Merge tag 'v3.11-rc7' into devicetree/next

Linux 3.11-rc7
author: Grant Likely <grant.likely@linaro.org> 2013-08-28 15:18:13 -0400
committer: Grant Likely <grant.likely@linaro.org> 2013-08-28 15:18:13 -0400
commit: 8be137f2664f0abb096626a9d2ce0fcdd955b109 (patch)
tree: 2c53a5535265a58eb397d6fbbab2ec26e92e6931 /net
parent: 8851b9f1625ce0858e9b1bb0ae4a57d4b43178b1 (diff)
parent: d8dfad3876e4386666b759da3c833d62fb8b2267 (diff)
91 files changed, 763 insertions, 428 deletions
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 4a78c4de9f20..6ee48aac776f 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -91,7 +91,12 @@ EXPORT_SYMBOL(__vlan_find_dev_deep);
 struct net_device *vlan_dev_real_dev(const struct net_device *dev)
 {
-        return vlan_dev_priv(dev)->real_dev;
+        struct net_device *ret = vlan_dev_priv(dev)->real_dev;
+        while (is_vlan_dev(ret))
+                ret = vlan_dev_priv(ret)->real_dev;
+        return ret;
 }
 EXPORT_SYMBOL(vlan_dev_real_dev);
diff --git a/net/Kconfig b/net/Kconfig
index 37702491abe9..2b406608a1a4 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -244,7 +244,7 @@ config NETPRIO_CGROUP
          Cgroup subsystem for use in assigning processes to network priorities on
          a per-interface basis
-config NET_LL_RX_POLL
+config NET_RX_BUSY_POLL
        boolean
        default y
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index e14531f1ce1c..264de88db320 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -1529,6 +1529,8 @@ out:
 * in these cases, the skb is further handled by this function and
 * returns 1, otherwise it returns 0 and the caller shall further
 * process the skb.
+ *
+ * This call might reallocate skb data.
 */
 int batadv_bla_tx(struct batadv_priv *bat_priv, struct sk_buff *skb,
                  unsigned short vid)
diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
index f105219f4a4b..7614af31daff 100644
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -508,6 +508,7 @@ out:
        return 0;
 }
+/* this call might reallocate skb data */
 static bool batadv_is_type_dhcprequest(struct sk_buff *skb, int header_len)
 {
        int ret = false;
@@ -568,6 +569,7 @@ out:
        return ret;
 }
+/* this call might reallocate skb data */
 bool batadv_gw_is_dhcp_target(struct sk_buff *skb, unsigned int *header_len)
 {
        struct ethhdr *ethhdr;
@@ -619,6 +621,12 @@ bool batadv_gw_is_dhcp_target(struct sk_buff *skb, unsigned int *header_len)
        if (!pskb_may_pull(skb, *header_len + sizeof(*udphdr)))
                return false;
+        /* skb->data might have been reallocated by pskb_may_pull() */
+        ethhdr = (struct ethhdr *)skb->data;
+        if (ntohs(ethhdr->h_proto) == ETH_P_8021Q)
+                ethhdr = (struct ethhdr *)(skb->data + VLAN_HLEN);
        udphdr = (struct udphdr *)(skb->data + *header_len);
        *header_len += sizeof(*udphdr);
@@ -634,12 +642,14 @@ bool batadv_gw_is_dhcp_target(struct sk_buff *skb, unsigned int *header_len)
        return true;
 }
+/* this call might reallocate skb data */
 bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
-                            struct sk_buff *skb, struct ethhdr *ethhdr)
+                            struct sk_buff *skb)
 {
        struct batadv_neigh_node *neigh_curr = NULL, *neigh_old = NULL;
        struct batadv_orig_node *orig_dst_node = NULL;
        struct batadv_gw_node *curr_gw = NULL;
+        struct ethhdr *ethhdr;
        bool ret, out_of_range = false;
        unsigned int header_len = 0;
        uint8_t curr_tq_avg;
@@ -648,6 +658,7 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
        if (!ret)
                goto out;
+        ethhdr = (struct ethhdr *)skb->data;
        orig_dst_node = batadv_transtable_search(bat_priv, ethhdr->h_source,
                                                 ethhdr->h_dest);
        if (!orig_dst_node)
diff --git a/net/batman-adv/gateway_client.h b/net/batman-adv/gateway_client.h
index 039902dca4a6..1037d75da51f 100644
--- a/net/batman-adv/gateway_client.h
+++ b/net/batman-adv/gateway_client.h
@@ -34,7 +34,6 @@ void batadv_gw_node_delete(struct batadv_priv *bat_priv,
 void batadv_gw_node_purge(struct batadv_priv *bat_priv);
 int batadv_gw_client_seq_print_text(struct seq_file *seq, void *offset);
 bool batadv_gw_is_dhcp_target(struct sk_buff *skb, unsigned int *header_len);
-bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
+bool batadv_gw_out_of_range(struct batadv_priv *bat_priv, struct sk_buff *skb);
-                            struct sk_buff *skb, struct ethhdr *ethhdr);
 #endif /* _NET_BATMAN_ADV_GATEWAY_CLIENT_H_ */
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 700d0b49742d..0f04e1c302b4 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -180,6 +180,9 @@ static int batadv_interface_tx(struct sk_buff *skb,
        if (batadv_bla_tx(bat_priv, skb, vid))
                goto dropped;
+        /* skb->data might have been reallocated by batadv_bla_tx() */
+        ethhdr = (struct ethhdr *)skb->data;
        /* Register the client MAC in the transtable */
        if (!is_multicast_ether_addr(ethhdr->h_source))
                batadv_tt_local_add(soft_iface, ethhdr->h_source, skb->skb_iif);
@@ -220,6 +223,10 @@ static int batadv_interface_tx(struct sk_buff *skb,
                default:
                        break;
                }
+                /* reminder: ethhdr might have become unusable from here on
+                 * (batadv_gw_is_dhcp_target() might have reallocated skb data)
+                 */
        }
        /* ethernet packet should be broadcasted */
@@ -266,7 +273,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
        /* unicast packet */
        } else {
                if (atomic_read(&bat_priv->gw_mode) != BATADV_GW_MODE_OFF) {
-                        ret = batadv_gw_out_of_range(bat_priv, skb, ethhdr);
+                        ret = batadv_gw_out_of_range(bat_priv, skb);
                        if (ret)
                                goto dropped;
                }
diff --git a/net/batman-adv/unicast.c b/net/batman-adv/unicast.c
index dc8b5d4dd636..857e1b8349ee 100644
--- a/net/batman-adv/unicast.c
+++ b/net/batman-adv/unicast.c
@@ -326,7 +326,9 @@ static bool batadv_unicast_push_and_fill_skb(struct sk_buff *skb, int hdr_size,
 * @skb: the skb containing the payload to encapsulate
 * @orig_node: the destination node
 *
- * Returns false if the payload could not be encapsulated or true otherwise
+ * Returns false if the payload could not be encapsulated or true otherwise.
+ *
+ * This call might reallocate skb data.
 */
 static bool batadv_unicast_prepare_skb(struct sk_buff *skb,
                                       struct batadv_orig_node *orig_node)
@@ -343,7 +345,9 @@ static bool batadv_unicast_prepare_skb(struct sk_buff *skb,
 * @orig_node: the destination node
 * @packet_subtype: the batman 4addr packet subtype to use
 *
- * Returns false if the payload could not be encapsulated or true otherwise
+ * Returns false if the payload could not be encapsulated or true otherwise.
+ *
+ * This call might reallocate skb data.
 */
 bool batadv_unicast_4addr_prepare_skb(struct batadv_priv *bat_priv,
                                      struct sk_buff *skb,
@@ -401,7 +405,7 @@ int batadv_unicast_generic_send_skb(struct batadv_priv *bat_priv,
        struct batadv_neigh_node *neigh_node;
        int data_len = skb->len;
        int ret = NET_RX_DROP;
-        unsigned int dev_mtu;
+        unsigned int dev_mtu, header_len;
        /* get routing information */
        if (is_multicast_ether_addr(ethhdr->h_dest)) {
@@ -428,11 +432,17 @@ find_router:
        switch (packet_type) {
        case BATADV_UNICAST:
-                batadv_unicast_prepare_skb(skb, orig_node);
+                if (!batadv_unicast_prepare_skb(skb, orig_node))
+                        goto out;
+                header_len = sizeof(struct batadv_unicast_packet);
                break;
        case BATADV_UNICAST_4ADDR:
-                batadv_unicast_4addr_prepare_skb(bat_priv, skb, orig_node,
+                if (!batadv_unicast_4addr_prepare_skb(bat_priv, skb, orig_node,
-                                                 packet_subtype);
+                                                      packet_subtype))
+                        goto out;
+                header_len = sizeof(struct batadv_unicast_4addr_packet);
                break;
        default:
                /* this function supports UNICAST and UNICAST_4ADDR only. It
@@ -441,6 +451,7 @@ find_router:
                goto out;
        }
+        ethhdr = (struct ethhdr *)(skb->data + header_len);
        unicast_packet = (struct batadv_unicast_packet *)skb->data;
        /* inform the destination node that we are still missing a correct route
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index e3a349977595..cc27297da5a9 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -513,7 +513,10 @@ static void hci_init2_req(struct hci_request *req, unsigned long opt)
        hci_setup_event_mask(req);
-        if (hdev->hci_ver > BLUETOOTH_VER_1_1)
+        /* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
+         * local supported commands HCI command.
+         */
+        if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
                hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
        if (lmp_ssp_capable(hdev)) {
@@ -2165,10 +2168,6 @@ int hci_register_dev(struct hci_dev *hdev)
        BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
-        write_lock(&hci_dev_list_lock);
-        list_add(&hdev->list, &hci_dev_list);
-        write_unlock(&hci_dev_list_lock);
        hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
                                          WQ_MEM_RECLAIM, 1, hdev->name);
        if (!hdev->workqueue) {
@@ -2203,6 +2202,10 @@ int hci_register_dev(struct hci_dev *hdev)
        if (hdev->dev_type != HCI_AMP)
                set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
+        write_lock(&hci_dev_list_lock);
+        list_add(&hdev->list, &hci_dev_list);
+        write_unlock(&hci_dev_list_lock);
        hci_notify(hdev, HCI_DEV_REG);
        hci_dev_hold(hdev);
@@ -2215,9 +2218,6 @@ err_wqueue:
        destroy_workqueue(hdev->req_workqueue);
 err:
        ida_simple_remove(&hci_index_ida, hdev->id);
-        write_lock(&hci_dev_list_lock);
-        list_del(&hdev->list);
-        write_unlock(&hci_dev_list_lock);
        return error;
 }
@@ -3399,8 +3399,16 @@ void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
         */
        if (hdev->sent_cmd) {
                req_complete = bt_cb(hdev->sent_cmd)->req.complete;
-                if (req_complete)
+                if (req_complete) {
+                        /* We must set the complete callback to NULL to
+                         * avoid calling the callback more than once if
+                         * this function gets called again.
+                         */
+                        bt_cb(hdev->sent_cmd)->req.complete = NULL;
                        goto call_complete;
+                }
        }
        /* Remove all pending commands belonging to this request */
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 2ef66781fedb..69363bd37f64 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -70,7 +70,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
                }
                mdst = br_mdb_get(br, skb, vid);
-                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))
+                if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
+                    br_multicast_querier_exists(br))
                        br_multicast_deliver(mdst, skb);
                else
                        br_flood_deliver(br, skb, false);
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 60aca9109a50..ffd5874f2592 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -161,7 +161,7 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
        if (!pv)
                return;
-        for_each_set_bit_from(vid, pv->vlan_bitmap, BR_VLAN_BITMAP_LEN) {
+        for_each_set_bit_from(vid, pv->vlan_bitmap, VLAN_N_VID) {
                f = __br_fdb_get(br, br->dev->dev_addr, vid);
                if (f && f->is_local && !f->dst)
                        fdb_delete(br, f);
@@ -730,7 +730,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                /* VID was specified, so use it. */
                err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
        } else {
-                if (!pv || bitmap_empty(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN)) {
+                if (!pv || bitmap_empty(pv->vlan_bitmap, VLAN_N_VID)) {
                        err = __br_fdb_add(ndm, p, addr, nlh_flags, 0);
                        goto out;
                }
@@ -739,7 +739,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 * specify a VLAN.  To be nice, add/update entry for every
                 * vlan on this port.
                 */
-                for_each_set_bit(vid, pv->vlan_bitmap, BR_VLAN_BITMAP_LEN) {
+                for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID) {
                        err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
                        if (err)
                                goto out;
@@ -817,7 +817,7 @@ int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
                err = __br_fdb_delete(p, addr, vid);
        } else {
-                if (!pv || bitmap_empty(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN)) {
+                if (!pv || bitmap_empty(pv->vlan_bitmap, VLAN_N_VID)) {
                        err = __br_fdb_delete(p, addr, 0);
                        goto out;
                }
@@ -827,7 +827,7 @@ int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
                 * vlan on this port.
                 */
                err = -ENOENT;
-                for_each_set_bit(vid, pv->vlan_bitmap, BR_VLAN_BITMAP_LEN) {
+                for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID) {
                        err &= __br_fdb_delete(p, addr, vid);
                }
        }
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 1b8b8b824cd7..8c561c0aa636 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -101,7 +101,8 @@ int br_handle_frame_finish(struct sk_buff *skb)
                unicast = false;
        } else if (is_multicast_ether_addr(dest)) {
                mdst = br_mdb_get(br, skb, vid);
-                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) {
+                if ((mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) &&
+                    br_multicast_querier_exists(br)) {
                        if ((mdst && mdst->mglist) ||
                            br_multicast_is_router(br))
                                skb2 = skb;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 69af490cce44..08e576ada0b2 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -619,6 +619,9 @@ rehash:
        mp->br = br;
        mp->addr = *group;
+        setup_timer(&mp->timer, br_multicast_group_expired,
+                    (unsigned long)mp);
        hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
        mdb->size++;
@@ -1011,6 +1014,16 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
 }
 #endif
+static void br_multicast_update_querier_timer(struct net_bridge *br,
+                                              unsigned long max_delay)
+{
+        if (!timer_pending(&br->multicast_querier_timer))
+                br->multicast_querier_delay_time = jiffies + max_delay;
+        mod_timer(&br->multicast_querier_timer,
+                  jiffies + br->multicast_querier_interval);
+}
 /*
 * Add port to router_list
 *  list is maintained ordered by pointer value
@@ -1061,11 +1074,11 @@ timer:
 static void br_multicast_query_received(struct net_bridge *br,
                                        struct net_bridge_port *port,
-                                        int saddr)
+                                        int saddr,
+                                        unsigned long max_delay)
 {
        if (saddr)
-                mod_timer(&br->multicast_querier_timer,
+                br_multicast_update_querier_timer(br, max_delay);
-                          jiffies + br->multicast_querier_interval);
        else if (timer_pending(&br->multicast_querier_timer))
                return;
@@ -1093,8 +1106,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
            (port && port->state == BR_STATE_DISABLED))
                goto out;
-        br_multicast_query_received(br, port, !!iph->saddr);
        group = ih->group;
        if (skb->len == sizeof(*ih)) {
@@ -1118,6 +1129,8 @@ static int br_ip4_multicast_query(struct net_bridge *br,
                            IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
        }
+        br_multicast_query_received(br, port, !!iph->saddr, max_delay);
        if (!group)
                goto out;
@@ -1126,7 +1139,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
        if (!mp)
                goto out;
-        setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
        mod_timer(&mp->timer, now + br->multicast_membership_interval);
        mp->timer_armed = true;
@@ -1174,8 +1186,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
            (port && port->state == BR_STATE_DISABLED))
                goto out;
-        br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr));
        if (skb->len == sizeof(*mld)) {
                if (!pskb_may_pull(skb, sizeof(*mld))) {
                        err = -EINVAL;
@@ -1185,7 +1195,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                max_delay = msecs_to_jiffies(ntohs(mld->mld_maxdelay));
                if (max_delay)
                        group = &mld->mld_mca;
-        } else if (skb->len >= sizeof(*mld2q)) {
+        } else {
                if (!pskb_may_pull(skb, sizeof(*mld2q))) {
                        err = -EINVAL;
                        goto out;
@@ -1196,6 +1206,9 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(ntohs(mld2q->mld2q_mrc)) : 1;
        }
+        br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr),
+                                    max_delay);
        if (!group)
                goto out;
@@ -1204,7 +1217,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
        if (!mp)
                goto out;
-        setup_timer(&mp->timer, br_multicast_group_expired, (unsigned long)mp);
        mod_timer(&mp->timer, now + br->multicast_membership_interval);
        mp->timer_armed = true;
@@ -1642,6 +1654,8 @@ void br_multicast_init(struct net_bridge *br)
        br->multicast_querier_interval = 255 * HZ;
        br->multicast_membership_interval = 260 * HZ;
+        br->multicast_querier_delay_time = 0;
        spin_lock_init(&br->multicast_lock);
        setup_timer(&br->multicast_router_timer,
                    br_multicast_local_router_expired, 0);
@@ -1830,6 +1844,8 @@ unlock:
 int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
 {
+        unsigned long max_delay;
        val = !!val;
        spin_lock_bh(&br->multicast_lock);
@@ -1837,8 +1853,14 @@ int br_multicast_set_querier(struct net_bridge *br, unsigned long val)
                goto unlock;
        br->multicast_querier = val;
-        if (val)
+        if (!val)
-                br_multicast_start_querier(br);
+                goto unlock;
+        max_delay = br->multicast_query_response_interval;
+        if (!timer_pending(&br->multicast_querier_timer))
+                br->multicast_querier_delay_time = jiffies + max_delay;
+        br_multicast_start_querier(br);
 unlock:
        spin_unlock_bh(&br->multicast_lock);
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 1fc30abd3a52..b9259efa636e 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -132,7 +132,7 @@ static int br_fill_ifinfo(struct sk_buff *skb,
                else
                        pv = br_get_vlan_info(br);
-                if (!pv || bitmap_empty(pv->vlan_bitmap, BR_VLAN_BITMAP_LEN))
+                if (!pv || bitmap_empty(pv->vlan_bitmap, VLAN_N_VID))
                        goto done;
                af = nla_nest_start(skb, IFLA_AF_SPEC);
@@ -140,7 +140,7 @@ static int br_fill_ifinfo(struct sk_buff *skb,
                        goto nla_put_failure;
                pvid = br_get_pvid(pv);
-                for_each_set_bit(vid, pv->vlan_bitmap, BR_VLAN_BITMAP_LEN) {
+                for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID) {
                        vinfo.vid = vid;
                        vinfo.flags = 0;
                        if (vid == pvid)
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 3be89b3ce17b..2f7da41851bf 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -267,6 +267,7 @@ struct net_bridge
        unsigned long                   multicast_query_interval;
        unsigned long                   multicast_query_response_interval;
        unsigned long                   multicast_startup_query_interval;
+        unsigned long                   multicast_querier_delay_time;
        spinlock_t                      multicast_lock;
        struct net_bridge_mdb_htable __rcu *mdb;
@@ -501,6 +502,13 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
               (br->multicast_router == 1 &&
                timer_pending(&br->multicast_router_timer));
 }
+static inline bool br_multicast_querier_exists(struct net_bridge *br)
+{
+        return time_is_before_jiffies(br->multicast_querier_delay_time) &&
+               (br->multicast_querier ||
+                timer_pending(&br->multicast_querier_timer));
+}
 #else
 static inline int br_multicast_rcv(struct net_bridge *br,
                                   struct net_bridge_port *port,
@@ -557,6 +565,10 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
 {
        return 0;
 }
+static inline bool br_multicast_querier_exists(struct net_bridge *br)
+{
+        return false;
+}
 static inline void br_mdb_init(void)
 {
 }
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index 394bb96b6087..3b9637fb7939 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -1,5 +1,5 @@
 /*
- *      Sysfs attributes of bridge ports
+ *      Sysfs attributes of bridge
 *      Linux ethernet bridge
 *
 *      Authors:
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index bd58b45f5f90..9a9ffe7e4019 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -108,7 +108,7 @@ static int __vlan_del(struct net_port_vlans *v, u16 vid)
        clear_bit(vid, v->vlan_bitmap);
        v->num_vlans--;
-        if (bitmap_empty(v->vlan_bitmap, BR_VLAN_BITMAP_LEN)) {
+        if (bitmap_empty(v->vlan_bitmap, VLAN_N_VID)) {
                if (v->port_idx)
                        rcu_assign_pointer(v->parent.port->vlan_info, NULL);
                else
@@ -122,7 +122,7 @@ static void __vlan_flush(struct net_port_vlans *v)
 {
        smp_wmb();
        v->pvid = 0;
-        bitmap_zero(v->vlan_bitmap, BR_VLAN_BITMAP_LEN);
+        bitmap_zero(v->vlan_bitmap, VLAN_N_VID);
        if (v->port_idx)
                rcu_assign_pointer(v->parent.port->vlan_info, NULL);
        else
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 00ee068efc1c..b84a1b155bc1 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -65,6 +65,7 @@ ipv6:
                nhoff += sizeof(struct ipv6hdr);
                break;
        }
+        case __constant_htons(ETH_P_8021AD):
        case __constant_htons(ETH_P_8021Q): {
                const struct vlan_hdr *vlan;
                struct vlan_hdr _vlan;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index b7de821f98df..60533db8b72d 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1441,16 +1441,18 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
                atomic_set(&p->refcnt, 1);
                p->reachable_time =
                                neigh_rand_reach_time(p->base_reachable_time);
+                dev_hold(dev);
+                p->dev = dev;
+                write_pnet(&p->net, hold_net(net));
+                p->sysctl_table = NULL;
                if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
+                        release_net(net);
+                        dev_put(dev);
                        kfree(p);
                        return NULL;
                }
-                dev_hold(dev);
-                p->dev = dev;
-                write_pnet(&p->net, hold_net(net));
-                p->sysctl_table = NULL;
                write_lock_bh(&tbl->lock);
                p->next         = tbl->parms.next;
                tbl->parms.next = p;
@@ -2767,6 +2769,7 @@ EXPORT_SYMBOL(neigh_app_ns);
 #ifdef CONFIG_SYSCTL
 static int zero;
+static int int_max = INT_MAX;
 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
 static int proc_unres_qlen(struct ctl_table *ctl, int write,
@@ -2819,19 +2822,25 @@ static struct neigh_sysctl_table {
                        .procname       = "mcast_solicit",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_UCAST_PROBE] = {
                        .procname       = "ucast_solicit",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_APP_PROBE] = {
                        .procname       = "app_solicit",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_RETRANS_TIME] = {
                        .procname       = "retrans_time",
@@ -2874,7 +2883,9 @@ static struct neigh_sysctl_table {
                        .procname       = "proxy_qlen",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_ANYCAST_DELAY] = {
                        .procname       = "anycast_delay",
@@ -2916,19 +2927,25 @@ static struct neigh_sysctl_table {
                        .procname       = "gc_thresh1",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_GC_THRESH2] = {
                        .procname       = "gc_thresh2",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                [NEIGH_VAR_GC_THRESH3] = {
                        .procname       = "gc_thresh3",
                        .maxlen         = sizeof(int),
                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                },
                {},
        },
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 3de740834d1f..ca198c1d1d30 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2156,7 +2156,7 @@ int ndo_dflt_fdb_del(struct ndmsg *ndm,
        /* If aging addresses are supported device will need to
         * implement its own handler for this.
         */
-        if (ndm->ndm_state & NUD_PERMANENT) {
+        if (!(ndm->ndm_state & NUD_PERMANENT)) {
                pr_info("%s: FDB only supports static addresses\n", dev->name);
                return -EINVAL;
        }
@@ -2384,7 +2384,7 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
        struct nlattr *extfilt;
        u32 filter_mask = 0;
-        extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct rtgenmsg),
+        extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct ifinfomsg),
                                  IFLA_EXT_MASK);
        if (extfilt)
                filter_mask = nla_get_u32(extfilt);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 20e02d2605ec..2c3d0f53d198 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -309,7 +309,8 @@ EXPORT_SYMBOL(__alloc_skb);
 * @frag_size: size of fragment, or 0 if head was kmalloced
 *
 * Allocate a new &sk_buff. Caller provides space holding head and
- * skb_shared_info. @data must have been allocated by kmalloc()
+ * skb_shared_info. @data must have been allocated by kmalloc() only if
+ * @frag_size is 0, otherwise data should come from the page allocator.
 * The return is the new skb buffer.
 * On a failure the return is %NULL, and @data is not freed.
 * Notes :
@@ -739,7 +740,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
        skb_copy_secmark(new, old);
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
        new->napi_id    = old->napi_id;
 #endif
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 548d716c5f62..2c097c5a35dd 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -900,7 +900,7 @@ set_rcvbuf:
                sock_valbool_flag(sk, SOCK_SELECT_ERR_QUEUE, valbool);
                break;
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
        case SO_BUSY_POLL:
                /* allow unprivileged users to decrease the value */
                if ((val > sk->sk_ll_usec) && !capable(CAP_NET_ADMIN))
@@ -1170,7 +1170,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                v.val = sock_flag(sk, SOCK_SELECT_ERR_QUEUE);
                break;
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
        case SO_BUSY_POLL:
                v.val = sk->sk_ll_usec;
                break;
@@ -2292,7 +2292,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
        sk->sk_stamp = ktime_set(-1L, 0);
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
        sk->sk_napi_id          =       0;
        sk->sk_ll_usec          =       sysctl_net_busy_read;
 #endif
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 660968616637..31107abd2783 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -21,7 +21,9 @@
 #include <net/net_ratelimit.h>
 #include <net/busy_poll.h>
+static int zero = 0;
 static int one = 1;
+static int ushort_max = USHRT_MAX;
 #ifdef CONFIG_RPS
 static int rps_sock_flow_sysctl(struct ctl_table *table, int write,
@@ -298,7 +300,7 @@ static struct ctl_table net_core_table[] = {
                .proc_handler   = flow_limit_table_len_sysctl
        },
 #endif /* CONFIG_NET_FLOW_LIMIT */
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
        {
                .procname       = "busy_poll",
                .data           = &sysctl_net_busy_poll,
@@ -339,7 +341,9 @@ static struct ctl_table netns_core_table[] = {
                .data           = &init_net.core.sysctl_somaxconn,
                .maxlen         = sizeof(int),
                .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .extra1         = &zero,
+                .extra2         = &ushort_max,
+                .proc_handler   = proc_dointvec_minmax
        },
        { }
 };
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 8d48c392adcc..34ca6d5a3a4b 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -772,7 +772,7 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
                ci = nla_data(tb[IFA_CACHEINFO]);
                if (!ci->ifa_valid || ci->ifa_prefered > ci->ifa_valid) {
                        err = -EINVAL;
-                        goto errout;
+                        goto errout_free;
                }
                *pvalid_lft = ci->ifa_valid;
                *pprefered_lft = ci->ifa_prefered;
@@ -780,6 +780,8 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
        return ifa;
+errout_free:
+        inet_free_ifa(ifa);
 errout:
        return ERR_PTR(err);
 }
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index ab3d814bc80a..109ee89f123e 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -477,7 +477,7 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu)
        }
        return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
-                 net_adj) & ~(align - 1)) + (net_adj - 2);
+                 net_adj) & ~(align - 1)) + net_adj - 2;
 }
 static void esp4_err(struct sk_buff *skb, u32 info)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 49616fed9340..3df6d3edb2a1 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -71,7 +71,6 @@
 #include <linux/init.h>
 #include <linux/list.h>
 #include <linux/slab.h>
-#include <linux/prefetch.h>
 #include <linux/export.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
@@ -1761,10 +1760,8 @@ static struct leaf *leaf_walk_rcu(struct tnode *p, struct rt_trie_node *c)
                        if (!c)
                                continue;
-                        if (IS_LEAF(c)) {
+                        if (IS_LEAF(c))
-                                prefetch(rcu_dereference_rtnl(p->child[idx]));
                                return (struct leaf *) c;
-                        }
                        /* Rescan start scanning in new node */
                        p = (struct tnode *) c;
@@ -2133,7 +2130,7 @@ static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat)
                max--;
        pointers = 0;
-        for (i = 1; i <= max; i++)
+        for (i = 1; i < max; i++)
                if (stat->nodesizes[i] != 0) {
                        seq_printf(seq, "  %u: %u",  i, stat->nodesizes[i]);
                        pointers += (1<<i) * stat->nodesizes[i];
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 1f6eab66f7ce..8d6939eeb492 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -383,7 +383,7 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
        if (daddr)
                memcpy(&iph->daddr, daddr, 4);
        if (iph->daddr)
-                return t->hlen;
+                return t->hlen + sizeof(*iph);
        return -(t->hlen + sizeof(*iph));
 }
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 7167b08977df..850525b34899 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -76,9 +76,7 @@ int iptunnel_xmit(struct net *net, struct rtable *rt,
        iph->daddr      =       dst;
        iph->saddr      =       src;
        iph->ttl        =       ttl;
-        tunnel_ip_select_ident(skb,
+        __ip_select_ident(iph, &rt->dst, (skb_shinfo(skb)->gso_segs ?: 1) - 1);
-                               (const struct iphdr *)skb_inner_network_header(skb),
-                               &rt->dst);
        err = ip_local_out(skb);
        if (unlikely(net_xmit_eval(err)))
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 6577a1149a47..463bd1273346 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -273,7 +273,7 @@ static const struct snmp_mib snmp4_net_list[] = {
        SNMP_MIB_ITEM("TCPFastOpenListenOverflow", LINUX_MIB_TCPFASTOPENLISTENOVERFLOW),
        SNMP_MIB_ITEM("TCPFastOpenCookieReqd", LINUX_MIB_TCPFASTOPENCOOKIEREQD),
        SNMP_MIB_ITEM("TCPSpuriousRtxHostQueues", LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES),
-        SNMP_MIB_ITEM("LowLatencyRxPackets", LINUX_MIB_LOWLATENCYRXPACKETS),
+        SNMP_MIB_ITEM("BusyPollRxPackets", LINUX_MIB_BUSYPOLLRXPACKETS),
        SNMP_MIB_SENTINEL
 };
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index b2c123c44d69..610e324348d1 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -36,6 +36,8 @@ static int tcp_adv_win_scale_min = -31;
 static int tcp_adv_win_scale_max = 31;
 static int ip_ttl_min = 1;
 static int ip_ttl_max = 255;
+static int tcp_syn_retries_min = 1;
+static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
 static int ip_ping_group_range_min[] = { 0, 0 };
 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
@@ -332,7 +334,9 @@ static struct ctl_table ipv4_table[] = {
                .data           = &sysctl_tcp_syn_retries,
                .maxlen         = sizeof(int),
                .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &tcp_syn_retries_min,
+                .extra2         = &tcp_syn_retries_max
        },
        {
                .procname       = "tcp_synack_retries",
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 5423223e93c2..b2f6c74861af 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1121,6 +1121,13 @@ new_segment:
                                        goto wait_for_memory;
                                /*
+                                 * All packets are restored as if they have
+                                 * already been sent.
+                                 */
+                                if (tp->repair)
+                                        TCP_SKB_CB(skb)->when = tcp_time_stamp;
+                                /*
                                 * Check whether we can use HW checksum.
                                 */
                                if (sk->sk_route_caps & NETIF_F_ALL_CSUM)
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index a9077f441cb2..b6ae92a51f58 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -206,8 +206,8 @@ static u32 cubic_root(u64 a)
 */
 static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
 {
-        u64 offs;
+        u32 delta, bic_target, max_cnt;
-        u32 delta, t, bic_target, max_cnt;
+        u64 offs, t;
        ca->ack_cnt++;  /* count the number of ACKs */
@@ -250,9 +250,11 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
         * if the cwnd < 1 million packets !!!
         */
+        t = (s32)(tcp_time_stamp - ca->epoch_start);
+        t += msecs_to_jiffies(ca->delay_min >> 3);
        /* change the unit from HZ to bictcp_HZ */
-        t = ((tcp_time_stamp + msecs_to_jiffies(ca->delay_min>>3)
+        t <<= BICTCP_HZ;
-              - ca->epoch_start) << BICTCP_HZ) / HZ;
+        do_div(t, HZ);
        if (t < ca->bic_K)              /* t - K */
                offs = ca->bic_K - t;
@@ -414,7 +416,7 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us)
                return;
        /* Discard delay samples right after fast recovery */
-        if ((s32)(tcp_time_stamp - ca->epoch_start) < HZ)
+        if (ca->epoch_start && (s32)(tcp_time_stamp - ca->epoch_start) < HZ)
                return;
        delay = (rtt_us << 3) / USEC_PER_MSEC;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index cfdcf7b2daf6..498ea99194af 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -813,8 +813,9 @@ static u32 inet6_addr_hash(const struct in6_addr *addr)
 /* On success it returns ifp with increased reference count */
 static struct inet6_ifaddr *
-ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
+ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
-              int scope, u32 flags)
+              const struct in6_addr *peer_addr, int pfxlen,
+              int scope, u32 flags, u32 valid_lft, u32 prefered_lft)
 {
        struct inet6_ifaddr *ifa = NULL;
        struct rt6_info *rt;
@@ -863,6 +864,8 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
        }
        ifa->addr = *addr;
+        if (peer_addr)
+                ifa->peer_addr = *peer_addr;
        spin_lock_init(&ifa->lock);
        spin_lock_init(&ifa->state_lock);
@@ -872,6 +875,8 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
        ifa->scope = scope;
        ifa->prefix_len = pfxlen;
        ifa->flags = flags | IFA_F_TENTATIVE;
+        ifa->valid_lft = valid_lft;
+        ifa->prefered_lft = prefered_lft;
        ifa->cstamp = ifa->tstamp = jiffies;
        ifa->tokenized = false;
@@ -1121,11 +1126,10 @@ retry:
        if (ifp->flags & IFA_F_OPTIMISTIC)
                addr_flags |= IFA_F_OPTIMISTIC;
-        ift = !max_addresses ||
+        ift = ipv6_add_addr(idev, &addr, NULL, tmp_plen,
-              ipv6_count_addresses(idev) < max_addresses ?
+                            ipv6_addr_scope(&addr), addr_flags,
-                ipv6_add_addr(idev, &addr, tmp_plen, ipv6_addr_scope(&addr),
+                            tmp_valid_lft, tmp_prefered_lft);
-                              addr_flags) : NULL;
+        if (IS_ERR(ift)) {
-        if (IS_ERR_OR_NULL(ift)) {
                in6_ifa_put(ifp);
                in6_dev_put(idev);
                pr_info("%s: retry temporary address regeneration\n", __func__);
@@ -1136,8 +1140,6 @@ retry:
        spin_lock_bh(&ift->lock);
        ift->ifpub = ifp;
-        ift->valid_lft = tmp_valid_lft;
-        ift->prefered_lft = tmp_prefered_lft;
        ift->cstamp = now;
        ift->tstamp = tmp_tstamp;
        spin_unlock_bh(&ift->lock);
@@ -2179,16 +2181,19 @@ ok:
                         */
                        if (!max_addresses ||
                            ipv6_count_addresses(in6_dev) < max_addresses)
-                                ifp = ipv6_add_addr(in6_dev, &addr, pinfo->prefix_len,
+                                ifp = ipv6_add_addr(in6_dev, &addr, NULL,
+                                                    pinfo->prefix_len,
                                                    addr_type&IPV6_ADDR_SCOPE_MASK,
-                                                    addr_flags);
+                                                    addr_flags, valid_lft,
+                                                    prefered_lft);
                        if (IS_ERR_OR_NULL(ifp)) {
                                in6_dev_put(in6_dev);
                                return;
                        }
-                        update_lft = create = 1;
+                        update_lft = 0;
+                        create = 1;
                        ifp->cstamp = jiffies;
                        ifp->tokenized = tokenized;
                        addrconf_dad_start(ifp);
@@ -2209,7 +2214,7 @@ ok:
                                stored_lft = ifp->valid_lft - (now - ifp->tstamp) / HZ;
                        else
                                stored_lft = 0;
-                        if (!update_lft && stored_lft) {
+                        if (!update_lft && !create && stored_lft) {
                                if (valid_lft > MIN_VALID_LIFETIME ||
                                    valid_lft > stored_lft)
                                        update_lft = 1;
@@ -2455,17 +2460,10 @@ static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *p
                prefered_lft = timeout;
        }
-        ifp = ipv6_add_addr(idev, pfx, plen, scope, ifa_flags);
+        ifp = ipv6_add_addr(idev, pfx, peer_pfx, plen, scope, ifa_flags,
+                            valid_lft, prefered_lft);
        if (!IS_ERR(ifp)) {
-                spin_lock_bh(&ifp->lock);
-                ifp->valid_lft = valid_lft;
-                ifp->prefered_lft = prefered_lft;
-                ifp->tstamp = jiffies;
-                if (peer_pfx)
-                        ifp->peer_addr = *peer_pfx;
-                spin_unlock_bh(&ifp->lock);
                addrconf_prefix_route(&ifp->addr, ifp->prefix_len, dev,
                                      expires, flags);
                /*
@@ -2557,7 +2555,8 @@ static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
 {
        struct inet6_ifaddr *ifp;
-        ifp = ipv6_add_addr(idev, addr, plen, scope, IFA_F_PERMANENT);
+        ifp = ipv6_add_addr(idev, addr, NULL, plen,
+                            scope, IFA_F_PERMANENT, 0, 0);
        if (!IS_ERR(ifp)) {
                spin_lock_bh(&ifp->lock);
                ifp->flags &= ~IFA_F_TENTATIVE;
@@ -2683,7 +2682,7 @@ static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr
 #endif
-        ifp = ipv6_add_addr(idev, addr, 64, IFA_LINK, addr_flags);
+        ifp = ipv6_add_addr(idev, addr, NULL, 64, IFA_LINK, addr_flags, 0, 0);
        if (!IS_ERR(ifp)) {
                addrconf_prefix_route(&ifp->addr, ifp->prefix_len, idev->dev, 0, 0);
                addrconf_dad_start(ifp);
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 40ffd72243a4..aeac0dc3635d 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -425,7 +425,7 @@ static u32 esp6_get_mtu(struct xfrm_state *x, int mtu)
                net_adj = 0;
        return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
-                 net_adj) & ~(align - 1)) + (net_adj - 2);
+                 net_adj) & ~(align - 1)) + net_adj - 2;
 }
 static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 5fc9c7a68d8d..c4ff5bbb45c4 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -993,14 +993,22 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
                        if (ipv6_prefix_equal(&key->addr, args->addr, key->plen)) {
 #ifdef CONFIG_IPV6_SUBTREES
-                                if (fn->subtree)
+                                if (fn->subtree) {
-                                        fn = fib6_lookup_1(fn->subtree, args + 1);
+                                        struct fib6_node *sfn;
+                                        sfn = fib6_lookup_1(fn->subtree,
+                                                            args + 1);
+                                        if (!sfn)
+                                                goto backtrack;
+                                        fn = sfn;
+                                }
 #endif
-                                if (!fn || fn->fn_flags & RTN_RTINFO)
+                                if (fn->fn_flags & RTN_RTINFO)
                                        return fn;
                        }
                }
+#ifdef CONFIG_IPV6_SUBTREES
+backtrack:
+#endif
                if (fn->fn_flags & RTN_ROOT)
                        break;
@@ -1632,27 +1640,28 @@ static int fib6_age(struct rt6_info *rt, void *arg)
 static DEFINE_SPINLOCK(fib6_gc_lock);
-void fib6_run_gc(unsigned long expires, struct net *net)
+void fib6_run_gc(unsigned long expires, struct net *net, bool force)
 {
-        if (expires != ~0UL) {
+        unsigned long now;
+        if (force) {
                spin_lock_bh(&fib6_gc_lock);
-                gc_args.timeout = expires ? (int)expires :
+        } else if (!spin_trylock_bh(&fib6_gc_lock)) {
-                        net->ipv6.sysctl.ip6_rt_gc_interval;
+                mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
-        } else {
+                return;
-                if (!spin_trylock_bh(&fib6_gc_lock)) {
-                        mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
-                        return;
-                }
-                gc_args.timeout = net->ipv6.sysctl.ip6_rt_gc_interval;
        }
+        gc_args.timeout = expires ? (int)expires :
+                          net->ipv6.sysctl.ip6_rt_gc_interval;
        gc_args.more = icmp6_dst_gc();
        fib6_clean_all(net, fib6_age, 0, NULL);
+        now = jiffies;
+        net->ipv6.ip6_rt_last_gc = now;
        if (gc_args.more)
                mod_timer(&net->ipv6.ip6_fib_timer,
-                          round_jiffies(jiffies
+                          round_jiffies(now
                                        + net->ipv6.sysctl.ip6_rt_gc_interval));
        else
                del_timer(&net->ipv6.ip6_fib_timer);
@@ -1661,7 +1670,7 @@ void fib6_run_gc(unsigned long expires, struct net *net)
 static void fib6_gc_timer_cb(unsigned long arg)
 {
-        fib6_run_gc(0, (struct net *)arg);
+        fib6_run_gc(0, (struct net *)arg, true);
 }
 static int __net_init fib6_net_init(struct net *net)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 583e8d435f9a..03986d31fa41 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -259,10 +259,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
 {
        struct mr6_table *mrt, *next;
+        rtnl_lock();
        list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
                list_del(&mrt->list);
                ip6mr_free_table(mrt);
        }
+        rtnl_unlock();
        fib_rules_unregister(net->ipv6.mr6_rules_ops);
 }
 #else
@@ -289,7 +291,10 @@ static int __net_init ip6mr_rules_init(struct net *net)
 static void __net_exit ip6mr_rules_exit(struct net *net)
 {
+        rtnl_lock();
        ip6mr_free_table(net->ipv6.mrt6);
+        net->ipv6.mrt6 = NULL;
+        rtnl_unlock();
 }
 #endif
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 24c03396e008..04d31c2fbef1 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1369,8 +1369,10 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
        if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
                return;
-        if (!ndopts.nd_opts_rh)
+        if (!ndopts.nd_opts_rh) {
+                ip6_redirect_no_header(skb, dev_net(skb->dev), 0, 0);
                return;
+        }
        hdr = (u8 *)ndopts.nd_opts_rh;
        hdr += 8;
@@ -1576,7 +1578,7 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
        switch (event) {
        case NETDEV_CHANGEADDR:
                neigh_changeaddr(&nd_tbl, dev);
-                fib6_run_gc(~0UL, net);
+                fib6_run_gc(0, net, false);
                idev = in6_dev_get(dev);
                if (!idev)
                        break;
@@ -1586,7 +1588,7 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
                break;
        case NETDEV_DOWN:
                neigh_ifdown(&nd_tbl, dev);
-                fib6_run_gc(~0UL, net);
+                fib6_run_gc(0, net, false);
                break;
        case NETDEV_NOTIFY_PEERS:
                ndisc_send_unsol_na(dev);
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 790d9f4b8b0b..1aeb473b2cc6 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -490,6 +490,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
        ipv6_hdr(head)->payload_len = htons(payload_len);
        ipv6_change_dsfield(ipv6_hdr(head), 0xff, ecn);
        IP6CB(head)->nhoff = nhoff;
+        IP6CB(head)->flags |= IP6SKB_FRAGMENTED;
        /* Yes, and fold redundant checksum back. 8) */
        if (head->ip_summed == CHECKSUM_COMPLETE)
@@ -524,6 +525,9 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
        struct net *net = dev_net(skb_dst(skb)->dev);
        int evicted;
+        if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED)
+                goto fail_hdr;
        IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);
        /* Jumbo payload inhibits frag. header */
@@ -544,6 +548,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
                                 ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMOKS);
                IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
+                IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;
                return 1;
        }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a8c891aa2464..8d9a93ed9c59 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1178,6 +1178,27 @@ void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark)
 }
 EXPORT_SYMBOL_GPL(ip6_redirect);
+void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif,
+                            u32 mark)
+{
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct rd_msg *msg = (struct rd_msg *)icmp6_hdr(skb);
+        struct dst_entry *dst;
+        struct flowi6 fl6;
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_oif = oif;
+        fl6.flowi6_mark = mark;
+        fl6.flowi6_flags = 0;
+        fl6.daddr = msg->dest;
+        fl6.saddr = iph->daddr;
+        dst = ip6_route_output(net, NULL, &fl6);
+        if (!dst->error)
+                rt6_do_redirect(dst, NULL, skb);
+        dst_release(dst);
+}
 void ip6_sk_redirect(struct sk_buff *skb, struct sock *sk)
 {
        ip6_redirect(skb, sock_net(sk), sk->sk_bound_dev_if, sk->sk_mark);
@@ -1311,7 +1332,6 @@ static void icmp6_clean_all(int (*func)(struct rt6_info *rt, void *arg),
 static int ip6_dst_gc(struct dst_ops *ops)
 {
-        unsigned long now = jiffies;
        struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
        int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
        int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
@@ -1321,13 +1341,12 @@ static int ip6_dst_gc(struct dst_ops *ops)
        int entries;
        entries = dst_entries_get_fast(ops);
-        if (time_after(rt_last_gc + rt_min_interval, now) &&
+        if (time_after(rt_last_gc + rt_min_interval, jiffies) &&
            entries <= rt_max_size)
                goto out;
        net->ipv6.ip6_rt_gc_expire++;
-        fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net);
+        fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, entries > rt_max_size);
-        net->ipv6.ip6_rt_last_gc = now;
        entries = dst_entries_get_slow(ops);
        if (entries < ops->gc_thresh)
                net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
@@ -2827,7 +2846,7 @@ int ipv6_sysctl_rtcache_flush(struct ctl_table *ctl, int write,
        net = (struct net *)ctl->extra1;
        delay = net->ipv6.sysctl.flush_delay;
        proc_dointvec(ctl, write, buffer, lenp, ppos);
-        fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
+        fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
        return 0;
 }
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9da862070dd8..ab8bd2cabfa0 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2081,6 +2081,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *
                        pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
        }
        pol->sadb_x_policy_dir = dir+1;
+        pol->sadb_x_policy_reserved = 0;
        pol->sadb_x_policy_id = xp->index;
        pol->sadb_x_policy_priority = xp->priority;
@@ -3137,7 +3138,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
        pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
        pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
        pol->sadb_x_policy_dir = XFRM_POLICY_OUT + 1;
+        pol->sadb_x_policy_reserved = 0;
        pol->sadb_x_policy_id = xp->index;
+        pol->sadb_x_policy_priority = xp->priority;
        /* Set sadb_comb's. */
        if (x->id.proto == IPPROTO_AH)
@@ -3525,6 +3528,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
        pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
        pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
        pol->sadb_x_policy_dir = dir + 1;
+        pol->sadb_x_policy_reserved = 0;
        pol->sadb_x_policy_id = 0;
        pol->sadb_x_policy_priority = 0;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 8184d121ff09..43dd7525bfcb 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -666,6 +666,8 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
                        if (sta->sdata->dev != dev)
                                continue;
+                        sinfo.filled = 0;
+                        sta_set_sinfo(sta, &sinfo);
                        i = 0;
                        ADD_STA_STATS(sta);
                }
diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
index 3b7bfc01ee36..22290a929b94 100644
--- a/net/mac80211/mesh_ps.c
+++ b/net/mac80211/mesh_ps.c
@@ -229,6 +229,10 @@ void ieee80211_mps_sta_status_update(struct sta_info *sta)
        enum nl80211_mesh_power_mode pm;
        bool do_buffer;
+        /* For non-assoc STA, prevent buffering or frame transmission */
+        if (sta->sta_state < IEEE80211_STA_ASSOC)
+                return;
        /*
         * use peer-specific power mode if peering is established and the
         * peer's power mode is known
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index ae31968d42d3..cc9e02d79b55 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -31,10 +31,12 @@
 #include "led.h"
 #define IEEE80211_AUTH_TIMEOUT          (HZ / 5)
+#define IEEE80211_AUTH_TIMEOUT_LONG     (HZ / 2)
 #define IEEE80211_AUTH_TIMEOUT_SHORT    (HZ / 10)
 #define IEEE80211_AUTH_MAX_TRIES        3
 #define IEEE80211_AUTH_WAIT_ASSOC       (HZ * 5)
 #define IEEE80211_ASSOC_TIMEOUT         (HZ / 5)
+#define IEEE80211_ASSOC_TIMEOUT_LONG    (HZ / 2)
 #define IEEE80211_ASSOC_TIMEOUT_SHORT   (HZ / 10)
 #define IEEE80211_ASSOC_MAX_TRIES       3
@@ -209,8 +211,9 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                             struct ieee80211_channel *channel,
                             const struct ieee80211_ht_operation *ht_oper,
                             const struct ieee80211_vht_operation *vht_oper,
-                             struct cfg80211_chan_def *chandef, bool verbose)
+                             struct cfg80211_chan_def *chandef, bool tracking)
 {
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
        struct cfg80211_chan_def vht_chandef;
        u32 ht_cfreq, ret;
@@ -229,7 +232,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
        ht_cfreq = ieee80211_channel_to_frequency(ht_oper->primary_chan,
                                                  channel->band);
        /* check that channel matches the right operating channel */
-        if (channel->center_freq != ht_cfreq) {
+        if (!tracking && channel->center_freq != ht_cfreq) {
                /*
                 * It's possible that some APs are confused here;
                 * Netgear WNDR3700 sometimes reports 4 higher than
@@ -237,11 +240,10 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                 * since we look at probe response/beacon data here
                 * it should be OK.
                 */
-                if (verbose)
+                sdata_info(sdata,
-                        sdata_info(sdata,
+                           "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
-                                   "Wrong control channel: center-freq: %d ht-cfreq: %d ht->primary_chan: %d band: %d - Disabling HT\n",
+                           channel->center_freq, ht_cfreq,
-                                   channel->center_freq, ht_cfreq,
+                           ht_oper->primary_chan, channel->band);
-                                   ht_oper->primary_chan, channel->band);
                ret = IEEE80211_STA_DISABLE_HT | IEEE80211_STA_DISABLE_VHT;
                goto out;
        }
@@ -295,7 +297,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                                channel->band);
                break;
        default:
-                if (verbose)
+                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
                        sdata_info(sdata,
                                   "AP VHT operation IE has invalid channel width (%d), disable VHT\n",
                                   vht_oper->chan_width);
@@ -304,7 +306,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
        }
        if (!cfg80211_chandef_valid(&vht_chandef)) {
-                if (verbose)
+                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
                        sdata_info(sdata,
                                   "AP VHT information is invalid, disable VHT\n");
                ret = IEEE80211_STA_DISABLE_VHT;
@@ -317,7 +319,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
        }
        if (!cfg80211_chandef_compatible(chandef, &vht_chandef)) {
-                if (verbose)
+                if (!(ifmgd->flags & IEEE80211_STA_DISABLE_VHT))
                        sdata_info(sdata,
                                   "AP VHT information doesn't match HT, disable VHT\n");
                ret = IEEE80211_STA_DISABLE_VHT;
@@ -333,18 +335,27 @@ out:
        if (ret & IEEE80211_STA_DISABLE_VHT)
                vht_chandef = *chandef;
+        /*
+         * Ignore the DISABLED flag when we're already connected and only
+         * tracking the APs beacon for bandwidth changes - otherwise we
+         * might get disconnected here if we connect to an AP, update our
+         * regulatory information based on the AP's country IE and the
+         * information we have is wrong/outdated and disables the channel
+         * that we're actually using for the connection to the AP.
+         */
        while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
-                                        IEEE80211_CHAN_DISABLED)) {
+                                        tracking ? 0 :
+                                                   IEEE80211_CHAN_DISABLED)) {
                if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
                        ret = IEEE80211_STA_DISABLE_HT |
                              IEEE80211_STA_DISABLE_VHT;
-                        goto out;
+                        break;
                }
                ret |= chandef_downgrade(chandef);
        }
-        if (chandef->width != vht_chandef.width && verbose)
+        if (chandef->width != vht_chandef.width && !tracking)
                sdata_info(sdata,
                           "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
@@ -384,7 +395,7 @@ static int ieee80211_config_bw(struct ieee80211_sub_if_data *sdata,
        /* calculate new channel (type) based on HT/VHT operation IEs */
        flags = ieee80211_determine_chantype(sdata, sband, chan, ht_oper,
-                                             vht_oper, &chandef, false);
+                                             vht_oper, &chandef, true);
        /*
         * Downgrade the new channel if we associated with restricted
@@ -3394,10 +3405,13 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
        if (tx_flags == 0) {
                auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
-                ifmgd->auth_data->timeout_started = true;
+                auth_data->timeout_started = true;
                run_again(sdata, auth_data->timeout);
        } else {
-                auth_data->timeout_started = false;
+                auth_data->timeout =
+                        round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG);
+                auth_data->timeout_started = true;
+                run_again(sdata, auth_data->timeout);
        }
        return 0;
@@ -3434,7 +3448,11 @@ static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
                assoc_data->timeout_started = true;
                run_again(sdata, assoc_data->timeout);
        } else {
-                assoc_data->timeout_started = false;
+                assoc_data->timeout =
+                        round_jiffies_up(jiffies +
+                                         IEEE80211_ASSOC_TIMEOUT_LONG);
+                assoc_data->timeout_started = true;
+                run_again(sdata, assoc_data->timeout);
        }
        return 0;
@@ -3829,7 +3847,7 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
        ifmgd->flags |= ieee80211_determine_chantype(sdata, sband,
                                                     cbss->channel,
                                                     ht_oper, vht_oper,
-                                                     &chandef, true);
+                                                     &chandef, false);
        sdata->needed_rx_chains = min(ieee80211_ht_vht_rx_chains(sdata, cbss),
                                      local->rx_chains);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7fc5d0d8149a..340126204343 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -99,10 +99,13 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
        }
        mutex_unlock(&local->sta_mtx);
-        /* remove all interfaces */
+        /* remove all interfaces that were created in the driver */
        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!ieee80211_sdata_running(sdata))
+                if (!ieee80211_sdata_running(sdata) ||
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
+                    sdata->vif.type == NL80211_IFTYPE_MONITOR)
                        continue;
                drv_remove_interface(local, sdata);
        }
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index ac7ef5414bde..e6512e2ffd20 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
        struct minstrel_rate *msr, *mr;
        unsigned int ndx;
        bool mrr_capable;
-        bool prev_sample = mi->prev_sample;
+        bool prev_sample;
        int delta;
        int sampling_ratio;
@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                        (mi->sample_count + mi->sample_deferred / 2);
        /* delta < 0: no sampling required */
+        prev_sample = mi->prev_sample;
        mi->prev_sample = false;
        if (delta < 0 || (!mrr_capable && prev_sample))
                return;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 5b2d3012b983..f5aed963b22e 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -804,10 +804,18 @@ minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
        sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
        info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
+        rate->count = 1;
+        if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
+                int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
+                rate->idx = mp->cck_rates[idx];
+                rate->flags = 0;
+                return;
+        }
        rate->idx = sample_idx % MCS_GROUP_RATES +
                    (sample_group->streams - 1) * MCS_GROUP_RATES;
        rate->flags = IEEE80211_TX_RC_MCS | sample_group->flags;
-        rate->count = 1;
 }
 static void
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 23dbcfc69b3b..2c5a79bd3777 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -936,8 +936,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
-        /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
+        /*
-        if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
+         * Drop duplicate 802.11 retransmissions
+         * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
+         */
+        if (rx->skb->len >= 24 && rx->sta &&
+            !ieee80211_is_ctl(hdr->frame_control) &&
+            !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
+            !is_multicast_ether_addr(hdr->addr1)) {
                if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
                             rx->sta->last_seq_ctrl[rx->seqno_idx] ==
                             hdr->seq_ctrl)) {
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index c63b618cd619..4fd1ca94fd4a 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -293,6 +293,11 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, unsigned int class,
                       sizeof(exp->tuple.dst.u3) - len);
        exp->tuple.dst.u.all = *dst;
+#ifdef CONFIG_NF_NAT_NEEDED
+        memset(&exp->saved_addr, 0, sizeof(exp->saved_addr));
+        memset(&exp->saved_proto, 0, sizeof(exp->saved_proto));
+#endif
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_init);
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 7dcc376eea5f..2f8010707d01 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -526,7 +526,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
        const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
        __u32 seq, ack, sack, end, win, swin;
        s16 receiver_offset;
-        bool res;
+        bool res, in_recv_win;
        /*
         * Get the required data from the packet.
@@ -649,14 +649,18 @@ static bool tcp_in_window(const struct nf_conn *ct,
                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
                 receiver->td_scale);
+        /* Is the ending sequence in the receive window (if available)? */
+        in_recv_win = !receiver->td_maxwin ||
+                      after(end, sender->td_end - receiver->td_maxwin - 1);
        pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
                 before(seq, sender->td_maxend + 1),
-                 after(end, sender->td_end - receiver->td_maxwin - 1),
+                 (in_recv_win ? 1 : 0),
                 before(sack, receiver->td_end + 1),
                 after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
        if (before(seq, sender->td_maxend + 1) &&
-            after(end, sender->td_end - receiver->td_maxwin - 1) &&
+            in_recv_win &&
            before(sack, receiver->td_end + 1) &&
            after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
                /*
@@ -725,7 +729,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
                        nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
                        "nf_ct_tcp: %s ",
                        before(seq, sender->td_maxend + 1) ?
-                        after(end, sender->td_end - receiver->td_maxwin - 1) ?
+                        in_recv_win ?
                        before(sack, receiver->td_end + 1) ?
                        after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
                        : "ACK is under the lower bound (possible overly delayed ACK)"
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 962e9792e317..d92cc317bf8b 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -419,6 +419,7 @@ __build_packet_message(struct nfnl_log_net *log,
        nfmsg->version = NFNETLINK_V0;
        nfmsg->res_id = htons(inst->group_num);
+        memset(&pmsg, 0, sizeof(pmsg));
        pmsg.hw_protocol        = skb->protocol;
        pmsg.hook               = hooknum;
@@ -498,7 +499,10 @@ __build_packet_message(struct nfnl_log_net *log,
        if (indev && skb->dev &&
            skb->mac_header != skb->network_header) {
                struct nfulnl_msg_packet_hw phw;
-                int len = dev_parse_header(skb, phw.hw_addr);
+                int len;
+                memset(&phw, 0, sizeof(phw));
+                len = dev_parse_header(skb, phw.hw_addr);
                if (len > 0) {
                        phw.hw_addrlen = htons(len);
                        if (nla_put(inst->skb, NFULA_HWADDR, sizeof(phw), &phw))
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 971ea145ab3e..8a703c3dd318 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -463,7 +463,10 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
        if (indev && entskb->dev &&
            entskb->mac_header != entskb->network_header) {
                struct nfqnl_msg_packet_hw phw;
-                int len = dev_parse_header(entskb, phw.hw_addr);
+                int len;
+                memset(&phw, 0, sizeof(phw));
+                len = dev_parse_header(entskb, phw.hw_addr);
                if (len) {
                        phw.hw_addrlen = htons(len);
                        if (nla_put(skb, NFQA_HWADDR, sizeof(phw), &phw))
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 7011c71646f0..6113cc7efffc 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -52,7 +52,8 @@ tcpmss_mangle_packet(struct sk_buff *skb,
 {
        const struct xt_tcpmss_info *info = par->targinfo;
        struct tcphdr *tcph;
-        unsigned int tcplen, i;
+        int len, tcp_hdrlen;
+        unsigned int i;
        __be16 oldval;
        u16 newmss;
        u8 *opt;
@@ -64,11 +65,14 @@ tcpmss_mangle_packet(struct sk_buff *skb,
        if (!skb_make_writable(skb, skb->len))
                return -1;
-        tcplen = skb->len - tcphoff;
+        len = skb->len - tcphoff;
+        if (len < (int)sizeof(struct tcphdr))
+                return -1;
        tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
+        tcp_hdrlen = tcph->doff * 4;
-        /* Header cannot be larger than the packet */
+        if (len < tcp_hdrlen)
-        if (tcplen < tcph->doff*4)
                return -1;
        if (info->mss == XT_TCPMSS_CLAMP_PMTU) {
@@ -87,9 +91,8 @@ tcpmss_mangle_packet(struct sk_buff *skb,
                newmss = info->mss;
        opt = (u_int8_t *)tcph;
-        for (i = sizeof(struct tcphdr); i < tcph->doff*4; i += optlen(opt, i)) {
+        for (i = sizeof(struct tcphdr); i <= tcp_hdrlen - TCPOLEN_MSS; i += optlen(opt, i)) {
-                if (opt[i] == TCPOPT_MSS && tcph->doff*4 - i >= TCPOLEN_MSS &&
+                if (opt[i] == TCPOPT_MSS && opt[i+1] == TCPOLEN_MSS) {
-                    opt[i+1] == TCPOLEN_MSS) {
                        u_int16_t oldmss;
                        oldmss = (opt[i+2] << 8) | opt[i+3];
@@ -112,9 +115,10 @@ tcpmss_mangle_packet(struct sk_buff *skb,
        }
        /* There is data after the header so the option can't be added
-           without moving it, and doing so may make the SYN packet
+         * without moving it, and doing so may make the SYN packet
-           itself too large. Accept the packet unmodified instead. */
+         * itself too large. Accept the packet unmodified instead.
-        if (tcplen > tcph->doff*4)
+         */
+        if (len > tcp_hdrlen)
                return 0;
        /*
@@ -143,10 +147,10 @@ tcpmss_mangle_packet(struct sk_buff *skb,
                newmss = min(newmss, (u16)1220);
        opt = (u_int8_t *)tcph + sizeof(struct tcphdr);
-        memmove(opt + TCPOLEN_MSS, opt, tcplen - sizeof(struct tcphdr));
+        memmove(opt + TCPOLEN_MSS, opt, len - sizeof(struct tcphdr));
        inet_proto_csum_replace2(&tcph->check, skb,
-                                 htons(tcplen), htons(tcplen + TCPOLEN_MSS), 1);
+                                 htons(len), htons(len + TCPOLEN_MSS), 1);
        opt[0] = TCPOPT_MSS;
        opt[1] = TCPOLEN_MSS;
        opt[2] = (newmss & 0xff00) >> 8;
diff --git a/net/netfilter/xt_TCPOPTSTRIP.c b/net/netfilter/xt_TCPOPTSTRIP.c
index b68fa191710f..625fa1d636a0 100644
--- a/net/netfilter/xt_TCPOPTSTRIP.c
+++ b/net/netfilter/xt_TCPOPTSTRIP.c
@@ -38,7 +38,7 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
        struct tcphdr *tcph;
        u_int16_t n, o;
        u_int8_t *opt;
-        int len;
+        int len, tcp_hdrlen;
        /* This is a fragment, no TCP header is available */
        if (par->fragoff != 0)
@@ -52,7 +52,9 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
                return NF_DROP;
        tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff);
-        if (tcph->doff * 4 > len)
+        tcp_hdrlen = tcph->doff * 4;
+        if (len < tcp_hdrlen)
                return NF_DROP;
        opt  = (u_int8_t *)tcph;
@@ -61,10 +63,10 @@ tcpoptstrip_mangle_packet(struct sk_buff *skb,
         * Walk through all TCP options - if we find some option to remove,
         * set all octets to %TCPOPT_NOP and adjust checksum.
         */
-        for (i = sizeof(struct tcphdr); i < tcp_hdrlen(skb); i += optl) {
+        for (i = sizeof(struct tcphdr); i < tcp_hdrlen - 1; i += optl) {
                optl = optlen(opt, i);
-                if (i + optl > tcp_hdrlen(skb))
+                if (i + optl > tcp_hdrlen)
                        break;
                if (!tcpoptstrip_test_bit(info->strip_bmap, opt[i]))
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index f8b71911037a..20b15916f403 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -172,7 +172,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
                /* Ignore non-transparent sockets,
                   if XT_SOCKET_TRANSPARENT is used */
-                if (info && info->flags & XT_SOCKET_TRANSPARENT)
+                if (info->flags & XT_SOCKET_TRANSPARENT)
                        transparent = ((sk->sk_state != TCP_TIME_WAIT &&
                                        inet_sk(sk)->transparent) ||
                                       (sk->sk_state == TCP_TIME_WAIT &&
@@ -196,7 +196,11 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
 static bool
 socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
 {
-        return socket_match(skb, par, NULL);
+        static struct xt_socket_mtinfo1 xt_info_v0 = {
+                .flags = 0,
+        };
+        return socket_match(skb, par, &xt_info_v0);
 }
 static bool
@@ -314,7 +318,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
                /* Ignore non-transparent sockets,
                   if XT_SOCKET_TRANSPARENT is used */
-                if (info && info->flags & XT_SOCKET_TRANSPARENT)
+                if (info->flags & XT_SOCKET_TRANSPARENT)
                        transparent = ((sk->sk_state != TCP_TIME_WAIT &&
                                        inet_sk(sk)->transparent) ||
                                       (sk->sk_state == TCP_TIME_WAIT &&
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index c15042f987bd..a1100640495d 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -691,8 +691,8 @@ static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
 {
        struct netlbl_domhsh_walk_arg *cb_arg = arg;
-        if (entry->type == NETLBL_NLTYPE_CIPSOV4 &&
+        if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 &&
-            entry->type_def.cipsov4->doi == cb_arg->doi)
+            entry->def.cipso->doi == cb_arg->doi)
                return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
        return 0;
diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
index 6bb1d42f0fac..85d842e6e431 100644
--- a/net/netlabel/netlabel_domainhash.c
+++ b/net/netlabel/netlabel_domainhash.c
@@ -84,15 +84,15 @@ static void netlbl_domhsh_free_entry(struct rcu_head *entry)
 #endif /* IPv6 */
        ptr = container_of(entry, struct netlbl_dom_map, rcu);
-        if (ptr->type == NETLBL_NLTYPE_ADDRSELECT) {
+        if (ptr->def.type == NETLBL_NLTYPE_ADDRSELECT) {
                netlbl_af4list_foreach_safe(iter4, tmp4,
-                                            &ptr->type_def.addrsel->list4) {
+                                            &ptr->def.addrsel->list4) {
                        netlbl_af4list_remove_entry(iter4);
                        kfree(netlbl_domhsh_addr4_entry(iter4));
                }
 #if IS_ENABLED(CONFIG_IPV6)
                netlbl_af6list_foreach_safe(iter6, tmp6,
-                                            &ptr->type_def.addrsel->list6) {
+                                            &ptr->def.addrsel->list6) {
                        netlbl_af6list_remove_entry(iter6);
                        kfree(netlbl_domhsh_addr6_entry(iter6));
                }
@@ -213,21 +213,21 @@ static void netlbl_domhsh_audit_add(struct netlbl_dom_map *entry,
                if (addr4 != NULL) {
                        struct netlbl_domaddr4_map *map4;
                        map4 = netlbl_domhsh_addr4_entry(addr4);
-                        type = map4->type;
+                        type = map4->def.type;
-                        cipsov4 = map4->type_def.cipsov4;
+                        cipsov4 = map4->def.cipso;
                        netlbl_af4list_audit_addr(audit_buf, 0, NULL,
                                                  addr4->addr, addr4->mask);
 #if IS_ENABLED(CONFIG_IPV6)
                } else if (addr6 != NULL) {
                        struct netlbl_domaddr6_map *map6;
                        map6 = netlbl_domhsh_addr6_entry(addr6);
-                        type = map6->type;
+                        type = map6->def.type;
                        netlbl_af6list_audit_addr(audit_buf, 0, NULL,
                                                  &addr6->addr, &addr6->mask);
 #endif /* IPv6 */
                } else {
-                        type = entry->type;
+                        type = entry->def.type;
-                        cipsov4 = entry->type_def.cipsov4;
+                        cipsov4 = entry->def.cipso;
                }
                switch (type) {
                case NETLBL_NLTYPE_UNLABELED:
@@ -265,26 +265,25 @@ static int netlbl_domhsh_validate(const struct netlbl_dom_map *entry)
        if (entry == NULL)
                return -EINVAL;
-        switch (entry->type) {
+        switch (entry->def.type) {
        case NETLBL_NLTYPE_UNLABELED:
-                if (entry->type_def.cipsov4 != NULL ||
+                if (entry->def.cipso != NULL || entry->def.addrsel != NULL)
-                    entry->type_def.addrsel != NULL)
                        return -EINVAL;
                break;
        case NETLBL_NLTYPE_CIPSOV4:
-                if (entry->type_def.cipsov4 == NULL)
+                if (entry->def.cipso == NULL)
                        return -EINVAL;
                break;
        case NETLBL_NLTYPE_ADDRSELECT:
-                netlbl_af4list_foreach(iter4, &entry->type_def.addrsel->list4) {
+                netlbl_af4list_foreach(iter4, &entry->def.addrsel->list4) {
                        map4 = netlbl_domhsh_addr4_entry(iter4);
-                        switch (map4->type) {
+                        switch (map4->def.type) {
                        case NETLBL_NLTYPE_UNLABELED:
-                                if (map4->type_def.cipsov4 != NULL)
+                                if (map4->def.cipso != NULL)
                                        return -EINVAL;
                                break;
                        case NETLBL_NLTYPE_CIPSOV4:
-                                if (map4->type_def.cipsov4 == NULL)
+                                if (map4->def.cipso == NULL)
                                        return -EINVAL;
                                break;
                        default:
@@ -292,9 +291,9 @@ static int netlbl_domhsh_validate(const struct netlbl_dom_map *entry)
                        }
                }
 #if IS_ENABLED(CONFIG_IPV6)
-                netlbl_af6list_foreach(iter6, &entry->type_def.addrsel->list6) {
+                netlbl_af6list_foreach(iter6, &entry->def.addrsel->list6) {
                        map6 = netlbl_domhsh_addr6_entry(iter6);
-                        switch (map6->type) {
+                        switch (map6->def.type) {
                        case NETLBL_NLTYPE_UNLABELED:
                                break;
                        default:
@@ -402,32 +401,31 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                        rcu_assign_pointer(netlbl_domhsh_def, entry);
                }
-                if (entry->type == NETLBL_NLTYPE_ADDRSELECT) {
+                if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
                        netlbl_af4list_foreach_rcu(iter4,
-                                               &entry->type_def.addrsel->list4)
+                                                   &entry->def.addrsel->list4)
                                netlbl_domhsh_audit_add(entry, iter4, NULL,
                                                        ret_val, audit_info);
 #if IS_ENABLED(CONFIG_IPV6)
                        netlbl_af6list_foreach_rcu(iter6,
-                                               &entry->type_def.addrsel->list6)
+                                                   &entry->def.addrsel->list6)
                                netlbl_domhsh_audit_add(entry, NULL, iter6,
                                                        ret_val, audit_info);
 #endif /* IPv6 */
                } else
                        netlbl_domhsh_audit_add(entry, NULL, NULL,
                                                ret_val, audit_info);
-        } else if (entry_old->type == NETLBL_NLTYPE_ADDRSELECT &&
+        } else if (entry_old->def.type == NETLBL_NLTYPE_ADDRSELECT &&
-                   entry->type == NETLBL_NLTYPE_ADDRSELECT) {
+                   entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
                struct list_head *old_list4;
                struct list_head *old_list6;
-                old_list4 = &entry_old->type_def.addrsel->list4;
+                old_list4 = &entry_old->def.addrsel->list4;
-                old_list6 = &entry_old->type_def.addrsel->list6;
+                old_list6 = &entry_old->def.addrsel->list6;
                /* we only allow the addition of address selectors if all of
                 * the selectors do not exist in the existing domain map */
-                netlbl_af4list_foreach_rcu(iter4,
+                netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4)
-                                           &entry->type_def.addrsel->list4)
                        if (netlbl_af4list_search_exact(iter4->addr,
                                                        iter4->mask,
                                                        old_list4)) {
@@ -435,8 +433,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                                goto add_return;
                        }
 #if IS_ENABLED(CONFIG_IPV6)
-                netlbl_af6list_foreach_rcu(iter6,
+                netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6)
-                                           &entry->type_def.addrsel->list6)
                        if (netlbl_af6list_search_exact(&iter6->addr,
                                                        &iter6->mask,
                                                        old_list6)) {
@@ -446,7 +443,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
 #endif /* IPv6 */
                netlbl_af4list_foreach_safe(iter4, tmp4,
-                                            &entry->type_def.addrsel->list4) {
+                                            &entry->def.addrsel->list4) {
                        netlbl_af4list_remove_entry(iter4);
                        iter4->valid = 1;
                        ret_val = netlbl_af4list_add(iter4, old_list4);
@@ -457,7 +454,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
                }
 #if IS_ENABLED(CONFIG_IPV6)
                netlbl_af6list_foreach_safe(iter6, tmp6,
-                                            &entry->type_def.addrsel->list6) {
+                                            &entry->def.addrsel->list6) {
                        netlbl_af6list_remove_entry(iter6);
                        iter6->valid = 1;
                        ret_val = netlbl_af6list_add(iter6, old_list6);
@@ -538,18 +535,18 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
                struct netlbl_af4list *iter4;
                struct netlbl_domaddr4_map *map4;
-                switch (entry->type) {
+                switch (entry->def.type) {
                case NETLBL_NLTYPE_ADDRSELECT:
                        netlbl_af4list_foreach_rcu(iter4,
-                                             &entry->type_def.addrsel->list4) {
+                                             &entry->def.addrsel->list4) {
                                map4 = netlbl_domhsh_addr4_entry(iter4);
-                                cipso_v4_doi_putdef(map4->type_def.cipsov4);
+                                cipso_v4_doi_putdef(map4->def.cipso);
                        }
                        /* no need to check the IPv6 list since we currently
                         * support only unlabeled protocols for IPv6 */
                        break;
                case NETLBL_NLTYPE_CIPSOV4:
-                        cipso_v4_doi_putdef(entry->type_def.cipsov4);
+                        cipso_v4_doi_putdef(entry->def.cipso);
                        break;
                }
                call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
@@ -590,20 +587,21 @@ int netlbl_domhsh_remove_af4(const char *domain,
                entry_map = netlbl_domhsh_search(domain);
        else
                entry_map = netlbl_domhsh_search_def(domain);
-        if (entry_map == NULL || entry_map->type != NETLBL_NLTYPE_ADDRSELECT)
+        if (entry_map == NULL ||
+            entry_map->def.type != NETLBL_NLTYPE_ADDRSELECT)
                goto remove_af4_failure;
        spin_lock(&netlbl_domhsh_lock);
        entry_addr = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
-                                           &entry_map->type_def.addrsel->list4);
+                                           &entry_map->def.addrsel->list4);
        spin_unlock(&netlbl_domhsh_lock);
        if (entry_addr == NULL)
                goto remove_af4_failure;
-        netlbl_af4list_foreach_rcu(iter4, &entry_map->type_def.addrsel->list4)
+        netlbl_af4list_foreach_rcu(iter4, &entry_map->def.addrsel->list4)
                goto remove_af4_single_addr;
 #if IS_ENABLED(CONFIG_IPV6)
-        netlbl_af6list_foreach_rcu(iter6, &entry_map->type_def.addrsel->list6)
+        netlbl_af6list_foreach_rcu(iter6, &entry_map->def.addrsel->list6)
                goto remove_af4_single_addr;
 #endif /* IPv6 */
        /* the domain mapping is empty so remove it from the mapping table */
@@ -616,7 +614,7 @@ remove_af4_single_addr:
         * shouldn't be a problem */
        synchronize_rcu();
        entry = netlbl_domhsh_addr4_entry(entry_addr);
-        cipso_v4_doi_putdef(entry->type_def.cipsov4);
+        cipso_v4_doi_putdef(entry->def.cipso);
        kfree(entry);
        return 0;
@@ -693,8 +691,8 @@ struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain)
 * responsible for ensuring that rcu_read_[un]lock() is called.
 *
 */
-struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af4(const char *domain,
-                                                       __be32 addr)
+                                                     __be32 addr)
 {
        struct netlbl_dom_map *dom_iter;
        struct netlbl_af4list *addr_iter;
@@ -702,15 +700,13 @@ struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
        dom_iter = netlbl_domhsh_search_def(domain);
        if (dom_iter == NULL)
                return NULL;
-        if (dom_iter->type != NETLBL_NLTYPE_ADDRSELECT)
-                return NULL;
-        addr_iter = netlbl_af4list_search(addr,
+        if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT)
-                                          &dom_iter->type_def.addrsel->list4);
+                return &dom_iter->def;
+        addr_iter = netlbl_af4list_search(addr, &dom_iter->def.addrsel->list4);
        if (addr_iter == NULL)
                return NULL;
+        return &(netlbl_domhsh_addr4_entry(addr_iter)->def);
-        return netlbl_domhsh_addr4_entry(addr_iter);
 }
 #if IS_ENABLED(CONFIG_IPV6)
@@ -725,7 +721,7 @@ struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
 * responsible for ensuring that rcu_read_[un]lock() is called.
 *
 */
-struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af6(const char *domain,
                                                   const struct in6_addr *addr)
 {
        struct netlbl_dom_map *dom_iter;
@@ -734,15 +730,13 @@ struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
        dom_iter = netlbl_domhsh_search_def(domain);
        if (dom_iter == NULL)
                return NULL;
-        if (dom_iter->type != NETLBL_NLTYPE_ADDRSELECT)
-                return NULL;
-        addr_iter = netlbl_af6list_search(addr,
+        if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT)
-                                          &dom_iter->type_def.addrsel->list6);
+                return &dom_iter->def;
+        addr_iter = netlbl_af6list_search(addr, &dom_iter->def.addrsel->list6);
        if (addr_iter == NULL)
                return NULL;
+        return &(netlbl_domhsh_addr6_entry(addr_iter)->def);
-        return netlbl_domhsh_addr6_entry(addr_iter);
 }
 #endif /* IPv6 */
diff --git a/net/netlabel/netlabel_domainhash.h b/net/netlabel/netlabel_domainhash.h
index 90872c4ca30f..b9be0eed8980 100644
--- a/net/netlabel/netlabel_domainhash.h
+++ b/net/netlabel/netlabel_domainhash.h
@@ -43,37 +43,35 @@
 #define NETLBL_DOMHSH_BITSIZE       7
 /* Domain mapping definition structures */
+struct netlbl_domaddr_map {
+        struct list_head list4;
+        struct list_head list6;
+};
+struct netlbl_dommap_def {
+        u32 type;
+        union {
+                struct netlbl_domaddr_map *addrsel;
+                struct cipso_v4_doi *cipso;
+        };
+};
 #define netlbl_domhsh_addr4_entry(iter) \
        container_of(iter, struct netlbl_domaddr4_map, list)
 struct netlbl_domaddr4_map {
-        u32 type;
+        struct netlbl_dommap_def def;
-        union {
-                struct cipso_v4_doi *cipsov4;
-        } type_def;
        struct netlbl_af4list list;
 };
 #define netlbl_domhsh_addr6_entry(iter) \
        container_of(iter, struct netlbl_domaddr6_map, list)
 struct netlbl_domaddr6_map {
-        u32 type;
+        struct netlbl_dommap_def def;
-        /* NOTE: no 'type_def' union needed at present since we don't currently
-         *       support any IPv6 labeling protocols */
        struct netlbl_af6list list;
 };
-struct netlbl_domaddr_map {
-        struct list_head list4;
-        struct list_head list6;
-};
 struct netlbl_dom_map {
        char *domain;
-        u32 type;
+        struct netlbl_dommap_def def;
-        union {
-                struct cipso_v4_doi *cipsov4;
-                struct netlbl_domaddr_map *addrsel;
-        } type_def;
        u32 valid;
        struct list_head list;
@@ -97,16 +95,16 @@ int netlbl_domhsh_remove_af4(const char *domain,
 int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info);
 int netlbl_domhsh_remove_default(struct netlbl_audit *audit_info);
 struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain);
-struct netlbl_domaddr4_map *netlbl_domhsh_getentry_af4(const char *domain,
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af4(const char *domain,
-                                                       __be32 addr);
+                                                     __be32 addr);
+#if IS_ENABLED(CONFIG_IPV6)
+struct netlbl_dommap_def *netlbl_domhsh_getentry_af6(const char *domain,
+                                                   const struct in6_addr *addr);
+#endif /* IPv6 */
 int netlbl_domhsh_walk(u32 *skip_bkt,
                     u32 *skip_chain,
                     int (*callback) (struct netlbl_dom_map *entry, void *arg),
                     void *cb_arg);
-#if IS_ENABLED(CONFIG_IPV6)
-struct netlbl_domaddr6_map *netlbl_domhsh_getentry_af6(const char *domain,
-                                                  const struct in6_addr *addr);
-#endif /* IPv6 */
 #endif
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 7c94aedd0912..96a458e12f60 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -122,7 +122,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
        }
        if (addr == NULL && mask == NULL)
-                entry->type = NETLBL_NLTYPE_UNLABELED;
+                entry->def.type = NETLBL_NLTYPE_UNLABELED;
        else if (addr != NULL && mask != NULL) {
                addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                if (addrmap == NULL)
@@ -137,7 +137,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                        map4 = kzalloc(sizeof(*map4), GFP_ATOMIC);
                        if (map4 == NULL)
                                goto cfg_unlbl_map_add_failure;
-                        map4->type = NETLBL_NLTYPE_UNLABELED;
+                        map4->def.type = NETLBL_NLTYPE_UNLABELED;
                        map4->list.addr = addr4->s_addr & mask4->s_addr;
                        map4->list.mask = mask4->s_addr;
                        map4->list.valid = 1;
@@ -154,7 +154,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                        map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
                        if (map6 == NULL)
                                goto cfg_unlbl_map_add_failure;
-                        map6->type = NETLBL_NLTYPE_UNLABELED;
+                        map6->def.type = NETLBL_NLTYPE_UNLABELED;
                        map6->list.addr = *addr6;
                        map6->list.addr.s6_addr32[0] &= mask6->s6_addr32[0];
                        map6->list.addr.s6_addr32[1] &= mask6->s6_addr32[1];
@@ -174,8 +174,8 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                        break;
                }
-                entry->type_def.addrsel = addrmap;
+                entry->def.addrsel = addrmap;
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
        } else {
                ret_val = -EINVAL;
                goto cfg_unlbl_map_add_failure;
@@ -355,8 +355,8 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
        }
        if (addr == NULL && mask == NULL) {
-                entry->type_def.cipsov4 = doi_def;
+                entry->def.cipso = doi_def;
-                entry->type = NETLBL_NLTYPE_CIPSOV4;
+                entry->def.type = NETLBL_NLTYPE_CIPSOV4;
        } else if (addr != NULL && mask != NULL) {
                addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
                if (addrmap == NULL)
@@ -367,8 +367,8 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
                addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
                if (addrinfo == NULL)
                        goto out_addrinfo;
-                addrinfo->type_def.cipsov4 = doi_def;
+                addrinfo->def.cipso = doi_def;
-                addrinfo->type = NETLBL_NLTYPE_CIPSOV4;
+                addrinfo->def.type = NETLBL_NLTYPE_CIPSOV4;
                addrinfo->list.addr = addr->s_addr & mask->s_addr;
                addrinfo->list.mask = mask->s_addr;
                addrinfo->list.valid = 1;
@@ -376,8 +376,8 @@ int netlbl_cfg_cipsov4_map_add(u32 doi,
                if (ret_val != 0)
                        goto cfg_cipsov4_map_add_failure;
-                entry->type_def.addrsel = addrmap;
+                entry->def.addrsel = addrmap;
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
        } else {
                ret_val = -EINVAL;
                goto out_addrmap;
@@ -657,14 +657,14 @@ int netlbl_sock_setattr(struct sock *sk,
        }
        switch (family) {
        case AF_INET:
-                switch (dom_entry->type) {
+                switch (dom_entry->def.type) {
                case NETLBL_NLTYPE_ADDRSELECT:
                        ret_val = -EDESTADDRREQ;
                        break;
                case NETLBL_NLTYPE_CIPSOV4:
                        ret_val = cipso_v4_sock_setattr(sk,
-                                                    dom_entry->type_def.cipsov4,
+                                                        dom_entry->def.cipso,
-                                                    secattr);
+                                                        secattr);
                        break;
                case NETLBL_NLTYPE_UNLABELED:
                        ret_val = 0;
@@ -754,23 +754,22 @@ int netlbl_conn_setattr(struct sock *sk,
 {
        int ret_val;
        struct sockaddr_in *addr4;
-        struct netlbl_domaddr4_map *af4_entry;
+        struct netlbl_dommap_def *entry;
        rcu_read_lock();
        switch (addr->sa_family) {
        case AF_INET:
                addr4 = (struct sockaddr_in *)addr;
-                af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
+                entry = netlbl_domhsh_getentry_af4(secattr->domain,
-                                                       addr4->sin_addr.s_addr);
+                                                   addr4->sin_addr.s_addr);
-                if (af4_entry == NULL) {
+                if (entry == NULL) {
                        ret_val = -ENOENT;
                        goto conn_setattr_return;
                }
-                switch (af4_entry->type) {
+                switch (entry->type) {
                case NETLBL_NLTYPE_CIPSOV4:
                        ret_val = cipso_v4_sock_setattr(sk,
-                                                   af4_entry->type_def.cipsov4,
+                                                        entry->cipso, secattr);
-                                                   secattr);
                        break;
                case NETLBL_NLTYPE_UNLABELED:
                        /* just delete the protocols we support for right now
@@ -812,36 +811,21 @@ int netlbl_req_setattr(struct request_sock *req,
                       const struct netlbl_lsm_secattr *secattr)
 {
        int ret_val;
-        struct netlbl_dom_map *dom_entry;
+        struct netlbl_dommap_def *entry;
-        struct netlbl_domaddr4_map *af4_entry;
-        u32 proto_type;
-        struct cipso_v4_doi *proto_cv4;
        rcu_read_lock();
-        dom_entry = netlbl_domhsh_getentry(secattr->domain);
-        if (dom_entry == NULL) {
-                ret_val = -ENOENT;
-                goto req_setattr_return;
-        }
        switch (req->rsk_ops->family) {
        case AF_INET:
-                if (dom_entry->type == NETLBL_NLTYPE_ADDRSELECT) {
+                entry = netlbl_domhsh_getentry_af4(secattr->domain,
-                        struct inet_request_sock *req_inet = inet_rsk(req);
+                                                   inet_rsk(req)->rmt_addr);
-                        af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
+                if (entry == NULL) {
-                                                            req_inet->rmt_addr);
+                        ret_val = -ENOENT;
-                        if (af4_entry == NULL) {
+                        goto req_setattr_return;
-                                ret_val = -ENOENT;
-                                goto req_setattr_return;
-                        }
-                        proto_type = af4_entry->type;
-                        proto_cv4 = af4_entry->type_def.cipsov4;
-                } else {
-                        proto_type = dom_entry->type;
-                        proto_cv4 = dom_entry->type_def.cipsov4;
                }
-                switch (proto_type) {
+                switch (entry->type) {
                case NETLBL_NLTYPE_CIPSOV4:
-                        ret_val = cipso_v4_req_setattr(req, proto_cv4, secattr);
+                        ret_val = cipso_v4_req_setattr(req,
+                                                       entry->cipso, secattr);
                        break;
                case NETLBL_NLTYPE_UNLABELED:
                        /* just delete the protocols we support for right now
@@ -899,23 +883,21 @@ int netlbl_skbuff_setattr(struct sk_buff *skb,
 {
        int ret_val;
        struct iphdr *hdr4;
-        struct netlbl_domaddr4_map *af4_entry;
+        struct netlbl_dommap_def *entry;
        rcu_read_lock();
        switch (family) {
        case AF_INET:
                hdr4 = ip_hdr(skb);
-                af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
+                entry = netlbl_domhsh_getentry_af4(secattr->domain,hdr4->daddr);
-                                                       hdr4->daddr);
+                if (entry == NULL) {
-                if (af4_entry == NULL) {
                        ret_val = -ENOENT;
                        goto skbuff_setattr_return;
                }
-                switch (af4_entry->type) {
+                switch (entry->type) {
                case NETLBL_NLTYPE_CIPSOV4:
-                        ret_val = cipso_v4_skbuff_setattr(skb,
+                        ret_val = cipso_v4_skbuff_setattr(skb, entry->cipso,
-                                                   af4_entry->type_def.cipsov4,
+                                                          secattr);
-                                                   secattr);
                        break;
                case NETLBL_NLTYPE_UNLABELED:
                        /* just delete the protocols we support for right now
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index c5384ffc6146..dd1c37d7acbc 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -104,7 +104,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                ret_val = -ENOMEM;
                goto add_failure;
        }
-        entry->type = nla_get_u32(info->attrs[NLBL_MGMT_A_PROTOCOL]);
+        entry->def.type = nla_get_u32(info->attrs[NLBL_MGMT_A_PROTOCOL]);
        if (info->attrs[NLBL_MGMT_A_DOMAIN]) {
                size_t tmp_size = nla_len(info->attrs[NLBL_MGMT_A_DOMAIN]);
                entry->domain = kmalloc(tmp_size, GFP_KERNEL);
@@ -116,12 +116,12 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                            info->attrs[NLBL_MGMT_A_DOMAIN], tmp_size);
        }
-        /* NOTE: internally we allow/use a entry->type value of
+        /* NOTE: internally we allow/use a entry->def.type value of
         *       NETLBL_NLTYPE_ADDRSELECT but we don't currently allow users
         *       to pass that as a protocol value because we need to know the
         *       "real" protocol */
-        switch (entry->type) {
+        switch (entry->def.type) {
        case NETLBL_NLTYPE_UNLABELED:
                break;
        case NETLBL_NLTYPE_CIPSOV4:
@@ -132,7 +132,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                cipsov4 = cipso_v4_doi_getdef(tmp_val);
                if (cipsov4 == NULL)
                        goto add_failure;
-                entry->type_def.cipsov4 = cipsov4;
+                entry->def.cipso = cipsov4;
                break;
        default:
                goto add_failure;
@@ -172,9 +172,9 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                map->list.addr = addr->s_addr & mask->s_addr;
                map->list.mask = mask->s_addr;
                map->list.valid = 1;
-                map->type = entry->type;
+                map->def.type = entry->def.type;
                if (cipsov4)
-                        map->type_def.cipsov4 = cipsov4;
+                        map->def.cipso = cipsov4;
                ret_val = netlbl_af4list_add(&map->list, &addrmap->list4);
                if (ret_val != 0) {
@@ -182,8 +182,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                        goto add_failure;
                }
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
-                entry->type_def.addrsel = addrmap;
+                entry->def.addrsel = addrmap;
 #if IS_ENABLED(CONFIG_IPV6)
        } else if (info->attrs[NLBL_MGMT_A_IPV6ADDR]) {
                struct in6_addr *addr;
@@ -223,7 +223,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                map->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
                map->list.mask = *mask;
                map->list.valid = 1;
-                map->type = entry->type;
+                map->def.type = entry->def.type;
                ret_val = netlbl_af6list_add(&map->list, &addrmap->list6);
                if (ret_val != 0) {
@@ -231,8 +231,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info,
                        goto add_failure;
                }
-                entry->type = NETLBL_NLTYPE_ADDRSELECT;
+                entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
-                entry->type_def.addrsel = addrmap;
+                entry->def.addrsel = addrmap;
 #endif /* IPv6 */
        }
@@ -281,14 +281,13 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                        return ret_val;
        }
-        switch (entry->type) {
+        switch (entry->def.type) {
        case NETLBL_NLTYPE_ADDRSELECT:
                nla_a = nla_nest_start(skb, NLBL_MGMT_A_SELECTORLIST);
                if (nla_a == NULL)
                        return -ENOMEM;
-                netlbl_af4list_foreach_rcu(iter4,
+                netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) {
-                                           &entry->type_def.addrsel->list4) {
                        struct netlbl_domaddr4_map *map4;
                        struct in_addr addr_struct;
@@ -310,13 +309,13 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                                return ret_val;
                        map4 = netlbl_domhsh_addr4_entry(iter4);
                        ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
-                                              map4->type);
+                                              map4->def.type);
                        if (ret_val != 0)
                                return ret_val;
-                        switch (map4->type) {
+                        switch (map4->def.type) {
                        case NETLBL_NLTYPE_CIPSOV4:
                                ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI,
-                                                  map4->type_def.cipsov4->doi);
+                                                      map4->def.cipso->doi);
                                if (ret_val != 0)
                                        return ret_val;
                                break;
@@ -325,8 +324,7 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                        nla_nest_end(skb, nla_b);
                }
 #if IS_ENABLED(CONFIG_IPV6)
-                netlbl_af6list_foreach_rcu(iter6,
+                netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) {
-                                           &entry->type_def.addrsel->list6) {
                        struct netlbl_domaddr6_map *map6;
                        nla_b = nla_nest_start(skb, NLBL_MGMT_A_ADDRSELECTOR);
@@ -345,7 +343,7 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                                return ret_val;
                        map6 = netlbl_domhsh_addr6_entry(iter6);
                        ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
-                                              map6->type);
+                                              map6->def.type);
                        if (ret_val != 0)
                                return ret_val;
@@ -356,14 +354,14 @@ static int netlbl_mgmt_listentry(struct sk_buff *skb,
                nla_nest_end(skb, nla_a);
                break;
        case NETLBL_NLTYPE_UNLABELED:
-                ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, entry->type);
+                ret_val = nla_put_u32(skb,NLBL_MGMT_A_PROTOCOL,entry->def.type);
                break;
        case NETLBL_NLTYPE_CIPSOV4:
-                ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, entry->type);
+                ret_val = nla_put_u32(skb,NLBL_MGMT_A_PROTOCOL,entry->def.type);
                if (ret_val != 0)
                        return ret_val;
                ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI,
-                                      entry->type_def.cipsov4->doi);
+                                      entry->def.cipso->doi);
                break;
        }
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index af3531926ee0..8f0897407a2c 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1541,7 +1541,7 @@ int __init netlbl_unlabel_defconf(void)
        entry = kzalloc(sizeof(*entry), GFP_KERNEL);
        if (entry == NULL)
                return -ENOMEM;
-        entry->type = NETLBL_NLTYPE_UNLABELED;
+        entry->def.type = NETLBL_NLTYPE_UNLABELED;
        ret_val = netlbl_domhsh_add_default(entry, &audit_info);
        if (ret_val != 0)
                return ret_val;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 2fd6dbea327a..512718adb0d5 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -571,7 +571,7 @@ static int genl_family_rcv_msg(struct genl_family *family,
            !capable(CAP_NET_ADMIN))
                return -EPERM;
-        if (nlh->nlmsg_flags & NLM_F_DUMP) {
+        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
                struct netlink_dump_control c = {
                        .dump = ops->dumpit,
                        .done = ops->done,
@@ -877,8 +877,10 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
 #ifdef CONFIG_MODULES
                if (res == NULL) {
                        genl_unlock();
+                        up_read(&cb_lock);
                        request_module("net-pf-%d-proto-%d-family-%s",
                                       PF_NETLINK, NETLINK_GENERIC, name);
+                        down_read(&cb_lock);
                        genl_lock();
                        res = genl_family_find_byname(name);
                }
diff --git a/net/nfc/core.c b/net/nfc/core.c
index dc96a83aa6ab..1d074dd1650f 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -44,7 +44,7 @@ DEFINE_MUTEX(nfc_devlist_mutex);
 /* NFC device ID bitmap */
 static DEFINE_IDA(nfc_index_ida);
-int nfc_fw_upload(struct nfc_dev *dev, const char *firmware_name)
+int nfc_fw_download(struct nfc_dev *dev, const char *firmware_name)
 {
        int rc = 0;
@@ -62,28 +62,28 @@ int nfc_fw_upload(struct nfc_dev *dev, const char *firmware_name)
                goto error;
        }
-        if (!dev->ops->fw_upload) {
+        if (!dev->ops->fw_download) {
                rc = -EOPNOTSUPP;
                goto error;
        }
-        dev->fw_upload_in_progress = true;
+        dev->fw_download_in_progress = true;
-        rc = dev->ops->fw_upload(dev, firmware_name);
+        rc = dev->ops->fw_download(dev, firmware_name);
        if (rc)
-                dev->fw_upload_in_progress = false;
+                dev->fw_download_in_progress = false;
 error:
        device_unlock(&dev->dev);
        return rc;
 }
-int nfc_fw_upload_done(struct nfc_dev *dev, const char *firmware_name)
+int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name)
 {
-        dev->fw_upload_in_progress = false;
+        dev->fw_download_in_progress = false;
-        return nfc_genl_fw_upload_done(dev, firmware_name);
+        return nfc_genl_fw_download_done(dev, firmware_name);
 }
-EXPORT_SYMBOL(nfc_fw_upload_done);
+EXPORT_SYMBOL(nfc_fw_download_done);
 /**
 * nfc_dev_up - turn on the NFC device
@@ -110,7 +110,7 @@ int nfc_dev_up(struct nfc_dev *dev)
                goto error;
        }
-        if (dev->fw_upload_in_progress) {
+        if (dev->fw_download_in_progress) {
                rc = -EBUSY;
                goto error;
        }
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index 7b1c186736eb..fe66908401f5 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -809,14 +809,14 @@ static void nfc_hci_recv_from_llc(struct nfc_hci_dev *hdev, struct sk_buff *skb)
        }
 }
-static int hci_fw_upload(struct nfc_dev *nfc_dev, const char *firmware_name)
+static int hci_fw_download(struct nfc_dev *nfc_dev, const char *firmware_name)
 {
        struct nfc_hci_dev *hdev = nfc_get_drvdata(nfc_dev);
-        if (!hdev->ops->fw_upload)
+        if (!hdev->ops->fw_download)
                return -ENOTSUPP;
-        return hdev->ops->fw_upload(hdev, firmware_name);
+        return hdev->ops->fw_download(hdev, firmware_name);
 }
 static struct nfc_ops hci_nfc_ops = {
@@ -831,7 +831,7 @@ static struct nfc_ops hci_nfc_ops = {
        .im_transceive = hci_transceive,
        .tm_send = hci_tm_send,
        .check_presence = hci_check_presence,
-        .fw_upload = hci_fw_upload,
+        .fw_download = hci_fw_download,
        .discover_se = hci_discover_se,
        .enable_se = hci_enable_se,
        .disable_se = hci_disable_se,
diff --git a/net/nfc/nci/Kconfig b/net/nfc/nci/Kconfig
index 2a2416080b4f..a4f1e42e3481 100644
--- a/net/nfc/nci/Kconfig
+++ b/net/nfc/nci/Kconfig
@@ -11,6 +11,7 @@ config NFC_NCI
 config NFC_NCI_SPI
        depends on NFC_NCI && SPI
+        select CRC_CCITT
        bool "NCI over SPI protocol support"
        default n
        help
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index b05ad909778f..f16fd59d4160 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -1089,7 +1089,7 @@ exit:
        return rc;
 }
-static int nfc_genl_fw_upload(struct sk_buff *skb, struct genl_info *info)
+static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info)
 {
        struct nfc_dev *dev;
        int rc;
@@ -1108,13 +1108,13 @@ static int nfc_genl_fw_upload(struct sk_buff *skb, struct genl_info *info)
        nla_strlcpy(firmware_name, info->attrs[NFC_ATTR_FIRMWARE_NAME],
                    sizeof(firmware_name));
-        rc = nfc_fw_upload(dev, firmware_name);
+        rc = nfc_fw_download(dev, firmware_name);
        nfc_put_device(dev);
        return rc;
 }
-int nfc_genl_fw_upload_done(struct nfc_dev *dev, const char *firmware_name)
+int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name)
 {
        struct sk_buff *msg;
        void *hdr;
@@ -1124,7 +1124,7 @@ int nfc_genl_fw_upload_done(struct nfc_dev *dev, const char *firmware_name)
                return -ENOMEM;
        hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
-                          NFC_CMD_FW_UPLOAD);
+                          NFC_CMD_FW_DOWNLOAD);
        if (!hdr)
                goto free_msg;
@@ -1251,8 +1251,8 @@ static struct genl_ops nfc_genl_ops[] = {
                .policy = nfc_genl_policy,
        },
        {
-                .cmd = NFC_CMD_FW_UPLOAD,
+                .cmd = NFC_CMD_FW_DOWNLOAD,
-                .doit = nfc_genl_fw_upload,
+                .doit = nfc_genl_fw_download,
                .policy = nfc_genl_policy,
        },
        {
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index ee85a1fc1b24..820a7850c36a 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -123,10 +123,10 @@ static inline void nfc_device_iter_exit(struct class_dev_iter *iter)
        class_dev_iter_exit(iter);
 }
-int nfc_fw_upload(struct nfc_dev *dev, const char *firmware_name);
+int nfc_fw_download(struct nfc_dev *dev, const char *firmware_name);
-int nfc_genl_fw_upload_done(struct nfc_dev *dev, const char *firmware_name);
+int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name);
-int nfc_fw_upload_done(struct nfc_dev *dev, const char *firmware_name);
+int nfc_fw_download_done(struct nfc_dev *dev, const char *firmware_name);
 int nfc_dev_up(struct nfc_dev *dev);
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 22c5f399f1cf..ab101f715447 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -535,6 +535,7 @@ int ovs_execute_actions(struct datapath *dp, struct sk_buff *skb)
 {
        struct sw_flow_actions *acts = rcu_dereference(OVS_CB(skb)->flow->sf_acts);
+        OVS_CB(skb)->tun_key = NULL;
        return do_execute_actions(dp, skb, acts->actions,
                                         acts->actions_len, false);
 }
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index f7e3a0d84c40..f2ed7600084e 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -2076,9 +2076,6 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
        ovs_notify(reply, info, &ovs_dp_vport_multicast_group);
        return 0;
-        rtnl_unlock();
-        return 0;
 exit_free:
        kfree_skb(reply);
 exit_unlock:
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index 5c519b121e1b..1aa84dc58777 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -240,7 +240,7 @@ static struct flex_array *alloc_buckets(unsigned int n_buckets)
        struct flex_array *buckets;
        int i, err;
-        buckets = flex_array_alloc(sizeof(struct hlist_head *),
+        buckets = flex_array_alloc(sizeof(struct hlist_head),
                                   n_buckets, GFP_KERNEL);
        if (!buckets)
                return NULL;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 4b66c752eae5..75c8bbf598c8 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3259,9 +3259,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
                if (po->tp_version == TPACKET_V3) {
                        lv = sizeof(struct tpacket_stats_v3);
+                        st.stats3.tp_packets += st.stats3.tp_drops;
                        data = &st.stats3;
                } else {
                        lv = sizeof(struct tpacket_stats);
+                        st.stats1.tp_packets += st.stats1.tp_drops;
                        data = &st.stats1;
                }
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 281c1bded1f6..51b968d3febb 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -285,6 +285,45 @@ static struct Qdisc_ops *qdisc_lookup_ops(struct nlattr *kind)
        return q;
 }
+/* The linklayer setting were not transferred from iproute2, in older
+ * versions, and the rate tables lookup systems have been dropped in
+ * the kernel. To keep backward compatible with older iproute2 tc
+ * utils, we detect the linklayer setting by detecting if the rate
+ * table were modified.
+ *
+ * For linklayer ATM table entries, the rate table will be aligned to
+ * 48 bytes, thus some table entries will contain the same value.  The
+ * mpu (min packet unit) is also encoded into the old rate table, thus
+ * starting from the mpu, we find low and high table entries for
+ * mapping this cell.  If these entries contain the same value, when
+ * the rate tables have been modified for linklayer ATM.
+ *
+ * This is done by rounding mpu to the nearest 48 bytes cell/entry,
+ * and then roundup to the next cell, calc the table entry one below,
+ * and compare.
+ */
+static __u8 __detect_linklayer(struct tc_ratespec *r, __u32 *rtab)
+{
+        int low       = roundup(r->mpu, 48);
+        int high      = roundup(low+1, 48);
+        int cell_low  = low >> r->cell_log;
+        int cell_high = (high >> r->cell_log) - 1;
+        /* rtab is too inaccurate at rates > 100Mbit/s */
+        if ((r->rate > (100000000/8)) || (rtab[0] == 0)) {
+                pr_debug("TC linklayer: Giving up ATM detection\n");
+                return TC_LINKLAYER_ETHERNET;
+        }
+        if ((cell_high > cell_low) && (cell_high < 256)
+            && (rtab[cell_low] == rtab[cell_high])) {
+                pr_debug("TC linklayer: Detected ATM, low(%d)=high(%d)=%u\n",
+                         cell_low, cell_high, rtab[cell_high]);
+                return TC_LINKLAYER_ATM;
+        }
+        return TC_LINKLAYER_ETHERNET;
+}
 static struct qdisc_rate_table *qdisc_rtab_list;
 struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r, struct nlattr *tab)
@@ -308,6 +347,8 @@ struct qdisc_rate_table *qdisc_get_rtab(struct tc_ratespec *r, struct nlattr *ta
                rtab->rate = *r;
                rtab->refcnt = 1;
                memcpy(rtab->data, nla_data(tab), 1024);
+                if (r->linklayer == TC_LINKLAYER_UNAWARE)
+                        r->linklayer = __detect_linklayer(r, rtab->data);
                rtab->next = qdisc_rtab_list;
                qdisc_rtab_list = rtab;
        }
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index ca8e0a57d945..1f9c31411f19 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -605,6 +605,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
                struct sockaddr_atmpvc pvc;
                int state;
+                memset(&pvc, 0, sizeof(pvc));
                pvc.sap_family = AF_ATMPVC;
                pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
                pvc.sap_addr.vpi = flow->vcc->vpi;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 71a568862557..7a42c81a19eb 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1465,6 +1465,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
        unsigned char *b = skb_tail_pointer(skb);
        struct tc_cbq_wrropt opt;
+        memset(&opt, 0, sizeof(opt));
        opt.flags = 0;
        opt.allot = cl->allot;
        opt.priority = cl->priority + 1;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 4626cef4b76e..48be3d5c0d92 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -25,6 +25,7 @@
 #include <linux/rcupdate.h>
 #include <linux/list.h>
 #include <linux/slab.h>
+#include <linux/if_vlan.h>
 #include <net/sch_generic.h>
 #include <net/pkt_sched.h>
 #include <net/dst.h>
@@ -207,15 +208,19 @@ void __qdisc_run(struct Qdisc *q)
 unsigned long dev_trans_start(struct net_device *dev)
 {
-        unsigned long val, res = dev->trans_start;
+        unsigned long val, res;
        unsigned int i;
+        if (is_vlan_dev(dev))
+                dev = vlan_dev_real_dev(dev);
+        res = dev->trans_start;
        for (i = 0; i < dev->num_tx_queues; i++) {
                val = netdev_get_tx_queue(dev, i)->trans_start;
                if (val && time_after(val, res))
                        res = val;
        }
        dev->trans_start = res;
        return res;
 }
 EXPORT_SYMBOL(dev_trans_start);
@@ -904,6 +909,7 @@ void psched_ratecfg_precompute(struct psched_ratecfg *r,
        memset(r, 0, sizeof(*r));
        r->overhead = conf->overhead;
        r->rate_bytes_ps = conf->rate;
+        r->linklayer = (conf->linklayer & TC_LINKLAYER_MASK);
        r->mult = 1;
        /*
         * The deal here is to replace a divide by a reciprocal one
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index c2124ea29f45..c2178b15ca6e 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -100,7 +100,7 @@ struct htb_class {
        struct psched_ratecfg   ceil;
        s64                     buffer, cbuffer;/* token bucket depth/rate */
        s64                     mbuffer;        /* max wait time */
-        int                     prio;           /* these two are used only by leaves... */
+        u32                     prio;           /* these two are used only by leaves... */
        int                     quantum;        /* but stored for parent-to-leaf return */
        struct tcf_proto        *filter_list;   /* class attached filters */
@@ -1329,6 +1329,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
        struct htb_sched *q = qdisc_priv(sch);
        struct htb_class *cl = (struct htb_class *)*arg, *parent;
        struct nlattr *opt = tca[TCA_OPTIONS];
+        struct qdisc_rate_table *rtab = NULL, *ctab = NULL;
        struct nlattr *tb[TCA_HTB_MAX + 1];
        struct tc_htb_opt *hopt;
@@ -1350,6 +1351,18 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
        if (!hopt->rate.rate || !hopt->ceil.rate)
                goto failure;
+        /* Keeping backward compatible with rate_table based iproute2 tc */
+        if (hopt->rate.linklayer == TC_LINKLAYER_UNAWARE) {
+                rtab = qdisc_get_rtab(&hopt->rate, tb[TCA_HTB_RTAB]);
+                if (rtab)
+                        qdisc_put_rtab(rtab);
+        }
+        if (hopt->ceil.linklayer == TC_LINKLAYER_UNAWARE) {
+                ctab = qdisc_get_rtab(&hopt->ceil, tb[TCA_HTB_CTAB]);
+                if (ctab)
+                        qdisc_put_rtab(ctab);
+        }
        if (!cl) {              /* new class */
                struct Qdisc *new_q;
                int prio;
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index bce5b79662a6..ab67efc64b24 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -846,12 +846,12 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
                else
                        spc_state = SCTP_ADDR_AVAILABLE;
                /* Don't inform ULP about transition from PF to
-                 * active state and set cwnd to 1, see SCTP
+                 * active state and set cwnd to 1 MTU, see SCTP
                 * Quick failover draft section 5.1, point 5
                 */
                if (transport->state == SCTP_PF) {
                        ulp_notify = false;
-                        transport->cwnd = 1;
+                        transport->cwnd = asoc->pathmtu;
                }
                transport->state = SCTP_ACTIVE;
                break;
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index bdbbc3fd7c14..8fdd16046d66 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -181,12 +181,12 @@ static void sctp_transport_destroy(struct sctp_transport *transport)
                return;
        }
-        call_rcu(&transport->rcu, sctp_transport_destroy_rcu);
        sctp_packet_free(&transport->packet);
        if (transport->asoc)
                sctp_association_put(transport->asoc);
+        call_rcu(&transport->rcu, sctp_transport_destroy_rcu);
 }
 /* Start T3_rtx timer if it is not already running and update the heartbeat
diff --git a/net/socket.c b/net/socket.c
index 829b460acb87..b2d7c629eeb9 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -106,7 +106,7 @@
 #include <linux/atalk.h>
 #include <net/busy_poll.h>
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
 unsigned int sysctl_net_busy_read __read_mostly;
 unsigned int sysctl_net_busy_poll __read_mostly;
 #endif
diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c
index d304f41260f2..af7ffd447fee 100644
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -120,7 +120,7 @@ static int gssp_rpc_create(struct net *net, struct rpc_clnt **_clnt)
        if (IS_ERR(clnt)) {
                dprintk("RPC:       failed to create AF_LOCAL gssproxy "
                                "client (errno %ld).\n", PTR_ERR(clnt));
-                result = -PTR_ERR(clnt);
+                result = PTR_ERR(clnt);
                *_clnt = NULL;
                goto out;
        }
@@ -328,7 +328,6 @@ void gssp_free_upcall_data(struct gssp_upcall_data *data)
        kfree(data->in_handle.data);
        kfree(data->out_handle.data);
        kfree(data->out_token.data);
-        kfree(data->mech_oid.data);
        free_svc_cred(&data->creds);
 }
diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
index 357f613df7ff..3c85d1c8a028 100644
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
@@ -430,7 +430,7 @@ static int dummy_enc_nameattr_array(struct xdr_stream *xdr,
 static int dummy_dec_nameattr_array(struct xdr_stream *xdr,
                                    struct gssx_name_attr_array *naa)
 {
-        struct gssx_name_attr dummy;
+        struct gssx_name_attr dummy = { .attr = {.len = 0} };
        u32 count, i;
        __be32 *p;
@@ -493,12 +493,13 @@ static int gssx_enc_name(struct xdr_stream *xdr,
        return err;
 }
 static int gssx_dec_name(struct xdr_stream *xdr,
                         struct gssx_name *name)
 {
-        struct xdr_netobj dummy_netobj;
+        struct xdr_netobj dummy_netobj = { .len = 0 };
-        struct gssx_name_attr_array dummy_name_attr_array;
+        struct gssx_name_attr_array dummy_name_attr_array = { .count = 0 };
-        struct gssx_option_array dummy_option_array;
+        struct gssx_option_array dummy_option_array = { .count = 0 };
        int err;
        /* name->display_name */
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index d0347d148b34..09fb638bcaa4 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1180,6 +1180,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
                gm = gss_mech_get_by_OID(&ud->mech_oid);
                if (!gm)
                        goto out;
+                rsci.cred.cr_gss_mech = gm;
                status = -EINVAL;
                /* mech-specific data: */
@@ -1195,7 +1196,6 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
        rscp = rsc_update(cd, &rsci, rscp);
        status = 0;
 out:
-        gss_mech_put(gm);
        rsc_free(&rsci);
        if (rscp)
                cache_put(&rscp->h, cd);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 74f6a704e374..ecbc4e3d83ad 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1660,6 +1660,10 @@ call_connect(struct rpc_task *task)
                task->tk_action = call_connect_status;
                if (task->tk_status < 0)
                        return;
+                if (task->tk_flags & RPC_TASK_NOCONNECT) {
+                        rpc_exit(task, -ENOTCONN);
+                        return;
+                }
                xprt_connect(task);
        }
 }
diff --git a/net/sunrpc/netns.h b/net/sunrpc/netns.h
index 74d948f5d5a1..779742cfc1ff 100644
--- a/net/sunrpc/netns.h
+++ b/net/sunrpc/netns.h
@@ -23,6 +23,7 @@ struct sunrpc_net {
        struct rpc_clnt *rpcb_local_clnt4;
        spinlock_t rpcb_clnt_lock;
        unsigned int rpcb_users;
+        unsigned int rpcb_is_af_local : 1;
        struct mutex gssp_lock;
        wait_queue_head_t gssp_wq;
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 3df764dc330c..1891a1022c17 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -204,13 +204,15 @@ void rpcb_put_local(struct net *net)
 }
 static void rpcb_set_local(struct net *net, struct rpc_clnt *clnt,
-                        struct rpc_clnt *clnt4)
+                        struct rpc_clnt *clnt4,
+                        bool is_af_local)
 {
        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
        /* Protected by rpcb_create_local_mutex */
        sn->rpcb_local_clnt = clnt;
        sn->rpcb_local_clnt4 = clnt4;
+        sn->rpcb_is_af_local = is_af_local ? 1 : 0;
        smp_wmb(); 
        sn->rpcb_users = 1;
        dprintk("RPC:       created new rpcb local clients (rpcb_local_clnt: "
@@ -238,6 +240,14 @@ static int rpcb_create_local_unix(struct net *net)
                .program        = &rpcb_program,
                .version        = RPCBVERS_2,
                .authflavor     = RPC_AUTH_NULL,
+                /*
+                 * We turn off the idle timeout to prevent the kernel
+                 * from automatically disconnecting the socket.
+                 * Otherwise, we'd have to cache the mount namespace
+                 * of the caller and somehow pass that to the socket
+                 * reconnect code.
+                 */
+                .flags          = RPC_CLNT_CREATE_NO_IDLE_TIMEOUT,
        };
        struct rpc_clnt *clnt, *clnt4;
        int result = 0;
@@ -263,7 +273,7 @@ static int rpcb_create_local_unix(struct net *net)
                clnt4 = NULL;
        }
-        rpcb_set_local(net, clnt, clnt4);
+        rpcb_set_local(net, clnt, clnt4, true);
 out:
        return result;
@@ -315,7 +325,7 @@ static int rpcb_create_local_net(struct net *net)
                clnt4 = NULL;
        }
-        rpcb_set_local(net, clnt, clnt4);
+        rpcb_set_local(net, clnt, clnt4, false);
 out:
        return result;
@@ -376,13 +386,16 @@ static struct rpc_clnt *rpcb_create(struct net *net, const char *hostname,
        return rpc_create(&args);
 }
-static int rpcb_register_call(struct rpc_clnt *clnt, struct rpc_message *msg)
+static int rpcb_register_call(struct sunrpc_net *sn, struct rpc_clnt *clnt, struct rpc_message *msg, bool is_set)
 {
-        int result, error = 0;
+        int flags = RPC_TASK_NOCONNECT;
+        int error, result = 0;
+        if (is_set || !sn->rpcb_is_af_local)
+                flags = RPC_TASK_SOFTCONN;
        msg->rpc_resp = &result;
-        error = rpc_call_sync(clnt, msg, RPC_TASK_SOFTCONN);
+        error = rpc_call_sync(clnt, msg, flags);
        if (error < 0) {
                dprintk("RPC:       failed to contact local rpcbind "
                                "server (errno %d).\n", -error);
@@ -439,16 +452,19 @@ int rpcb_register(struct net *net, u32 prog, u32 vers, int prot, unsigned short
                .rpc_argp       = &map,
        };
        struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
+        bool is_set = false;
        dprintk("RPC:       %sregistering (%u, %u, %d, %u) with local "
                        "rpcbind\n", (port ? "" : "un"),
                        prog, vers, prot, port);
        msg.rpc_proc = &rpcb_procedures2[RPCBPROC_UNSET];
-        if (port)
+        if (port != 0) {
                msg.rpc_proc = &rpcb_procedures2[RPCBPROC_SET];
+                is_set = true;
+        }
-        return rpcb_register_call(sn->rpcb_local_clnt, &msg);
+        return rpcb_register_call(sn, sn->rpcb_local_clnt, &msg, is_set);
 }
 /*
@@ -461,6 +477,7 @@ static int rpcb_register_inet4(struct sunrpc_net *sn,
        const struct sockaddr_in *sin = (const struct sockaddr_in *)sap;
        struct rpcbind_args *map = msg->rpc_argp;
        unsigned short port = ntohs(sin->sin_port);
+        bool is_set = false;
        int result;
        map->r_addr = rpc_sockaddr2uaddr(sap, GFP_KERNEL);
@@ -471,10 +488,12 @@ static int rpcb_register_inet4(struct sunrpc_net *sn,
                        map->r_addr, map->r_netid);
        msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
-        if (port)
+        if (port != 0) {
                msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
+                is_set = true;
+        }
-        result = rpcb_register_call(sn->rpcb_local_clnt4, msg);
+        result = rpcb_register_call(sn, sn->rpcb_local_clnt4, msg, is_set);
        kfree(map->r_addr);
        return result;
 }
@@ -489,6 +508,7 @@ static int rpcb_register_inet6(struct sunrpc_net *sn,
        const struct sockaddr_in6 *sin6 = (const struct sockaddr_in6 *)sap;
        struct rpcbind_args *map = msg->rpc_argp;
        unsigned short port = ntohs(sin6->sin6_port);
+        bool is_set = false;
        int result;
        map->r_addr = rpc_sockaddr2uaddr(sap, GFP_KERNEL);
@@ -499,10 +519,12 @@ static int rpcb_register_inet6(struct sunrpc_net *sn,
                        map->r_addr, map->r_netid);
        msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
-        if (port)
+        if (port != 0) {
                msg->rpc_proc = &rpcb_procedures4[RPCBPROC_SET];
+                is_set = true;
+        }
-        result = rpcb_register_call(sn->rpcb_local_clnt4, msg);
+        result = rpcb_register_call(sn, sn->rpcb_local_clnt4, msg, is_set);
        kfree(map->r_addr);
        return result;
 }
@@ -519,7 +541,7 @@ static int rpcb_unregister_all_protofamilies(struct sunrpc_net *sn,
        map->r_addr = "";
        msg->rpc_proc = &rpcb_procedures4[RPCBPROC_UNSET];
-        return rpcb_register_call(sn->rpcb_local_clnt4, msg);
+        return rpcb_register_call(sn, sn->rpcb_local_clnt4, msg, false);
 }
 /**
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 305374d4fb98..7762b9f8a8b7 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1193,7 +1193,9 @@ static int svc_tcp_has_wspace(struct svc_xprt *xprt)
        if (test_bit(XPT_LISTENER, &xprt->xpt_flags))
                return 1;
        required = atomic_read(&xprt->xpt_reserved) + serv->sv_max_mesg;
-        if (sk_stream_wspace(svsk->sk_sk) >= required)
+        if (sk_stream_wspace(svsk->sk_sk) >= required ||
+            (sk_stream_min_wspace(svsk->sk_sk) == 0 &&
+             atomic_read(&xprt->xpt_reserved) == 0))
                return 1;
        set_bit(SOCK_NOSPACE, &svsk->sk_sock->flags);
        return 0;
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index cb29ef7ba2f0..609c30c80816 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -460,6 +460,7 @@ static void bearer_disable(struct tipc_bearer *b_ptr)
 {
        struct tipc_link *l_ptr;
        struct tipc_link *temp_l_ptr;
+        struct tipc_link_req *temp_req;
        pr_info("Disabling bearer <%s>\n", b_ptr->name);
        spin_lock_bh(&b_ptr->lock);
@@ -468,9 +469,13 @@ static void bearer_disable(struct tipc_bearer *b_ptr)
        list_for_each_entry_safe(l_ptr, temp_l_ptr, &b_ptr->links, link_list) {
                tipc_link_delete(l_ptr);
        }
-        if (b_ptr->link_req)
+        temp_req = b_ptr->link_req;
-                tipc_disc_delete(b_ptr->link_req);
+        b_ptr->link_req = NULL;
        spin_unlock_bh(&b_ptr->lock);
+        if (temp_req)
+                tipc_disc_delete(temp_req);
        memset(b_ptr, 0, sizeof(struct tipc_bearer));
 }
diff --git a/net/tipc/server.c b/net/tipc/server.c
index 19da5abe0fa6..fd3fa57a410e 100644
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -355,8 +355,12 @@ static int tipc_open_listening_sock(struct tipc_server *s)
                return PTR_ERR(con);
        sock = tipc_create_listen_sock(con);
-        if (!sock)
+        if (!sock) {
+                idr_remove(&s->conn_idr, con->conid);
+                s->idr_in_use--;
+                kfree(con);
                return -EINVAL;
+        }
        tipc_register_callbacks(sock, con);
        return 0;
@@ -563,9 +567,14 @@ int tipc_server_start(struct tipc_server *s)
                kmem_cache_destroy(s->rcvbuf_cache);
                return ret;
        }
+        ret = tipc_open_listening_sock(s);
+        if (ret < 0) {
+                tipc_work_stop(s);
+                kmem_cache_destroy(s->rcvbuf_cache);
+                return ret;
+        }
        s->enabled = 1;
+        return ret;
-        return tipc_open_listening_sock(s);
 }
 void tipc_server_stop(struct tipc_server *s)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 593071dabd1c..4d9334683f84 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -347,7 +347,7 @@ void vsock_for_each_connected_socket(void (*fn)(struct sock *sk))
        for (i = 0; i < ARRAY_SIZE(vsock_connected_table); i++) {
                struct vsock_sock *vsk;
                list_for_each_entry(vsk, &vsock_connected_table[i],
-                                    connected_table);
+                                    connected_table)
                        fn(sk_vsock(vsk));
        }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 4f9f216665e9..a8c29fa4f1b3 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -765,6 +765,7 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
                cfg80211_leave_mesh(rdev, dev);
                break;
        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
                cfg80211_stop_ap(rdev, dev);
                break;
        default:
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 1cc47aca7f05..5f6e982cdcf4 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -441,10 +441,12 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                        goto out_unlock;
                }
                *rdev = wiphy_to_dev((*wdev)->wiphy);
-                cb->args[0] = (*rdev)->wiphy_idx;
+                /* 0 is the first index - add 1 to parse only once */
+                cb->args[0] = (*rdev)->wiphy_idx + 1;
                cb->args[1] = (*wdev)->identifier;
        } else {
-                struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
+                /* subtract the 1 again here */
+                struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
                struct wireless_dev *tmp;
                if (!wiphy) {
@@ -2620,8 +2622,8 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                             NL80211_CMD_NEW_KEY);
-        if (IS_ERR(hdr))
+        if (!hdr)
-                return PTR_ERR(hdr);
+                return -ENOBUFS;
        cookie.msg = msg;
        cookie.idx = key_idx;
@@ -4770,9 +4772,9 @@ do {									    \
        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
                                  mask, NL80211_MESHCONF_FORWARDING,
                                  nla_get_u8);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
+        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
                                  mask, NL80211_MESHCONF_RSSI_THRESHOLD,
-                                  nla_get_u32);
+                                  nla_get_s32);
        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
                                  mask, NL80211_MESHCONF_HT_OPMODE,
                                  nla_get_u16);
@@ -6505,6 +6507,9 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
                                           NL80211_CMD_TESTMODE);
                struct nlattr *tmdata;
+                if (!hdr)
+                        break;
                if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
                        genlmsg_cancel(skb, hdr);
                        break;
@@ -6613,12 +6618,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
 {
+        struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
        void *hdr = ((void **)skb->cb)[1];
        struct nlattr *data = ((void **)skb->cb)[2];
        nla_nest_end(skb, data);
        genlmsg_end(skb, hdr);
-        genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
+                                nl80211_testmode_mcgrp.id, gfp);
 }
 EXPORT_SYMBOL(cfg80211_testmode_event);
 #endif
@@ -6947,9 +6954,8 @@ static int nl80211_remain_on_channel(struct sk_buff *skb,
        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                             NL80211_CMD_REMAIN_ON_CHANNEL);
+        if (!hdr) {
-        if (IS_ERR(hdr)) {
+                err = -ENOBUFS;
-                err = PTR_ERR(hdr);
                goto free_msg;
        }
@@ -7247,9 +7253,8 @@ static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
                hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                                     NL80211_CMD_FRAME);
+                if (!hdr) {
-                if (IS_ERR(hdr)) {
+                        err = -ENOBUFS;
-                        err = PTR_ERR(hdr);
                        goto free_msg;
                }
        }
@@ -8128,9 +8133,8 @@ static int nl80211_probe_client(struct sk_buff *skb,
        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                             NL80211_CMD_PROBE_CLIENT);
+        if (!hdr) {
-        if (IS_ERR(hdr)) {
+                err = -ENOBUFS;
-                err = PTR_ERR(hdr);
                goto free_msg;
        }
@@ -10064,7 +10068,8 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
        return;
 nla_put_failure:
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 5a24c986f34b..de06d5d1287f 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2247,10 +2247,13 @@ int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env)
 void wiphy_regulatory_register(struct wiphy *wiphy)
 {
+        struct regulatory_request *lr;
        if (!reg_dev_ignore_cell_hint(wiphy))
                reg_num_devs_support_basehint++;
-        wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
+        lr = get_last_request();
+        wiphy_update_regulatory(wiphy, lr->initiator);
 }
 void wiphy_regulatory_deregister(struct wiphy *wiphy)
@@ -2279,7 +2282,9 @@ void wiphy_regulatory_deregister(struct wiphy *wiphy)
 static void reg_timeout_work(struct work_struct *work)
 {
        REG_DBG_PRINT("Timeout while waiting for CRDA to reply, restoring regulatory settings\n");
+        rtnl_lock();
        restore_regulatory_settings(true);
+        rtnl_unlock();
 }
 int __init regulatory_init(void)
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 1d3cfb1a3f28..20e86a95dc4e 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -34,8 +34,10 @@ struct cfg80211_conn {
                CFG80211_CONN_SCAN_AGAIN,
                CFG80211_CONN_AUTHENTICATE_NEXT,
                CFG80211_CONN_AUTHENTICATING,
+                CFG80211_CONN_AUTH_FAILED,
                CFG80211_CONN_ASSOCIATE_NEXT,
                CFG80211_CONN_ASSOCIATING,
+                CFG80211_CONN_ASSOC_FAILED,
                CFG80211_CONN_DEAUTH,
                CFG80211_CONN_CONNECTED,
        } state;
@@ -164,6 +166,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                          NULL, 0,
                                          params->key, params->key_len,
                                          params->key_idx, NULL, 0);
+        case CFG80211_CONN_AUTH_FAILED:
+                return -ENOTCONN;
        case CFG80211_CONN_ASSOCIATE_NEXT:
                BUG_ON(!rdev->ops->assoc);
                wdev->conn->state = CFG80211_CONN_ASSOCIATING;
@@ -188,10 +192,17 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                                             WLAN_REASON_DEAUTH_LEAVING,
                                             false);
                return err;
+        case CFG80211_CONN_ASSOC_FAILED:
+                cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                     NULL, 0,
+                                     WLAN_REASON_DEAUTH_LEAVING, false);
+                return -ENOTCONN;
        case CFG80211_CONN_DEAUTH:
                cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
                                     NULL, 0,
                                     WLAN_REASON_DEAUTH_LEAVING, false);
+                /* free directly, disconnected event already sent */
+                cfg80211_sme_free(wdev);
                return 0;
        default:
                return 0;
@@ -371,7 +382,7 @@ bool cfg80211_sme_rx_assoc_resp(struct wireless_dev *wdev, u16 status)
                return true;
        }
-        wdev->conn->state = CFG80211_CONN_DEAUTH;
+        wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
        schedule_work(&rdev->conn_work);
        return false;
 }
@@ -383,7 +394,13 @@ void cfg80211_sme_deauth(struct wireless_dev *wdev)
 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
 {
-        cfg80211_sme_free(wdev);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        if (!wdev->conn)
+                return;
+        wdev->conn->state = CFG80211_CONN_AUTH_FAILED;
+        schedule_work(&rdev->conn_work);
 }
 void cfg80211_sme_disassoc(struct wireless_dev *wdev)
@@ -399,7 +416,13 @@ void cfg80211_sme_disassoc(struct wireless_dev *wdev)
 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
 {
-        cfg80211_sme_disassoc(wdev);
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        if (!wdev->conn)
+                return;
+        wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
+        schedule_work(&rdev->conn_work);
 }
 static int cfg80211_sme_connect(struct wireless_dev *wdev,
@@ -953,21 +976,19 @@ int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
                        struct net_device *dev, u16 reason, bool wextev)
 {
        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        int err;
+        int err = 0;
        ASSERT_WDEV_LOCK(wdev);
        kfree(wdev->connect_keys);
        wdev->connect_keys = NULL;
-        if (wdev->conn) {
+        if (wdev->conn)
                err = cfg80211_sme_disconnect(wdev, reason);
-        } else if (!rdev->ops->disconnect) {
+        else if (!rdev->ops->disconnect)
                cfg80211_mlme_down(rdev, dev);
-                err = 0;
+        else if (wdev->current_bss)
-        } else {
                err = rdev_disconnect(rdev, dev, reason);
-        }
        return err;
 }
author	Grant Likely <grant.likely@linaro.org>	2013-08-28 15:18:13 -0400
committer	Grant Likely <grant.likely@linaro.org>	2013-08-28 15:18:13 -0400
commit	8be137f2664f0abb096626a9d2ce0fcdd955b109 (patch)
tree	2c53a5535265a58eb397d6fbbab2ec26e92e6931 /net
parent	8851b9f1625ce0858e9b1bb0ae4a57d4b43178b1 (diff)
parent	d8dfad3876e4386666b759da3c833d62fb8b2267 (diff)