Merge tag 'v3.13-rc4' into x86/mm

Pick up the latest fixes before applying new patches. Signed-off-by: Ingo Molnar <mingo@kernel.org>
author: Ingo Molnar <mingo@kernel.org> 2013-12-19 07:56:10 -0500
committer: Ingo Molnar <mingo@kernel.org> 2013-12-19 07:56:10 -0500
commit: 3331e924e7c5b98d245531b181551cb2a7380d0e (patch)
tree: 25c4432afd79bedc1e8941415166a5cef0c168fb /net
parent: fd8526ad14c182605e42b64646344b95befd9f94 (diff)
parent: 319e2e3f63c348a9b66db4667efa73178e18b17d (diff)
158 files changed, 1520 insertions, 1458 deletions
diff --git a/net/Kconfig b/net/Kconfig
index 0715db64a5c3..d334678c0bd8 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -224,7 +224,7 @@ source "net/hsr/Kconfig"
 config RPS
        boolean
-        depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
+        depends on SMP && SYSFS
        default y
 config RFS_ACCEL
@@ -235,7 +235,7 @@ config RFS_ACCEL
 config XPS
        boolean
-        depends on SMP && USE_GENERIC_SMP_HELPERS
+        depends on SMP
        default y
 config NETPRIO_CGROUP
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 7fee50d637f9..7d424ac6e760 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1735,7 +1735,6 @@ static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
                         size_t size, int flags)
 {
        struct sock *sk = sock->sk;
-        struct sockaddr_at *sat = (struct sockaddr_at *)msg->msg_name;
        struct ddpehdr *ddp;
        int copied = 0;
        int offset = 0;
@@ -1764,14 +1763,13 @@ static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
        }
        err = skb_copy_datagram_iovec(skb, offset, msg->msg_iov, copied);
-        if (!err) {
+        if (!err && msg->msg_name) {
-                if (sat) {
+                struct sockaddr_at *sat = msg->msg_name;
-                        sat->sat_family      = AF_APPLETALK;
+                sat->sat_family      = AF_APPLETALK;
-                        sat->sat_port        = ddp->deh_sport;
+                sat->sat_port        = ddp->deh_sport;
-                        sat->sat_addr.s_node = ddp->deh_snode;
+                sat->sat_addr.s_node = ddp->deh_snode;
-                        sat->sat_addr.s_net  = ddp->deh_snet;
+                sat->sat_addr.s_net  = ddp->deh_snet;
-                }
+                msg->msg_namelen     = sizeof(*sat);
-                msg->msg_namelen = sizeof(*sat);
        }
        skb_free_datagram(sk, skb);     /* Free the datagram. */
diff --git a/net/atm/common.c b/net/atm/common.c
index 737bef59ce89..7b491006eaf4 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -531,8 +531,6 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
        struct sk_buff *skb;
        int copied, error = -EINVAL;
-        msg->msg_namelen = 0;
        if (sock->state != SS_CONNECTED)
                return -ENOTCONN;
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index a00123ebb0ae..7bb1605bdfd9 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1636,11 +1636,11 @@ static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
        skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
-        if (msg->msg_namelen != 0) {
+        if (msg->msg_name) {
-                struct sockaddr_ax25 *sax = (struct sockaddr_ax25 *)msg->msg_name;
                ax25_digi digi;
                ax25_address src;
                const unsigned char *mac = skb_mac_header(skb);
+                struct sockaddr_ax25 *sax = msg->msg_name;
                memset(sax, 0, sizeof(struct full_sockaddr_ax25));
                ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index f6a1671ea2ff..56ca494621c6 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -224,10 +224,9 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        skb = skb_recv_datagram(sk, flags, noblock, &err);
        if (!skb) {
-                if (sk->sk_shutdown & RCV_SHUTDOWN) {
+                if (sk->sk_shutdown & RCV_SHUTDOWN)
-                        msg->msg_namelen = 0;
                        return 0;
-                }
                return err;
        }
@@ -245,8 +244,6 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                if (bt_sk(sk)->skb_msg_name)
                        bt_sk(sk)->skb_msg_name(skb, msg->msg_name,
                                                &msg->msg_namelen);
-                else
-                        msg->msg_namelen = 0;
        }
        skb_free_datagram(sk, skb);
@@ -295,8 +292,6 @@ int bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (flags & MSG_OOB)
                return -EOPNOTSUPP;
-        msg->msg_namelen = 0;
        BT_DBG("sk %p size %zu", sk, size);
        lock_sock(sk);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 71f0be173080..6a6c8bb4fd72 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -856,8 +856,6 @@ static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (!skb)
                return err;
-        msg->msg_namelen = 0;
        copied = skb->len;
        if (len < copied) {
                msg->msg_flags |= MSG_TRUNC;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 0cef67707838..4af3821df880 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2439,6 +2439,9 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
        int err;
        struct sk_buff_head seg_queue;
+        if (!chan->conn)
+                return -ENOTCONN;
        /* Connectionless channel */
        if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
                skb = l2cap_create_connless_pdu(chan, msg, len, priority);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 94d06cbfbc18..facd8a79c038 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -694,6 +694,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
        addr.l2_family = AF_BLUETOOTH;
        addr.l2_psm    = 0;
        addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
        *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
        if (*err < 0)
                goto failed;
@@ -719,6 +720,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
        addr.l2_family = AF_BLUETOOTH;
        addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
        addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
        *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
        if (*err == 0 || *err == -EINPROGRESS)
                return s;
@@ -1983,6 +1985,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
        addr.l2_family = AF_BLUETOOTH;
        addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
        addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
        err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
        if (err < 0) {
                BT_ERR("Bind failed %d", err);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c4d3d423f89b..3c2d3e4aa2f5 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -615,7 +615,6 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                rfcomm_dlc_accept(d);
-                msg->msg_namelen = 0;
                return 0;
        }
@@ -739,8 +738,9 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 {
        struct sock *sk = sock->sk;
+        struct sock *l2cap_sk;
+        struct l2cap_conn *conn;
        struct rfcomm_conninfo cinfo;
-        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
        int len, err = 0;
        u32 opt;
@@ -783,6 +783,9 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
                        break;
                }
+                l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
+                conn = l2cap_pi(l2cap_sk)->chan->conn;
                memset(&cinfo, 0, sizeof(cinfo));
                cinfo.hci_handle = conn->hcon->handle;
                memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 12a0e51e21e1..24fa3964b3c8 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -711,7 +711,6 @@ static int sco_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
            test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
                sco_conn_defer_accept(pi->conn->hcon, pi->setting);
                sk->sk_state = BT_CONFIG;
-                msg->msg_namelen = 0;
                release_sock(sk);
                return 0;
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 85a2796cac61..4b07acb8293c 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -742,6 +742,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
        BT_DBG("conn %p", conn);
+        if (!(conn->hcon->link_mode & HCI_LM_MASTER))
+                return SMP_CMD_NOTSUPP;
        hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
        if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index c41d5fbb91d0..4bf02adb5dc2 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -172,6 +172,9 @@ void br_dev_delete(struct net_device *dev, struct list_head *head)
                del_nbp(p);
        }
+        br_fdb_delete_by_port(br, NULL, 1);
+        br_vlan_flush(br);
        del_timer_sync(&br->gc_timer);
        br_sysfs_delbr(br->dev);
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 229d820bdf0b..045d56eaeca2 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -426,6 +426,16 @@ netdev_features_t br_features_recompute(struct net_bridge *br,
 int br_handle_frame_finish(struct sk_buff *skb);
 rx_handler_result_t br_handle_frame(struct sk_buff **pskb);
+static inline bool br_rx_handler_check_rcu(const struct net_device *dev)
+{
+        return rcu_dereference(dev->rx_handler) == br_handle_frame;
+}
+static inline struct net_bridge_port *br_port_get_check_rcu(const struct net_device *dev)
+{
+        return br_rx_handler_check_rcu(dev) ? br_port_get_rcu(dev) : NULL;
+}
 /* br_ioctl.c */
 int br_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd,
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 8660ea3be705..bdb459d21ad8 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -153,7 +153,7 @@ void br_stp_rcv(const struct stp_proto *proto, struct sk_buff *skb,
        if (buf[0] != 0 || buf[1] != 0 || buf[2] != 0)
                goto err;
-        p = br_port_get_rcu(dev);
+        p = br_port_get_check_rcu(dev);
        if (!p)
                goto err;
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 53f0990eab58..af5ebd18d705 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -34,7 +34,6 @@ static void __vlan_add_flags(struct net_port_vlans *v, u16 vid, u16 flags)
 static int __vlan_add(struct net_port_vlans *v, u16 vid, u16 flags)
 {
-        const struct net_device_ops *ops;
        struct net_bridge_port *p = NULL;
        struct net_bridge *br;
        struct net_device *dev;
@@ -53,17 +52,15 @@ static int __vlan_add(struct net_port_vlans *v, u16 vid, u16 flags)
                br = v->parent.br;
                dev = br->dev;
        }
-        ops = dev->netdev_ops;
-        if (p && (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) {
+        if (p) {
                /* Add VLAN to the device filter if it is supported.
                 * Stricly speaking, this is not necessary now, since
                 * devices are made promiscuous by the bridge, but if
                 * that ever changes this code will allow tagged
                 * traffic to enter the bridge.
                 */
-                err = ops->ndo_vlan_rx_add_vid(dev, htons(ETH_P_8021Q),
+                err = vlan_vid_add(dev, htons(ETH_P_8021Q), vid);
-                                               vid);
                if (err)
                        return err;
        }
@@ -82,8 +79,8 @@ static int __vlan_add(struct net_port_vlans *v, u16 vid, u16 flags)
        return 0;
 out_filt:
-        if (p && (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER))
+        if (p)
-                ops->ndo_vlan_rx_kill_vid(dev, htons(ETH_P_8021Q), vid);
+                vlan_vid_del(dev, htons(ETH_P_8021Q), vid);
        return err;
 }
@@ -95,13 +92,8 @@ static int __vlan_del(struct net_port_vlans *v, u16 vid)
        __vlan_delete_pvid(v, vid);
        clear_bit(vid, v->untagged_bitmap);
-        if (v->port_idx) {
+        if (v->port_idx)
-                struct net_device *dev = v->parent.port->dev;
+                vlan_vid_del(v->parent.port->dev, htons(ETH_P_8021Q), vid);
-                const struct net_device_ops *ops = dev->netdev_ops;
-                if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
-                        ops->ndo_vlan_rx_kill_vid(dev, htons(ETH_P_8021Q), vid);
-        }
        clear_bit(vid, v->vlan_bitmap);
        v->num_vlans--;
@@ -398,6 +390,7 @@ int nbp_vlan_delete(struct net_bridge_port *port, u16 vid)
 void nbp_vlan_flush(struct net_bridge_port *port)
 {
        struct net_port_vlans *pv;
+        u16 vid;
        ASSERT_RTNL();
@@ -405,6 +398,9 @@ void nbp_vlan_flush(struct net_bridge_port *port)
        if (!pv)
                return;
+        for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID)
+                vlan_vid_del(port->dev, htons(ETH_P_8021Q), vid);
        __vlan_flush(pv);
 }
diff --git a/net/bridge/netfilter/ebt_ip6.c b/net/bridge/netfilter/ebt_ip6.c
index 99c85668f551..17fd5f2cb4b8 100644
--- a/net/bridge/netfilter/ebt_ip6.c
+++ b/net/bridge/netfilter/ebt_ip6.c
@@ -48,10 +48,12 @@ ebt_ip6_mt(const struct sk_buff *skb, struct xt_action_param *par)
        if (info->bitmask & EBT_IP6_TCLASS &&
           FWINV(info->tclass != ipv6_get_dsfield(ih6), EBT_IP6_TCLASS))
                return false;
-        if (FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
+        if ((info->bitmask & EBT_IP6_SOURCE &&
-                                       &info->saddr), EBT_IP6_SOURCE) ||
+            FWINV(ipv6_masked_addr_cmp(&ih6->saddr, &info->smsk,
+                                       &info->saddr), EBT_IP6_SOURCE)) ||
+            (info->bitmask & EBT_IP6_DEST &&
            FWINV(ipv6_masked_addr_cmp(&ih6->daddr, &info->dmsk,
-                                       &info->daddr), EBT_IP6_DEST))
+                                       &info->daddr), EBT_IP6_DEST)))
                return false;
        if (info->bitmask & EBT_IP6_PROTO) {
                uint8_t nexthdr = ih6->nexthdr;
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 05a41c7ec304..d6be3edb7a43 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -286,8 +286,6 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (m->msg_flags&MSG_OOB)
                goto read_error;
-        m->msg_namelen = 0;
        skb = skb_recv_datagram(sk, flags, 0 , &ret);
        if (!skb)
                goto read_error;
@@ -361,8 +359,6 @@ static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (flags&MSG_OOB)
                goto out;
-        msg->msg_namelen = 0;
        /*
         * Lock the socket to prevent queue disordering
         * while sleeps in memcpy_tomsg
diff --git a/net/compat.c b/net/compat.c
index 89032580bd1d..dd32e34c1e2c 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -72,7 +72,7 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
            __get_user(kmsg->msg_flags, &umsg->msg_flags))
                return -EFAULT;
        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
-                return -EINVAL;
+                kmsg->msg_namelen = sizeof(struct sockaddr_storage);
        kmsg->msg_name = compat_ptr(tmp1);
        kmsg->msg_iov = compat_ptr(tmp2);
        kmsg->msg_control = compat_ptr(tmp3);
@@ -93,7 +93,8 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
                        if (err < 0)
                                return err;
                }
-                kern_msg->msg_name = kern_address;
+                if (kern_msg->msg_name)
+                        kern_msg->msg_name = kern_address;
        } else
                kern_msg->msg_name = NULL;
diff --git a/net/core/dev.c b/net/core/dev.c
index 8ffc52e01ece..ba3b7ea5ebb3 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -131,6 +131,7 @@
 #include <linux/static_key.h>
 #include <linux/hashtable.h>
 #include <linux/vmalloc.h>
+#include <linux/if_macvlan.h>
 #include "net-sysfs.h"
@@ -1424,6 +1425,10 @@ void dev_disable_lro(struct net_device *dev)
        if (is_vlan_dev(dev))
                dev = vlan_dev_real_dev(dev);
+        /* the same for macvlan devices */
+        if (netif_is_macvlan(dev))
+                dev = macvlan_dev_real_dev(dev);
        dev->wanted_features &= ~NETIF_F_LRO;
        netdev_update_features(dev);
@@ -1690,13 +1695,9 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
                kfree_skb(skb);
                return NET_RX_DROP;
        }
-        skb->protocol = eth_type_trans(skb, dev);
-        /* eth_type_trans() can set pkt_type.
-         * call skb_scrub_packet() after it to clear pkt_type _after_ calling
-         * eth_type_trans().
-         */
        skb_scrub_packet(skb, true);
+        skb->protocol = eth_type_trans(skb, dev);
        return netif_rx(skb);
 }
@@ -4995,7 +4996,7 @@ static void dev_change_rx_flags(struct net_device *dev, int flags)
 {
        const struct net_device_ops *ops = dev->netdev_ops;
-        if ((dev->flags & IFF_UP) && ops->ndo_change_rx_flags)
+        if (ops->ndo_change_rx_flags)
                ops->ndo_change_rx_flags(dev, flags);
 }
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 5e78d44333b9..e70301eb7a4a 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -64,7 +64,6 @@ static struct genl_family net_drop_monitor_family = {
        .hdrsize        = 0,
        .name           = "NET_DM",
        .version        = 2,
-        .maxattr        = NET_DM_CMD_MAX,
 };
 static DEFINE_PER_CPU(struct per_cpu_dm_data, dm_cpu_data);
@@ -106,6 +105,10 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
        return skb;
 }
+static struct genl_multicast_group dropmon_mcgrps[] = {
+        { .name = "events", },
+};
 static void send_dm_alert(struct work_struct *work)
 {
        struct sk_buff *skb;
@@ -116,7 +119,8 @@ static void send_dm_alert(struct work_struct *work)
        skb = reset_per_cpu_data(data);
        if (skb)
-                genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
+                genlmsg_multicast(&net_drop_monitor_family, skb, 0,
+                                  0, GFP_KERNEL);
 }
 /*
@@ -333,7 +337,7 @@ out:
        return NOTIFY_DONE;
 }
-static struct genl_ops dropmon_ops[] = {
+static const struct genl_ops dropmon_ops[] = {
        {
                .cmd = NET_DM_CMD_CONFIG,
                .doit = net_dm_cmd_config,
@@ -364,13 +368,13 @@ static int __init init_net_drop_monitor(void)
                return -ENOSPC;
        }
-        rc = genl_register_family_with_ops(&net_drop_monitor_family,
+        rc = genl_register_family_with_ops_groups(&net_drop_monitor_family,
-                                           dropmon_ops,
+                                                  dropmon_ops, dropmon_mcgrps);
-                                           ARRAY_SIZE(dropmon_ops));
        if (rc) {
                pr_err("Could not create drop monitor netlink family\n");
                return rc;
        }
+        WARN_ON(net_drop_monitor_family.mcgrp_offset != NET_DM_GRP_ALERT);
        rc = register_netdevice_notifier(&dropmon_net_notifier);
        if (rc < 0) {
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 4cdb7c48dad6..b61869429f4c 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -48,7 +48,8 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
                        if (err < 0)
                                return err;
                }
-                m->msg_name = address;
+                if (m->msg_name)
+                        m->msg_name = address;
        } else {
                m->msg_name = NULL;
        }
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 261357a66300..a797fff7f222 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2527,6 +2527,8 @@ static int process_ipsec(struct pktgen_dev *pkt_dev,
                if (x) {
                        int ret;
                        __u8 *eth;
+                        struct iphdr *iph;
                        nhead = x->props.header_len - skb_headroom(skb);
                        if (nhead > 0) {
                                ret = pskb_expand_head(skb, nhead, 0, GFP_ATOMIC);
@@ -2548,6 +2550,11 @@ static int process_ipsec(struct pktgen_dev *pkt_dev,
                        eth = (__u8 *) skb_push(skb, ETH_HLEN);
                        memcpy(eth, pkt_dev->hh, 12);
                        *(u16 *) &eth[12] = protocol;
+                        /* Update IPv4 header len as well as checksum value */
+                        iph = ip_hdr(skb);
+                        iph->tot_len = htons(skb->len - ETH_HLEN);
+                        ip_send_check(iph);
                }
        }
        return 1;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 8cec1e6b844d..06e72d3cdf60 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2796,6 +2796,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
        struct sk_buff *segs = NULL;
        struct sk_buff *tail = NULL;
        struct sk_buff *fskb = skb_shinfo(skb)->frag_list;
+        skb_frag_t *skb_frag = skb_shinfo(skb)->frags;
        unsigned int mss = skb_shinfo(skb)->gso_size;
        unsigned int doffset = skb->data - skb_mac_header(skb);
        unsigned int offset = doffset;
@@ -2835,16 +2836,38 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                if (hsize > len || !sg)
                        hsize = len;
-                if (!hsize && i >= nfrags) {
+                if (!hsize && i >= nfrags && skb_headlen(fskb) &&
-                        BUG_ON(fskb->len != len);
+                    (skb_headlen(fskb) == len || sg)) {
+                        BUG_ON(skb_headlen(fskb) > len);
+                        i = 0;
+                        nfrags = skb_shinfo(fskb)->nr_frags;
+                        skb_frag = skb_shinfo(fskb)->frags;
+                        pos += skb_headlen(fskb);
+                        while (pos < offset + len) {
+                                BUG_ON(i >= nfrags);
+                                size = skb_frag_size(skb_frag);
+                                if (pos + size > offset + len)
+                                        break;
+                                i++;
+                                pos += size;
+                                skb_frag++;
+                        }
-                        pos += len;
                        nskb = skb_clone(fskb, GFP_ATOMIC);
                        fskb = fskb->next;
                        if (unlikely(!nskb))
                                goto err;
+                        if (unlikely(pskb_trim(nskb, len))) {
+                                kfree_skb(nskb);
+                                goto err;
+                        }
                        hsize = skb_end_offset(nskb);
                        if (skb_cow_head(nskb, doffset + headroom)) {
                                kfree_skb(nskb);
@@ -2881,7 +2904,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                                                 nskb->data - tnl_hlen,
                                                 doffset + tnl_hlen);
-                if (fskb != skb_shinfo(skb)->frag_list)
+                if (nskb->len == len + doffset)
                        goto perform_csum_check;
                if (!sg) {
@@ -2899,8 +2922,28 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                skb_shinfo(nskb)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
-                while (pos < offset + len && i < nfrags) {
+                while (pos < offset + len) {
-                        *frag = skb_shinfo(skb)->frags[i];
+                        if (i >= nfrags) {
+                                BUG_ON(skb_headlen(fskb));
+                                i = 0;
+                                nfrags = skb_shinfo(fskb)->nr_frags;
+                                skb_frag = skb_shinfo(fskb)->frags;
+                                BUG_ON(!nfrags);
+                                fskb = fskb->next;
+                        }
+                        if (unlikely(skb_shinfo(nskb)->nr_frags >=
+                                     MAX_SKB_FRAGS)) {
+                                net_warn_ratelimited(
+                                        "skb_segment: too many frags: %u %u\n",
+                                        pos, mss);
+                                goto err;
+                        }
+                        *frag = *skb_frag;
                        __skb_frag_ref(frag);
                        size = skb_frag_size(frag);
@@ -2913,6 +2956,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                        if (pos + size <= offset + len) {
                                i++;
+                                skb_frag++;
                                pos += size;
                        } else {
                                skb_frag_size_sub(frag, pos + size - (offset + len));
@@ -2922,25 +2966,6 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                        frag++;
                }
-                if (pos < offset + len) {
-                        struct sk_buff *fskb2 = fskb;
-                        BUG_ON(pos + fskb->len != offset + len);
-                        pos += fskb->len;
-                        fskb = fskb->next;
-                        if (fskb2->next) {
-                                fskb2 = skb_clone(fskb2, GFP_ATOMIC);
-                                if (!fskb2)
-                                        goto err;
-                        } else
-                                skb_get(fskb2);
-                        SKB_FRAG_ASSERT(nskb);
-                        skb_shinfo(nskb)->frag_list = fskb2;
-                }
 skip_fraglist:
                nskb->data_len = len - hsize;
                nskb->len += nskb->data_len;
@@ -3559,6 +3584,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
        skb->tstamp.tv64 = 0;
        skb->pkt_type = PACKET_HOST;
        skb->skb_iif = 0;
+        skb->local_df = 0;
        skb_dst_drop(skb);
        skb->mark = 0;
        secpath_reset(skb);
diff --git a/net/core/sock.c b/net/core/sock.c
index ab20ed9b0f31..5393b4b719d7 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -882,7 +882,7 @@ set_rcvbuf:
        case SO_PEEK_OFF:
                if (sock->ops->set_peek_off)
-                        sock->ops->set_peek_off(sk, val);
+                        ret = sock->ops->set_peek_off(sk, val);
                else
                        ret = -EOPNOTSUPP;
                break;
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 4ac71ff7c2e4..2b90a786e475 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -851,7 +851,6 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                        if (flowlabel == NULL)
                                return -EINVAL;
-                        usin->sin6_addr = flowlabel->dst;
                        fl6_sock_release(flowlabel);
                }
        }
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 003f5bb3acd2..4bdab1521878 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -288,7 +288,8 @@ void hsr_addr_subst_dest(struct hsr_priv *hsr_priv, struct ethhdr *ethhdr,
 static bool seq_nr_after(u16 a, u16 b)
 {
        /* Remove inconsistency where
-         * seq_nr_after(a, b) == seq_nr_before(a, b) */
+         * seq_nr_after(a, b) == seq_nr_before(a, b)
+         */
        if ((int) b - a == 32768)
                return false;
diff --git a/net/hsr/hsr_netlink.c b/net/hsr/hsr_netlink.c
index 4e66bf61f585..01a5261ac7a5 100644
--- a/net/hsr/hsr_netlink.c
+++ b/net/hsr/hsr_netlink.c
@@ -23,6 +23,8 @@ static const struct nla_policy hsr_policy[IFLA_HSR_MAX + 1] = {
        [IFLA_HSR_SLAVE1]               = { .type = NLA_U32 },
        [IFLA_HSR_SLAVE2]               = { .type = NLA_U32 },
        [IFLA_HSR_MULTICAST_SPEC]       = { .type = NLA_U8 },
+        [IFLA_HSR_SUPERVISION_ADDR]     = { .type = NLA_BINARY, .len = ETH_ALEN },
+        [IFLA_HSR_SEQ_NR]               = { .type = NLA_U16 },
 };
@@ -59,6 +61,31 @@ static int hsr_newlink(struct net *src_net, struct net_device *dev,
        return hsr_dev_finalize(dev, link, multicast_spec);
 }
+static int hsr_fill_info(struct sk_buff *skb, const struct net_device *dev)
+{
+        struct hsr_priv *hsr_priv;
+        hsr_priv = netdev_priv(dev);
+        if (hsr_priv->slave[0])
+                if (nla_put_u32(skb, IFLA_HSR_SLAVE1, hsr_priv->slave[0]->ifindex))
+                        goto nla_put_failure;
+        if (hsr_priv->slave[1])
+                if (nla_put_u32(skb, IFLA_HSR_SLAVE2, hsr_priv->slave[1]->ifindex))
+                        goto nla_put_failure;
+        if (nla_put(skb, IFLA_HSR_SUPERVISION_ADDR, ETH_ALEN,
+                    hsr_priv->sup_multicast_addr) ||
+            nla_put_u16(skb, IFLA_HSR_SEQ_NR, hsr_priv->sequence_nr))
+                goto nla_put_failure;
+        return 0;
+nla_put_failure:
+        return -EMSGSIZE;
+}
 static struct rtnl_link_ops hsr_link_ops __read_mostly = {
        .kind           = "hsr",
        .maxtype        = IFLA_HSR_MAX,
@@ -66,6 +93,7 @@ static struct rtnl_link_ops hsr_link_ops __read_mostly = {
        .priv_size      = sizeof(struct hsr_priv),
        .setup          = hsr_dev_setup,
        .newlink        = hsr_newlink,
+        .fill_info      = hsr_fill_info,
 };
@@ -90,8 +118,8 @@ static struct genl_family hsr_genl_family = {
        .maxattr = HSR_A_MAX,
 };
-static struct genl_multicast_group hsr_network_genl_mcgrp = {
+static const struct genl_multicast_group hsr_mcgrps[] = {
-        .name = "hsr-network",
+        { .name = "hsr-network", },
 };
@@ -129,7 +157,7 @@ void hsr_nl_ringerror(struct hsr_priv *hsr_priv, unsigned char addr[ETH_ALEN],
                goto nla_put_failure;
        genlmsg_end(skb, msg_head);
-        genlmsg_multicast(skb, 0, hsr_network_genl_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(&hsr_genl_family, skb, 0, 0, GFP_ATOMIC);
        return;
@@ -163,7 +191,7 @@ void hsr_nl_nodedown(struct hsr_priv *hsr_priv, unsigned char addr[ETH_ALEN])
                goto nla_put_failure;
        genlmsg_end(skb, msg_head);
-        genlmsg_multicast(skb, 0, hsr_network_genl_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(&hsr_genl_family, skb, 0, 0, GFP_ATOMIC);
        return;
@@ -249,7 +277,7 @@ static int hsr_get_node_status(struct sk_buff *skb_in, struct genl_info *info)
                        &hsr_node_if2_age,
                        &hsr_node_if2_seq);
        if (res < 0)
-                goto fail;
+                goto nla_put_failure;
        res = nla_put(skb_out, HSR_A_NODE_ADDR, ETH_ALEN,
                                        nla_data(info->attrs[HSR_A_NODE_ADDR]));
@@ -306,15 +334,6 @@ fail:
        return res;
 }
-static struct genl_ops hsr_ops_get_node_status = {
-        .cmd = HSR_C_GET_NODE_STATUS,
-        .flags = 0,
-        .policy = hsr_genl_policy,
-        .doit = hsr_get_node_status,
-        .dumpit = NULL,
-};
 /* Get a list of MacAddressA of all nodes known to this node (other than self).
 */
 static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info)
@@ -398,12 +417,21 @@ fail:
 }
-static struct genl_ops hsr_ops_get_node_list = {
+static const struct genl_ops hsr_ops[] = {
-        .cmd = HSR_C_GET_NODE_LIST,
+        {
-        .flags = 0,
+                .cmd = HSR_C_GET_NODE_STATUS,
-        .policy = hsr_genl_policy,
+                .flags = 0,
-        .doit = hsr_get_node_list,
+                .policy = hsr_genl_policy,
-        .dumpit = NULL,
+                .doit = hsr_get_node_status,
+                .dumpit = NULL,
+        },
+        {
+                .cmd = HSR_C_GET_NODE_LIST,
+                .flags = 0,
+                .policy = hsr_genl_policy,
+                .doit = hsr_get_node_list,
+                .dumpit = NULL,
+        },
 };
 int __init hsr_netlink_init(void)
@@ -414,30 +442,13 @@ int __init hsr_netlink_init(void)
        if (rc)
                goto fail_rtnl_link_register;
-        rc = genl_register_family(&hsr_genl_family);
+        rc = genl_register_family_with_ops_groups(&hsr_genl_family, hsr_ops,
+                                                  hsr_mcgrps);
        if (rc)
                goto fail_genl_register_family;
-        rc = genl_register_ops(&hsr_genl_family, &hsr_ops_get_node_status);
-        if (rc)
-                goto fail_genl_register_ops;
-        rc = genl_register_ops(&hsr_genl_family, &hsr_ops_get_node_list);
-        if (rc)
-                goto fail_genl_register_ops_node_list;
-        rc = genl_register_mc_group(&hsr_genl_family, &hsr_network_genl_mcgrp);
-        if (rc)
-                goto fail_genl_register_mc_group;
        return 0;
-fail_genl_register_mc_group:
-        genl_unregister_ops(&hsr_genl_family, &hsr_ops_get_node_list);
-fail_genl_register_ops_node_list:
-        genl_unregister_ops(&hsr_genl_family, &hsr_ops_get_node_status);
-fail_genl_register_ops:
-        genl_unregister_family(&hsr_genl_family);
 fail_genl_register_family:
        rtnl_link_unregister(&hsr_link_ops);
 fail_rtnl_link_register:
@@ -447,10 +458,7 @@ fail_rtnl_link_register:
 void __exit hsr_netlink_exit(void)
 {
-        genl_unregister_mc_group(&hsr_genl_family, &hsr_network_genl_mcgrp);
-        genl_unregister_ops(&hsr_genl_family, &hsr_ops_get_node_status);
        genl_unregister_family(&hsr_genl_family);
        rtnl_link_unregister(&hsr_link_ops);
 }
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 426b5df1c98f..459e200c08a4 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -956,7 +956,7 @@ lowpan_process_data(struct sk_buff *skb)
         * Traffic class carried in-line
         * ECN + DSCP (1 byte), Flow Label is elided
         */
-        case 1: /* 10b */
+        case 2: /* 10b */
                if (lowpan_fetch_skb_u8(skb, &tmp))
                        goto drop;
@@ -967,7 +967,7 @@ lowpan_process_data(struct sk_buff *skb)
         * Flow Label carried in-line
         * ECN + 2-bit Pad + Flow Label (3 bytes), DSCP is elided
         */
-        case 2: /* 01b */
+        case 1: /* 01b */
                if (lowpan_fetch_skb_u8(skb, &tmp))
                        goto drop;
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 581a59504bd5..1865fdf5a5a5 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -315,9 +315,8 @@ static int dgram_recvmsg(struct kiocb *iocb, struct sock *sk,
        if (saddr) {
                saddr->family = AF_IEEE802154;
                saddr->addr = mac_cb(skb)->sa;
-        }
-        if (addr_len)
                *addr_len = sizeof(*saddr);
+        }
        if (flags & MSG_TRUNC)
                copied = skb->len;
diff --git a/net/ieee802154/ieee802154.h b/net/ieee802154/ieee802154.h
index aadec428e6ec..cee4425b9956 100644
--- a/net/ieee802154/ieee802154.h
+++ b/net/ieee802154/ieee802154.h
@@ -47,7 +47,24 @@ struct sk_buff *ieee802154_nl_new_reply(struct genl_info *info,
 int ieee802154_nl_reply(struct sk_buff *msg, struct genl_info *info);
 extern struct genl_family nl802154_family;
-int nl802154_mac_register(void);
-int nl802154_phy_register(void);
+/* genetlink ops/groups */
+int ieee802154_list_phy(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_dump_phy(struct sk_buff *skb, struct netlink_callback *cb);
+int ieee802154_add_iface(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_del_iface(struct sk_buff *skb, struct genl_info *info);
+enum ieee802154_mcgrp_ids {
+        IEEE802154_COORD_MCGRP,
+        IEEE802154_BEACON_MCGRP,
+};
+int ieee802154_associate_req(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_associate_resp(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_disassociate_req(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_list_iface(struct sk_buff *skb, struct genl_info *info);
+int ieee802154_dump_iface(struct sk_buff *skb, struct netlink_callback *cb);
 #endif
diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c
index 7e49bbcc6967..43f1b2bf469f 100644
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -70,7 +70,7 @@ int ieee802154_nl_mcast(struct sk_buff *msg, unsigned int group)
        if (genlmsg_end(msg, hdr) < 0)
                goto out;
-        return genlmsg_multicast(msg, 0, group, GFP_ATOMIC);
+        return genlmsg_multicast(&nl802154_family, msg, 0, group, GFP_ATOMIC);
 out:
        nlmsg_free(msg);
        return -ENOBUFS;
@@ -109,31 +109,36 @@ out:
        return -ENOBUFS;
 }
-int __init ieee802154_nl_init(void)
+static const struct genl_ops ieee8021154_ops[] = {
-{
+        /* see nl-phy.c */
-        int rc;
+        IEEE802154_DUMP(IEEE802154_LIST_PHY, ieee802154_list_phy,
+                        ieee802154_dump_phy),
-        rc = genl_register_family(&nl802154_family);
+        IEEE802154_OP(IEEE802154_ADD_IFACE, ieee802154_add_iface),
-        if (rc)
+        IEEE802154_OP(IEEE802154_DEL_IFACE, ieee802154_del_iface),
-                goto fail;
+        /* see nl-mac.c */
+        IEEE802154_OP(IEEE802154_ASSOCIATE_REQ, ieee802154_associate_req),
-        rc = nl802154_mac_register();
+        IEEE802154_OP(IEEE802154_ASSOCIATE_RESP, ieee802154_associate_resp),
-        if (rc)
+        IEEE802154_OP(IEEE802154_DISASSOCIATE_REQ, ieee802154_disassociate_req),
-                goto fail;
+        IEEE802154_OP(IEEE802154_SCAN_REQ, ieee802154_scan_req),
+        IEEE802154_OP(IEEE802154_START_REQ, ieee802154_start_req),
+        IEEE802154_DUMP(IEEE802154_LIST_IFACE, ieee802154_list_iface,
+                        ieee802154_dump_iface),
+};
-        rc = nl802154_phy_register();
+static const struct genl_multicast_group ieee802154_mcgrps[] = {
-        if (rc)
+        [IEEE802154_COORD_MCGRP] = { .name = IEEE802154_MCAST_COORD_NAME, },
-                goto fail;
+        [IEEE802154_BEACON_MCGRP] = { .name = IEEE802154_MCAST_BEACON_NAME, },
+};
-        return 0;
-fail:
+int __init ieee802154_nl_init(void)
-        genl_unregister_family(&nl802154_family);
+{
-        return rc;
+        return genl_register_family_with_ops_groups(&nl802154_family,
+                                                    ieee8021154_ops,
+                                                    ieee802154_mcgrps);
 }
 void __exit ieee802154_nl_exit(void)
 {
        genl_unregister_family(&nl802154_family);
 }
diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
index b0bdd8c51e9c..ba5c1e002f37 100644
--- a/net/ieee802154/nl-mac.c
+++ b/net/ieee802154/nl-mac.c
@@ -39,14 +39,6 @@
 #include "ieee802154.h"
-static struct genl_multicast_group ieee802154_coord_mcgrp = {
-        .name           = IEEE802154_MCAST_COORD_NAME,
-};
-static struct genl_multicast_group ieee802154_beacon_mcgrp = {
-        .name           = IEEE802154_MCAST_BEACON_NAME,
-};
 int ieee802154_nl_assoc_indic(struct net_device *dev,
                struct ieee802154_addr *addr, u8 cap)
 {
@@ -72,7 +64,7 @@ int ieee802154_nl_assoc_indic(struct net_device *dev,
            nla_put_u8(msg, IEEE802154_ATTR_CAPABILITY, cap))
                goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 nla_put_failure:
        nlmsg_free(msg);
@@ -98,7 +90,7 @@ int ieee802154_nl_assoc_confirm(struct net_device *dev, u16 short_addr,
            nla_put_u16(msg, IEEE802154_ATTR_SHORT_ADDR, short_addr) ||
            nla_put_u8(msg, IEEE802154_ATTR_STATUS, status))
                goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 nla_put_failure:
        nlmsg_free(msg);
@@ -133,7 +125,7 @@ int ieee802154_nl_disassoc_indic(struct net_device *dev,
        }
        if (nla_put_u8(msg, IEEE802154_ATTR_REASON, reason))
                goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 nla_put_failure:
        nlmsg_free(msg);
@@ -157,7 +149,7 @@ int ieee802154_nl_disassoc_confirm(struct net_device *dev, u8 status)
                    dev->dev_addr) ||
            nla_put_u8(msg, IEEE802154_ATTR_STATUS, status))
                goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 nla_put_failure:
        nlmsg_free(msg);
@@ -183,7 +175,7 @@ int ieee802154_nl_beacon_indic(struct net_device *dev,
            nla_put_u16(msg, IEEE802154_ATTR_COORD_SHORT_ADDR, coord_addr) ||
            nla_put_u16(msg, IEEE802154_ATTR_COORD_PAN_ID, panid))
                goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 nla_put_failure:
        nlmsg_free(msg);
@@ -214,7 +206,7 @@ int ieee802154_nl_scan_confirm(struct net_device *dev,
            (edl &&
             nla_put(msg, IEEE802154_ATTR_ED_LIST, 27, edl)))
                goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 nla_put_failure:
        nlmsg_free(msg);
@@ -238,7 +230,7 @@ int ieee802154_nl_start_confirm(struct net_device *dev, u8 status)
                    dev->dev_addr) ||
            nla_put_u8(msg, IEEE802154_ATTR_STATUS, status))
                goto nla_put_failure;
-        return ieee802154_nl_mcast(msg, ieee802154_coord_mcgrp.id);
+        return ieee802154_nl_mcast(msg, IEEE802154_COORD_MCGRP);
 nla_put_failure:
        nlmsg_free(msg);
@@ -309,8 +301,7 @@ static struct net_device *ieee802154_nl_get_dev(struct genl_info *info)
        return dev;
 }
-static int ieee802154_associate_req(struct sk_buff *skb,
+int ieee802154_associate_req(struct sk_buff *skb, struct genl_info *info)
-                struct genl_info *info)
 {
        struct net_device *dev;
        struct ieee802154_addr addr;
@@ -357,8 +348,7 @@ out:
        return ret;
 }
-static int ieee802154_associate_resp(struct sk_buff *skb,
+int ieee802154_associate_resp(struct sk_buff *skb, struct genl_info *info)
-                struct genl_info *info)
 {
        struct net_device *dev;
        struct ieee802154_addr addr;
@@ -390,8 +380,7 @@ out:
        return ret;
 }
-static int ieee802154_disassociate_req(struct sk_buff *skb,
+int ieee802154_disassociate_req(struct sk_buff *skb, struct genl_info *info)
-                struct genl_info *info)
 {
        struct net_device *dev;
        struct ieee802154_addr addr;
@@ -433,7 +422,7 @@ out:
 * PAN_coordinator, battery_life_extension = 0,
 * coord_realignment = 0, security_enable = 0
 */
-static int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info)
+int ieee802154_start_req(struct sk_buff *skb, struct genl_info *info)
 {
        struct net_device *dev;
        struct ieee802154_addr addr;
@@ -492,7 +481,7 @@ out:
        return ret;
 }
-static int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info)
+int ieee802154_scan_req(struct sk_buff *skb, struct genl_info *info)
 {
        struct net_device *dev;
        int ret = -EOPNOTSUPP;
@@ -530,8 +519,7 @@ out:
        return ret;
 }
-static int ieee802154_list_iface(struct sk_buff *skb,
+int ieee802154_list_iface(struct sk_buff *skb, struct genl_info *info)
-        struct genl_info *info)
 {
        /* Request for interface name, index, type, IEEE address,
           PAN Id, short address */
@@ -565,8 +553,7 @@ out_dev:
 }
-static int ieee802154_dump_iface(struct sk_buff *skb,
+int ieee802154_dump_iface(struct sk_buff *skb, struct netlink_callback *cb)
-        struct netlink_callback *cb)
 {
        struct net *net = sock_net(skb->sk);
        struct net_device *dev;
@@ -590,41 +577,3 @@ cont:
        return skb->len;
 }
-static struct genl_ops ieee802154_coordinator_ops[] = {
-        IEEE802154_OP(IEEE802154_ASSOCIATE_REQ, ieee802154_associate_req),
-        IEEE802154_OP(IEEE802154_ASSOCIATE_RESP, ieee802154_associate_resp),
-        IEEE802154_OP(IEEE802154_DISASSOCIATE_REQ, ieee802154_disassociate_req),
-        IEEE802154_OP(IEEE802154_SCAN_REQ, ieee802154_scan_req),
-        IEEE802154_OP(IEEE802154_START_REQ, ieee802154_start_req),
-        IEEE802154_DUMP(IEEE802154_LIST_IFACE, ieee802154_list_iface,
-                                                        ieee802154_dump_iface),
-};
-/*
- * No need to unregister as family unregistration will do it.
- */
-int nl802154_mac_register(void)
-{
-        int i;
-        int rc;
-        rc = genl_register_mc_group(&nl802154_family,
-                        &ieee802154_coord_mcgrp);
-        if (rc)
-                return rc;
-        rc = genl_register_mc_group(&nl802154_family,
-                        &ieee802154_beacon_mcgrp);
-        if (rc)
-                return rc;
-        for (i = 0; i < ARRAY_SIZE(ieee802154_coordinator_ops); i++) {
-                rc = genl_register_ops(&nl802154_family,
-                                &ieee802154_coordinator_ops[i]);
-                if (rc)
-                        return rc;
-        }
-        return 0;
-}
diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index 22b1a7058fd3..d08c7a43dcd1 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -77,8 +77,7 @@ out:
        return -EMSGSIZE;
 }
-static int ieee802154_list_phy(struct sk_buff *skb,
+int ieee802154_list_phy(struct sk_buff *skb, struct genl_info *info)
-        struct genl_info *info)
 {
        /* Request for interface name, index, type, IEEE address,
           PAN Id, short address */
@@ -151,8 +150,7 @@ static int ieee802154_dump_phy_iter(struct wpan_phy *phy, void *_data)
        return 0;
 }
-static int ieee802154_dump_phy(struct sk_buff *skb,
+int ieee802154_dump_phy(struct sk_buff *skb, struct netlink_callback *cb)
-        struct netlink_callback *cb)
 {
        struct dump_phy_data data = {
                .cb = cb,
@@ -170,8 +168,7 @@ static int ieee802154_dump_phy(struct sk_buff *skb,
        return skb->len;
 }
-static int ieee802154_add_iface(struct sk_buff *skb,
+int ieee802154_add_iface(struct sk_buff *skb, struct genl_info *info)
-                struct genl_info *info)
 {
        struct sk_buff *msg;
        struct wpan_phy *phy;
@@ -273,8 +270,7 @@ out_dev:
        return rc;
 }
-static int ieee802154_del_iface(struct sk_buff *skb,
+int ieee802154_del_iface(struct sk_buff *skb, struct genl_info *info)
-                struct genl_info *info)
 {
        struct sk_buff *msg;
        struct wpan_phy *phy;
@@ -356,28 +352,3 @@ out_dev:
        return rc;
 }
-static struct genl_ops ieee802154_phy_ops[] = {
-        IEEE802154_DUMP(IEEE802154_LIST_PHY, ieee802154_list_phy,
-                                                        ieee802154_dump_phy),
-        IEEE802154_OP(IEEE802154_ADD_IFACE, ieee802154_add_iface),
-        IEEE802154_OP(IEEE802154_DEL_IFACE, ieee802154_del_iface),
-};
-/*
- * No need to unregister as family unregistration will do it.
- */
-int nl802154_phy_register(void)
-{
-        int i;
-        int rc;
-        for (i = 0; i < ARRAY_SIZE(ieee802154_phy_ops); i++) {
-                rc = genl_register_ops(&nl802154_family,
-                                &ieee802154_phy_ops[i]);
-                if (rc)
-                        return rc;
-        }
-        return 0;
-}
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index b28e863fe0a7..19e36376d2a0 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -57,7 +57,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        if (IS_ERR(rt)) {
                err = PTR_ERR(rt);
                if (err == -ENETUNREACH)
-                        IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
+                        IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
                goto out;
        }
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 523be38e37de..f2e15738534d 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -104,7 +104,10 @@ errout:
 static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
 {
        struct fib_result *result = (struct fib_result *) arg->result;
-        struct net_device *dev = result->fi->fib_dev;
+        struct net_device *dev = NULL;
+        if (result->fi)
+                dev = result->fi->fib_dev;
        /* do not accept result if the route does
         * not meet the required prefix length
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 3f858266fa7e..ddf32a6bc415 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -386,7 +386,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
 /*
 *      Handle MSG_ERRQUEUE
 */
-int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
+int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
        struct sock_exterr_skb *serr;
        struct sk_buff *skb, *skb2;
@@ -423,6 +423,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
                                                   serr->addr_offset);
                sin->sin_port = serr->port;
                memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
+                *addr_len = sizeof(*sin);
        }
        memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index caf01176a5e4..90ff9570d7d4 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -454,6 +454,8 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
        tstats->rx_bytes += skb->len;
        u64_stats_update_end(&tstats->syncp);
+        skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(tunnel->dev)));
        if (tunnel->dev->type == ARPHRD_ETHER) {
                skb->protocol = eth_type_trans(skb, tunnel->dev);
                skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
@@ -461,8 +463,6 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
                skb->dev = tunnel->dev;
        }
-        skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(tunnel->dev)));
        gro_cells_receive(&tunnel->gro_cells, skb);
        return 0;
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 5d9c845d288a..52b802a0cd8c 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -126,6 +126,7 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
        if (!rt->dst.xfrm ||
            rt->dst.xfrm->props.mode != XFRM_MODE_TUNNEL) {
                dev->stats.tx_carrier_errors++;
+                ip_rt_put(rt);
                goto tx_error_icmp;
        }
        tdev = rt->dst.dev;
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 01cffeaa0085..f13bd91d9a56 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -244,6 +244,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
        this_cpu_inc(snet->stats->cookie_valid);
        opts->mss = mss;
+        opts->options |= XT_SYNPROXY_OPT_MSS;
        if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
                synproxy_check_timestamp_cookie(opts);
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index cbc85f660d54..242e7f4ed6f4 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -772,7 +772,7 @@ int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                err = PTR_ERR(rt);
                rt = NULL;
                if (err == -ENETUNREACH)
-                        IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
+                        IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
                goto out;
        }
@@ -830,8 +830,6 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 {
        struct inet_sock *isk = inet_sk(sk);
        int family = sk->sk_family;
-        struct sockaddr_in *sin;
-        struct sockaddr_in6 *sin6;
        struct sk_buff *skb;
        int copied, err;
@@ -841,19 +839,13 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        if (flags & MSG_OOB)
                goto out;
-        if (addr_len) {
-                if (family == AF_INET)
-                        *addr_len = sizeof(*sin);
-                else if (family == AF_INET6 && addr_len)
-                        *addr_len = sizeof(*sin6);
-        }
        if (flags & MSG_ERRQUEUE) {
                if (family == AF_INET) {
-                        return ip_recv_error(sk, msg, len);
+                        return ip_recv_error(sk, msg, len, addr_len);
 #if IS_ENABLED(CONFIG_IPV6)
                } else if (family == AF_INET6) {
-                        return pingv6_ops.ipv6_recv_error(sk, msg, len);
+                        return pingv6_ops.ipv6_recv_error(sk, msg, len,
+                                                          addr_len);
 #endif
                }
        }
@@ -877,11 +869,15 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        /* Copy the address and add cmsg data. */
        if (family == AF_INET) {
-                sin = (struct sockaddr_in *) msg->msg_name;
+                struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
-                sin->sin_family = AF_INET;
-                sin->sin_port = 0 /* skb->h.uh->source */;
+                if (sin) {
-                sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
+                        sin->sin_family = AF_INET;
-                memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+                        sin->sin_port = 0 /* skb->h.uh->source */;
+                        sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
+                        memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+                        *addr_len = sizeof(*sin);
+                }
                if (isk->cmsg_flags)
                        ip_cmsg_recv(msg, skb);
@@ -890,17 +886,21 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        } else if (family == AF_INET6) {
                struct ipv6_pinfo *np = inet6_sk(sk);
                struct ipv6hdr *ip6 = ipv6_hdr(skb);
-                sin6 = (struct sockaddr_in6 *) msg->msg_name;
+                struct sockaddr_in6 *sin6 =
-                sin6->sin6_family = AF_INET6;
+                        (struct sockaddr_in6 *)msg->msg_name;
-                sin6->sin6_port = 0;
-                sin6->sin6_addr = ip6->saddr;
+                if (sin6) {
+                        sin6->sin6_family = AF_INET6;
-                sin6->sin6_flowinfo = 0;
+                        sin6->sin6_port = 0;
-                if (np->sndflow)
+                        sin6->sin6_addr = ip6->saddr;
-                        sin6->sin6_flowinfo = ip6_flowinfo(ip6);
+                        sin6->sin6_flowinfo = 0;
+                        if (np->sndflow)
-                sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,
+                                sin6->sin6_flowinfo = ip6_flowinfo(ip6);
-                                                          IP6CB(skb)->iif);
+                        sin6->sin6_scope_id =
+                                ipv6_iface_scope_id(&sin6->sin6_addr,
+                                                    IP6CB(skb)->iif);
+                        *addr_len = sizeof(*sin6);
+                }
                if (inet6_sk(sk)->rxopt.all)
                        pingv6_ops.ip6_datagram_recv_ctl(sk, msg, skb);
diff --git a/net/ipv4/protocol.c b/net/ipv4/protocol.c
index ce848461acbb..46d6a1c923a8 100644
--- a/net/ipv4/protocol.c
+++ b/net/ipv4/protocol.c
@@ -31,10 +31,6 @@
 const struct net_protocol __rcu *inet_protos[MAX_INET_PROTOS] __read_mostly;
 const struct net_offload __rcu *inet_offloads[MAX_INET_PROTOS] __read_mostly;
-/*
- *      Add a protocol handler to the hash tables
- */
 int inet_add_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
        if (!prot->netns_ok) {
@@ -55,10 +51,6 @@ int inet_add_offload(const struct net_offload *prot, unsigned char protocol)
 }
 EXPORT_SYMBOL(inet_add_offload);
-/*
- *      Remove a protocol from the hash tables.
- */
 int inet_del_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
        int ret;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 41e1d2845c8f..23c3e5b5bb53 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -696,11 +696,8 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        if (flags & MSG_OOB)
                goto out;
-        if (addr_len)
-                *addr_len = sizeof(*sin);
        if (flags & MSG_ERRQUEUE) {
-                err = ip_recv_error(sk, msg, len);
+                err = ip_recv_error(sk, msg, len, addr_len);
                goto out;
        }
@@ -726,6 +723,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
                sin->sin_port = 0;
                memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
+                *addr_len = sizeof(*sin);
        }
        if (inet->cmsg_flags)
                ip_cmsg_recv(msg, skb);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index f428935c50db..f8da28278014 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1776,8 +1776,12 @@ local_input:
                rth->dst.error= -err;
                rth->rt_flags   &= ~RTCF_LOCAL;
        }
-        if (do_cache)
+        if (do_cache) {
-                rt_cache_route(&FIB_RES_NH(res), rth);
+                if (unlikely(!rt_cache_route(&FIB_RES_NH(res), rth))) {
+                        rth->dst.flags |= DST_NOCACHE;
+                        rt_add_uncached_list(rth);
+                }
+        }
        skb_dst_set(skb, &rth->dst);
        err = 0;
        goto out;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 8e8529d3c8c9..c4638e6f0238 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -808,12 +808,6 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
                xmit_size_goal = min_t(u32, gso_size,
                                       sk->sk_gso_max_size - 1 - hlen);
-                /* TSQ : try to have at least two segments in flight
-                 * (one in NIC TX ring, another in Qdisc)
-                 */
-                xmit_size_goal = min_t(u32, xmit_size_goal,
-                                       sysctl_tcp_limit_output_bytes >> 1);
                xmit_size_goal = tcp_bound_to_half_wnd(tp, xmit_size_goal);
                /* We try hard to avoid divides here */
@@ -1431,7 +1425,7 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
        do {
                if (dma_async_is_tx_complete(tp->ucopy.dma_chan,
                                              last_issued, &done,
-                                              &used) == DMA_SUCCESS) {
+                                              &used) == DMA_COMPLETE) {
                        /* Safe to free early-copied skbs now */
                        __skb_queue_purge(&sk->sk_async_wait_queue);
                        break;
@@ -1439,7 +1433,7 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
                        struct sk_buff *skb;
                        while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
                               (dma_async_is_complete(skb->dma_cookie, done,
-                                                      used) == DMA_SUCCESS)) {
+                                                      used) == DMA_COMPLETE)) {
                                __skb_dequeue(&sk->sk_async_wait_queue);
                                kfree_skb(skb);
                        }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 59a6f8b90cd9..067213924751 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -177,7 +177,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        if (IS_ERR(rt)) {
                err = PTR_ERR(rt);
                if (err == -ENETUNREACH)
-                        IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
+                        IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
                return err;
        }
diff --git a/net/ipv4/tcp_memcontrol.c b/net/ipv4/tcp_memcontrol.c
index 03e9154f7e68..f7e522c558ba 100644
--- a/net/ipv4/tcp_memcontrol.c
+++ b/net/ipv4/tcp_memcontrol.c
@@ -6,13 +6,6 @@
 #include <linux/memcontrol.h>
 #include <linux/module.h>
-static void memcg_tcp_enter_memory_pressure(struct sock *sk)
-{
-        if (sk->sk_cgrp->memory_pressure)
-                sk->sk_cgrp->memory_pressure = 1;
-}
-EXPORT_SYMBOL(memcg_tcp_enter_memory_pressure);
 int tcp_init_cgroup(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
 {
        /*
@@ -60,7 +53,6 @@ EXPORT_SYMBOL(tcp_destroy_cgroup);
 static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
 {
        struct cg_proto *cg_proto;
-        u64 old_lim;
        int i;
        int ret;
@@ -71,7 +63,6 @@ static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
        if (val > RES_COUNTER_MAX)
                val = RES_COUNTER_MAX;
-        old_lim = res_counter_read_u64(&cg_proto->memory_allocated, RES_LIMIT);
        ret = res_counter_set_limit(&cg_proto->memory_allocated, val);
        if (ret)
                return ret;
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 2ab09cbae74d..06493736fbc8 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -663,10 +663,13 @@ void tcp_fastopen_cache_get(struct sock *sk, u16 *mss,
 void tcp_fastopen_cache_set(struct sock *sk, u16 mss,
                            struct tcp_fastopen_cookie *cookie, bool syn_lost)
 {
+        struct dst_entry *dst = __sk_dst_get(sk);
        struct tcp_metrics_block *tm;
+        if (!dst)
+                return;
        rcu_read_lock();
-        tm = tcp_get_metrics(sk, __sk_dst_get(sk), true);
+        tm = tcp_get_metrics(sk, dst, true);
        if (tm) {
                struct tcp_fastopen_metrics *tfom = &tm->tcpm_fastopen;
@@ -988,7 +991,7 @@ static int tcp_metrics_nl_cmd_del(struct sk_buff *skb, struct genl_info *info)
        return 0;
 }
-static struct genl_ops tcp_metrics_nl_ops[] = {
+static const struct genl_ops tcp_metrics_nl_ops[] = {
        {
                .cmd = TCP_METRICS_CMD_GET,
                .doit = tcp_metrics_nl_cmd_get,
@@ -1079,8 +1082,7 @@ void __init tcp_metrics_init(void)
        if (ret < 0)
                goto cleanup;
        ret = genl_register_family_with_ops(&tcp_metrics_nl_family,
-                                            tcp_metrics_nl_ops,
+                                            tcp_metrics_nl_ops);
-                                            ARRAY_SIZE(tcp_metrics_nl_ops));
        if (ret < 0)
                goto cleanup_subsys;
        return;
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index a2b68a108eae..05606353c7e7 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -274,33 +274,32 @@ static struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *
 {
        const struct iphdr *iph = skb_gro_network_header(skb);
        __wsum wsum;
-        __sum16 sum;
+        /* Don't bother verifying checksum if we're going to flush anyway. */
+        if (NAPI_GRO_CB(skb)->flush)
+                goto skip_csum;
+        wsum = skb->csum;
        switch (skb->ip_summed) {
+        case CHECKSUM_NONE:
+                wsum = skb_checksum(skb, skb_gro_offset(skb), skb_gro_len(skb),
+                                    0);
+                /* fall through */
        case CHECKSUM_COMPLETE:
                if (!tcp_v4_check(skb_gro_len(skb), iph->saddr, iph->daddr,
-                                  skb->csum)) {
+                                  wsum)) {
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
                        break;
                }
-flush:
                NAPI_GRO_CB(skb)->flush = 1;
                return NULL;
-        case CHECKSUM_NONE:
-                wsum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
-                                          skb_gro_len(skb), IPPROTO_TCP, 0);
-                sum = csum_fold(skb_checksum(skb,
-                                             skb_gro_offset(skb),
-                                             skb_gro_len(skb),
-                                             wsum));
-                if (sum)
-                        goto flush;
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                break;
        }
+skip_csum:
        return tcp_gro_receive(head, skb);
 }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 672854664ff5..7820f3a7dd70 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1875,8 +1875,12 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 *  - better RTT estimation and ACK scheduling
                 *  - faster recovery
                 *  - high rates
+                 * Alas, some drivers / subsystems require a fair amount
+                 * of queued bytes to ensure line rate.
+                 * One example is wifi aggregation (802.11 AMPDU)
                 */
-                limit = max(skb->truesize, sk->sk_pacing_rate >> 10);
+                limit = max_t(unsigned int, sysctl_tcp_limit_output_bytes,
+                              sk->sk_pacing_rate >> 10);
                if (atomic_read(&sk->sk_wmem_alloc) > limit) {
                        set_bit(TSQ_THROTTLED, &tp->tsq_flags);
@@ -3093,7 +3097,6 @@ void tcp_send_window_probe(struct sock *sk)
 {
        if (sk->sk_state == TCP_ESTABLISHED) {
                tcp_sk(sk)->snd_wl1 = tcp_sk(sk)->rcv_nxt - 1;
-                tcp_sk(sk)->snd_nxt = tcp_sk(sk)->write_seq;
                tcp_xmit_probe_skb(sk, 0);
        }
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index de86e5bc4462..62c19fdd102d 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -560,15 +560,11 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,
                                                 __be16 sport, __be16 dport,
                                                 struct udp_table *udptable)
 {
-        struct sock *sk;
        const struct iphdr *iph = ip_hdr(skb);
-        if (unlikely(sk = skb_steal_sock(skb)))
+        return __udp4_lib_lookup(dev_net(skb_dst(skb)->dev), iph->saddr, sport,
-                return sk;
+                                 iph->daddr, dport, inet_iif(skb),
-        else
+                                 udptable);
-                return __udp4_lib_lookup(dev_net(skb_dst(skb)->dev), iph->saddr, sport,
-                                         iph->daddr, dport, inet_iif(skb),
-                                         udptable);
 }
 struct sock *udp4_lib_lookup(struct net *net, __be32 saddr, __be16 sport,
@@ -999,7 +995,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        err = PTR_ERR(rt);
                        rt = NULL;
                        if (err == -ENETUNREACH)
-                                IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
+                                IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
                        goto out;
                }
@@ -1098,6 +1094,9 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset,
        struct udp_sock *up = udp_sk(sk);
        int ret;
+        if (flags & MSG_SENDPAGE_NOTLAST)
+                flags |= MSG_MORE;
        if (!up->pending) {
                struct msghdr msg = {   .msg_flags = flags|MSG_MORE };
@@ -1235,14 +1234,8 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        int is_udplite = IS_UDPLITE(sk);
        bool slow;
-        /*
-         *      Check any passed addresses
-         */
-        if (addr_len)
-                *addr_len = sizeof(*sin);
        if (flags & MSG_ERRQUEUE)
-                return ip_recv_error(sk, msg, len);
+                return ip_recv_error(sk, msg, len, addr_len);
 try_again:
        skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
@@ -1302,6 +1295,7 @@ try_again:
                sin->sin_port = udp_hdr(skb)->source;
                sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
                memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
+                *addr_len = sizeof(*sin);
        }
        if (inet->cmsg_flags)
                ip_cmsg_recv(msg, skb);
@@ -1605,12 +1599,21 @@ static void flush_stack(struct sock **stack, unsigned int count,
                kfree_skb(skb1);
 }
-static void udp_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+/* For TCP sockets, sk_rx_dst is protected by socket lock
+ * For UDP, we use sk_dst_lock to guard against concurrent changes.
+ */
+static void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
 {
-        struct dst_entry *dst = skb_dst(skb);
+        struct dst_entry *old;
-        dst_hold(dst);
+        spin_lock(&sk->sk_dst_lock);
-        sk->sk_rx_dst = dst;
+        old = sk->sk_rx_dst;
+        if (likely(old != dst)) {
+                dst_hold(dst);
+                sk->sk_rx_dst = dst;
+                dst_release(old);
+        }
+        spin_unlock(&sk->sk_dst_lock);
 }
 /*
@@ -1741,15 +1744,16 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        if (udp4_csum_init(skb, uh, proto))
                goto csum_error;
-        if (skb->sk) {
+        sk = skb_steal_sock(skb);
+        if (sk) {
+                struct dst_entry *dst = skb_dst(skb);
                int ret;
-                sk = skb->sk;
-                if (unlikely(sk->sk_rx_dst == NULL))
+                if (unlikely(sk->sk_rx_dst != dst))
-                        udp_sk_rx_dst_set(sk, skb);
+                        udp_sk_rx_dst_set(sk, dst);
                ret = udp_queue_rcv_skb(sk, skb);
+                sock_put(sk);
                /* a return value > 0 means to resubmit the input, but
                 * it wants the return to be -protocol, or 0
                 */
@@ -1915,17 +1919,20 @@ static struct sock *__udp4_lib_demux_lookup(struct net *net,
 void udp_v4_early_demux(struct sk_buff *skb)
 {
-        const struct iphdr *iph = ip_hdr(skb);
+        struct net *net = dev_net(skb->dev);
-        const struct udphdr *uh = udp_hdr(skb);
+        const struct iphdr *iph;
+        const struct udphdr *uh;
        struct sock *sk;
        struct dst_entry *dst;
-        struct net *net = dev_net(skb->dev);
        int dif = skb->dev->ifindex;
        /* validate the packet */
        if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr)))
                return;
+        iph = ip_hdr(skb);
+        uh = udp_hdr(skb);
        if (skb->pkt_type == PACKET_BROADCAST ||
            skb->pkt_type == PACKET_MULTICAST)
                sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5658d9d51637..d5fa5b8c443e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1996,23 +1996,6 @@ static void addrconf_add_mroute(struct net_device *dev)
        ip6_route_add(&cfg);
 }
-#if IS_ENABLED(CONFIG_IPV6_SIT)
-static void sit_route_add(struct net_device *dev)
-{
-        struct fib6_config cfg = {
-                .fc_table = RT6_TABLE_MAIN,
-                .fc_metric = IP6_RT_PRIO_ADDRCONF,
-                .fc_ifindex = dev->ifindex,
-                .fc_dst_len = 96,
-                .fc_flags = RTF_UP | RTF_NONEXTHOP,
-                .fc_nlinfo.nl_net = dev_net(dev),
-        };
-        /* prefix length - 96 bits "::d.d.d.d" */
-        ip6_route_add(&cfg);
-}
-#endif
 static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
 {
        struct inet6_dev *idev;
@@ -2542,7 +2525,8 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
        struct in6_addr addr;
        struct net_device *dev;
        struct net *net = dev_net(idev->dev);
-        int scope;
+        int scope, plen;
+        u32 pflags = 0;
        ASSERT_RTNL();
@@ -2552,12 +2536,16 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
        if (idev->dev->flags&IFF_POINTOPOINT) {
                addr.s6_addr32[0] = htonl(0xfe800000);
                scope = IFA_LINK;
+                plen = 64;
        } else {
                scope = IPV6_ADDR_COMPATv4;
+                plen = 96;
+                pflags |= RTF_NONEXTHOP;
        }
        if (addr.s6_addr32[3]) {
-                add_addr(idev, &addr, 128, scope);
+                add_addr(idev, &addr, plen, scope);
+                addrconf_prefix_route(&addr, plen, idev->dev, 0, pflags);
                return;
        }
@@ -2569,7 +2557,6 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
                        int flag = scope;
                        for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
-                                int plen;
                                addr.s6_addr32[3] = ifa->ifa_local;
@@ -2580,12 +2567,10 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
                                                continue;
                                        flag |= IFA_HOST;
                                }
-                                if (idev->dev->flags&IFF_POINTOPOINT)
-                                        plen = 64;
-                                else
-                                        plen = 96;
                                add_addr(idev, &addr, plen, flag);
+                                addrconf_prefix_route(&addr, plen, idev->dev, 0,
+                                                      pflags);
                        }
                }
        }
@@ -2628,7 +2613,7 @@ static void init_loopback(struct net_device *dev)
                        if (sp_ifa->rt)
                                continue;
-                        sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
+                        sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, false);
                        /* Failure cases are ignored */
                        if (!IS_ERR(sp_rt)) {
@@ -2711,7 +2696,6 @@ static void addrconf_sit_config(struct net_device *dev)
                struct in6_addr addr;
                ipv6_addr_set(&addr,  htonl(0xFE800000), 0, 0, 0);
-                addrconf_prefix_route(&addr, 64, dev, 0, 0);
                if (!ipv6_generate_eui64(addr.s6_addr + 8, dev))
                        addrconf_add_linklocal(idev, &addr);
                return;
@@ -2721,8 +2705,6 @@ static void addrconf_sit_config(struct net_device *dev)
        if (dev->flags&IFF_POINTOPOINT)
                addrconf_add_mroute(dev);
-        else
-                sit_route_add(dev);
 }
 #endif
@@ -2740,8 +2722,6 @@ static void addrconf_gre_config(struct net_device *dev)
        }
        ipv6_addr_set(&addr,  htonl(0xFE800000), 0, 0, 0);
-        addrconf_prefix_route(&addr, 64, dev, 0, 0);
        if (!ipv6_generate_eui64(addr.s6_addr + 8, dev))
                addrconf_add_linklocal(idev, &addr);
 }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index ff75313f27a8..4fbdb7046d28 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -972,10 +972,10 @@ out:
 #ifdef CONFIG_SYSCTL
 sysctl_fail:
-        ipv6_packet_cleanup();
+        pingv6_exit();
 #endif
 pingv6_fail:
-        pingv6_exit();
+        ipv6_packet_cleanup();
 ipv6_packet_fail:
        tcpv6_exit();
 tcpv6_fail:
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index a454b0ff57c7..93b1aa34c432 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -73,7 +73,6 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                        if (flowlabel == NULL)
                                return -EINVAL;
-                        usin->sin6_addr = flowlabel->dst;
                }
        }
@@ -318,7 +317,7 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
 /*
 *      Handle MSG_ERRQUEUE
 */
-int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
+int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct sock_exterr_skb *serr;
@@ -369,6 +368,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                                               &sin->sin6_addr);
                        sin->sin6_scope_id = 0;
                }
+                *addr_len = sizeof(*sin);
        }
        memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
@@ -377,6 +377,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
        if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
                sin->sin6_family = AF_INET6;
                sin->sin6_flowinfo = 0;
+                sin->sin6_port = 0;
                if (skb->protocol == htons(ETH_P_IPV6)) {
                        sin->sin6_addr = ipv6_hdr(skb)->saddr;
                        if (np->rxopt.all)
@@ -423,7 +424,8 @@ EXPORT_SYMBOL_GPL(ipv6_recv_error);
 /*
 *      Handle IPV6_RECVPATHMTU
 */
-int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
+int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len,
+                     int *addr_len)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct sk_buff *skb;
@@ -457,6 +459,7 @@ int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
                sin->sin6_port = 0;
                sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id;
                sin->sin6_addr = mtu_info.ip6m_addr.sin6_addr;
+                *addr_len = sizeof(*sin);
        }
        put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index e27591635f92..3fd0a578329e 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -122,7 +122,11 @@ out:
 static bool fib6_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
 {
        struct rt6_info *rt = (struct rt6_info *) arg->result;
-        struct net_device *dev = rt->rt6i_idev->dev;
+        struct net_device *dev = NULL;
+        if (rt->rt6i_idev)
+                dev = rt->rt6i_idev->dev;
        /* do not accept result if the route does
         * not meet the required prefix length
         */
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 59df872e2f4d..4acdb63495db 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -116,8 +116,8 @@ static int ip6_finish_output2(struct sk_buff *skb)
        }
        rcu_read_unlock_bh();
-        IP6_INC_STATS_BH(dev_net(dst->dev),
+        IP6_INC_STATS(dev_net(dst->dev),
-                         ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
+                      ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
        kfree_skb(skb);
        return -EINVAL;
 }
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index df1fa58528c6..d6062325db08 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1642,6 +1642,15 @@ static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
        return ip6_tnl_update(t, &p);
 }
+static void ip6_tnl_dellink(struct net_device *dev, struct list_head *head)
+{
+        struct net *net = dev_net(dev);
+        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+        if (dev != ip6n->fb_tnl_dev)
+                unregister_netdevice_queue(dev, head);
+}
 static size_t ip6_tnl_get_size(const struct net_device *dev)
 {
        return
@@ -1706,6 +1715,7 @@ static struct rtnl_link_ops ip6_link_ops __read_mostly = {
        .validate       = ip6_tnl_validate,
        .newlink        = ip6_tnl_newlink,
        .changelink     = ip6_tnl_changelink,
+        .dellink        = ip6_tnl_dellink,
        .get_size       = ip6_tnl_get_size,
        .fill_info      = ip6_tnl_fill_info,
 };
@@ -1722,9 +1732,9 @@ static struct xfrm6_tunnel ip6ip6_handler __read_mostly = {
        .priority       =       1,
 };
-static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
+static void __net_exit ip6_tnl_destroy_tunnels(struct net *net)
 {
-        struct net *net = dev_net(ip6n->fb_tnl_dev);
+        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
        struct net_device *dev, *aux;
        int h;
        struct ip6_tnl *t;
@@ -1792,10 +1802,8 @@ err_alloc_dev:
 static void __net_exit ip6_tnl_exit_net(struct net *net)
 {
-        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
        rtnl_lock();
-        ip6_tnl_destroy_tunnels(ip6n);
+        ip6_tnl_destroy_tunnels(net);
        rtnl_unlock();
 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index f8a55ff1971b..300865171394 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1277,6 +1277,9 @@ skip_linkparms:
                            ri->prefix_len == 0)
                                continue;
 #endif
+                        if (ri->prefix_len == 0 &&
+                            !in6_dev->cnf.accept_ra_defrtr)
+                                continue;
                        if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
                                continue;
                        rt6_route_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3,
@@ -1726,8 +1729,8 @@ int __init ndisc_init(void)
                                    &ndisc_ifinfo_sysctl_change);
        if (err)
                goto out_unregister_pernet;
-#endif
 out:
+#endif
        return err;
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index bf9f612c1bc2..f78f41aca8e9 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -259,6 +259,7 @@ synproxy_recv_client_ack(const struct synproxy_net *snet,
        this_cpu_inc(snet->stats->cookie_valid);
        opts->mss = mss;
+        opts->options |= XT_SYNPROXY_OPT_MSS;
        if (opts->options & XT_SYNPROXY_OPT_TIMESTAMP)
                synproxy_check_timestamp_cookie(opts);
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index 8815e31a87fe..a83243c3d656 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -57,7 +57,8 @@ static struct inet_protosw pingv6_protosw = {
 /* Compatibility glue so we can support IPv6 when it's compiled as a module */
-static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
+static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len,
+                                 int *addr_len)
 {
        return -EAFNOSUPPORT;
 }
diff --git a/net/ipv6/protocol.c b/net/ipv6/protocol.c
index 22d1bd4670da..e048cf1bb6a2 100644
--- a/net/ipv6/protocol.c
+++ b/net/ipv6/protocol.c
@@ -36,10 +36,6 @@ int inet6_add_protocol(const struct inet6_protocol *prot, unsigned char protocol
 }
 EXPORT_SYMBOL(inet6_add_protocol);
-/*
- *      Remove a protocol from the hash tables.
- */
 int inet6_del_protocol(const struct inet6_protocol *prot, unsigned char protocol)
 {
        int ret;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 3c00842b0079..b6bb87e55805 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -465,14 +465,11 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
        if (flags & MSG_OOB)
                return -EOPNOTSUPP;
-        if (addr_len)
-                *addr_len=sizeof(*sin6);
        if (flags & MSG_ERRQUEUE)
-                return ipv6_recv_error(sk, msg, len);
+                return ipv6_recv_error(sk, msg, len, addr_len);
        if (np->rxpmtu && np->rxopt.bits.rxpmtu)
-                return ipv6_recv_rxpmtu(sk, msg, len);
+                return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
        skb = skb_recv_datagram(sk, flags, noblock, &err);
        if (!skb)
@@ -506,6 +503,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                sin6->sin6_flowinfo = 0;
                sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,
                                                          IP6CB(skb)->iif);
+                *addr_len = sizeof(*sin6);
        }
        sock_recv_ts_and_drops(msg, sk, skb);
@@ -794,7 +792,6 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                                flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                                if (flowlabel == NULL)
                                        return -EINVAL;
-                                daddr = &flowlabel->dst;
                        }
                }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7faa9d5e1503..a0a48ac3403f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -84,6 +84,8 @@ static int		 ip6_dst_gc(struct dst_ops *ops);
 static int              ip6_pkt_discard(struct sk_buff *skb);
 static int              ip6_pkt_discard_out(struct sk_buff *skb);
+static int              ip6_pkt_prohibit(struct sk_buff *skb);
+static int              ip6_pkt_prohibit_out(struct sk_buff *skb);
 static void             ip6_link_failure(struct sk_buff *skb);
 static void             ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
                                           struct sk_buff *skb, u32 mtu);
@@ -234,9 +236,6 @@ static const struct rt6_info ip6_null_entry_template = {
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
-static int ip6_pkt_prohibit(struct sk_buff *skb);
-static int ip6_pkt_prohibit_out(struct sk_buff *skb);
 static const struct rt6_info ip6_prohibit_entry_template = {
        .dst = {
                .__refcnt       = ATOMIC_INIT(1),
@@ -1565,21 +1564,24 @@ int ip6_route_add(struct fib6_config *cfg)
                                goto out;
                        }
                }
-                rt->dst.output = ip6_pkt_discard_out;
-                rt->dst.input = ip6_pkt_discard;
                rt->rt6i_flags = RTF_REJECT|RTF_NONEXTHOP;
                switch (cfg->fc_type) {
                case RTN_BLACKHOLE:
                        rt->dst.error = -EINVAL;
+                        rt->dst.output = dst_discard;
+                        rt->dst.input = dst_discard;
                        break;
                case RTN_PROHIBIT:
                        rt->dst.error = -EACCES;
+                        rt->dst.output = ip6_pkt_prohibit_out;
+                        rt->dst.input = ip6_pkt_prohibit;
                        break;
                case RTN_THROW:
-                        rt->dst.error = -EAGAIN;
-                        break;
                default:
-                        rt->dst.error = -ENETUNREACH;
+                        rt->dst.error = (cfg->fc_type == RTN_THROW) ? -EAGAIN
+                                        : -ENETUNREACH;
+                        rt->dst.output = ip6_pkt_discard_out;
+                        rt->dst.input = ip6_pkt_discard;
                        break;
                }
                goto install_route;
@@ -2144,8 +2146,6 @@ static int ip6_pkt_discard_out(struct sk_buff *skb)
        return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_OUTNOROUTES);
 }
-#ifdef CONFIG_IPV6_MULTIPLE_TABLES
 static int ip6_pkt_prohibit(struct sk_buff *skb)
 {
        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_INNOROUTES);
@@ -2157,8 +2157,6 @@ static int ip6_pkt_prohibit_out(struct sk_buff *skb)
        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
 }
-#endif
 /*
 *      Allocate a dst for local (unicast / anycast) address.
 */
@@ -2168,12 +2166,10 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
                                    bool anycast)
 {
        struct net *net = dev_net(idev->dev);
-        struct rt6_info *rt = ip6_dst_alloc(net, net->loopback_dev, 0, NULL);
+        struct rt6_info *rt = ip6_dst_alloc(net, net->loopback_dev,
+                                            DST_NOCOUNT, NULL);
-        if (!rt) {
+        if (!rt)
-                net_warn_ratelimited("Maximum number of routes reached, consider increasing route/max_size\n");
                return ERR_PTR(-ENOMEM);
-        }
        in6_dev_hold(idev);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index bfc6fcea3841..366fbba3359a 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -478,14 +478,44 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
        dev_put(dev);
 }
+/* Generate icmpv6 with type/code ICMPV6_DEST_UNREACH/ICMPV6_ADDR_UNREACH
+ * if sufficient data bytes are available
+ */
+static int ipip6_err_gen_icmpv6_unreach(struct sk_buff *skb)
+{
+        const struct iphdr *iph = (const struct iphdr *) skb->data;
+        struct rt6_info *rt;
+        struct sk_buff *skb2;
+        if (!pskb_may_pull(skb, iph->ihl * 4 + sizeof(struct ipv6hdr) + 8))
+                return 1;
+        skb2 = skb_clone(skb, GFP_ATOMIC);
+        if (!skb2)
+                return 1;
+        skb_dst_drop(skb2);
+        skb_pull(skb2, iph->ihl * 4);
+        skb_reset_network_header(skb2);
+        rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 0);
+        if (rt && rt->dst.dev)
+                skb2->dev = rt->dst.dev;
+        icmpv6_send(skb2, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
+        if (rt)
+                ip6_rt_put(rt);
+        kfree_skb(skb2);
+        return 0;
+}
 static int ipip6_err(struct sk_buff *skb, u32 info)
 {
-/* All the routers (except for Linux) return only
-   8 bytes of packet payload. It means, that precise relaying of
-   ICMP in the real Internet is absolutely infeasible.
- */
        const struct iphdr *iph = (const struct iphdr *)skb->data;
        const int type = icmp_hdr(skb)->type;
        const int code = icmp_hdr(skb)->code;
@@ -500,7 +530,6 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
        case ICMP_DEST_UNREACH:
                switch (code) {
                case ICMP_SR_FAILED:
-                case ICMP_PORT_UNREACH:
                        /* Impossible event. */
                        return 0;
                default:
@@ -545,6 +574,9 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
                goto out;
        err = 0;
+        if (!ipip6_err_gen_icmpv6_unreach(skb))
+                goto out;
        if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
                goto out;
@@ -919,7 +951,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                if (!new_skb) {
                        ip_rt_put(rt);
                        dev->stats.tx_dropped++;
-                        dev_kfree_skb(skb);
+                        kfree_skb(skb);
                        return NETDEV_TX_OK;
                }
                if (skb->sk)
@@ -945,7 +977,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
 tx_error_icmp:
        dst_link_failure(skb);
 tx_error:
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
 out:
        dev->stats.tx_errors++;
        return NETDEV_TX_OK;
@@ -985,7 +1017,7 @@ static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb,
 tx_err:
        dev->stats.tx_errors++;
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
        return NETDEV_TX_OK;
 }
@@ -1619,6 +1651,15 @@ static const struct nla_policy ipip6_policy[IFLA_IPTUN_MAX + 1] = {
 #endif
 };
+static void ipip6_dellink(struct net_device *dev, struct list_head *head)
+{
+        struct net *net = dev_net(dev);
+        struct sit_net *sitn = net_generic(net, sit_net_id);
+        if (dev != sitn->fb_tunnel_dev)
+                unregister_netdevice_queue(dev, head);
+}
 static struct rtnl_link_ops sit_link_ops __read_mostly = {
        .kind           = "sit",
        .maxtype        = IFLA_IPTUN_MAX,
@@ -1630,6 +1671,7 @@ static struct rtnl_link_ops sit_link_ops __read_mostly = {
        .changelink     = ipip6_changelink,
        .get_size       = ipip6_get_size,
        .fill_info      = ipip6_fill_info,
+        .dellink        = ipip6_dellink,
 };
 static struct xfrm_tunnel sit_handler __read_mostly = {
@@ -1644,9 +1686,10 @@ static struct xfrm_tunnel ipip_handler __read_mostly = {
        .priority       =       2,
 };
-static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_head *head)
+static void __net_exit sit_destroy_tunnels(struct net *net,
+                                           struct list_head *head)
 {
-        struct net *net = dev_net(sitn->fb_tunnel_dev);
+        struct sit_net *sitn = net_generic(net, sit_net_id);
        struct net_device *dev, *aux;
        int prio;
@@ -1721,11 +1764,10 @@ err_alloc_dev:
 static void __net_exit sit_exit_net(struct net *net)
 {
-        struct sit_net *sitn = net_generic(net, sit_net_id);
        LIST_HEAD(list);
        rtnl_lock();
-        sit_destroy_tunnels(sitn, &list);
+        sit_destroy_tunnels(net, &list);
        unregister_netdevice_many(&list);
        rtnl_unlock();
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 0740f93a114a..f67033b4bb66 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -156,7 +156,6 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                        if (flowlabel == NULL)
                                return -EINVAL;
-                        usin->sin6_addr = flowlabel->dst;
                        fl6_sock_release(flowlabel);
                }
        }
diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
index c1097c798900..6d18157dc32c 100644
--- a/net/ipv6/tcpv6_offload.c
+++ b/net/ipv6/tcpv6_offload.c
@@ -37,34 +37,32 @@ static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 {
        const struct ipv6hdr *iph = skb_gro_network_header(skb);
        __wsum wsum;
-        __sum16 sum;
+        /* Don't bother verifying checksum if we're going to flush anyway. */
+        if (NAPI_GRO_CB(skb)->flush)
+                goto skip_csum;
+        wsum = skb->csum;
        switch (skb->ip_summed) {
+        case CHECKSUM_NONE:
+                wsum = skb_checksum(skb, skb_gro_offset(skb), skb_gro_len(skb),
+                                    wsum);
+                /* fall through */
        case CHECKSUM_COMPLETE:
                if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
-                                  skb->csum)) {
+                                  wsum)) {
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
                        break;
                }
-flush:
                NAPI_GRO_CB(skb)->flush = 1;
                return NULL;
-        case CHECKSUM_NONE:
-                wsum = ~csum_unfold(csum_ipv6_magic(&iph->saddr, &iph->daddr,
-                                                    skb_gro_len(skb),
-                                                    IPPROTO_TCP, 0));
-                sum = csum_fold(skb_checksum(skb,
-                                             skb_gro_offset(skb),
-                                             skb_gro_len(skb),
-                                             wsum));
-                if (sum)
-                        goto flush;
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                break;
        }
+skip_csum:
        return tcp_gro_receive(head, skb);
 }
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index f3893e897f72..089c741a3992 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -392,14 +392,11 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
        int is_udp4;
        bool slow;
-        if (addr_len)
-                *addr_len = sizeof(struct sockaddr_in6);
        if (flags & MSG_ERRQUEUE)
-                return ipv6_recv_error(sk, msg, len);
+                return ipv6_recv_error(sk, msg, len, addr_len);
        if (np->rxpmtu && np->rxopt.bits.rxpmtu)
-                return ipv6_recv_rxpmtu(sk, msg, len);
+                return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 try_again:
        skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
@@ -480,7 +477,7 @@ try_again:
                                ipv6_iface_scope_id(&sin6->sin6_addr,
                                                    IP6CB(skb)->iif);
                }
+                *addr_len = sizeof(*sin6);
        }
        if (is_udp4) {
                if (inet->cmsg_flags)
@@ -1143,7 +1140,6 @@ do_udp_sendmsg:
                                flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                                if (flowlabel == NULL)
                                        return -EINVAL;
-                                daddr = &flowlabel->dst;
                        }
                }
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 7a1e0fc1bd4d..e096025b477f 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1823,8 +1823,6 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (skb->tstamp.tv64)
                sk->sk_stamp = skb->tstamp;
-        msg->msg_namelen = sizeof(*sipx);
        if (sipx) {
                sipx->sipx_family       = AF_IPX;
                sipx->sipx_port         = ipx->ipx_source.sock;
@@ -1832,6 +1830,7 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
                sipx->sipx_network      = IPX_SKB_CB(skb)->ipx_source_net;
                sipx->sipx_type         = ipx->ipx_type;
                sipx->sipx_zero         = 0;
+                msg->msg_namelen        = sizeof(*sipx);
        }
        rc = copied;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 0f676908d15b..de7db23049f1 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1385,8 +1385,6 @@ static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,
        IRDA_DEBUG(4, "%s()\n", __func__);
-        msg->msg_namelen = 0;
        skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                flags & MSG_DONTWAIT, &err);
        if (!skb)
@@ -1451,8 +1449,6 @@ static int irda_recvmsg_stream(struct kiocb *iocb, struct socket *sock,
        target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
        timeo = sock_rcvtimeo(sk, noblock);
-        msg->msg_namelen = 0;
        do {
                int chunk;
                struct sk_buff *skb = skb_dequeue(&sk->sk_receive_queue);
diff --git a/net/irda/irnetlink.c b/net/irda/irnetlink.c
index c32971269280..a37b81fe0479 100644
--- a/net/irda/irnetlink.c
+++ b/net/irda/irnetlink.c
@@ -131,7 +131,7 @@ static const struct nla_policy irda_nl_policy[IRDA_NL_ATTR_MAX + 1] = {
        [IRDA_NL_ATTR_MODE] = { .type = NLA_U32 },
 };
-static struct genl_ops irda_nl_ops[] = {
+static const struct genl_ops irda_nl_ops[] = {
        {
                .cmd = IRDA_NL_CMD_SET_MODE,
                .doit = irda_nl_set_mode,
@@ -149,8 +149,7 @@ static struct genl_ops irda_nl_ops[] = {
 int irda_nl_register(void)
 {
-        return genl_register_family_with_ops(&irda_nl_family,
+        return genl_register_family_with_ops(&irda_nl_family, irda_nl_ops);
-                irda_nl_ops, ARRAY_SIZE(irda_nl_ops));
 }
 void irda_nl_unregister(void)
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 168aff5e60de..c4b7218058b6 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1324,8 +1324,6 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        int err = 0;
        u32 offset;
-        msg->msg_namelen = 0;
        if ((sk->sk_state == IUCV_DISCONN) &&
            skb_queue_empty(&iucv->backlog_skb_q) &&
            skb_queue_empty(&sk->sk_receive_queue) &&
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 911ef03bf8fb..545f047868ad 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3616,7 +3616,6 @@ static int pfkey_recvmsg(struct kiocb *kiocb,
        if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
                goto out;
-        msg->msg_namelen = 0;
        skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err);
        if (skb == NULL)
                goto out;
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 571db8dd2292..da1a1cee1a08 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -518,9 +518,6 @@ static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
        if (flags & MSG_OOB)
                goto out;
-        if (addr_len)
-                *addr_len = sizeof(*sin);
        skb = skb_recv_datagram(sk, flags, noblock, &err);
        if (!skb)
                goto out;
@@ -543,6 +540,7 @@ static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
                sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
                sin->sin_port = 0;
                memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
+                *addr_len = sizeof(*sin);
        }
        if (inet->cmsg_flags)
                ip_cmsg_recv(msg, skb);
diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index cfd65304be60..bb6e206ea70b 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -528,7 +528,6 @@ static int l2tp_ip6_sendmsg(struct kiocb *iocb, struct sock *sk,
                                flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                                if (flowlabel == NULL)
                                        return -EINVAL;
-                                daddr = &flowlabel->dst;
                        }
                }
@@ -665,7 +664,7 @@ static int l2tp_ip6_recvmsg(struct kiocb *iocb, struct sock *sk,
                *addr_len = sizeof(*lsa);
        if (flags & MSG_ERRQUEUE)
-                return ipv6_recv_error(sk, msg, len);
+                return ipv6_recv_error(sk, msg, len, addr_len);
        skb = skb_recv_datagram(sk, flags, noblock, &err);
        if (!skb)
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index be446d517bc9..4cfd722e9153 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -793,7 +793,7 @@ static struct nla_policy l2tp_nl_policy[L2TP_ATTR_MAX + 1] = {
        },
 };
-static struct genl_ops l2tp_nl_ops[] = {
+static const struct genl_ops l2tp_nl_ops[] = {
        {
                .cmd = L2TP_CMD_NOOP,
                .doit = l2tp_nl_cmd_noop,
@@ -887,13 +887,8 @@ EXPORT_SYMBOL_GPL(l2tp_nl_unregister_ops);
 static int l2tp_nl_init(void)
 {
-        int err;
        pr_info("L2TP netlink interface\n");
-        err = genl_register_family_with_ops(&l2tp_nl_family, l2tp_nl_ops,
+        return genl_register_family_with_ops(&l2tp_nl_family, l2tp_nl_ops);
-                                            ARRAY_SIZE(l2tp_nl_ops));
-        return err;
 }
 static void l2tp_nl_cleanup(void)
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index ffda81ef1a70..be5fadf34739 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -197,8 +197,6 @@ static int pppol2tp_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (sk->sk_state & PPPOX_BOUND)
                goto end;
-        msg->msg_namelen = 0;
        err = 0;
        skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                flags & MSG_DONTWAIT, &err);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 6cba486353e8..7b01b9f5846c 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -720,8 +720,6 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
        int target;     /* Read at least this many bytes */
        long timeo;
-        msg->msg_namelen = 0;
        lock_sock(sk);
        copied = -ENOTCONN;
        if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 95667b088c5b..364ce0c5962f 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1368,7 +1368,7 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                        changed |=
                              ieee80211_mps_set_sta_local_pm(sta,
                                                             params->local_pm);
-                ieee80211_bss_info_change_notify(sdata, changed);
+                ieee80211_mbss_info_change_notify(sdata, changed);
 #endif
        }
@@ -2488,8 +2488,7 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
-            sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
                return -EOPNOTSUPP;
        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
@@ -3120,9 +3119,17 @@ static int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
                    params->chandef.chan->band)
                        return -EINVAL;
+                ifmsh->chsw_init = true;
+                if (!ifmsh->pre_value)
+                        ifmsh->pre_value = 1;
+                else
+                        ifmsh->pre_value++;
                err = ieee80211_mesh_csa_beacon(sdata, params, true);
-                if (err < 0)
+                if (err < 0) {
+                        ifmsh->chsw_init = false;
                        return err;
+                }
                break;
 #endif
        default:
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 531be040b9ae..27a39de89679 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -823,6 +823,10 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
        if (err)
                return false;
+        /* channel switch is not supported, disconnect */
+        if (!(sdata->local->hw.wiphy->flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
+                goto disconnect;
        params.count = csa_ie.count;
        params.chandef = csa_ie.chandef;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 29dc505be125..4aea4e791113 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1228,6 +1228,7 @@ struct ieee80211_csa_ie {
        u8 mode;
        u8 count;
        u8 ttl;
+        u16 pre_value;
 };
 /* Parsed Information Elements */
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index ff101ea1d9ae..36c3a4cbcabf 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1325,7 +1325,6 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,
                sdata->vif.bss_conf.bssid = NULL;
                break;
        case NL80211_IFTYPE_AP_VLAN:
-                break;
        case NL80211_IFTYPE_P2P_DEVICE:
                sdata->vif.bss_conf.bssid = sdata->vif.addr;
                break;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 21d5d44444d0..7d1c3ac48ed9 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -940,6 +940,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                wiphy_debug(local->hw.wiphy, "Failed to initialize wep: %d\n",
                            result);
+        local->hw.conf.flags = IEEE80211_CONF_IDLE;
        ieee80211_led_init(local);
        rtnl_lock();
@@ -1047,6 +1049,7 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
        cancel_work_sync(&local->restart_work);
        cancel_work_sync(&local->reconfig_filter);
+        flush_work(&local->sched_scan_stopped_work);
        ieee80211_clear_tx_pending(local);
        rate_control_deinitialize(local);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 896fe3bd599e..ba105257d03f 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -943,14 +943,19 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
                 params.chandef.chan->center_freq);
        params.block_tx = csa_ie.mode & WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT;
-        if (beacon)
+        if (beacon) {
                ifmsh->chsw_ttl = csa_ie.ttl - 1;
-        else
+                if (ifmsh->pre_value >= csa_ie.pre_value)
-                ifmsh->chsw_ttl = 0;
+                        return false;
+                ifmsh->pre_value = csa_ie.pre_value;
+        }
-        if (ifmsh->chsw_ttl > 0)
+        if (ifmsh->chsw_ttl < ifmsh->mshcfg.dot11MeshTTL) {
                if (ieee80211_mesh_csa_beacon(sdata, &params, false) < 0)
                        return false;
+        } else {
+                return false;
+        }
        sdata->csa_radar_required = params.radar_required;
@@ -1163,7 +1168,6 @@ static int mesh_fwd_csa_frame(struct ieee80211_sub_if_data *sdata,
        offset_ttl = (len < 42) ? 7 : 10;
        *(pos + offset_ttl) -= 1;
        *(pos + offset_ttl + 1) &= ~WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR;
-        sdata->u.mesh.chsw_ttl = *(pos + offset_ttl);
        memcpy(mgmt_fwd, mgmt, len);
        eth_broadcast_addr(mgmt_fwd->da);
@@ -1182,7 +1186,7 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
        u16 pre_value;
        bool fwd_csa = true;
        size_t baselen;
-        u8 *pos, ttl;
+        u8 *pos;
        if (mgmt->u.action.u.measurement.action_code !=
            WLAN_ACTION_SPCT_CHL_SWITCH)
@@ -1193,8 +1197,8 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata,
                           u.action.u.chan_switch.variable);
        ieee802_11_parse_elems(pos, len - baselen, false, &elems);
-        ttl = elems.mesh_chansw_params_ie->mesh_ttl;
+        ifmsh->chsw_ttl = elems.mesh_chansw_params_ie->mesh_ttl;
-        if (!--ttl)
+        if (!--ifmsh->chsw_ttl)
                fwd_csa = false;
        pre_value = le16_to_cpu(elems.mesh_chansw_params_ie->mesh_pre_value);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d7504ab61a34..b3a3ce316656 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1910,6 +1910,8 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
        if (ifmgd->flags & IEEE80211_STA_CONNECTION_POLL)
                already = true;
+        ifmgd->flags |= IEEE80211_STA_CONNECTION_POLL;
        mutex_unlock(&sdata->local->mtx);
        if (already)
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 5d60779a0c1b..4096ff6cc24f 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -226,7 +226,7 @@ minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
                nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
        nsecs += minstrel_mcs_groups[group].duration[rate];
-        tp = 1000000 * ((mr->probability * 1000) / nsecs);
+        tp = 1000000 * ((prob * 1000) / nsecs);
        mr->cur_tp = MINSTREL_TRUNC(tp);
 }
@@ -277,13 +277,15 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
                        if (!(mg->supported & BIT(i)))
                                continue;
+                        index = MCS_GROUP_RATES * group + i;
                        /* initialize rates selections starting indexes */
                        if (!mg_rates_valid) {
                                mg->max_tp_rate = mg->max_tp_rate2 =
                                        mg->max_prob_rate = i;
                                if (!mi_rates_valid) {
                                        mi->max_tp_rate = mi->max_tp_rate2 =
-                                                mi->max_prob_rate = i;
+                                                mi->max_prob_rate = index;
                                        mi_rates_valid = true;
                                }
                                mg_rates_valid = true;
@@ -291,7 +293,6 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
                        mr = &mg->rates[i];
                        mr->retry_updated = false;
-                        index = MCS_GROUP_RATES * group + i;
                        minstrel_calc_rate_ewma(mr);
                        minstrel_ht_calc_tp(mi, group, i);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index caecef870c0e..2b0debb0422b 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -911,7 +911,8 @@ static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
        u16 sc;
        u8 tid, ack_policy;
-        if (!ieee80211_is_data_qos(hdr->frame_control))
+        if (!ieee80211_is_data_qos(hdr->frame_control) ||
+            is_multicast_ether_addr(hdr->addr1))
                goto dont_reorder;
        /*
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 5ad66a83ef7f..bcc4833d7542 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -1088,6 +1088,6 @@ void ieee80211_sched_scan_stopped(struct ieee80211_hw *hw)
        trace_api_sched_scan_stopped(local);
-        ieee80211_queue_work(&local->hw, &local->sched_scan_stopped_work);
+        schedule_work(&local->sched_scan_stopped_work);
 }
 EXPORT_SYMBOL(ieee80211_sched_scan_stopped);
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index a40da20b32e0..6ab009070084 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -78,6 +78,8 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
        if (elems->mesh_chansw_params_ie) {
                csa_ie->ttl = elems->mesh_chansw_params_ie->mesh_ttl;
                csa_ie->mode = elems->mesh_chansw_params_ie->mesh_flags;
+                csa_ie->pre_value = le16_to_cpu(
+                                elems->mesh_chansw_params_ie->mesh_pre_value);
        }
        new_freq = ieee80211_channel_to_frequency(new_chan_no, new_band);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 592a18171f95..9f9b9bd3fd44 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2278,17 +2278,15 @@ void ieee80211_dfs_radar_detected_work(struct work_struct *work)
 {
        struct ieee80211_local *local =
                container_of(work, struct ieee80211_local, radar_detected_work);
-        struct cfg80211_chan_def chandef;
+        struct cfg80211_chan_def chandef = local->hw.conf.chandef;
        ieee80211_dfs_cac_cancel(local);
        if (local->use_chanctx)
                /* currently not handled */
                WARN_ON(1);
-        else {
+        else
-                chandef = local->hw.conf.chandef;
                cfg80211_radar_event(local->hw.wiphy, &chandef, GFP_KERNEL);
-        }
 }
 void ieee80211_radar_detected(struct ieee80211_hw *hw)
@@ -2459,14 +2457,9 @@ int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
                          WLAN_EID_CHAN_SWITCH_PARAM_TX_RESTRICT : 0x00;
                put_unaligned_le16(WLAN_REASON_MESH_CHAN, pos); /* Reason Cd */
                pos += 2;
-                if (!ifmsh->pre_value)
-                        ifmsh->pre_value = 1;
-                else
-                        ifmsh->pre_value++;
                pre_value = cpu_to_le16(ifmsh->pre_value);
                memcpy(pos, &pre_value, 2);             /* Precedence Value */
                pos += 2;
-                ifmsh->chsw_init = true;
        }
        ieee80211_tx_skb(sdata, skb);
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 48acec17e27a..c3398cd99b94 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -909,7 +909,7 @@ config NETFILTER_XT_MATCH_CONNLABEL
          connection simultaneously.
 config NETFILTER_XT_MATCH_CONNLIMIT
-        tristate '"connlimit" match support"'
+        tristate '"connlimit" match support'
        depends on NF_CONNTRACK
        depends on NETFILTER_ADVANCED
        ---help---
diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c
index 2bc2dec20b00..6226803fc490 100644
--- a/net/netfilter/ipset/ip_set_hash_netnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netnet.c
@@ -59,7 +59,7 @@ hash_netnet4_data_equal(const struct hash_netnet4_elem *ip1,
                     u32 *multi)
 {
        return ip1->ipcmp == ip2->ipcmp &&
-               ip2->ccmp == ip2->ccmp;
+               ip1->ccmp == ip2->ccmp;
 }
 static inline int
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 1ded5c6d268c..35be035ee0ce 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3580,7 +3580,7 @@ out:
 }
-static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
+static const struct genl_ops ip_vs_genl_ops[] __read_mostly = {
        {
                .cmd    = IPVS_CMD_NEW_SERVICE,
                .flags  = GENL_ADMIN_PERM,
@@ -3679,7 +3679,7 @@ static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
 static int __init ip_vs_genl_register(void)
 {
        return genl_register_family_with_ops(&ip_vs_genl_family,
-                ip_vs_genl_ops, ARRAY_SIZE(ip_vs_genl_ops));
+                                             ip_vs_genl_ops);
 }
 static void ip_vs_genl_unregister(void)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e22d950c60b3..43549eb7a7be 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -764,9 +764,10 @@ void nf_conntrack_free(struct nf_conn *ct)
        struct net *net = nf_ct_net(ct);
        nf_ct_ext_destroy(ct);
-        atomic_dec(&net->ct.count);
        nf_ct_ext_free(ct);
        kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
+        smp_mb__before_atomic_dec();
+        atomic_dec(&net->ct.count);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_free);
diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
index 5f9bfd060dea..17c1bcb182c6 100644
--- a/net/netfilter/nf_conntrack_seqadj.c
+++ b/net/netfilter/nf_conntrack_seqadj.c
@@ -41,8 +41,8 @@ int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
        spin_lock_bh(&ct->lock);
        this_way = &seqadj->seq[dir];
        if (this_way->offset_before == this_way->offset_after ||
-            before(this_way->correction_pos, seq)) {
+            before(this_way->correction_pos, ntohl(seq))) {
-                this_way->correction_pos = seq;
+                this_way->correction_pos = ntohl(seq);
                this_way->offset_before  = this_way->offset_after;
                this_way->offset_after  += off;
        }
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index cdf4567ba9b3..9858e3e51a3a 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -151,9 +151,10 @@ void synproxy_init_timestamp_cookie(const struct xt_synproxy_info *info,
        opts->tsecr = opts->tsval;
        opts->tsval = tcp_time_stamp & ~0x3f;
-        if (opts->options & XT_SYNPROXY_OPT_WSCALE)
+        if (opts->options & XT_SYNPROXY_OPT_WSCALE) {
-                opts->tsval |= info->wscale;
+                opts->tsval |= opts->wscale;
-        else
+                opts->wscale = info->wscale;
+        } else
                opts->tsval |= 0xf;
        if (opts->options & XT_SYNPROXY_OPT_SACK_PERM)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index dcddc49c0e08..f93b7d06f4be 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1717,6 +1717,19 @@ nf_tables_delrule_one(struct nft_ctx *ctx, struct nft_rule *rule)
        return -ENOENT;
 }
+static int nf_table_delrule_by_chain(struct nft_ctx *ctx)
+{
+        struct nft_rule *rule;
+        int err;
+        list_for_each_entry(rule, &ctx->chain->rules, list) {
+                err = nf_tables_delrule_one(ctx, rule);
+                if (err < 0)
+                        return err;
+        }
+        return 0;
+}
 static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
                             const struct nlmsghdr *nlh,
                             const struct nlattr * const nla[])
@@ -1725,8 +1738,8 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
        const struct nft_af_info *afi;
        struct net *net = sock_net(skb->sk);
        const struct nft_table *table;
-        struct nft_chain *chain;
+        struct nft_chain *chain = NULL;
-        struct nft_rule *rule, *tmp;
+        struct nft_rule *rule;
        int family = nfmsg->nfgen_family, err = 0;
        struct nft_ctx ctx;
@@ -1738,22 +1751,29 @@ static int nf_tables_delrule(struct sock *nlsk, struct sk_buff *skb,
        if (IS_ERR(table))
                return PTR_ERR(table);
-        chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
+        if (nla[NFTA_RULE_CHAIN]) {
-        if (IS_ERR(chain))
+                chain = nf_tables_chain_lookup(table, nla[NFTA_RULE_CHAIN]);
-                return PTR_ERR(chain);
+                if (IS_ERR(chain))
+                        return PTR_ERR(chain);
+        }
        nft_ctx_init(&ctx, skb, nlh, afi, table, chain, nla);
-        if (nla[NFTA_RULE_HANDLE]) {
+        if (chain) {
-                rule = nf_tables_rule_lookup(chain, nla[NFTA_RULE_HANDLE]);
+                if (nla[NFTA_RULE_HANDLE]) {
-                if (IS_ERR(rule))
+                        rule = nf_tables_rule_lookup(chain,
-                        return PTR_ERR(rule);
+                                                     nla[NFTA_RULE_HANDLE]);
+                        if (IS_ERR(rule))
+                                return PTR_ERR(rule);
-                err = nf_tables_delrule_one(&ctx, rule);
-        } else {
-                /* Remove all rules in this chain */
-                list_for_each_entry_safe(rule, tmp, &chain->rules, list) {
                        err = nf_tables_delrule_one(&ctx, rule);
+                } else {
+                        err = nf_table_delrule_by_chain(&ctx);
+                }
+        } else {
+                list_for_each_entry(chain, &table->chains, list) {
+                        ctx.chain = chain;
+                        err = nf_table_delrule_by_chain(&ctx);
                        if (err < 0)
                                break;
                }
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index a82667c64729..da0c1f4ada12 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -128,7 +128,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1]
        [NFTA_RULE_COMPAT_FLAGS]        = { .type = NLA_U32 },
 };
-static u8 nft_parse_compat(const struct nlattr *attr, bool *inv)
+static int nft_parse_compat(const struct nlattr *attr, u8 *proto, bool *inv)
 {
        struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
        u32 flags;
@@ -148,7 +148,8 @@ static u8 nft_parse_compat(const struct nlattr *attr, bool *inv)
        if (flags & NFT_RULE_COMPAT_F_INV)
                *inv = true;
-        return ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
+        *proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO]));
+        return 0;
 }
 static int
@@ -166,8 +167,11 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
        target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info);
-        if (ctx->nla[NFTA_RULE_COMPAT])
+        if (ctx->nla[NFTA_RULE_COMPAT]) {
-                proto = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &inv);
+                ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
+                if (ret < 0)
+                        goto err;
+        }
        nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv);
@@ -356,8 +360,11 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
        match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info);
-        if (ctx->nla[NFTA_RULE_COMPAT])
+        if (ctx->nla[NFTA_RULE_COMPAT]) {
-                proto = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &inv);
+                ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv);
+                if (ret < 0)
+                        goto err;
+        }
        nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv);
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 9ff035c71403..a3910fc2122b 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -325,21 +325,24 @@ static void htable_gc(unsigned long htlong)
        add_timer(&ht->timer);
 }
-static void htable_destroy(struct xt_hashlimit_htable *hinfo)
+static void htable_remove_proc_entry(struct xt_hashlimit_htable *hinfo)
 {
        struct hashlimit_net *hashlimit_net = hashlimit_pernet(hinfo->net);
        struct proc_dir_entry *parent;
-        del_timer_sync(&hinfo->timer);
        if (hinfo->family == NFPROTO_IPV4)
                parent = hashlimit_net->ipt_hashlimit;
        else
                parent = hashlimit_net->ip6t_hashlimit;
-        if(parent != NULL)
+        if (parent != NULL)
                remove_proc_entry(hinfo->name, parent);
+}
+static void htable_destroy(struct xt_hashlimit_htable *hinfo)
+{
+        del_timer_sync(&hinfo->timer);
+        htable_remove_proc_entry(hinfo);
        htable_selective_cleanup(hinfo, select_all);
        kfree(hinfo->name);
        vfree(hinfo);
@@ -883,21 +886,15 @@ static int __net_init hashlimit_proc_net_init(struct net *net)
 static void __net_exit hashlimit_proc_net_exit(struct net *net)
 {
        struct xt_hashlimit_htable *hinfo;
-        struct proc_dir_entry *pde;
        struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
-        /* recent_net_exit() is called before recent_mt_destroy(). Make sure
+        /* hashlimit_net_exit() is called before hashlimit_mt_destroy().
-         * that the parent xt_recent proc entry is is empty before trying to
+         * Make sure that the parent ipt_hashlimit and ip6t_hashlimit proc
-         * remove it.
+         * entries is empty before trying to remove it.
         */
        mutex_lock(&hashlimit_mutex);
-        pde = hashlimit_net->ipt_hashlimit;
-        if (pde == NULL)
-                pde = hashlimit_net->ip6t_hashlimit;
        hlist_for_each_entry(hinfo, &hashlimit_net->htables, node)
-                remove_proc_entry(hinfo->name, pde);
+                htable_remove_proc_entry(hinfo);
        hashlimit_net->ipt_hashlimit = NULL;
        hashlimit_net->ip6t_hashlimit = NULL;
        mutex_unlock(&hashlimit_mutex);
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index a1100640495d..69345cebe3a3 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -737,7 +737,7 @@ static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
 * NetLabel Generic NETLINK Command Definitions
 */
-static struct genl_ops netlbl_cipsov4_ops[] = {
+static const struct genl_ops netlbl_cipsov4_ops[] = {
        {
        .cmd = NLBL_CIPSOV4_C_ADD,
        .flags = GENL_ADMIN_PERM,
@@ -783,5 +783,5 @@ static struct genl_ops netlbl_cipsov4_ops[] = {
 int __init netlbl_cipsov4_genl_init(void)
 {
        return genl_register_family_with_ops(&netlbl_cipsov4_gnl_family,
-                netlbl_cipsov4_ops, ARRAY_SIZE(netlbl_cipsov4_ops));
+                                             netlbl_cipsov4_ops);
 }
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index dd1c37d7acbc..8ef83ee97c6a 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -705,7 +705,7 @@ version_failure:
 * NetLabel Generic NETLINK Command Definitions
 */
-static struct genl_ops netlbl_mgmt_genl_ops[] = {
+static const struct genl_ops netlbl_mgmt_genl_ops[] = {
        {
        .cmd = NLBL_MGMT_C_ADD,
        .flags = GENL_ADMIN_PERM,
@@ -779,5 +779,5 @@ static struct genl_ops netlbl_mgmt_genl_ops[] = {
 int __init netlbl_mgmt_genl_init(void)
 {
        return genl_register_family_with_ops(&netlbl_mgmt_gnl_family,
-                netlbl_mgmt_genl_ops, ARRAY_SIZE(netlbl_mgmt_genl_ops));
+                                             netlbl_mgmt_genl_ops);
 }
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index 8f0897407a2c..43817d73ccf9 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1323,7 +1323,7 @@ unlabel_staticlistdef_return:
 * NetLabel Generic NETLINK Command Definitions
 */
-static struct genl_ops netlbl_unlabel_genl_ops[] = {
+static const struct genl_ops netlbl_unlabel_genl_ops[] = {
        {
        .cmd = NLBL_UNLABEL_C_STATICADD,
        .flags = GENL_ADMIN_PERM,
@@ -1397,7 +1397,7 @@ static struct genl_ops netlbl_unlabel_genl_ops[] = {
 int __init netlbl_unlabel_genl_init(void)
 {
        return genl_register_family_with_ops(&netlbl_unlabel_gnl_family,
-                netlbl_unlabel_genl_ops, ARRAY_SIZE(netlbl_unlabel_genl_ops));
+                                             netlbl_unlabel_genl_ops);
 }
 /*
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 8df7f64c6db3..bca50b95c182 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2017,7 +2017,7 @@ out:
 * netlink_set_err - report error to broadcast listeners
 * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
 * @portid: the PORTID of a process that we want to skip (if any)
- * @groups: the broadcast group that will notice the error
+ * @group: the broadcast group that will notice the error
 * @code: error code, must be negative (as usual in kernelspace)
 *
 * This function returns the number of broadcast listeners that have set the
@@ -2335,8 +2335,6 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
        }
 #endif
-        msg->msg_namelen = 0;
        copied = data_skb->len;
        if (len < copied) {
                msg->msg_flags |= MSG_TRUNC;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 0c741cec4d0d..713671ae45af 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -65,12 +65,27 @@ static struct list_head family_ht[GENL_FAM_TAB_SIZE];
 * To avoid an allocation at boot of just one unsigned long,
 * declare it global instead.
 * Bit 0 is marked as already used since group 0 is invalid.
+ * Bit 1 is marked as already used since the drop-monitor code
+ * abuses the API and thinks it can statically use group 1.
+ * That group will typically conflict with other groups that
+ * any proper users use.
+ * Bit 16 is marked as used since it's used for generic netlink
+ * and the code no longer marks pre-reserved IDs as used.
+ * Bit 17 is marked as already used since the VFS quota code
+ * also abused this API and relied on family == group ID, we
+ * cater to that by giving it a static family and group ID.
+ * Bit 18 is marked as already used since the PMCRAID driver
+ * did the same thing as the VFS quota code (maybe copied?)
 */
-static unsigned long mc_group_start = 0x1;
+static unsigned long mc_group_start = 0x3 | BIT(GENL_ID_CTRL) |
+                                      BIT(GENL_ID_VFS_DQUOT) |
+                                      BIT(GENL_ID_PMCRAID);
 static unsigned long *mc_groups = &mc_group_start;
 static unsigned long mc_groups_longs = 1;
-static int genl_ctrl_event(int event, void *data);
+static int genl_ctrl_event(int event, struct genl_family *family,
+                           const struct genl_multicast_group *grp,
+                           int grp_id);
 static inline unsigned int genl_family_hash(unsigned int id)
 {
@@ -106,13 +121,13 @@ static struct genl_family *genl_family_find_byname(char *name)
        return NULL;
 }
-static struct genl_ops *genl_get_cmd(u8 cmd, struct genl_family *family)
+static const struct genl_ops *genl_get_cmd(u8 cmd, struct genl_family *family)
 {
-        struct genl_ops *ops;
+        int i;
-        list_for_each_entry(ops, &family->ops_list, ops_list)
+        for (i = 0; i < family->n_ops; i++)
-                if (ops->cmd == cmd)
+                if (family->ops[i].cmd == cmd)
-                        return ops;
+                        return &family->ops[i];
        return NULL;
 }
@@ -126,7 +141,9 @@ static u16 genl_generate_id(void)
        int i;
        for (i = 0; i <= GENL_MAX_ID - GENL_MIN_ID; i++) {
-                if (!genl_family_find_byid(id_gen_idx))
+                if (id_gen_idx != GENL_ID_VFS_DQUOT &&
+                    id_gen_idx != GENL_ID_PMCRAID &&
+                    !genl_family_find_byid(id_gen_idx))
                        return id_gen_idx;
                if (++id_gen_idx > GENL_MAX_ID)
                        id_gen_idx = GENL_MIN_ID;
@@ -135,62 +152,113 @@ static u16 genl_generate_id(void)
        return 0;
 }
-static struct genl_multicast_group notify_grp;
+static int genl_allocate_reserve_groups(int n_groups, int *first_id)
-/**
- * genl_register_mc_group - register a multicast group
- *
- * Registers the specified multicast group and notifies userspace
- * about the new group.
- *
- * Returns 0 on success or a negative error code.
- *
- * @family: The generic netlink family the group shall be registered for.
- * @grp: The group to register, must have a name.
- */
-int genl_register_mc_group(struct genl_family *family,
-                           struct genl_multicast_group *grp)
 {
-        int id;
        unsigned long *new_groups;
-        int err = 0;
+        int start = 0;
+        int i;
+        int id;
+        bool fits;
+        do {
+                if (start == 0)
+                        id = find_first_zero_bit(mc_groups,
+                                                 mc_groups_longs *
+                                                 BITS_PER_LONG);
+                else
+                        id = find_next_zero_bit(mc_groups,
+                                                mc_groups_longs * BITS_PER_LONG,
+                                                start);
+                fits = true;
+                for (i = id;
+                     i < min_t(int, id + n_groups,
+                               mc_groups_longs * BITS_PER_LONG);
+                     i++) {
+                        if (test_bit(i, mc_groups)) {
+                                start = i;
+                                fits = false;
+                                break;
+                        }
+                }
-        BUG_ON(grp->name[0] == '\0');
+                if (id >= mc_groups_longs * BITS_PER_LONG) {
-        BUG_ON(memchr(grp->name, '\0', GENL_NAMSIZ) == NULL);
+                        unsigned long new_longs = mc_groups_longs +
+                                                  BITS_TO_LONGS(n_groups);
+                        size_t nlen = new_longs * sizeof(unsigned long);
+                        if (mc_groups == &mc_group_start) {
+                                new_groups = kzalloc(nlen, GFP_KERNEL);
+                                if (!new_groups)
+                                        return -ENOMEM;
+                                mc_groups = new_groups;
+                                *mc_groups = mc_group_start;
+                        } else {
+                                new_groups = krealloc(mc_groups, nlen,
+                                                      GFP_KERNEL);
+                                if (!new_groups)
+                                        return -ENOMEM;
+                                mc_groups = new_groups;
+                                for (i = 0; i < BITS_TO_LONGS(n_groups); i++)
+                                        mc_groups[mc_groups_longs + i] = 0;
+                        }
+                        mc_groups_longs = new_longs;
+                }
+        } while (!fits);
-        genl_lock_all();
+        for (i = id; i < id + n_groups; i++)
+                set_bit(i, mc_groups);
+        *first_id = id;
+        return 0;
+}
-        /* special-case our own group */
+static struct genl_family genl_ctrl;
-        if (grp == &notify_grp)
-                id = GENL_ID_CTRL;
-        else
-                id = find_first_zero_bit(mc_groups,
-                                         mc_groups_longs * BITS_PER_LONG);
+static int genl_validate_assign_mc_groups(struct genl_family *family)
+{
+        int first_id;
+        int n_groups = family->n_mcgrps;
+        int err = 0, i;
+        bool groups_allocated = false;
-        if (id >= mc_groups_longs * BITS_PER_LONG) {
+        if (!n_groups)
-                size_t nlen = (mc_groups_longs + 1) * sizeof(unsigned long);
+                return 0;
-                if (mc_groups == &mc_group_start) {
+        for (i = 0; i < n_groups; i++) {
-                        new_groups = kzalloc(nlen, GFP_KERNEL);
+                const struct genl_multicast_group *grp = &family->mcgrps[i];
-                        if (!new_groups) {
-                                err = -ENOMEM;
+                if (WARN_ON(grp->name[0] == '\0'))
-                                goto out;
+                        return -EINVAL;
-                        }
+                if (WARN_ON(memchr(grp->name, '\0', GENL_NAMSIZ) == NULL))
-                        mc_groups = new_groups;
+                        return -EINVAL;
-                        *mc_groups = mc_group_start;
+        }
-                } else {
-                        new_groups = krealloc(mc_groups, nlen, GFP_KERNEL);
+        /* special-case our own group and hacks */
-                        if (!new_groups) {
+        if (family == &genl_ctrl) {
-                                err = -ENOMEM;
+                first_id = GENL_ID_CTRL;
-                                goto out;
+                BUG_ON(n_groups != 1);
-                        }
+        } else if (strcmp(family->name, "NET_DM") == 0) {
-                        mc_groups = new_groups;
+                first_id = 1;
-                        mc_groups[mc_groups_longs] = 0;
+                BUG_ON(n_groups != 1);
-                }
+        } else if (family->id == GENL_ID_VFS_DQUOT) {
-                mc_groups_longs++;
+                first_id = GENL_ID_VFS_DQUOT;
+                BUG_ON(n_groups != 1);
+        } else if (family->id == GENL_ID_PMCRAID) {
+                first_id = GENL_ID_PMCRAID;
+                BUG_ON(n_groups != 1);
+        } else {
+                groups_allocated = true;
+                err = genl_allocate_reserve_groups(n_groups, &first_id);
+                if (err)
+                        return err;
        }
+        family->mcgrp_offset = first_id;
+        /* if still initializing, can't and don't need to to realloc bitmaps */
+        if (!init_net.genl_sock)
+                return 0;
        if (family->netnsok) {
                struct net *net;
@@ -206,9 +274,7 @@ int genl_register_mc_group(struct genl_family *family,
                                 * number of _possible_ groups has been
                                 * increased on some sockets which is ok.
                                 */
-                                rcu_read_unlock();
+                                break;
-                                netlink_table_ungrab();
-                                goto out;
                        }
                }
                rcu_read_unlock();
@@ -216,152 +282,67 @@ int genl_register_mc_group(struct genl_family *family,
        } else {
                err = netlink_change_ngroups(init_net.genl_sock,
                                             mc_groups_longs * BITS_PER_LONG);
-                if (err)
-                        goto out;
        }
-        grp->id = id;
+        if (groups_allocated && err) {
-        set_bit(id, mc_groups);
+                for (i = 0; i < family->n_mcgrps; i++)
-        list_add_tail(&grp->list, &family->mcast_groups);
+                        clear_bit(family->mcgrp_offset + i, mc_groups);
-        grp->family = family;
+        }
-        genl_ctrl_event(CTRL_CMD_NEWMCAST_GRP, grp);
- out:
-        genl_unlock_all();
        return err;
 }
-EXPORT_SYMBOL(genl_register_mc_group);
-static void __genl_unregister_mc_group(struct genl_family *family,
+static void genl_unregister_mc_groups(struct genl_family *family)
-                                       struct genl_multicast_group *grp)
 {
        struct net *net;
-        BUG_ON(grp->family != family);
+        int i;
        netlink_table_grab();
        rcu_read_lock();
-        for_each_net_rcu(net)
+        for_each_net_rcu(net) {
-                __netlink_clear_multicast_users(net->genl_sock, grp->id);
+                for (i = 0; i < family->n_mcgrps; i++)
+                        __netlink_clear_multicast_users(
+                                net->genl_sock, family->mcgrp_offset + i);
+        }
        rcu_read_unlock();
        netlink_table_ungrab();
-        clear_bit(grp->id, mc_groups);
+        for (i = 0; i < family->n_mcgrps; i++) {
-        list_del(&grp->list);
+                int grp_id = family->mcgrp_offset + i;
-        genl_ctrl_event(CTRL_CMD_DELMCAST_GRP, grp);
-        grp->id = 0;
-        grp->family = NULL;
-}
-/**
+                if (grp_id != 1)
- * genl_unregister_mc_group - unregister a multicast group
+                        clear_bit(grp_id, mc_groups);
- *
+                genl_ctrl_event(CTRL_CMD_DELMCAST_GRP, family,
- * Unregisters the specified multicast group and notifies userspace
+                                &family->mcgrps[i], grp_id);
- * about it. All current listeners on the group are removed.
+        }
- *
- * Note: It is not necessary to unregister all multicast groups before
- *       unregistering the family, unregistering the family will cause
- *       all assigned multicast groups to be unregistered automatically.
- *
- * @family: Generic netlink family the group belongs to.
- * @grp: The group to unregister, must have been registered successfully
- *       previously.
- */
-void genl_unregister_mc_group(struct genl_family *family,
-                              struct genl_multicast_group *grp)
-{
-        genl_lock_all();
-        __genl_unregister_mc_group(family, grp);
-        genl_unlock_all();
 }
-EXPORT_SYMBOL(genl_unregister_mc_group);
-static void genl_unregister_mc_groups(struct genl_family *family)
+static int genl_validate_ops(struct genl_family *family)
 {
-        struct genl_multicast_group *grp, *tmp;
+        const struct genl_ops *ops = family->ops;
+        unsigned int n_ops = family->n_ops;
+        int i, j;
-        list_for_each_entry_safe(grp, tmp, &family->mcast_groups, list)
+        if (WARN_ON(n_ops && !ops))
-                __genl_unregister_mc_group(family, grp);
+                return -EINVAL;
-}
-/**
- * genl_register_ops - register generic netlink operations
- * @family: generic netlink family
- * @ops: operations to be registered
- *
- * Registers the specified operations and assigns them to the specified
- * family. Either a doit or dumpit callback must be specified or the
- * operation will fail. Only one operation structure per command
- * identifier may be registered.
- *
- * See include/net/genetlink.h for more documenation on the operations
- * structure.
- *
- * Returns 0 on success or a negative error code.
- */
-int genl_register_ops(struct genl_family *family, struct genl_ops *ops)
-{
-        int err = -EINVAL;
-        if (ops->dumpit == NULL && ops->doit == NULL)
+        if (!n_ops)
-                goto errout;
+                return 0;
-        if (genl_get_cmd(ops->cmd, family)) {
+        for (i = 0; i < n_ops; i++) {
-                err = -EEXIST;
+                if (ops[i].dumpit == NULL && ops[i].doit == NULL)
-                goto errout;
+                        return -EINVAL;
+                for (j = i + 1; j < n_ops; j++)
+                        if (ops[i].cmd == ops[j].cmd)
+                                return -EINVAL;
        }
-        if (ops->dumpit)
+        /* family is not registered yet, so no locking needed */
-                ops->flags |= GENL_CMD_CAP_DUMP;
+        family->ops = ops;
-        if (ops->doit)
+        family->n_ops = n_ops;
-                ops->flags |= GENL_CMD_CAP_DO;
-        if (ops->policy)
-                ops->flags |= GENL_CMD_CAP_HASPOL;
-        genl_lock_all();
+        return 0;
-        list_add_tail(&ops->ops_list, &family->ops_list);
-        genl_unlock_all();
-        genl_ctrl_event(CTRL_CMD_NEWOPS, ops);
-        err = 0;
-errout:
-        return err;
-}
-EXPORT_SYMBOL(genl_register_ops);
-/**
- * genl_unregister_ops - unregister generic netlink operations
- * @family: generic netlink family
- * @ops: operations to be unregistered
- *
- * Unregisters the specified operations and unassigns them from the
- * specified family. The operation blocks until the current message
- * processing has finished and doesn't start again until the
- * unregister process has finished.
- *
- * Note: It is not necessary to unregister all operations before
- *       unregistering the family, unregistering the family will cause
- *       all assigned operations to be unregistered automatically.
- *
- * Returns 0 on success or a negative error code.
- */
-int genl_unregister_ops(struct genl_family *family, struct genl_ops *ops)
-{
-        struct genl_ops *rc;
-        genl_lock_all();
-        list_for_each_entry(rc, &family->ops_list, ops_list) {
-                if (rc == ops) {
-                        list_del(&ops->ops_list);
-                        genl_unlock_all();
-                        genl_ctrl_event(CTRL_CMD_DELOPS, ops);
-                        return 0;
-                }
-        }
-        genl_unlock_all();
-        return -ENOENT;
 }
-EXPORT_SYMBOL(genl_unregister_ops);
 /**
 * __genl_register_family - register a generic netlink family
@@ -372,11 +353,14 @@ EXPORT_SYMBOL(genl_unregister_ops);
 * The family id may equal GENL_ID_GENERATE causing an unique id to
 * be automatically generated and assigned.
 *
+ * The family's ops array must already be assigned, you can use the
+ * genl_register_family_with_ops() helper function.
+ *
 * Return 0 on success or a negative error code.
 */
 int __genl_register_family(struct genl_family *family)
 {
-        int err = -EINVAL;
+        int err = -EINVAL, i;
        if (family->id && family->id < GENL_MIN_ID)
                goto errout;
@@ -384,8 +368,9 @@ int __genl_register_family(struct genl_family *family)
        if (family->id > GENL_MAX_ID)
                goto errout;
-        INIT_LIST_HEAD(&family->ops_list);
+        err = genl_validate_ops(family);
-        INIT_LIST_HEAD(&family->mcast_groups);
+        if (err)
+                return err;
        genl_lock_all();
@@ -418,10 +403,18 @@ int __genl_register_family(struct genl_family *family)
        } else
                family->attrbuf = NULL;
+        err = genl_validate_assign_mc_groups(family);
+        if (err)
+                goto errout_locked;
        list_add_tail(&family->family_list, genl_family_chain(family->id));
        genl_unlock_all();
-        genl_ctrl_event(CTRL_CMD_NEWFAMILY, family);
+        /* send all events */
+        genl_ctrl_event(CTRL_CMD_NEWFAMILY, family, NULL, 0);
+        for (i = 0; i < family->n_mcgrps; i++)
+                genl_ctrl_event(CTRL_CMD_NEWMCAST_GRP, family,
+                                &family->mcgrps[i], family->mcgrp_offset + i);
        return 0;
@@ -433,52 +426,6 @@ errout:
 EXPORT_SYMBOL(__genl_register_family);
 /**
- * __genl_register_family_with_ops - register a generic netlink family
- * @family: generic netlink family
- * @ops: operations to be registered
- * @n_ops: number of elements to register
- *
- * Registers the specified family and operations from the specified table.
- * Only one family may be registered with the same family name or identifier.
- *
- * The family id may equal GENL_ID_GENERATE causing an unique id to
- * be automatically generated and assigned.
- *
- * Either a doit or dumpit callback must be specified for every registered
- * operation or the function will fail. Only one operation structure per
- * command identifier may be registered.
- *
- * See include/net/genetlink.h for more documenation on the operations
- * structure.
- *
- * This is equivalent to calling genl_register_family() followed by
- * genl_register_ops() for every operation entry in the table taking
- * care to unregister the family on error path.
- *
- * Return 0 on success or a negative error code.
- */
-int __genl_register_family_with_ops(struct genl_family *family,
-        struct genl_ops *ops, size_t n_ops)
-{
-        int err, i;
-        err = __genl_register_family(family);
-        if (err)
-                return err;
-        for (i = 0; i < n_ops; ++i, ++ops) {
-                err = genl_register_ops(family, ops);
-                if (err)
-                        goto err_out;
-        }
-        return 0;
-err_out:
-        genl_unregister_family(family);
-        return err;
-}
-EXPORT_SYMBOL(__genl_register_family_with_ops);
-/**
 * genl_unregister_family - unregister generic netlink family
 * @family: generic netlink family
 *
@@ -499,11 +446,11 @@ int genl_unregister_family(struct genl_family *family)
                        continue;
                list_del(&rc->family_list);
-                INIT_LIST_HEAD(&family->ops_list);
+                family->n_ops = 0;
                genl_unlock_all();
                kfree(family->attrbuf);
-                genl_ctrl_event(CTRL_CMD_DELFAMILY, family);
+                genl_ctrl_event(CTRL_CMD_DELFAMILY, family, NULL, 0);
                return 0;
        }
@@ -546,7 +493,8 @@ EXPORT_SYMBOL(genlmsg_put);
 static int genl_lock_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 {
-        struct genl_ops *ops = cb->data;
+        /* our ops are always const - netlink API doesn't propagate that */
+        const struct genl_ops *ops = cb->data;
        int rc;
        genl_lock();
@@ -557,7 +505,8 @@ static int genl_lock_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 static int genl_lock_done(struct netlink_callback *cb)
 {
-        struct genl_ops *ops = cb->data;
+        /* our ops are always const - netlink API doesn't propagate that */
+        const struct genl_ops *ops = cb->data;
        int rc = 0;
        if (ops->done) {
@@ -572,7 +521,7 @@ static int genl_family_rcv_msg(struct genl_family *family,
                               struct sk_buff *skb,
                               struct nlmsghdr *nlh)
 {
-        struct genl_ops *ops;
+        const struct genl_ops *ops;
        struct net *net = sock_net(skb->sk);
        struct genl_info info;
        struct genlmsghdr *hdr = nlmsg_data(nlh);
@@ -604,7 +553,8 @@ static int genl_family_rcv_msg(struct genl_family *family,
                if (!family->parallel_ops) {
                        struct netlink_dump_control c = {
                                .module = family->module,
-                                .data = ops,
+                                /* we have const, but the netlink API doesn't */
+                                .data = (void *)ops,
                                .dump = genl_lock_dumpit,
                                .done = genl_lock_done,
                        };
@@ -726,24 +676,32 @@ static int ctrl_fill_info(struct genl_family *family, u32 portid, u32 seq,
            nla_put_u32(skb, CTRL_ATTR_MAXATTR, family->maxattr))
                goto nla_put_failure;
-        if (!list_empty(&family->ops_list)) {
+        if (family->n_ops) {
                struct nlattr *nla_ops;
-                struct genl_ops *ops;
+                int i;
-                int idx = 1;
                nla_ops = nla_nest_start(skb, CTRL_ATTR_OPS);
                if (nla_ops == NULL)
                        goto nla_put_failure;
-                list_for_each_entry(ops, &family->ops_list, ops_list) {
+                for (i = 0; i < family->n_ops; i++) {
                        struct nlattr *nest;
+                        const struct genl_ops *ops = &family->ops[i];
+                        u32 op_flags = ops->flags;
-                        nest = nla_nest_start(skb, idx++);
+                        if (ops->dumpit)
+                                op_flags |= GENL_CMD_CAP_DUMP;
+                        if (ops->doit)
+                                op_flags |= GENL_CMD_CAP_DO;
+                        if (ops->policy)
+                                op_flags |= GENL_CMD_CAP_HASPOL;
+                        nest = nla_nest_start(skb, i + 1);
                        if (nest == NULL)
                                goto nla_put_failure;
                        if (nla_put_u32(skb, CTRL_ATTR_OP_ID, ops->cmd) ||
-                            nla_put_u32(skb, CTRL_ATTR_OP_FLAGS, ops->flags))
+                            nla_put_u32(skb, CTRL_ATTR_OP_FLAGS, op_flags))
                                goto nla_put_failure;
                        nla_nest_end(skb, nest);
@@ -752,23 +710,26 @@ static int ctrl_fill_info(struct genl_family *family, u32 portid, u32 seq,
                nla_nest_end(skb, nla_ops);
        }
-        if (!list_empty(&family->mcast_groups)) {
+        if (family->n_mcgrps) {
-                struct genl_multicast_group *grp;
                struct nlattr *nla_grps;
-                int idx = 1;
+                int i;
                nla_grps = nla_nest_start(skb, CTRL_ATTR_MCAST_GROUPS);
                if (nla_grps == NULL)
                        goto nla_put_failure;
-                list_for_each_entry(grp, &family->mcast_groups, list) {
+                for (i = 0; i < family->n_mcgrps; i++) {
                        struct nlattr *nest;
+                        const struct genl_multicast_group *grp;
+                        grp = &family->mcgrps[i];
-                        nest = nla_nest_start(skb, idx++);
+                        nest = nla_nest_start(skb, i + 1);
                        if (nest == NULL)
                                goto nla_put_failure;
-                        if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID, grp->id) ||
+                        if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID,
+                                        family->mcgrp_offset + i) ||
                            nla_put_string(skb, CTRL_ATTR_MCAST_GRP_NAME,
                                           grp->name))
                                goto nla_put_failure;
@@ -785,9 +746,10 @@ nla_put_failure:
        return -EMSGSIZE;
 }
-static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 portid,
+static int ctrl_fill_mcgrp_info(struct genl_family *family,
-                                u32 seq, u32 flags, struct sk_buff *skb,
+                                const struct genl_multicast_group *grp,
-                                u8 cmd)
+                                int grp_id, u32 portid, u32 seq, u32 flags,
+                                struct sk_buff *skb, u8 cmd)
 {
        void *hdr;
        struct nlattr *nla_grps;
@@ -797,8 +759,8 @@ static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 portid,
        if (hdr == NULL)
                return -1;
-        if (nla_put_string(skb, CTRL_ATTR_FAMILY_NAME, grp->family->name) ||
+        if (nla_put_string(skb, CTRL_ATTR_FAMILY_NAME, family->name) ||
-            nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, grp->family->id))
+            nla_put_u16(skb, CTRL_ATTR_FAMILY_ID, family->id))
                goto nla_put_failure;
        nla_grps = nla_nest_start(skb, CTRL_ATTR_MCAST_GROUPS);
@@ -809,7 +771,7 @@ static int ctrl_fill_mcgrp_info(struct genl_multicast_group *grp, u32 portid,
        if (nest == NULL)
                goto nla_put_failure;
-        if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID, grp->id) ||
+        if (nla_put_u32(skb, CTRL_ATTR_MCAST_GRP_ID, grp_id) ||
            nla_put_string(skb, CTRL_ATTR_MCAST_GRP_NAME,
                           grp->name))
                goto nla_put_failure;
@@ -875,8 +837,10 @@ static struct sk_buff *ctrl_build_family_msg(struct genl_family *family,
        return skb;
 }
-static struct sk_buff *ctrl_build_mcgrp_msg(struct genl_multicast_group *grp,
+static struct sk_buff *
-                                            u32 portid, int seq, u8 cmd)
+ctrl_build_mcgrp_msg(struct genl_family *family,
+                     const struct genl_multicast_group *grp,
+                     int grp_id, u32 portid, int seq, u8 cmd)
 {
        struct sk_buff *skb;
        int err;
@@ -885,7 +849,8 @@ static struct sk_buff *ctrl_build_mcgrp_msg(struct genl_multicast_group *grp,
        if (skb == NULL)
                return ERR_PTR(-ENOBUFS);
-        err = ctrl_fill_mcgrp_info(grp, portid, seq, 0, skb, cmd);
+        err = ctrl_fill_mcgrp_info(family, grp, grp_id, portid,
+                                   seq, 0, skb, cmd);
        if (err < 0) {
                nlmsg_free(skb);
                return ERR_PTR(err);
@@ -947,11 +912,11 @@ static int ctrl_getfamily(struct sk_buff *skb, struct genl_info *info)
        return genlmsg_reply(msg, info);
 }
-static int genl_ctrl_event(int event, void *data)
+static int genl_ctrl_event(int event, struct genl_family *family,
+                           const struct genl_multicast_group *grp,
+                           int grp_id)
 {
        struct sk_buff *msg;
-        struct genl_family *family;
-        struct genl_multicast_group *grp;
        /* genl is still initialising */
        if (!init_net.genl_sock)
@@ -960,14 +925,13 @@ static int genl_ctrl_event(int event, void *data)
        switch (event) {
        case CTRL_CMD_NEWFAMILY:
        case CTRL_CMD_DELFAMILY:
-                family = data;
+                WARN_ON(grp);
                msg = ctrl_build_family_msg(family, 0, 0, event);
                break;
        case CTRL_CMD_NEWMCAST_GRP:
        case CTRL_CMD_DELMCAST_GRP:
-                grp = data;
+                BUG_ON(!grp);
-                family = grp->family;
+                msg = ctrl_build_mcgrp_msg(family, grp, grp_id, 0, 0, event);
-                msg = ctrl_build_mcgrp_msg(data, 0, 0, event);
                break;
        default:
                return -EINVAL;
@@ -977,26 +941,29 @@ static int genl_ctrl_event(int event, void *data)
                return PTR_ERR(msg);
        if (!family->netnsok) {
-                genlmsg_multicast_netns(&init_net, msg, 0,
+                genlmsg_multicast_netns(&genl_ctrl, &init_net, msg, 0,
-                                        GENL_ID_CTRL, GFP_KERNEL);
+                                        0, GFP_KERNEL);
        } else {
                rcu_read_lock();
-                genlmsg_multicast_allns(msg, 0, GENL_ID_CTRL, GFP_ATOMIC);
+                genlmsg_multicast_allns(&genl_ctrl, msg, 0,
+                                        0, GFP_ATOMIC);
                rcu_read_unlock();
        }
        return 0;
 }
-static struct genl_ops genl_ctrl_ops = {
+static struct genl_ops genl_ctrl_ops[] = {
-        .cmd            = CTRL_CMD_GETFAMILY,
+        {
-        .doit           = ctrl_getfamily,
+                .cmd            = CTRL_CMD_GETFAMILY,
-        .dumpit         = ctrl_dumpfamily,
+                .doit           = ctrl_getfamily,
-        .policy         = ctrl_policy,
+                .dumpit         = ctrl_dumpfamily,
+                .policy         = ctrl_policy,
+        },
 };
-static struct genl_multicast_group notify_grp = {
+static struct genl_multicast_group genl_ctrl_groups[] = {
-        .name           = "notify",
+        { .name = "notify", },
 };
 static int __net_init genl_pernet_init(struct net *net)
@@ -1036,7 +1003,8 @@ static int __init genl_init(void)
        for (i = 0; i < GENL_FAM_TAB_SIZE; i++)
                INIT_LIST_HEAD(&family_ht[i]);
-        err = genl_register_family_with_ops(&genl_ctrl, &genl_ctrl_ops, 1);
+        err = genl_register_family_with_ops_groups(&genl_ctrl, genl_ctrl_ops,
+                                                   genl_ctrl_groups);
        if (err < 0)
                goto problem;
@@ -1044,10 +1012,6 @@ static int __init genl_init(void)
        if (err)
                goto problem;
-        err = genl_register_mc_group(&genl_ctrl, &notify_grp);
-        if (err < 0)
-                goto problem;
        return 0;
 problem:
@@ -1085,14 +1049,18 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group,
        return err;
 }
-int genlmsg_multicast_allns(struct sk_buff *skb, u32 portid, unsigned int group,
+int genlmsg_multicast_allns(struct genl_family *family, struct sk_buff *skb,
-                            gfp_t flags)
+                            u32 portid, unsigned int group, gfp_t flags)
 {
+        if (WARN_ON_ONCE(group >= family->n_mcgrps))
+                return -EINVAL;
+        group = family->mcgrp_offset + group;
        return genlmsg_mcast(skb, portid, group, flags);
 }
 EXPORT_SYMBOL(genlmsg_multicast_allns);
-void genl_notify(struct sk_buff *skb, struct net *net, u32 portid, u32 group,
+void genl_notify(struct genl_family *family,
+                 struct sk_buff *skb, struct net *net, u32 portid, u32 group,
                 struct nlmsghdr *nlh, gfp_t flags)
 {
        struct sock *sk = net->genl_sock;
@@ -1101,6 +1069,9 @@ void genl_notify(struct sk_buff *skb, struct net *net, u32 portid, u32 group,
        if (nlh)
                report = nlmsg_report(nlh);
+        if (WARN_ON_ONCE(group >= family->n_mcgrps))
+                return;
+        group = family->mcgrp_offset + group;
        nlmsg_notify(sk, skb, portid, group, report, flags);
 }
 EXPORT_SYMBOL(genl_notify);
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 698814bfa7ad..53c19a35fc6d 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1179,10 +1179,9 @@ static int nr_recvmsg(struct kiocb *iocb, struct socket *sock,
                sax->sax25_family = AF_NETROM;
                skb_copy_from_linear_data_offset(skb, 7, sax->sax25_call.ax25_call,
                              AX25_ADDR_LEN);
+                msg->msg_namelen = sizeof(*sax);
        }
-        msg->msg_namelen = sizeof(*sax);
        skb_free_datagram(sk, skb);
        release_sock(sk);
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index d308402b67d8..824c6056bf82 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -807,8 +807,6 @@ static int llcp_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
        pr_debug("%p %zu\n", sk, len);
-        msg->msg_namelen = 0;
        lock_sock(sk);
        if (sk->sk_state == LLCP_CLOSED &&
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index 84b7e3ea7b7a..a9b2342d5253 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -30,8 +30,8 @@
 #include "nfc.h"
 #include "llcp.h"
-static struct genl_multicast_group nfc_genl_event_mcgrp = {
+static const struct genl_multicast_group nfc_genl_mcgrps[] = {
-        .name = NFC_GENL_MCAST_EVENT_NAME,
+        { .name = NFC_GENL_MCAST_EVENT_NAME, },
 };
 static struct genl_family nfc_genl_family = {
@@ -194,7 +194,7 @@ int nfc_genl_targets_found(struct nfc_dev *dev)
        genlmsg_end(msg, hdr);
-        return genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_ATOMIC);
+        return genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC);
 nla_put_failure:
        genlmsg_cancel(msg, hdr);
@@ -223,7 +223,7 @@ int nfc_genl_target_lost(struct nfc_dev *dev, u32 target_idx)
        genlmsg_end(msg, hdr);
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
        return 0;
@@ -255,7 +255,7 @@ int nfc_genl_tm_activated(struct nfc_dev *dev, u32 protocol)
        genlmsg_end(msg, hdr);
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
        return 0;
@@ -285,7 +285,7 @@ int nfc_genl_tm_deactivated(struct nfc_dev *dev)
        genlmsg_end(msg, hdr);
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
        return 0;
@@ -318,7 +318,7 @@ int nfc_genl_device_added(struct nfc_dev *dev)
        genlmsg_end(msg, hdr);
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
        return 0;
@@ -348,7 +348,7 @@ int nfc_genl_device_removed(struct nfc_dev *dev)
        genlmsg_end(msg, hdr);
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
        return 0;
@@ -414,7 +414,7 @@ int nfc_genl_llc_send_sdres(struct nfc_dev *dev, struct hlist_head *sdres_list)
        genlmsg_end(msg, hdr);
-        return genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_ATOMIC);
+        return genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC);
 nla_put_failure:
        genlmsg_cancel(msg, hdr);
@@ -448,7 +448,7 @@ int nfc_genl_se_added(struct nfc_dev *dev, u32 se_idx, u16 type)
        genlmsg_end(msg, hdr);
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
        return 0;
@@ -479,7 +479,7 @@ int nfc_genl_se_removed(struct nfc_dev *dev, u32 se_idx)
        genlmsg_end(msg, hdr);
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
        return 0;
@@ -600,7 +600,7 @@ int nfc_genl_dep_link_up_event(struct nfc_dev *dev, u32 target_idx,
        dev->dep_link_up = true;
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC);
        return 0;
@@ -632,7 +632,7 @@ int nfc_genl_dep_link_down_event(struct nfc_dev *dev)
        genlmsg_end(msg, hdr);
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_ATOMIC);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC);
        return 0;
@@ -1137,7 +1137,7 @@ int nfc_genl_fw_download_done(struct nfc_dev *dev, const char *firmware_name,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
        return 0;
@@ -1308,7 +1308,7 @@ static void se_io_cb(void *context, u8 *apdu, size_t apdu_len, int err)
        genlmsg_end(msg, hdr);
-        genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL);
        kfree(ctx);
@@ -1364,7 +1364,7 @@ static int nfc_genl_se_io(struct sk_buff *skb, struct genl_info *info)
        return dev->ops->se_io(dev, se_idx, apdu, apdu_len, se_io_cb, ctx);
 }
-static struct genl_ops nfc_genl_ops[] = {
+static const struct genl_ops nfc_genl_ops[] = {
        {
                .cmd = NFC_CMD_GET_DEVICE,
                .doit = nfc_genl_get_device,
@@ -1536,16 +1536,15 @@ int __init nfc_genl_init(void)
 {
        int rc;
-        rc = genl_register_family_with_ops(&nfc_genl_family, nfc_genl_ops,
+        rc = genl_register_family_with_ops_groups(&nfc_genl_family,
-                                           ARRAY_SIZE(nfc_genl_ops));
+                                                  nfc_genl_ops,
+                                                  nfc_genl_mcgrps);
        if (rc)
                return rc;
-        rc = genl_register_mc_group(&nfc_genl_family, &nfc_genl_event_mcgrp);
        netlink_register_notifier(&nl_notifier);
-        return rc;
+        return 0;
 }
 /**
diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c
index cd958b381f96..66bcd2eb5773 100644
--- a/net/nfc/rawsock.c
+++ b/net/nfc/rawsock.c
@@ -244,8 +244,6 @@ static int rawsock_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (!skb)
                return rc;
-        msg->msg_namelen = 0;
        copied = skb->len;
        if (len < copied) {
                msg->msg_flags |= MSG_TRUNC;
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 449e0776a2c0..6f5e1dd3be2d 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -61,11 +61,11 @@
 int ovs_net_id __read_mostly;
-static void ovs_notify(struct sk_buff *skb, struct genl_info *info,
+static void ovs_notify(struct genl_family *family,
-                       struct genl_multicast_group *grp)
+                       struct sk_buff *skb, struct genl_info *info)
 {
-        genl_notify(skb, genl_info_net(info), info->snd_portid,
+        genl_notify(family, skb, genl_info_net(info), info->snd_portid,
-                    grp->id, info->nlhdr, GFP_KERNEL);
+                    0, info->nlhdr, GFP_KERNEL);
 }
 /**
@@ -557,7 +557,7 @@ static const struct nla_policy packet_policy[OVS_PACKET_ATTR_MAX + 1] = {
        [OVS_PACKET_ATTR_ACTIONS] = { .type = NLA_NESTED },
 };
-static struct genl_ops dp_packet_genl_ops[] = {
+static const struct genl_ops dp_packet_genl_ops[] = {
        { .cmd = OVS_PACKET_CMD_EXECUTE,
          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
          .policy = packet_policy,
@@ -877,10 +877,10 @@ static int ovs_flow_cmd_new_or_set(struct sk_buff *skb, struct genl_info *info)
        ovs_unlock();
        if (!IS_ERR(reply))
-                ovs_notify(reply, info, &ovs_dp_flow_multicast_group);
+                ovs_notify(&dp_flow_genl_family, reply, info);
        else
-                netlink_set_err(sock_net(skb->sk)->genl_sock, 0,
+                genl_set_err(&dp_flow_genl_family, sock_net(skb->sk), 0,
-                                ovs_dp_flow_multicast_group.id, PTR_ERR(reply));
+                             0, PTR_ERR(reply));
        return 0;
 err_flow_free:
@@ -990,7 +990,7 @@ static int ovs_flow_cmd_del(struct sk_buff *skb, struct genl_info *info)
        ovs_flow_free(flow, true);
        ovs_unlock();
-        ovs_notify(reply, info, &ovs_dp_flow_multicast_group);
+        ovs_notify(&dp_flow_genl_family, reply, info);
        return 0;
 unlock:
        ovs_unlock();
@@ -1034,7 +1034,7 @@ static int ovs_flow_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
        return skb->len;
 }
-static struct genl_ops dp_flow_genl_ops[] = {
+static const struct genl_ops dp_flow_genl_ops[] = {
        { .cmd = OVS_FLOW_CMD_NEW,
          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
          .policy = flow_policy,
@@ -1243,7 +1243,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
        ovs_unlock();
-        ovs_notify(reply, info, &ovs_dp_datapath_multicast_group);
+        ovs_notify(&dp_datapath_genl_family, reply, info);
        return 0;
 err_destroy_local_port:
@@ -1308,7 +1308,7 @@ static int ovs_dp_cmd_del(struct sk_buff *skb, struct genl_info *info)
        __dp_destroy(dp);
        ovs_unlock();
-        ovs_notify(reply, info, &ovs_dp_datapath_multicast_group);
+        ovs_notify(&dp_datapath_genl_family, reply, info);
        return 0;
 unlock:
@@ -1332,14 +1332,14 @@ static int ovs_dp_cmd_set(struct sk_buff *skb, struct genl_info *info)
                                      info->snd_seq, OVS_DP_CMD_NEW);
        if (IS_ERR(reply)) {
                err = PTR_ERR(reply);
-                netlink_set_err(sock_net(skb->sk)->genl_sock, 0,
+                genl_set_err(&dp_datapath_genl_family, sock_net(skb->sk), 0,
-                                ovs_dp_datapath_multicast_group.id, err);
+                             0, err);
                err = 0;
                goto unlock;
        }
        ovs_unlock();
-        ovs_notify(reply, info, &ovs_dp_datapath_multicast_group);
+        ovs_notify(&dp_datapath_genl_family, reply, info);
        return 0;
 unlock:
@@ -1398,7 +1398,7 @@ static int ovs_dp_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
        return skb->len;
 }
-static struct genl_ops dp_datapath_genl_ops[] = {
+static const struct genl_ops dp_datapath_genl_ops[] = {
        { .cmd = OVS_DP_CMD_NEW,
          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
          .policy = datapath_policy,
@@ -1431,7 +1431,7 @@ static const struct nla_policy vport_policy[OVS_VPORT_ATTR_MAX + 1] = {
        [OVS_VPORT_ATTR_OPTIONS] = { .type = NLA_NESTED },
 };
-static struct genl_family dp_vport_genl_family = {
+struct genl_family dp_vport_genl_family = {
        .id = GENL_ID_GENERATE,
        .hdrsize = sizeof(struct ovs_header),
        .name = OVS_VPORT_FAMILY,
@@ -1601,7 +1601,7 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info)
                goto exit_unlock;
        }
-        ovs_notify(reply, info, &ovs_dp_vport_multicast_group);
+        ovs_notify(&dp_vport_genl_family, reply, info);
 exit_unlock:
        ovs_unlock();
@@ -1648,7 +1648,7 @@ static int ovs_vport_cmd_set(struct sk_buff *skb, struct genl_info *info)
        BUG_ON(err < 0);
        ovs_unlock();
-        ovs_notify(reply, info, &ovs_dp_vport_multicast_group);
+        ovs_notify(&dp_vport_genl_family, reply, info);
        return 0;
 exit_free:
@@ -1685,7 +1685,7 @@ static int ovs_vport_cmd_del(struct sk_buff *skb, struct genl_info *info)
        err = 0;
        ovs_dp_detach_port(vport);
-        ovs_notify(reply, info, &ovs_dp_vport_multicast_group);
+        ovs_notify(&dp_vport_genl_family, reply, info);
 exit_unlock:
        ovs_unlock();
@@ -1759,7 +1759,7 @@ out:
        return skb->len;
 }
-static struct genl_ops dp_vport_genl_ops[] = {
+static const struct genl_ops dp_vport_genl_ops[] = {
        { .cmd = OVS_VPORT_CMD_NEW,
          .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN privilege. */
          .policy = vport_policy,
@@ -1785,9 +1785,9 @@ static struct genl_ops dp_vport_genl_ops[] = {
 struct genl_family_and_ops {
        struct genl_family *family;
-        struct genl_ops *ops;
+        const struct genl_ops *ops;
        int n_ops;
-        struct genl_multicast_group *group;
+        const struct genl_multicast_group *group;
 };
 static const struct genl_family_and_ops dp_genl_families[] = {
@@ -1823,17 +1823,14 @@ static int dp_register_genl(void)
        for (i = 0; i < ARRAY_SIZE(dp_genl_families); i++) {
                const struct genl_family_and_ops *f = &dp_genl_families[i];
-                err = genl_register_family_with_ops(f->family, f->ops,
+                f->family->ops = f->ops;
-                                                    f->n_ops);
+                f->family->n_ops = f->n_ops;
+                f->family->mcgrps = f->group;
+                f->family->n_mcgrps = f->group ? 1 : 0;
+                err = genl_register_family(f->family);
                if (err)
                        goto error;
                n_registered++;
-                if (f->group) {
-                        err = genl_register_mc_group(f->family, f->group);
-                        if (err)
-                                goto error;
-                }
        }
        return 0;
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index d3d14a58aa91..4067ea41be28 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -177,6 +177,7 @@ static inline struct vport *ovs_vport_ovsl(const struct datapath *dp, int port_n
 }
 extern struct notifier_block ovs_dp_device_notifier;
+extern struct genl_family dp_vport_genl_family;
 extern struct genl_multicast_group ovs_dp_vport_multicast_group;
 void ovs_dp_process_received_packet(struct vport *, struct sk_buff *);
diff --git a/net/openvswitch/dp_notify.c b/net/openvswitch/dp_notify.c
index 5c2dab276109..2c631fe76be1 100644
--- a/net/openvswitch/dp_notify.c
+++ b/net/openvswitch/dp_notify.c
@@ -34,15 +34,14 @@ static void dp_detach_port_notify(struct vport *vport)
                                          OVS_VPORT_CMD_DEL);
        ovs_dp_detach_port(vport);
        if (IS_ERR(notify)) {
-                netlink_set_err(ovs_dp_get_net(dp)->genl_sock, 0,
+                genl_set_err(&dp_vport_genl_family, ovs_dp_get_net(dp), 0,
-                                ovs_dp_vport_multicast_group.id,
+                             0, PTR_ERR(notify));
-                                PTR_ERR(notify));
                return;
        }
-        genlmsg_multicast_netns(ovs_dp_get_net(dp), notify, 0,
+        genlmsg_multicast_netns(&dp_vport_genl_family,
-                                ovs_dp_vport_multicast_group.id,
+                                ovs_dp_get_net(dp), notify, 0,
-                                GFP_KERNEL);
+                                0, GFP_KERNEL);
 }
 void ovs_dp_notify_wq(struct work_struct *work)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 2e8286b47c28..88cfbc189558 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -237,6 +237,30 @@ struct packet_skb_cb {
 static void __fanout_unlink(struct sock *sk, struct packet_sock *po);
 static void __fanout_link(struct sock *sk, struct packet_sock *po);
+static struct net_device *packet_cached_dev_get(struct packet_sock *po)
+{
+        struct net_device *dev;
+        rcu_read_lock();
+        dev = rcu_dereference(po->cached_dev);
+        if (likely(dev))
+                dev_hold(dev);
+        rcu_read_unlock();
+        return dev;
+}
+static void packet_cached_dev_assign(struct packet_sock *po,
+                                     struct net_device *dev)
+{
+        rcu_assign_pointer(po->cached_dev, dev);
+}
+static void packet_cached_dev_reset(struct packet_sock *po)
+{
+        RCU_INIT_POINTER(po->cached_dev, NULL);
+}
 /* register_prot_hook must be invoked with the po->bind_lock held,
 * or from a context in which asynchronous accesses to the packet
 * socket is not possible (packet_create()).
@@ -244,11 +268,13 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po);
 static void register_prot_hook(struct sock *sk)
 {
        struct packet_sock *po = pkt_sk(sk);
        if (!po->running) {
                if (po->fanout)
                        __fanout_link(sk, po);
                else
                        dev_add_pack(&po->prot_hook);
                sock_hold(sk);
                po->running = 1;
        }
@@ -266,10 +292,12 @@ static void __unregister_prot_hook(struct sock *sk, bool sync)
        struct packet_sock *po = pkt_sk(sk);
        po->running = 0;
        if (po->fanout)
                __fanout_unlink(sk, po);
        else
                __dev_remove_pack(&po->prot_hook);
        __sock_put(sk);
        if (sync) {
@@ -432,9 +460,9 @@ static void prb_shutdown_retire_blk_timer(struct packet_sock *po,
        pkc = tx_ring ? &po->tx_ring.prb_bdqc : &po->rx_ring.prb_bdqc;
-        spin_lock(&rb_queue->lock);
+        spin_lock_bh(&rb_queue->lock);
        pkc->delete_blk_timer = 1;
-        spin_unlock(&rb_queue->lock);
+        spin_unlock_bh(&rb_queue->lock);
        prb_del_retire_blk_timer(pkc);
 }
@@ -2057,7 +2085,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
        struct sk_buff *skb;
        struct net_device *dev;
        __be16 proto;
-        bool need_rls_dev = false;
        int err, reserve = 0;
        void *ph;
        struct sockaddr_ll *saddr = (struct sockaddr_ll *)msg->msg_name;
@@ -2069,8 +2096,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
        mutex_lock(&po->pg_vec_lock);
-        if (saddr == NULL) {
+        if (likely(saddr == NULL)) {
-                dev = po->prot_hook.dev;
+                dev     = packet_cached_dev_get(po);
                proto   = po->num;
                addr    = NULL;
        } else {
@@ -2084,19 +2111,17 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                proto   = saddr->sll_protocol;
                addr    = saddr->sll_addr;
                dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
-                need_rls_dev = true;
        }
        err = -ENXIO;
        if (unlikely(dev == NULL))
                goto out;
-        reserve = dev->hard_header_len;
        err = -ENETDOWN;
        if (unlikely(!(dev->flags & IFF_UP)))
                goto out_put;
+        reserve = dev->hard_header_len;
        size_max = po->tx_ring.frame_size
                - (po->tp_hdrlen - sizeof(struct sockaddr_ll));
@@ -2173,8 +2198,7 @@ out_status:
        __packet_set_status(po, ph, status);
        kfree_skb(skb);
 out_put:
-        if (need_rls_dev)
+        dev_put(dev);
-                dev_put(dev);
 out:
        mutex_unlock(&po->pg_vec_lock);
        return err;
@@ -2212,7 +2236,6 @@ static int packet_snd(struct socket *sock,
        struct sk_buff *skb;
        struct net_device *dev;
        __be16 proto;
-        bool need_rls_dev = false;
        unsigned char *addr;
        int err, reserve = 0;
        struct virtio_net_hdr vnet_hdr = { 0 };
@@ -2227,8 +2250,8 @@ static int packet_snd(struct socket *sock,
         *      Get and verify the address.
         */
-        if (saddr == NULL) {
+        if (likely(saddr == NULL)) {
-                dev = po->prot_hook.dev;
+                dev     = packet_cached_dev_get(po);
                proto   = po->num;
                addr    = NULL;
        } else {
@@ -2240,19 +2263,17 @@ static int packet_snd(struct socket *sock,
                proto   = saddr->sll_protocol;
                addr    = saddr->sll_addr;
                dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
-                need_rls_dev = true;
        }
        err = -ENXIO;
-        if (dev == NULL)
+        if (unlikely(dev == NULL))
                goto out_unlock;
-        if (sock->type == SOCK_RAW)
-                reserve = dev->hard_header_len;
        err = -ENETDOWN;
-        if (!(dev->flags & IFF_UP))
+        if (unlikely(!(dev->flags & IFF_UP)))
                goto out_unlock;
+        if (sock->type == SOCK_RAW)
+                reserve = dev->hard_header_len;
        if (po->has_vnet_hdr) {
                vnet_hdr_len = sizeof(vnet_hdr);
@@ -2386,15 +2407,14 @@ static int packet_snd(struct socket *sock,
        if (err > 0 && (err = net_xmit_errno(err)) != 0)
                goto out_unlock;
-        if (need_rls_dev)
+        dev_put(dev);
-                dev_put(dev);
        return len;
 out_free:
        kfree_skb(skb);
 out_unlock:
-        if (dev && need_rls_dev)
+        if (dev)
                dev_put(dev);
 out:
        return err;
@@ -2439,6 +2459,8 @@ static int packet_release(struct socket *sock)
        spin_lock(&po->bind_lock);
        unregister_prot_hook(sk, false);
+        packet_cached_dev_reset(po);
        if (po->prot_hook.dev) {
                dev_put(po->prot_hook.dev);
                po->prot_hook.dev = NULL;
@@ -2494,14 +2516,17 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protoc
        spin_lock(&po->bind_lock);
        unregister_prot_hook(sk, true);
        po->num = protocol;
        po->prot_hook.type = protocol;
        if (po->prot_hook.dev)
                dev_put(po->prot_hook.dev);
-        po->prot_hook.dev = dev;
+        po->prot_hook.dev = dev;
        po->ifindex = dev ? dev->ifindex : 0;
+        packet_cached_dev_assign(po, dev);
        if (protocol == 0)
                goto out_unlock;
@@ -2615,6 +2640,8 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
        sk->sk_family = PF_PACKET;
        po->num = proto;
+        packet_cached_dev_reset(po);
        sk->sk_destruct = packet_sock_destruct;
        sk_refcnt_debug_inc(sk);
@@ -2660,7 +2687,6 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
        struct sock *sk = sock->sk;
        struct sk_buff *skb;
        int copied, err;
-        struct sockaddr_ll *sll;
        int vnet_hdr_len = 0;
        err = -EINVAL;
@@ -2744,22 +2770,10 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
                        goto out_free;
        }
-        /*
+        /* You lose any data beyond the buffer you gave. If it worries
-         *      If the address length field is there to be filled in, we fill
+         * a user program they can ask the device for its MTU
-         *      it in now.
+         * anyway.
         */
-        sll = &PACKET_SKB_CB(skb)->sa.ll;
-        if (sock->type == SOCK_PACKET)
-                msg->msg_namelen = sizeof(struct sockaddr_pkt);
-        else
-                msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
-        /*
-         *      You lose any data beyond the buffer you gave. If it worries a
-         *      user program they can ask the device for its MTU anyway.
-         */
        copied = skb->len;
        if (copied > len) {
                copied = len;
@@ -2772,9 +2786,20 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
        sock_recv_ts_and_drops(msg, sk, skb);
-        if (msg->msg_name)
+        if (msg->msg_name) {
+                /* If the address length field is there to be filled
+                 * in, we fill it in now.
+                 */
+                if (sock->type == SOCK_PACKET) {
+                        msg->msg_namelen = sizeof(struct sockaddr_pkt);
+                } else {
+                        struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
+                        msg->msg_namelen = sll->sll_halen +
+                                offsetof(struct sockaddr_ll, sll_addr);
+                }
                memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
                       msg->msg_namelen);
+        }
        if (pkt_sk(sk)->auxdata) {
                struct tpacket_auxdata aux;
@@ -3326,6 +3351,7 @@ static int packet_notifier(struct notifier_block *this,
                                                sk->sk_error_report(sk);
                                }
                                if (msg == NETDEV_UNREGISTER) {
+                                        packet_cached_dev_reset(po);
                                        po->ifindex = -1;
                                        if (po->prot_hook.dev)
                                                dev_put(po->prot_hook.dev);
diff --git a/net/packet/internal.h b/net/packet/internal.h
index c4e4b4561207..1035fa2d909c 100644
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -113,6 +113,7 @@ struct packet_sock {
        unsigned int            tp_loss:1;
        unsigned int            tp_tx_has_off:1;
        unsigned int            tp_tstamp;
+        struct net_device __rcu *cached_dev;
        struct packet_type      prot_hook ____cacheline_aligned_in_smp;
 };
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index 12c30f3e643e..38946b26e471 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -139,9 +139,6 @@ static int pn_recvmsg(struct kiocb *iocb, struct sock *sk,
                        MSG_CMSG_COMPAT))
                goto out_nofree;
-        if (addr_len)
-                *addr_len = sizeof(sa);
        skb = skb_recv_datagram(sk, flags, noblock, &rval);
        if (skb == NULL)
                goto out_nofree;
@@ -162,8 +159,10 @@ static int pn_recvmsg(struct kiocb *iocb, struct sock *sk,
        rval = (flags & MSG_TRUNC) ? skb->len : copylen;
-        if (msg->msg_name != NULL)
+        if (msg->msg_name != NULL) {
-                memcpy(msg->msg_name, &sa, sizeof(struct sockaddr_pn));
+                memcpy(msg->msg_name, &sa, sizeof(sa));
+                *addr_len = sizeof(sa);
+        }
 out:
        skb_free_datagram(sk, skb);
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index e59094981175..37be6e226d1b 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -552,9 +552,8 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
            && rm->m_inc.i_hdr.h_flags & RDS_FLAG_CONG_BITMAP) {
                rds_cong_map_updated(conn->c_fcong, ~(u64) 0);
                scat = &rm->data.op_sg[sg];
-                ret = sizeof(struct rds_header) + RDS_CONG_MAP_BYTES;
+                ret = max_t(int, RDS_CONG_MAP_BYTES, scat->length);
-                ret = min_t(int, ret, scat->length - conn->c_xmit_data_off);
+                return sizeof(struct rds_header) + ret;
-                return ret;
        }
        /* FIXME we may overallocate here */
diff --git a/net/rds/recv.c b/net/rds/recv.c
index 9f0f17cf6bf9..de339b24ca14 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -410,8 +410,6 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
        rdsdebug("size %zu flags 0x%x timeo %ld\n", size, msg_flags, timeo);
-        msg->msg_namelen = 0;
        if (msg_flags & MSG_OOB)
                goto out;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index e98fcfbe6007..33af77246bfe 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1216,7 +1216,6 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
 {
        struct sock *sk = sock->sk;
        struct rose_sock *rose = rose_sk(sk);
-        struct sockaddr_rose *srose = (struct sockaddr_rose *)msg->msg_name;
        size_t copied;
        unsigned char *asmptr;
        struct sk_buff *skb;
@@ -1252,8 +1251,11 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
        skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
-        if (srose != NULL) {
+        if (msg->msg_name) {
-                memset(srose, 0, msg->msg_namelen);
+                struct sockaddr_rose *srose;
+                memset(msg->msg_name, 0, sizeof(struct full_sockaddr_rose));
+                srose = msg->msg_name;
                srose->srose_family = AF_ROSE;
                srose->srose_addr   = rose->dest_addr;
                srose->srose_call   = rose->dest_call;
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index 4b48687c3890..898492a8d61b 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -143,10 +143,13 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
                /* copy the peer address and timestamp */
                if (!continue_call) {
-                        if (msg->msg_name && msg->msg_namelen > 0)
+                        if (msg->msg_name) {
+                                size_t len =
+                                        sizeof(call->conn->trans->peer->srx);
                                memcpy(msg->msg_name,
-                                       &call->conn->trans->peer->srx,
+                                       &call->conn->trans->peer->srx, len);
-                                       sizeof(call->conn->trans->peer->srx));
+                                msg->msg_namelen = len;
+                        }
                        sock_recv_ts_and_drops(msg, &rx->sk, skb);
                }
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index fd7072827a40..69cb848e8345 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -270,6 +270,16 @@ int tcf_register_action(struct tc_action_ops *act)
 {
        struct tc_action_ops *a, **ap;
+        /* Must supply act, dump, cleanup and init */
+        if (!act->act || !act->dump || !act->cleanup || !act->init)
+                return -EINVAL;
+        /* Supply defaults */
+        if (!act->lookup)
+                act->lookup = tcf_hash_search;
+        if (!act->walk)
+                act->walk = tcf_generic_walker;
        write_lock(&act_mod_lock);
        for (ap = &act_base; (a = *ap) != NULL; ap = &a->next) {
                if (act->type == a->type || (strcmp(act->kind, a->kind) == 0)) {
@@ -381,7 +391,7 @@ int tcf_action_exec(struct sk_buff *skb, const struct tc_action *act,
        }
        while ((a = act) != NULL) {
 repeat:
-                if (a->ops && a->ops->act) {
+                if (a->ops) {
                        ret = a->ops->act(skb, a, res);
                        if (TC_MUNGED & skb->tc_verd) {
                                /* copied already, allow trampling */
@@ -405,7 +415,7 @@ void tcf_action_destroy(struct tc_action *act, int bind)
        struct tc_action *a;
        for (a = act; a; a = act) {
-                if (a->ops && a->ops->cleanup) {
+                if (a->ops) {
                        if (a->ops->cleanup(a, bind) == ACT_P_DELETED)
                                module_put(a->ops->owner);
                        act = act->next;
@@ -424,7 +434,7 @@ tcf_action_dump_old(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
        int err = -EINVAL;
-        if (a->ops == NULL || a->ops->dump == NULL)
+        if (a->ops == NULL)
                return err;
        return a->ops->dump(skb, a, bind, ref);
 }
@@ -436,7 +446,7 @@ tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
        unsigned char *b = skb_tail_pointer(skb);
        struct nlattr *nest;
-        if (a->ops == NULL || a->ops->dump == NULL)
+        if (a->ops == NULL)
                return err;
        if (nla_put_string(skb, TCA_KIND, a->ops->kind))
@@ -723,8 +733,6 @@ tcf_action_get_1(struct nlattr *nla, struct nlmsghdr *n, u32 portid)
        a->ops = tc_lookup_action(tb[TCA_ACT_KIND]);
        if (a->ops == NULL)
                goto err_free;
-        if (a->ops->lookup == NULL)
-                goto err_mod;
        err = -ENOENT;
        if (a->ops->lookup(a, index) == 0)
                goto err_mod;
@@ -1084,12 +1092,6 @@ tc_dump_action(struct sk_buff *skb, struct netlink_callback *cb)
        memset(&a, 0, sizeof(struct tc_action));
        a.ops = a_o;
-        if (a_o->walk == NULL) {
-                WARN(1, "tc_dump_action: %s !capable of dumping table\n",
-                     a_o->kind);
-                goto out_module_put;
-        }
        nlh = nlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
                        cb->nlh->nlmsg_type, sizeof(*t), 0);
        if (!nlh)
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 3a4c0caa1f7d..5c5edf56adbd 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -585,9 +585,7 @@ static struct tc_action_ops act_csum_ops = {
        .act            = tcf_csum,
        .dump           = tcf_csum_dump,
        .cleanup        = tcf_csum_cleanup,
-        .lookup         = tcf_hash_search,
        .init           = tcf_csum_init,
-        .walk           = tcf_generic_walker
 };
 MODULE_DESCRIPTION("Checksum updating actions");
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index fd2b3cff5fa2..5645a4d32abd 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -206,9 +206,7 @@ static struct tc_action_ops act_gact_ops = {
        .act            =       tcf_gact,
        .dump           =       tcf_gact_dump,
        .cleanup        =       tcf_gact_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_gact_init,
-        .walk           =       tcf_generic_walker
 };
 MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 60d88b6b9560..882a89762f77 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -298,9 +298,7 @@ static struct tc_action_ops act_ipt_ops = {
        .act            =       tcf_ipt,
        .dump           =       tcf_ipt_dump,
        .cleanup        =       tcf_ipt_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_ipt_init,
-        .walk           =       tcf_generic_walker
 };
 static struct tc_action_ops act_xt_ops = {
@@ -312,9 +310,7 @@ static struct tc_action_ops act_xt_ops = {
        .act            =       tcf_ipt,
        .dump           =       tcf_ipt_dump,
        .cleanup        =       tcf_ipt_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_ipt_init,
-        .walk           =       tcf_generic_walker
 };
 MODULE_AUTHOR("Jamal Hadi Salim(2002-13)");
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 977c10e0631b..252378121ce7 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -271,9 +271,7 @@ static struct tc_action_ops act_mirred_ops = {
        .act            =       tcf_mirred,
        .dump           =       tcf_mirred_dump,
        .cleanup        =       tcf_mirred_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_mirred_init,
-        .walk           =       tcf_generic_walker
 };
 MODULE_AUTHOR("Jamal Hadi Salim(2002)");
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 876f0ef29694..6a15ace00241 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -308,9 +308,7 @@ static struct tc_action_ops act_nat_ops = {
        .act            =       tcf_nat,
        .dump           =       tcf_nat_dump,
        .cleanup        =       tcf_nat_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_nat_init,
-        .walk           =       tcf_generic_walker
 };
 MODULE_DESCRIPTION("Stateless NAT actions");
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 7ed78c9e505c..03b67674169c 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -243,9 +243,7 @@ static struct tc_action_ops act_pedit_ops = {
        .act            =       tcf_pedit,
        .dump           =       tcf_pedit_dump,
        .cleanup        =       tcf_pedit_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_pedit_init,
-        .walk           =       tcf_generic_walker
 };
 MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 272d8e924cf6..16a62c36928a 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -407,7 +407,6 @@ static struct tc_action_ops act_police_ops = {
        .act            =       tcf_act_police,
        .dump           =       tcf_act_police_dump,
        .cleanup        =       tcf_act_police_cleanup,
-        .lookup         =       tcf_hash_search,
        .init           =       tcf_act_police_locate,
        .walk           =       tcf_act_police_walker
 };
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 7725eb4ab756..31157d3e729c 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -201,7 +201,6 @@ static struct tc_action_ops act_simp_ops = {
        .dump           =       tcf_simp_dump,
        .cleanup        =       tcf_simp_cleanup,
        .init           =       tcf_simp_init,
-        .walk           =       tcf_generic_walker,
 };
 MODULE_AUTHOR("Jamal Hadi Salim(2005)");
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index cb4221171f93..35ea643b4325 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -203,7 +203,6 @@ static struct tc_action_ops act_skbedit_ops = {
        .dump           =       tcf_skbedit_dump,
        .cleanup        =       tcf_skbedit_cleanup,
        .init           =       tcf_skbedit_init,
-        .walk           =       tcf_generic_walker,
 };
 MODULE_AUTHOR("Alexander Duyck, <alexander.h.duyck@intel.com>");
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index fdc041c57853..95d843961907 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -88,7 +88,7 @@ struct fq_sched_data {
        struct fq_flow  internal;       /* for non classified or high prio packets */
        u32             quantum;
        u32             initial_quantum;
-        u32             flow_default_rate;/* rate per flow : bytes per second */
+        u32             flow_refill_delay;
        u32             flow_max_rate;  /* optional max rate per flow */
        u32             flow_plimit;    /* max packets per flow */
        struct rb_root  *fq_root;
@@ -115,6 +115,7 @@ static struct fq_flow detached, throttled;
 static void fq_flow_set_detached(struct fq_flow *f)
 {
        f->next = &detached;
+        f->age = jiffies;
 }
 static bool fq_flow_is_detached(const struct fq_flow *f)
@@ -209,21 +210,15 @@ static void fq_gc(struct fq_sched_data *q,
        }
 }
-static const u8 prio2band[TC_PRIO_MAX + 1] = {
-        1, 2, 2, 2, 1, 2, 0, 0 , 1, 1, 1, 1, 1, 1, 1, 1
-};
 static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q)
 {
        struct rb_node **p, *parent;
        struct sock *sk = skb->sk;
        struct rb_root *root;
        struct fq_flow *f;
-        int band;
        /* warning: no starvation prevention... */
-        band = prio2band[skb->priority & TC_PRIO_MAX];
+        if (unlikely((skb->priority & TC_PRIO_MAX) == TC_PRIO_CONTROL))
-        if (unlikely(band == 0))
                return &q->internal;
        if (unlikely(!sk)) {
@@ -373,17 +368,20 @@ static int fq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        }
        f->qlen++;
-        flow_queue_add(f, skb);
        if (skb_is_retransmit(skb))
                q->stat_tcp_retrans++;
        sch->qstats.backlog += qdisc_pkt_len(skb);
        if (fq_flow_is_detached(f)) {
                fq_flow_add_tail(&q->new_flows, f);
-                if (q->quantum > f->credit)
+                if (time_after(jiffies, f->age + q->flow_refill_delay))
-                        f->credit = q->quantum;
+                        f->credit = max_t(u32, f->credit, q->quantum);
                q->inactive_flows--;
                qdisc_unthrottled(sch);
        }
+        /* Note: this overwrites f->age */
+        flow_queue_add(f, skb);
        if (unlikely(f == &q->internal)) {
                q->stat_internal_packets++;
                qdisc_unthrottled(sch);
@@ -461,7 +459,6 @@ begin:
                        fq_flow_add_tail(&q->old_flows, f);
                } else {
                        fq_flow_set_detached(f);
-                        f->age = jiffies;
                        q->inactive_flows++;
                }
                goto begin;
@@ -615,6 +612,7 @@ static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = {
        [TCA_FQ_FLOW_DEFAULT_RATE]      = { .type = NLA_U32 },
        [TCA_FQ_FLOW_MAX_RATE]          = { .type = NLA_U32 },
        [TCA_FQ_BUCKETS_LOG]            = { .type = NLA_U32 },
+        [TCA_FQ_FLOW_REFILL_DELAY]      = { .type = NLA_U32 },
 };
 static int fq_change(struct Qdisc *sch, struct nlattr *opt)
@@ -656,7 +654,8 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
                q->initial_quantum = nla_get_u32(tb[TCA_FQ_INITIAL_QUANTUM]);
        if (tb[TCA_FQ_FLOW_DEFAULT_RATE])
-                q->flow_default_rate = nla_get_u32(tb[TCA_FQ_FLOW_DEFAULT_RATE]);
+                pr_warn_ratelimited("sch_fq: defrate %u ignored.\n",
+                                    nla_get_u32(tb[TCA_FQ_FLOW_DEFAULT_RATE]));
        if (tb[TCA_FQ_FLOW_MAX_RATE])
                q->flow_max_rate = nla_get_u32(tb[TCA_FQ_FLOW_MAX_RATE]);
@@ -670,6 +669,12 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt)
                        err = -EINVAL;
        }
+        if (tb[TCA_FQ_FLOW_REFILL_DELAY]) {
+                u32 usecs_delay = nla_get_u32(tb[TCA_FQ_FLOW_REFILL_DELAY]) ;
+                q->flow_refill_delay = usecs_to_jiffies(usecs_delay);
+        }
        if (!err)
                err = fq_resize(q, fq_log);
@@ -705,7 +710,7 @@ static int fq_init(struct Qdisc *sch, struct nlattr *opt)
        q->flow_plimit          = 100;
        q->quantum              = 2 * psched_mtu(qdisc_dev(sch));
        q->initial_quantum      = 10 * psched_mtu(qdisc_dev(sch));
-        q->flow_default_rate    = 0;
+        q->flow_refill_delay    = msecs_to_jiffies(40);
        q->flow_max_rate        = ~0U;
        q->rate_enable          = 1;
        q->new_flows.first      = NULL;
@@ -732,15 +737,16 @@ static int fq_dump(struct Qdisc *sch, struct sk_buff *skb)
        if (opts == NULL)
                goto nla_put_failure;
-        /* TCA_FQ_FLOW_DEFAULT_RATE is not used anymore,
+        /* TCA_FQ_FLOW_DEFAULT_RATE is not used anymore */
-         * do not bother giving its value
-         */
        if (nla_put_u32(skb, TCA_FQ_PLIMIT, sch->limit) ||
            nla_put_u32(skb, TCA_FQ_FLOW_PLIMIT, q->flow_plimit) ||
            nla_put_u32(skb, TCA_FQ_QUANTUM, q->quantum) ||
            nla_put_u32(skb, TCA_FQ_INITIAL_QUANTUM, q->initial_quantum) ||
            nla_put_u32(skb, TCA_FQ_RATE_ENABLE, q->rate_enable) ||
            nla_put_u32(skb, TCA_FQ_FLOW_MAX_RATE, q->flow_max_rate) ||
+            nla_put_u32(skb, TCA_FQ_FLOW_REFILL_DELAY,
+                        jiffies_to_usecs(q->flow_refill_delay)) ||
            nla_put_u32(skb, TCA_FQ_BUCKETS_LOG, q->fq_trees_log))
                goto nla_put_failure;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 0e1e38b40025..717b2108f852 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1477,11 +1477,22 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                sch_tree_lock(sch);
        }
+        rate64 = tb[TCA_HTB_RATE64] ? nla_get_u64(tb[TCA_HTB_RATE64]) : 0;
+        ceil64 = tb[TCA_HTB_CEIL64] ? nla_get_u64(tb[TCA_HTB_CEIL64]) : 0;
+        psched_ratecfg_precompute(&cl->rate, &hopt->rate, rate64);
+        psched_ratecfg_precompute(&cl->ceil, &hopt->ceil, ceil64);
        /* it used to be a nasty bug here, we have to check that node
         * is really leaf before changing cl->un.leaf !
         */
        if (!cl->level) {
-                cl->quantum = hopt->rate.rate / q->rate2quantum;
+                u64 quantum = cl->rate.rate_bytes_ps;
+                do_div(quantum, q->rate2quantum);
+                cl->quantum = min_t(u64, quantum, INT_MAX);
                if (!hopt->quantum && cl->quantum < 1000) {
                        pr_warning(
                               "HTB: quantum of class %X is small. Consider r2q change.\n",
@@ -1500,13 +1511,6 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                        cl->prio = TC_HTB_NUMPRIO - 1;
        }
-        rate64 = tb[TCA_HTB_RATE64] ? nla_get_u64(tb[TCA_HTB_RATE64]) : 0;
-        ceil64 = tb[TCA_HTB_CEIL64] ? nla_get_u64(tb[TCA_HTB_CEIL64]) : 0;
-        psched_ratecfg_precompute(&cl->rate, &hopt->rate, rate64);
-        psched_ratecfg_precompute(&cl->ceil, &hopt->ceil, ceil64);
        cl->buffer = PSCHED_TICKS2NS(hopt->buffer);
        cl->cbuffer = PSCHED_TICKS2NS(hopt->cbuffer);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 75c94e59a3bd..bccd52b36e97 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -215,10 +215,10 @@ static bool loss_4state(struct netem_sched_data *q)
                if (rnd < clg->a4) {
                        clg->state = 4;
                        return true;
-                } else if (clg->a4 < rnd && rnd < clg->a1) {
+                } else if (clg->a4 < rnd && rnd < clg->a1 + clg->a4) {
                        clg->state = 3;
                        return true;
-                } else if (clg->a1 < rnd)
+                } else if (clg->a1 + clg->a4 < rnd)
                        clg->state = 1;
                break;
@@ -268,10 +268,11 @@ static bool loss_gilb_ell(struct netem_sched_data *q)
                        clg->state = 2;
                if (net_random() < clg->a4)
                        return true;
+                break;
        case 2:
                if (net_random() < clg->a2)
                        clg->state = 1;
-                if (clg->a3 > net_random())
+                if (net_random() > clg->a3)
                        return true;
        }
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 68f98595819c..887e672f9d7d 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -21,6 +21,7 @@
 #include <net/netlink.h>
 #include <net/sch_generic.h>
 #include <net/pkt_sched.h>
+#include <net/tcp.h>
 /*      Simple Token Bucket Filter.
@@ -117,6 +118,48 @@ struct tbf_sched_data {
 };
+/* Time to Length, convert time in ns to length in bytes
+ * to determinate how many bytes can be sent in given time.
+ */
+static u64 psched_ns_t2l(const struct psched_ratecfg *r,
+                         u64 time_in_ns)
+{
+        /* The formula is :
+         * len = (time_in_ns * r->rate_bytes_ps) / NSEC_PER_SEC
+         */
+        u64 len = time_in_ns * r->rate_bytes_ps;
+        do_div(len, NSEC_PER_SEC);
+        if (unlikely(r->linklayer == TC_LINKLAYER_ATM)) {
+                do_div(len, 53);
+                len = len * 48;
+        }
+        if (len > r->overhead)
+                len -= r->overhead;
+        else
+                len = 0;
+        return len;
+}
+/*
+ * Return length of individual segments of a gso packet,
+ * including all headers (MAC, IP, TCP/UDP)
+ */
+static unsigned int skb_gso_seglen(const struct sk_buff *skb)
+{
+        unsigned int hdr_len = skb_transport_header(skb) - skb_mac_header(skb);
+        const struct skb_shared_info *shinfo = skb_shinfo(skb);
+        if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
+                hdr_len += tcp_hdrlen(skb);
+        else
+                hdr_len += sizeof(struct udphdr);
+        return hdr_len + shinfo->gso_size;
+}
 /* GSO packet is too big, segment it so that tbf can transmit
 * each segment in time
 */
@@ -136,12 +179,8 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch)
        while (segs) {
                nskb = segs->next;
                segs->next = NULL;
-                if (likely(segs->len <= q->max_size)) {
+                qdisc_skb_cb(segs)->pkt_len = segs->len;
-                        qdisc_skb_cb(segs)->pkt_len = segs->len;
+                ret = qdisc_enqueue(segs, q->qdisc);
-                        ret = qdisc_enqueue(segs, q->qdisc);
-                } else {
-                        ret = qdisc_reshape_fail(skb, sch);
-                }
                if (ret != NET_XMIT_SUCCESS) {
                        if (net_xmit_drop_count(ret))
                                sch->qstats.drops++;
@@ -163,7 +202,7 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        int ret;
        if (qdisc_pkt_len(skb) > q->max_size) {
-                if (skb_is_gso(skb))
+                if (skb_is_gso(skb) && skb_gso_seglen(skb) <= q->max_size)
                        return tbf_segment(skb, sch);
                return qdisc_reshape_fail(skb, sch);
        }
@@ -276,10 +315,11 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
        struct tbf_sched_data *q = qdisc_priv(sch);
        struct nlattr *tb[TCA_TBF_MAX + 1];
        struct tc_tbf_qopt *qopt;
-        struct qdisc_rate_table *rtab = NULL;
-        struct qdisc_rate_table *ptab = NULL;
        struct Qdisc *child = NULL;
-        int max_size, n;
+        struct psched_ratecfg rate;
+        struct psched_ratecfg peak;
+        u64 max_size;
+        s64 buffer, mtu;
        u64 rate64 = 0, prate64 = 0;
        err = nla_parse_nested(tb, TCA_TBF_MAX, opt, tbf_policy);
@@ -291,33 +331,13 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                goto done;
        qopt = nla_data(tb[TCA_TBF_PARMS]);
-        rtab = qdisc_get_rtab(&qopt->rate, tb[TCA_TBF_RTAB]);
+        if (qopt->rate.linklayer == TC_LINKLAYER_UNAWARE)
-        if (rtab == NULL)
+                qdisc_put_rtab(qdisc_get_rtab(&qopt->rate,
-                goto done;
+                                              tb[TCA_TBF_RTAB]));
-        if (qopt->peakrate.rate) {
+        if (qopt->peakrate.linklayer == TC_LINKLAYER_UNAWARE)
-                if (qopt->peakrate.rate > qopt->rate.rate)
+                        qdisc_put_rtab(qdisc_get_rtab(&qopt->peakrate,
-                        ptab = qdisc_get_rtab(&qopt->peakrate, tb[TCA_TBF_PTAB]);
+                                                      tb[TCA_TBF_PTAB]));
-                if (ptab == NULL)
-                        goto done;
-        }
-        for (n = 0; n < 256; n++)
-                if (rtab->data[n] > qopt->buffer)
-                        break;
-        max_size = (n << qopt->rate.cell_log) - 1;
-        if (ptab) {
-                int size;
-                for (n = 0; n < 256; n++)
-                        if (ptab->data[n] > qopt->mtu)
-                                break;
-                size = (n << qopt->peakrate.cell_log) - 1;
-                if (size < max_size)
-                        max_size = size;
-        }
-        if (max_size < 0)
-                goto done;
        if (q->qdisc != &noop_qdisc) {
                err = fifo_set_limit(q->qdisc, qopt->limit);
@@ -331,6 +351,39 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
                }
        }
+        buffer = min_t(u64, PSCHED_TICKS2NS(qopt->buffer), ~0U);
+        mtu = min_t(u64, PSCHED_TICKS2NS(qopt->mtu), ~0U);
+        if (tb[TCA_TBF_RATE64])
+                rate64 = nla_get_u64(tb[TCA_TBF_RATE64]);
+        psched_ratecfg_precompute(&rate, &qopt->rate, rate64);
+        max_size = min_t(u64, psched_ns_t2l(&rate, buffer), ~0U);
+        if (qopt->peakrate.rate) {
+                if (tb[TCA_TBF_PRATE64])
+                        prate64 = nla_get_u64(tb[TCA_TBF_PRATE64]);
+                psched_ratecfg_precompute(&peak, &qopt->peakrate, prate64);
+                if (peak.rate_bytes_ps <= rate.rate_bytes_ps) {
+                        pr_warn_ratelimited("sch_tbf: peakrate %llu is lower than or equals to rate %llu !\n",
+                                            peak.rate_bytes_ps, rate.rate_bytes_ps);
+                        err = -EINVAL;
+                        goto done;
+                }
+                max_size = min_t(u64, max_size, psched_ns_t2l(&peak, mtu));
+        }
+        if (max_size < psched_mtu(qdisc_dev(sch)))
+                pr_warn_ratelimited("sch_tbf: burst %llu is lower than device %s mtu (%u) !\n",
+                                    max_size, qdisc_dev(sch)->name,
+                                    psched_mtu(qdisc_dev(sch)));
+        if (!max_size) {
+                err = -EINVAL;
+                goto done;
+        }
        sch_tree_lock(sch);
        if (child) {
                qdisc_tree_decrease_qlen(q->qdisc, q->qdisc->q.qlen);
@@ -344,13 +397,9 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
        q->tokens = q->buffer;
        q->ptokens = q->mtu;
-        if (tb[TCA_TBF_RATE64])
+        memcpy(&q->rate, &rate, sizeof(struct psched_ratecfg));
-                rate64 = nla_get_u64(tb[TCA_TBF_RATE64]);
+        if (qopt->peakrate.rate) {
-        psched_ratecfg_precompute(&q->rate, &rtab->rate, rate64);
+                memcpy(&q->peak, &peak, sizeof(struct psched_ratecfg));
-        if (ptab) {
-                if (tb[TCA_TBF_PRATE64])
-                        prate64 = nla_get_u64(tb[TCA_TBF_PRATE64]);
-                psched_ratecfg_precompute(&q->peak, &ptab->rate, prate64);
                q->peak_present = true;
        } else {
                q->peak_present = false;
@@ -359,10 +408,6 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt)
        sch_tree_unlock(sch);
        err = 0;
 done:
-        if (rtab)
-                qdisc_put_rtab(rtab);
-        if (ptab)
-                qdisc_put_rtab(ptab);
        return err;
 }
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index c9b91cb1cb0d..31ed008c8e13 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -154,8 +154,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
        asoc->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] = 0;
        asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay;
-        asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
+        asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] = sp->autoclose * HZ;
-                min_t(unsigned long, sp->autoclose, net->sctp.max_autoclose) * HZ;
        /* Initializes the timers */
        for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i)
@@ -291,8 +290,6 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
                asoc->peer.ipv6_address = 1;
        INIT_LIST_HEAD(&asoc->asocs);
-        asoc->autoclose = sp->autoclose;
        asoc->default_stream = sp->default_stream;
        asoc->default_ppid = sp->default_ppid;
        asoc->default_flags = sp->default_flags;
@@ -907,8 +904,8 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
                if (!first || t->last_time_heard > first->last_time_heard) {
                        second = first;
                        first = t;
-                }
+                } else if (!second ||
-                if (!second || t->last_time_heard > second->last_time_heard)
+                           t->last_time_heard > second->last_time_heard)
                        second = t;
        }
@@ -929,6 +926,8 @@ void sctp_assoc_control_transport(struct sctp_association *asoc,
                first = asoc->peer.primary_path;
        }
+        if (!second)
+                second = first;
        /* If we failed to find a usable transport, just camp on the
         * primary, even if it is inactive.
         */
diff --git a/net/sctp/output.c b/net/sctp/output.c
index e650978daf27..0fb140f8f088 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -474,10 +474,11 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                         * for a given destination transport address.
                         */
-                        if (!tp->rto_pending) {
+                        if (!chunk->resent && !tp->rto_pending) {
                                chunk->rtt_in_progress = 1;
                                tp->rto_pending = 1;
                        }
                        has_data = 1;
                }
@@ -580,7 +581,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                unsigned long timeout;
                /* Restart the AUTOCLOSE timer when sending data. */
-                if (sctp_state(asoc, ESTABLISHED) && asoc->autoclose) {
+                if (sctp_state(asoc, ESTABLISHED) &&
+                    asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
                        timer = &asoc->timers[SCTP_EVENT_TIMEOUT_AUTOCLOSE];
                        timeout = asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE];
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 94df75877869..f51ba985a36e 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -446,6 +446,8 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                                transport->rto_pending = 0;
                        }
+                        chunk->resent = 1;
                        /* Move the chunk to the retransmit queue. The chunks
                         * on the retransmit queue are always kept in order.
                         */
@@ -1375,6 +1377,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                 * instance).
                                 */
                                if (!tchunk->tsn_gap_acked &&
+                                    !tchunk->resent &&
                                    tchunk->rtt_in_progress) {
                                        tchunk->rtt_in_progress = 0;
                                        rtt = jiffies - tchunk->sent_at;
@@ -1391,7 +1394,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                         */
                        if (!tchunk->tsn_gap_acked) {
                                tchunk->tsn_gap_acked = 1;
-                                *highest_new_tsn_in_sack = tsn;
+                                if (TSN_lt(*highest_new_tsn_in_sack, tsn))
+                                        *highest_new_tsn_in_sack = tsn;
                                bytes_acked += sctp_data_size(tchunk);
                                if (!tchunk->transport)
                                        migrate_bytes += sctp_data_size(tchunk);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index dfe3f36ff2aa..a26065be7289 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -820,7 +820,7 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
        SCTP_INC_STATS(net, SCTP_MIB_PASSIVEESTABS);
        sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
-        if (new_asoc->autoclose)
+        if (new_asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
@@ -908,7 +908,7 @@ sctp_disposition_t sctp_sf_do_5_1E_ca(struct net *net,
        SCTP_INC_STATS(net, SCTP_MIB_CURRESTAB);
        SCTP_INC_STATS(net, SCTP_MIB_ACTIVEESTABS);
        sctp_add_cmd_sf(commands, SCTP_CMD_HB_TIMERS_START, SCTP_NULL());
-        if (asoc->autoclose)
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
@@ -2970,7 +2970,7 @@ sctp_disposition_t sctp_sf_eat_data_6_2(struct net *net,
        if (chunk->chunk_hdr->flags & SCTP_DATA_SACK_IMM)
                force = SCTP_FORCE();
-        if (asoc->autoclose) {
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
        }
@@ -3878,7 +3878,7 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn(struct net *net,
                                SCTP_CHUNK(chunk));
        /* Count this as receiving DATA. */
-        if (asoc->autoclose) {
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE]) {
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
        }
@@ -5267,7 +5267,7 @@ sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                        SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
-        if (asoc->autoclose)
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
@@ -5346,7 +5346,7 @@ sctp_disposition_t sctp_sf_do_9_2_shutdown_ack(
        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                        SCTP_TO(SCTP_EVENT_TIMEOUT_T2_SHUTDOWN));
-        if (asoc->autoclose)
+        if (asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE])
                sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
                                SCTP_TO(SCTP_EVENT_TIMEOUT_AUTOCLOSE));
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 72046b9729a8..42b709c95cf3 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2196,6 +2196,7 @@ static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
                                     unsigned int optlen)
 {
        struct sctp_sock *sp = sctp_sk(sk);
+        struct net *net = sock_net(sk);
        /* Applicable to UDP-style socket only */
        if (sctp_style(sk, TCP))
@@ -2205,6 +2206,9 @@ static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
        if (copy_from_user(&sp->autoclose, optval, optlen))
                return -EFAULT;
+        if (sp->autoclose > net->sctp.max_autoclose)
+                sp->autoclose = net->sctp.max_autoclose;
        return 0;
 }
@@ -2811,6 +2815,8 @@ static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigne
 {
        struct sctp_rtoinfo rtoinfo;
        struct sctp_association *asoc;
+        unsigned long rto_min, rto_max;
+        struct sctp_sock *sp = sctp_sk(sk);
        if (optlen != sizeof (struct sctp_rtoinfo))
                return -EINVAL;
@@ -2824,26 +2830,36 @@ static int sctp_setsockopt_rtoinfo(struct sock *sk, char __user *optval, unsigne
        if (!asoc && rtoinfo.srto_assoc_id && sctp_style(sk, UDP))
                return -EINVAL;
+        rto_max = rtoinfo.srto_max;
+        rto_min = rtoinfo.srto_min;
+        if (rto_max)
+                rto_max = asoc ? msecs_to_jiffies(rto_max) : rto_max;
+        else
+                rto_max = asoc ? asoc->rto_max : sp->rtoinfo.srto_max;
+        if (rto_min)
+                rto_min = asoc ? msecs_to_jiffies(rto_min) : rto_min;
+        else
+                rto_min = asoc ? asoc->rto_min : sp->rtoinfo.srto_min;
+        if (rto_min > rto_max)
+                return -EINVAL;
        if (asoc) {
                if (rtoinfo.srto_initial != 0)
                        asoc->rto_initial =
                                msecs_to_jiffies(rtoinfo.srto_initial);
-                if (rtoinfo.srto_max != 0)
+                asoc->rto_max = rto_max;
-                        asoc->rto_max = msecs_to_jiffies(rtoinfo.srto_max);
+                asoc->rto_min = rto_min;
-                if (rtoinfo.srto_min != 0)
-                        asoc->rto_min = msecs_to_jiffies(rtoinfo.srto_min);
        } else {
                /* If there is no association or the association-id = 0
                 * set the values to the endpoint.
                 */
-                struct sctp_sock *sp = sctp_sk(sk);
                if (rtoinfo.srto_initial != 0)
                        sp->rtoinfo.srto_initial = rtoinfo.srto_initial;
-                if (rtoinfo.srto_max != 0)
+                sp->rtoinfo.srto_max = rto_max;
-                        sp->rtoinfo.srto_max = rtoinfo.srto_max;
+                sp->rtoinfo.srto_min = rto_min;
-                if (rtoinfo.srto_min != 0)
-                        sp->rtoinfo.srto_min = rtoinfo.srto_min;
        }
        return 0;
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 6b36561a1b3b..b0565afb61c7 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -56,11 +56,16 @@ extern long sysctl_sctp_mem[3];
 extern int sysctl_sctp_rmem[3];
 extern int sysctl_sctp_wmem[3];
-static int proc_sctp_do_hmac_alg(struct ctl_table *ctl,
+static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
-                                int write,
+                                void __user *buffer, size_t *lenp,
+                                loff_t *ppos);
+static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
+                                void __user *buffer, size_t *lenp,
+                                loff_t *ppos);
+static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
                                void __user *buffer, size_t *lenp,
                                loff_t *ppos);
 static struct ctl_table sctp_table[] = {
        {
                .procname       = "sctp_mem",
@@ -102,17 +107,17 @@ static struct ctl_table sctp_net_table[] = {
                .data           = &init_net.sctp.rto_min,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
+                .proc_handler   = proc_sctp_do_rto_min,
                .extra1         = &one,
-                .extra2         = &timer_max
+                .extra2         = &init_net.sctp.rto_max
        },
        {
                .procname       = "rto_max",
                .data           = &init_net.sctp.rto_max,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
+                .proc_handler   = proc_sctp_do_rto_max,
-                .extra1         = &one,
+                .extra1         = &init_net.sctp.rto_min,
                .extra2         = &timer_max
        },
        {
@@ -294,8 +299,7 @@ static struct ctl_table sctp_net_table[] = {
        { /* sentinel */ }
 };
-static int proc_sctp_do_hmac_alg(struct ctl_table *ctl,
+static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
-                                int write,
                                void __user *buffer, size_t *lenp,
                                loff_t *ppos)
 {
@@ -342,6 +346,60 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl,
        return ret;
 }
+static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
+                                void __user *buffer, size_t *lenp,
+                                loff_t *ppos)
+{
+        struct net *net = current->nsproxy->net_ns;
+        int new_value;
+        struct ctl_table tbl;
+        unsigned int min = *(unsigned int *) ctl->extra1;
+        unsigned int max = *(unsigned int *) ctl->extra2;
+        int ret;
+        memset(&tbl, 0, sizeof(struct ctl_table));
+        tbl.maxlen = sizeof(unsigned int);
+        if (write)
+                tbl.data = &new_value;
+        else
+                tbl.data = &net->sctp.rto_min;
+        ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
+        if (write) {
+                if (ret || new_value > max || new_value < min)
+                        return -EINVAL;
+                net->sctp.rto_min = new_value;
+        }
+        return ret;
+}
+static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
+                                void __user *buffer, size_t *lenp,
+                                loff_t *ppos)
+{
+        struct net *net = current->nsproxy->net_ns;
+        int new_value;
+        struct ctl_table tbl;
+        unsigned int min = *(unsigned int *) ctl->extra1;
+        unsigned int max = *(unsigned int *) ctl->extra2;
+        int ret;
+        memset(&tbl, 0, sizeof(struct ctl_table));
+        tbl.maxlen = sizeof(unsigned int);
+        if (write)
+                tbl.data = &new_value;
+        else
+                tbl.data = &net->sctp.rto_max;
+        ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
+        if (write) {
+                if (ret || new_value > max || new_value < min)
+                        return -EINVAL;
+                net->sctp.rto_max = new_value;
+        }
+        return ret;
+}
 int sctp_sysctl_net_register(struct net *net)
 {
        struct ctl_table *table;
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index e332efb124cc..efc46ffed1fd 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -573,7 +573,7 @@ void sctp_transport_burst_limited(struct sctp_transport *t)
        u32 old_cwnd = t->cwnd;
        u32 max_burst_bytes;
-        if (t->burst_limited)
+        if (t->burst_limited || asoc->max_burst == 0)
                return;
        max_burst_bytes = t->flight_size + (asoc->max_burst * asoc->pathmtu);
diff --git a/net/socket.c b/net/socket.c
index c226aceee65b..e83c416708af 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -221,12 +221,13 @@ static int move_addr_to_user(struct sockaddr_storage *kaddr, int klen,
        int err;
        int len;
+        BUG_ON(klen > sizeof(struct sockaddr_storage));
        err = get_user(len, ulen);
        if (err)
                return err;
        if (len > klen)
                len = klen;
-        if (len < 0 || len > sizeof(struct sockaddr_storage))
+        if (len < 0)
                return -EINVAL;
        if (len) {
                if (audit_sockaddr(klen, kaddr))
@@ -1840,8 +1841,10 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
        msg.msg_iov = &iov;
        iov.iov_len = size;
        iov.iov_base = ubuf;
-        msg.msg_name = (struct sockaddr *)&address;
+        /* Save some cycles and don't copy the address if not needed */
-        msg.msg_namelen = sizeof(address);
+        msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
+        /* We assume all kernel code knows the size of sockaddr_storage */
+        msg.msg_namelen = 0;
        if (sock->file->f_flags & O_NONBLOCK)
                flags |= MSG_DONTWAIT;
        err = sock_recvmsg(sock, &msg, size, flags);
@@ -1970,7 +1973,7 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
        if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
                return -EFAULT;
        if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
-                return -EINVAL;
+                kmsg->msg_namelen = sizeof(struct sockaddr_storage);
        return 0;
 }
@@ -2221,16 +2224,14 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
                        goto out;
        }
-        /*
+        /* Save the user-mode address (verify_iovec will change the
-         *      Save the user-mode address (verify_iovec will change the
+         * kernel msghdr to use the kernel address space)
-         *      kernel msghdr to use the kernel address space)
         */
        uaddr = (__force void __user *)msg_sys->msg_name;
        uaddr_len = COMPAT_NAMELEN(msg);
-        if (MSG_CMSG_COMPAT & flags) {
+        if (MSG_CMSG_COMPAT & flags)
                err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
-        } else
+        else
                err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
        if (err < 0)
                goto out_freeiov;
@@ -2239,6 +2240,9 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
        cmsg_ptr = (unsigned long)msg_sys->msg_control;
        msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
+        /* We assume all kernel code knows the size of sockaddr_storage */
+        msg_sys->msg_namelen = 0;
        if (sock->file->f_flags & O_NONBLOCK)
                flags |= MSG_DONTWAIT;
        err = (nosec ? sock_recvmsg_nosec : sock_recvmsg)(sock, msg_sys,
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 97912b40c254..42fdfc634e56 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1517,7 +1517,7 @@ out:
 static int
 gss_refresh_null(struct rpc_task *task)
 {
-        return -EACCES;
+        return 0;
 }
 static __be32 *
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index d0d14a04dce1..bf04b30a788a 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -471,15 +471,6 @@ struct rpc_filelist {
        umode_t mode;
 };
-static int rpc_delete_dentry(const struct dentry *dentry)
-{
-        return 1;
-}
-static const struct dentry_operations rpc_dentry_operations = {
-        .d_delete = rpc_delete_dentry,
-};
 static struct inode *
 rpc_get_inode(struct super_block *sb, umode_t mode)
 {
@@ -1266,7 +1257,7 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
        sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
        sb->s_magic = RPCAUTH_GSSMAGIC;
        sb->s_op = &s_ops;
-        sb->s_d_op = &rpc_dentry_operations;
+        sb->s_d_op = &simple_dentry_operations;
        sb->s_time_gran = 1;
        inode = rpc_get_inode(sb, S_IFDIR | S_IRUGO | S_IXUGO);
diff --git a/net/tipc/core.c b/net/tipc/core.c
index fd4eeeaa972a..c6d3f75a9e1b 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -113,7 +113,6 @@ err:
 static void tipc_core_stop(void)
 {
        tipc_netlink_stop();
-        tipc_handler_stop();
        tipc_cfg_stop();
        tipc_subscr_stop();
        tipc_nametbl_stop();
@@ -146,9 +145,10 @@ static int tipc_core_start(void)
                res = tipc_subscr_start();
        if (!res)
                res = tipc_cfg_init();
-        if (res)
+        if (res) {
+                tipc_handler_stop();
                tipc_core_stop();
+        }
        return res;
 }
@@ -178,6 +178,7 @@ static int __init tipc_init(void)
 static void __exit tipc_exit(void)
 {
+        tipc_handler_stop();
        tipc_core_stop_net();
        tipc_core_stop();
        pr_info("Deactivated\n");
diff --git a/net/tipc/handler.c b/net/tipc/handler.c
index b36f0fcd9bdf..e4bc8a296744 100644
--- a/net/tipc/handler.c
+++ b/net/tipc/handler.c
@@ -56,12 +56,13 @@ unsigned int tipc_k_signal(Handler routine, unsigned long argument)
 {
        struct queue_item *item;
+        spin_lock_bh(&qitem_lock);
        if (!handler_enabled) {
                pr_err("Signal request ignored by handler\n");
+                spin_unlock_bh(&qitem_lock);
                return -ENOPROTOOPT;
        }
-        spin_lock_bh(&qitem_lock);
        item = kmem_cache_alloc(tipc_queue_item_cache, GFP_ATOMIC);
        if (!item) {
                pr_err("Signal queue out of memory\n");
@@ -112,10 +113,14 @@ void tipc_handler_stop(void)
        struct list_head *l, *n;
        struct queue_item *item;
-        if (!handler_enabled)
+        spin_lock_bh(&qitem_lock);
+        if (!handler_enabled) {
+                spin_unlock_bh(&qitem_lock);
                return;
+        }
        handler_enabled = 0;
+        spin_unlock_bh(&qitem_lock);
        tasklet_kill(&tipc_tasklet);
        spin_lock_bh(&qitem_lock);
diff --git a/net/tipc/link.c b/net/tipc/link.c
index cf465d66ccde..69cd9bf3f561 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -2358,7 +2358,8 @@ int tipc_link_recv_fragment(struct sk_buff **head, struct sk_buff **tail,
                *head = frag;
                skb_frag_list_init(*head);
                return 0;
-        } else if (skb_try_coalesce(*head, frag, &headstolen, &delta)) {
+        } else if (*head &&
+                   skb_try_coalesce(*head, frag, &headstolen, &delta)) {
                kfree_skb_partial(frag, headstolen);
        } else {
                if (!*head)
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 8bcd4985d0fb..9f72a6376362 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -76,9 +76,11 @@ static struct genl_family tipc_genl_family = {
        .maxattr        = 0,
 };
-static struct genl_ops tipc_genl_ops = {
+static struct genl_ops tipc_genl_ops[] = {
-        .cmd            = TIPC_GENL_CMD,
+        {
-        .doit           = handle_cmd,
+                .cmd            = TIPC_GENL_CMD,
+                .doit           = handle_cmd,
+        },
 };
 static int tipc_genl_family_registered;
@@ -87,8 +89,7 @@ int tipc_netlink_start(void)
 {
        int res;
-        res = genl_register_family_with_ops(&tipc_genl_family,
+        res = genl_register_family_with_ops(&tipc_genl_family, tipc_genl_ops);
-                &tipc_genl_ops, 1);
        if (res) {
                pr_err("Failed to register netlink interface\n");
                return res;
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 3906527259d1..3b61851bb927 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -980,9 +980,6 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
                goto exit;
        }
-        /* will be updated in set_orig_addr() if needed */
-        m->msg_namelen = 0;
        timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 restart:
@@ -1091,9 +1088,6 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
                goto exit;
        }
-        /* will be updated in set_orig_addr() if needed */
-        m->msg_namelen = 0;
        target = sock_rcvlowat(sk, flags & MSG_WAITALL, buf_len);
        timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index c1f403bed683..a0ca162e5bd5 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -530,13 +530,17 @@ static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
 static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
                                  struct msghdr *, size_t, int);
-static void unix_set_peek_off(struct sock *sk, int val)
+static int unix_set_peek_off(struct sock *sk, int val)
 {
        struct unix_sock *u = unix_sk(sk);
-        mutex_lock(&u->readlock);
+        if (mutex_lock_interruptible(&u->readlock))
+                return -EINTR;
        sk->sk_peek_off = val;
        mutex_unlock(&u->readlock);
+        return 0;
 }
@@ -1754,7 +1758,6 @@ static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
 {
        struct unix_sock *u = unix_sk(sk);
-        msg->msg_namelen = 0;
        if (u->addr) {
                msg->msg_namelen = u->addr->len;
                memcpy(msg->msg_name, u->addr->name, u->addr->len);
@@ -1778,8 +1781,6 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (flags&MSG_OOB)
                goto out;
-        msg->msg_namelen = 0;
        err = mutex_lock_interruptible(&u->readlock);
        if (err) {
                err = sock_intr_errno(sock_rcvtimeo(sk, noblock));
@@ -1924,8 +1925,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
        target = sock_rcvlowat(sk, flags&MSG_WAITALL, size);
        timeo = sock_rcvtimeo(sk, flags&MSG_DONTWAIT);
-        msg->msg_namelen = 0;
        /* Lock the socket to prevent queue disordering
         * while sleeps in memcpy_tomsg
         */
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 545c08b8a1d4..5adfd94c5b85 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1662,8 +1662,6 @@ vsock_stream_recvmsg(struct kiocb *kiocb,
        vsk = vsock_sk(sk);
        err = 0;
-        msg->msg_namelen = 0;
        lock_sock(sk);
        if (sk->sk_state != SS_CONNECTED) {
diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
index 9d6986634e0b..687360da62d9 100644
--- a/net/vmw_vsock/vmci_transport.c
+++ b/net/vmw_vsock/vmci_transport.c
@@ -1746,8 +1746,6 @@ static int vmci_transport_dgram_dequeue(struct kiocb *kiocb,
        if (flags & MSG_OOB || flags & MSG_ERRQUEUE)
                return -EOPNOTSUPP;
-        msg->msg_namelen = 0;
        /* Retrieve the head sk_buff from the socket's receive queue. */
        err = 0;
        skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err);
diff --git a/net/wimax/op-msg.c b/net/wimax/op-msg.c
index 0694d62e4dbc..c278b3356f75 100644
--- a/net/wimax/op-msg.c
+++ b/net/wimax/op-msg.c
@@ -279,7 +279,7 @@ int wimax_msg_send(struct wimax_dev *wimax_dev, struct sk_buff *skb)
        d_printf(1, dev, "CTX: wimax msg, %zu bytes\n", size);
        d_dump(2, dev, msg, size);
-        genlmsg_multicast(skb, 0, wimax_gnl_mcg.id, GFP_KERNEL);
+        genlmsg_multicast(&wimax_gnl_family, skb, 0, 0, GFP_KERNEL);
        d_printf(1, dev, "CTX: genl multicast done\n");
        return 0;
 }
@@ -321,17 +321,6 @@ int wimax_msg(struct wimax_dev *wimax_dev, const char *pipe_name,
 }
 EXPORT_SYMBOL_GPL(wimax_msg);
-static const struct nla_policy wimax_gnl_msg_policy[WIMAX_GNL_ATTR_MAX + 1] = {
-        [WIMAX_GNL_MSG_IFIDX] = {
-                .type = NLA_U32,
-        },
-        [WIMAX_GNL_MSG_DATA] = {
-                .type = NLA_UNSPEC,     /* libnl doesn't grok BINARY yet */
-        },
-};
 /*
 * Relays a message from user space to the driver
 *
@@ -340,7 +329,6 @@ static const struct nla_policy wimax_gnl_msg_policy[WIMAX_GNL_ATTR_MAX + 1] = {
 *
 * This call will block while handling/relaying the message.
 */
-static
 int wimax_gnl_doit_msg_from_user(struct sk_buff *skb, struct genl_info *info)
 {
        int result, ifindex;
@@ -418,16 +406,3 @@ error_no_wimax_dev:
        return result;
 }
-/*
- * Generic Netlink glue
- */
-struct genl_ops wimax_gnl_msg_from_user = {
-        .cmd = WIMAX_GNL_OP_MSG_FROM_USER,
-        .flags = GENL_ADMIN_PERM,
-        .policy = wimax_gnl_msg_policy,
-        .doit = wimax_gnl_doit_msg_from_user,
-        .dumpit = NULL,
-};
diff --git a/net/wimax/op-reset.c b/net/wimax/op-reset.c
index 7ceffe39d70e..eb4580784d9d 100644
--- a/net/wimax/op-reset.c
+++ b/net/wimax/op-reset.c
@@ -92,13 +92,6 @@ int wimax_reset(struct wimax_dev *wimax_dev)
 EXPORT_SYMBOL(wimax_reset);
-static const struct nla_policy wimax_gnl_reset_policy[WIMAX_GNL_ATTR_MAX + 1] = {
-        [WIMAX_GNL_RESET_IFIDX] = {
-                .type = NLA_U32,
-        },
-};
 /*
 * Exporting to user space over generic netlink
 *
@@ -106,7 +99,6 @@ static const struct nla_policy wimax_gnl_reset_policy[WIMAX_GNL_ATTR_MAX + 1] =
 *
 * No attributes.
 */
-static
 int wimax_gnl_doit_reset(struct sk_buff *skb, struct genl_info *info)
 {
        int result, ifindex;
@@ -130,12 +122,3 @@ error_no_wimax_dev:
        d_fnend(3, NULL, "(skb %p info %p) = %d\n", skb, info, result);
        return result;
 }
-struct genl_ops wimax_gnl_reset = {
-        .cmd = WIMAX_GNL_OP_RESET,
-        .flags = GENL_ADMIN_PERM,
-        .policy = wimax_gnl_reset_policy,
-        .doit = wimax_gnl_doit_reset,
-        .dumpit = NULL,
-};
diff --git a/net/wimax/op-rfkill.c b/net/wimax/op-rfkill.c
index 7ab60babdd22..403078d670a9 100644
--- a/net/wimax/op-rfkill.c
+++ b/net/wimax/op-rfkill.c
@@ -411,17 +411,6 @@ void wimax_rfkill_rm(struct wimax_dev *wimax_dev)
 * just query).
 */
-static const struct nla_policy wimax_gnl_rfkill_policy[WIMAX_GNL_ATTR_MAX + 1] = {
-        [WIMAX_GNL_RFKILL_IFIDX] = {
-                .type = NLA_U32,
-        },
-        [WIMAX_GNL_RFKILL_STATE] = {
-                .type = NLA_U32         /* enum wimax_rf_state */
-        },
-};
-static
 int wimax_gnl_doit_rfkill(struct sk_buff *skb, struct genl_info *info)
 {
        int result, ifindex;
@@ -457,13 +446,3 @@ error_no_wimax_dev:
        d_fnend(3, NULL, "(skb %p info %p) = %d\n", skb, info, result);
        return result;
 }
-struct genl_ops wimax_gnl_rfkill = {
-        .cmd = WIMAX_GNL_OP_RFKILL,
-        .flags = GENL_ADMIN_PERM,
-        .policy = wimax_gnl_rfkill_policy,
-        .doit = wimax_gnl_doit_rfkill,
-        .dumpit = NULL,
-};
diff --git a/net/wimax/op-state-get.c b/net/wimax/op-state-get.c
index aff8776e2d41..995c08c827b5 100644
--- a/net/wimax/op-state-get.c
+++ b/net/wimax/op-state-get.c
@@ -33,13 +33,6 @@
 #include "debug-levels.h"
-static const struct nla_policy wimax_gnl_state_get_policy[WIMAX_GNL_ATTR_MAX + 1] = {
-        [WIMAX_GNL_STGET_IFIDX] = {
-                .type = NLA_U32,
-        },
-};
 /*
 * Exporting to user space over generic netlink
 *
@@ -48,7 +41,6 @@ static const struct nla_policy wimax_gnl_state_get_policy[WIMAX_GNL_ATTR_MAX + 1
 *
 * No attributes.
 */
-static
 int wimax_gnl_doit_state_get(struct sk_buff *skb, struct genl_info *info)
 {
        int result, ifindex;
@@ -72,12 +64,3 @@ error_no_wimax_dev:
        d_fnend(3, NULL, "(skb %p info %p) = %d\n", skb, info, result);
        return result;
 }
-struct genl_ops wimax_gnl_state_get = {
-        .cmd = WIMAX_GNL_OP_STATE_GET,
-        .flags = GENL_ADMIN_PERM,
-        .policy = wimax_gnl_state_get_policy,
-        .doit = wimax_gnl_doit_state_get,
-        .dumpit = NULL,
-};
diff --git a/net/wimax/stack.c b/net/wimax/stack.c
index a6470ac39498..ec8b577db135 100644
--- a/net/wimax/stack.c
+++ b/net/wimax/stack.c
@@ -116,8 +116,9 @@ struct sk_buff *wimax_gnl_re_state_change_alloc(
                dev_err(dev, "RE_STCH: can't create message\n");
                goto error_new;
        }
-        data = genlmsg_put(report_skb, 0, wimax_gnl_mcg.id, &wimax_gnl_family,
+        /* FIXME: sending a group ID as the seq is wrong */
-                           0, WIMAX_GNL_RE_STATE_CHANGE);
+        data = genlmsg_put(report_skb, 0, wimax_gnl_family.mcgrp_offset,
+                           &wimax_gnl_family, 0, WIMAX_GNL_RE_STATE_CHANGE);
        if (data == NULL) {
                dev_err(dev, "RE_STCH: can't put data into message\n");
                goto error_put;
@@ -177,7 +178,7 @@ int wimax_gnl_re_state_change_send(
                goto out;
        }
        genlmsg_end(report_skb, header);
-        genlmsg_multicast(report_skb, 0, wimax_gnl_mcg.id, GFP_KERNEL);
+        genlmsg_multicast(&wimax_gnl_family, report_skb, 0, 0, GFP_KERNEL);
 out:
        d_fnend(3, dev, "(wimax_dev %p report_skb %p) = %d\n",
                wimax_dev, report_skb, result);
@@ -402,22 +403,44 @@ void wimax_dev_init(struct wimax_dev *wimax_dev)
 }
 EXPORT_SYMBOL_GPL(wimax_dev_init);
-/*
+static const struct nla_policy wimax_gnl_policy[WIMAX_GNL_ATTR_MAX + 1] = {
- * This extern is declared here because it's easier to keep track --
+        [WIMAX_GNL_RESET_IFIDX] = { .type = NLA_U32, },
- * both declarations are a list of the same
+        [WIMAX_GNL_RFKILL_IFIDX] = { .type = NLA_U32, },
- */
+        [WIMAX_GNL_RFKILL_STATE] = {
-extern struct genl_ops
+                .type = NLA_U32         /* enum wimax_rf_state */
-        wimax_gnl_msg_from_user,
+        },
-        wimax_gnl_reset,
+        [WIMAX_GNL_STGET_IFIDX] = { .type = NLA_U32, },
-        wimax_gnl_rfkill,
+        [WIMAX_GNL_MSG_IFIDX] = { .type = NLA_U32, },
-        wimax_gnl_state_get;
+        [WIMAX_GNL_MSG_DATA] = {
+                .type = NLA_UNSPEC,     /* libnl doesn't grok BINARY yet */
+        },
+};
-static
+static const struct genl_ops wimax_gnl_ops[] = {
-struct genl_ops *wimax_gnl_ops[] = {
+        {
-        &wimax_gnl_msg_from_user,
+                .cmd = WIMAX_GNL_OP_MSG_FROM_USER,
-        &wimax_gnl_reset,
+                .flags = GENL_ADMIN_PERM,
-        &wimax_gnl_rfkill,
+                .policy = wimax_gnl_policy,
-        &wimax_gnl_state_get,
+                .doit = wimax_gnl_doit_msg_from_user,
+        },
+        {
+                .cmd = WIMAX_GNL_OP_RESET,
+                .flags = GENL_ADMIN_PERM,
+                .policy = wimax_gnl_policy,
+                .doit = wimax_gnl_doit_reset,
+        },
+        {
+                .cmd = WIMAX_GNL_OP_RFKILL,
+                .flags = GENL_ADMIN_PERM,
+                .policy = wimax_gnl_policy,
+                .doit = wimax_gnl_doit_rfkill,
+        },
+        {
+                .cmd = WIMAX_GNL_OP_STATE_GET,
+                .flags = GENL_ADMIN_PERM,
+                .policy = wimax_gnl_policy,
+                .doit = wimax_gnl_doit_state_get,
+        },
 };
@@ -557,8 +580,8 @@ struct genl_family wimax_gnl_family = {
        .maxattr = WIMAX_GNL_ATTR_MAX,
 };
-struct genl_multicast_group wimax_gnl_mcg = {
+static const struct genl_multicast_group wimax_gnl_mcgrps[] = {
-        .name = "msg",
+        { .name = "msg", },
 };
@@ -567,7 +590,7 @@ struct genl_multicast_group wimax_gnl_mcg = {
 static
 int __init wimax_subsys_init(void)
 {
-        int result, cnt;
+        int result;
        d_fnstart(4, NULL, "()\n");
        d_parse_params(D_LEVEL, D_LEVEL_SIZE, wimax_debug_params,
@@ -575,38 +598,18 @@ int __init wimax_subsys_init(void)
        snprintf(wimax_gnl_family.name, sizeof(wimax_gnl_family.name),
                 "WiMAX");
-        result = genl_register_family(&wimax_gnl_family);
+        result = genl_register_family_with_ops_groups(&wimax_gnl_family,
+                                                      wimax_gnl_ops,
+                                                      wimax_gnl_mcgrps);
        if (unlikely(result < 0)) {
                printk(KERN_ERR "cannot register generic netlink family: %d\n",
                       result);
                goto error_register_family;
        }
-        for (cnt = 0; cnt < ARRAY_SIZE(wimax_gnl_ops); cnt++) {
-                result = genl_register_ops(&wimax_gnl_family,
-                                           wimax_gnl_ops[cnt]);
-                d_printf(4, NULL, "registering generic netlink op code "
-                         "%u: %d\n", wimax_gnl_ops[cnt]->cmd, result);
-                if (unlikely(result < 0)) {
-                        printk(KERN_ERR "cannot register generic netlink op "
-                               "code %u: %d\n",
-                               wimax_gnl_ops[cnt]->cmd, result);
-                        goto error_register_ops;
-                }
-        }
-        result = genl_register_mc_group(&wimax_gnl_family, &wimax_gnl_mcg);
-        if (result < 0)
-                goto error_mc_group;
        d_fnend(4, NULL, "() = 0\n");
        return 0;
-error_mc_group:
-error_register_ops:
-        for (cnt--; cnt >= 0; cnt--)
-                genl_unregister_ops(&wimax_gnl_family,
-                                    wimax_gnl_ops[cnt]);
-        genl_unregister_family(&wimax_gnl_family);
 error_register_family:
        d_fnend(4, NULL, "() = %d\n", result);
        return result;
@@ -619,12 +622,7 @@ module_init(wimax_subsys_init);
 static
 void __exit wimax_subsys_exit(void)
 {
-        int cnt;
        wimax_id_table_release();
-        genl_unregister_mc_group(&wimax_gnl_family, &wimax_gnl_mcg);
-        for (cnt = ARRAY_SIZE(wimax_gnl_ops) - 1; cnt >= 0; cnt--)
-                genl_unregister_ops(&wimax_gnl_family,
-                                    wimax_gnl_ops[cnt]);
        genl_unregister_family(&wimax_gnl_family);
 }
 module_exit(wimax_subsys_exit);
diff --git a/net/wimax/wimax-internal.h b/net/wimax/wimax-internal.h
index 5dcd9c067bf0..b445b82020a8 100644
--- a/net/wimax/wimax-internal.h
+++ b/net/wimax/wimax-internal.h
@@ -84,8 +84,14 @@ void wimax_id_table_release(void);
 int wimax_rfkill_add(struct wimax_dev *);
 void wimax_rfkill_rm(struct wimax_dev *);
+/* generic netlink */
 extern struct genl_family wimax_gnl_family;
-extern struct genl_multicast_group wimax_gnl_mcg;
+/* ops */
+int wimax_gnl_doit_msg_from_user(struct sk_buff *skb, struct genl_info *info);
+int wimax_gnl_doit_reset(struct sk_buff *skb, struct genl_info *info);
+int wimax_gnl_doit_rfkill(struct sk_buff *skb, struct genl_info *info);
+int wimax_gnl_doit_state_get(struct sk_buff *skb, struct genl_info *info);
 #endif /* #ifdef __KERNEL__ */
 #endif /* #ifndef __WIMAX_INTERNAL_H__ */
diff --git a/net/wireless/core.c b/net/wireless/core.c
index aff959e5a1b3..52b865fb7351 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -451,6 +451,15 @@ int wiphy_register(struct wiphy *wiphy)
        int i;
        u16 ifmodes = wiphy->interface_modes;
+        /* support for 5/10 MHz is broken due to nl80211 API mess - disable */
+        wiphy->flags &= ~WIPHY_FLAG_SUPPORTS_5_10_MHZ;
+        /*
+         * There are major locking problems in nl80211/mac80211 for CSA,
+         * disable for all drivers until this has been reworked.
+         */
+        wiphy->flags &= ~WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 #ifdef CONFIG_PM
        if (WARN_ON(wiphy->wowlan &&
                    (wiphy->wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index 9d797df56649..89737ee2669a 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -262,7 +262,7 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
        /* try to find an IBSS channel if none requested ... */
        if (!wdev->wext.ibss.chandef.chan) {
-                wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                struct ieee80211_channel *new_chan = NULL;
                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                        struct ieee80211_supported_band *sband;
@@ -278,18 +278,19 @@ int cfg80211_ibss_wext_join(struct cfg80211_registered_device *rdev,
                                        continue;
                                if (chan->flags & IEEE80211_CHAN_DISABLED)
                                        continue;
-                                wdev->wext.ibss.chandef.chan = chan;
+                                new_chan = chan;
-                                wdev->wext.ibss.chandef.center_freq1 =
-                                        chan->center_freq;
                                break;
                        }
-                        if (wdev->wext.ibss.chandef.chan)
+                        if (new_chan)
                                break;
                }
-                if (!wdev->wext.ibss.chandef.chan)
+                if (!new_chan)
                        return -EINVAL;
+                cfg80211_chandef_create(&wdev->wext.ibss.chandef, new_chan,
+                                        NL80211_CHAN_NO_HT);
        }
        /* don't join -- SSID is not there */
@@ -363,9 +364,8 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                return err;
        if (chan) {
-                wdev->wext.ibss.chandef.chan = chan;
+                cfg80211_chandef_create(&wdev->wext.ibss.chandef, chan,
-                wdev->wext.ibss.chandef.width = NL80211_CHAN_WIDTH_20_NOHT;
+                                        NL80211_CHAN_NO_HT);
-                wdev->wext.ibss.chandef.center_freq1 = freq;
                wdev->wext.ibss.channel_fixed = true;
        } else {
                /* cfg80211_ibss_wext_join will pick one if needed */
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index a7f4e7902104..138dc3bb8b67 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -30,9 +30,9 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
                                   struct cfg80211_crypto_settings *settings,
                                   int cipher_limit);
-static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
+static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
                            struct genl_info *info);
-static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
+static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
                              struct genl_info *info);
 /* the netlink family */
@@ -47,6 +47,25 @@ static struct genl_family nl80211_fam = {
        .post_doit = nl80211_post_doit,
 };
+/* multicast groups */
+enum nl80211_multicast_groups {
+        NL80211_MCGRP_CONFIG,
+        NL80211_MCGRP_SCAN,
+        NL80211_MCGRP_REGULATORY,
+        NL80211_MCGRP_MLME,
+        NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
+};
+static const struct genl_multicast_group nl80211_mcgrps[] = {
+        [NL80211_MCGRP_CONFIG] = { .name = "config", },
+        [NL80211_MCGRP_SCAN] = { .name = "scan", },
+        [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
+        [NL80211_MCGRP_MLME] = { .name = "mlme", },
+#ifdef CONFIG_NL80211_TESTMODE
+        [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
+#endif
+};
 /* returns ERR_PTR values */
 static struct wireless_dev *
 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
@@ -2668,7 +2687,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                             NL80211_CMD_NEW_KEY);
        if (!hdr)
-                return -ENOBUFS;
+                goto nla_put_failure;
        cookie.msg = msg;
        cookie.idx = key_idx;
@@ -5330,6 +5349,10 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                                err = -EINVAL;
                                goto out_free;
                        }
+                        if (!wiphy->bands[band])
+                                continue;
                        err = ieee80211_get_ratemask(wiphy->bands[band],
                                                     nla_data(attr),
                                                     nla_len(attr),
@@ -6656,10 +6679,6 @@ static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
 #ifdef CONFIG_NL80211_TESTMODE
-static struct genl_multicast_group nl80211_testmode_mcgrp = {
-        .name = "testmode",
-};
 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
 {
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
@@ -6868,8 +6887,8 @@ void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
        nla_nest_end(skb, data);
        genlmsg_end(skb, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
-                                nl80211_testmode_mcgrp.id, gfp);
+                                NL80211_MCGRP_TESTMODE, gfp);
 }
 EXPORT_SYMBOL(cfg80211_testmode_event);
 #endif
@@ -8851,7 +8870,7 @@ static int nl80211_crit_protocol_stop(struct sk_buff *skb,
 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
                                         NL80211_FLAG_CHECK_NETDEV_UP)
-static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
+static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
                            struct genl_info *info)
 {
        struct cfg80211_registered_device *rdev;
@@ -8920,7 +8939,7 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
        return 0;
 }
-static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
+static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
                              struct genl_info *info)
 {
        if (info->user_ptr[1]) {
@@ -8937,7 +8956,7 @@ static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
                rtnl_unlock();
 }
-static struct genl_ops nl80211_ops[] = {
+static const struct genl_ops nl80211_ops[] = {
        {
                .cmd = NL80211_CMD_GET_WIPHY,
                .doit = nl80211_get_wiphy,
@@ -9566,21 +9585,6 @@ static struct genl_ops nl80211_ops[] = {
        },
 };
-static struct genl_multicast_group nl80211_mlme_mcgrp = {
-        .name = "mlme",
-};
-/* multicast groups */
-static struct genl_multicast_group nl80211_config_mcgrp = {
-        .name = "config",
-};
-static struct genl_multicast_group nl80211_scan_mcgrp = {
-        .name = "scan",
-};
-static struct genl_multicast_group nl80211_regulatory_mcgrp = {
-        .name = "regulatory",
-};
 /* notification functions */
 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
@@ -9597,8 +9601,8 @@ void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
                return;
        }
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_config_mcgrp.id, GFP_KERNEL);
+                                NL80211_MCGRP_CONFIG, GFP_KERNEL);
 }
 static int nl80211_add_scan_req(struct sk_buff *msg,
@@ -9633,8 +9637,9 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
            nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
                goto nla_put_failure;
-        if (req->flags)
+        if (req->flags &&
-                nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
+            nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
+                goto nla_put_failure;
        return 0;
 nla_put_failure:
@@ -9707,8 +9712,8 @@ void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
                return;
        }
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
@@ -9726,8 +9731,8 @@ void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
                return;
        }
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
@@ -9745,8 +9750,8 @@ void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
                return;
        }
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
@@ -9764,8 +9769,8 @@ void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
                return;
        }
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
@@ -9782,8 +9787,8 @@ void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
                return;
        }
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_scan_mcgrp.id, GFP_KERNEL);
+                                NL80211_MCGRP_SCAN, GFP_KERNEL);
 }
 /*
@@ -9837,8 +9842,8 @@ void nl80211_send_reg_change_event(struct regulatory_request *request)
        genlmsg_end(msg, hdr);
        rcu_read_lock();
-        genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
+        genlmsg_multicast_allns(&nl80211_fam, msg, 0,
-                                GFP_ATOMIC);
+                                NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
        rcu_read_unlock();
        return;
@@ -9873,8 +9878,8 @@ static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -9961,8 +9966,8 @@ static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10017,8 +10022,8 @@ void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10056,8 +10061,8 @@ void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10094,8 +10099,8 @@ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, GFP_KERNEL);
+                                NL80211_MCGRP_MLME, GFP_KERNEL);
        return;
 nla_put_failure:
@@ -10128,8 +10133,8 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10169,8 +10174,8 @@ void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10208,8 +10213,8 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10261,8 +10266,8 @@ void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
        genlmsg_end(msg, hdr);
        rcu_read_lock();
-        genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
+        genlmsg_multicast_allns(&nl80211_fam, msg, 0,
-                                GFP_ATOMIC);
+                                NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
        rcu_read_unlock();
        return;
@@ -10307,8 +10312,8 @@ static void nl80211_send_remain_on_chan_event(
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10362,8 +10367,8 @@ void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
                return;
        }
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
 }
 EXPORT_SYMBOL(cfg80211_new_sta);
@@ -10392,8 +10397,8 @@ void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10428,8 +10433,8 @@ void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10590,8 +10595,8 @@ void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10639,8 +10644,8 @@ void cfg80211_cqm_rssi_notify(struct net_device *dev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10684,8 +10689,8 @@ static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10742,8 +10747,8 @@ nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10789,8 +10794,8 @@ static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10866,8 +10871,8 @@ void cfg80211_cqm_txe_notify(struct net_device *dev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10915,8 +10920,8 @@ nl80211_radar_notify(struct cfg80211_registered_device *rdev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -10962,8 +10967,8 @@ void cfg80211_cqm_pktloss_notify(struct net_device *dev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -11002,8 +11007,8 @@ void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -11093,6 +11098,8 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
                struct nlattr *reasons;
                reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
+                if (!reasons)
+                        goto free_msg;
                if (wakeup->disconnect &&
                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
@@ -11118,16 +11125,18 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
                                wakeup->pattern_idx))
                        goto free_msg;
-                if (wakeup->tcp_match)
+                if (wakeup->tcp_match &&
-                        nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
+                        goto free_msg;
-                if (wakeup->tcp_connlost)
+                if (wakeup->tcp_connlost &&
-                        nla_put_flag(msg,
+                    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
-                                     NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
+                        goto free_msg;
-                if (wakeup->tcp_nomoretokens)
+                if (wakeup->tcp_nomoretokens &&
-                        nla_put_flag(msg,
+                    nla_put_flag(msg,
-                                NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
+                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
+                        goto free_msg;
                if (wakeup->packet) {
                        u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
@@ -11154,8 +11163,8 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 free_msg:
@@ -11196,8 +11205,8 @@ void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, gfp);
+                                NL80211_MCGRP_MLME, gfp);
        return;
 nla_put_failure:
@@ -11263,24 +11272,29 @@ void cfg80211_ft_event(struct net_device *netdev,
                return;
        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
-        if (!hdr) {
+        if (!hdr)
-                nlmsg_free(msg);
+                goto out;
-                return;
-        }
-        nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
-        nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
-        nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
-        if (ft_event->ies)
+                goto out;
-                nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
-        if (ft_event->ric_ies)
+        if (ft_event->ies &&
-                nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
+            nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
-                        ft_event->ric_ies);
+                goto out;
+        if (ft_event->ric_ies &&
+            nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
+                    ft_event->ric_ies))
+                goto out;
        genlmsg_end(msg, hdr);
-        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
-                                nl80211_mlme_mcgrp.id, GFP_KERNEL);
+                                NL80211_MCGRP_MLME, GFP_KERNEL);
+        return;
+ out:
+        nlmsg_free(msg);
 }
 EXPORT_SYMBOL(cfg80211_ft_event);
@@ -11329,33 +11343,11 @@ int nl80211_init(void)
 {
        int err;
-        err = genl_register_family_with_ops(&nl80211_fam,
+        err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
-                nl80211_ops, ARRAY_SIZE(nl80211_ops));
+                                                   nl80211_mcgrps);
        if (err)
                return err;
-        err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
-        if (err)
-                goto err_out;
-        err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
-        if (err)
-                goto err_out;
-        err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
-        if (err)
-                goto err_out;
-        err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
-        if (err)
-                goto err_out;
-#ifdef CONFIG_NL80211_TESTMODE
-        err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
-        if (err)
-                goto err_out;
-#endif
        err = netlink_register_notifier(&nl80211_netlink_notifier);
        if (err)
                goto err_out;
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 45a3ab5612c1..7622789d3750 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1340,10 +1340,9 @@ static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (sx25) {
                sx25->sx25_family = AF_X25;
                sx25->sx25_addr   = x25->dest_addr;
+                msg->msg_namelen = sizeof(*sx25);
        }
-        msg->msg_namelen = sizeof(struct sockaddr_x25);
        x25_check_rbuf(sk);
        rc = copied;
 out_free_dgram:
author	Ingo Molnar <mingo@kernel.org>	2013-12-19 07:56:10 -0500
committer	Ingo Molnar <mingo@kernel.org>	2013-12-19 07:56:10 -0500
commit	3331e924e7c5b98d245531b181551cb2a7380d0e (patch)
tree	25c4432afd79bedc1e8941415166a5cef0c168fb /net
parent	fd8526ad14c182605e42b64646344b95befd9f94 (diff)
parent	319e2e3f63c348a9b66db4667efa73178e18b17d (diff)