN];
+        const struct nf_logger *logger;
+
+        rcu_read_lock();
+        logger = rcu_dereference(net->nf.nf_loggers[pf]);
+        if (logger) {
+                va_start(args, fmt);
+                vsnprintf(prefix, sizeof(prefix), fmt, args);
+                va_end(args);
+                logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix);
+        }
+        rcu_read_unlock();
+}
+EXPORT_SYMBOL(nf_log_trace);
+
 #define S_SIZE (1024 - (sizeof(unsigned int) + 1))
 
 struct nf_log_buf {
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 6ab777912237..ac1a9528dbf2 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1225,7 +1225,10 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
 
         if (nla[NFTA_CHAIN_POLICY]) {
                 if ((chain != NULL &&
-                    !(chain->flags & NFT_BASE_CHAIN)) ||
+                    !(chain->flags & NFT_BASE_CHAIN)))
+                        return -EOPNOTSUPP;
+
+                if (chain == NULL &&
                     nla[NFTA_CHAIN_HOOK] == NULL)
                         return -EOPNOTSUPP;
 
diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 3b90eb2b2c55..2d298dccb6dd 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -94,10 +94,10 @@ static void nft_trace_packet(const struct nft_pktinfo *pkt,
 {
         struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);
 
-        nf_log_packet(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
-                      pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
-                      chain->table->name, chain->name, comments[type],
-                      rulenum);
+        nf_log_trace(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,
+                     pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",
+                     chain->table->name, chain->name, comments[type],
+                     rulenum);
 }
 
 unsigned int
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index a5599fc51a6f..54330fb5efaf 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -77,6 +77,9 @@ nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple *tuple,
         if (!tb[NFCTH_TUPLE_L3PROTONUM] || !tb[NFCTH_TUPLE_L4PROTONUM])
                 return -EINVAL;
 
+        /* Not all fields are initialized so first zero the tuple */
+        memset(tuple, 0, sizeof(struct nf_conntrack_tuple));
+
         tuple->src.l3num = ntohs(nla_get_be16(tb[NFCTH_TUPLE_L3PROTONUM]));
         tuple->dst.protonum = nla_get_u8(tb[NFCTH_TUPLE_L4PROTONUM]);
 
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 213584cf04b3..65f3e2b6be44 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -133,6 +133,9 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                 entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
                 break;
         case AF_INET6:
+                if (proto)
+                        entry->e6.ipv6.flags |= IP6T_F_PROTO;
+
                 entry->e6.ipv6.proto = proto;
                 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                 break;
@@ -344,6 +347,9 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                 entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0;
                 break;
         case AF_INET6:
+                if (proto)
+                        entry->e6.ipv6.flags |= IP6T_F_PROTO;
+
                 entry->e6.ipv6.proto = proto;
                 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                 break;
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index c82df0a48fcd..37c15e674884 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -153,6 +153,8 @@ static void nft_hash_walk(const struct nft_ctx *ctx, const struct nft_set *set,
                                 iter->err = err;
                                 goto out;
                         }
+
+                        continue;
                 }
 
                 if (iter->count < iter->skip)
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index ef8a926752a9..50e1e5aaf4ce 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -513,8 +513,8 @@ static int tproxy_tg6_check(const struct xt_tgchk_param *par)
 {
         const struct ip6t_ip6 *i = par->entryinfo;
 
-        if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP)
-            && !(i->flags & IP6T_INV_PROTO))
+        if ((i->proto == IPPROTO_TCP || i->proto == IPPROTO_UDP) &&
+            !(i->invflags & IP6T_INV_PROTO))
                 return 0;
 
         pr_info("Can be used only in combination with "
diff --git a/net/socket.c b/net/socket.c
index bbedbfcb42c2..245330ca0015 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1702,6 +1702,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
 
         if (len > INT_MAX)
                 len = INT_MAX;
+        if (unlikely(!access_ok(VERIFY_READ, buff, len)))
+                return -EFAULT;
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
                 goto out;
@@ -1760,6 +1762,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
 
         if (size > INT_MAX)
                 size = INT_MAX;
+        if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
+                return -EFAULT;
         sock = sockfd_lookup_light(fd, &err, &fput_needed);
         if (!sock)
                 goto out;