Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
	drivers/net/ethernet/cadence/macb.c

Overlapping changes in macb driver, mostly fixes and cleanups
in 'net' overlapping with the integration of at91_ether into
macb in 'net-next'.

Signed-off-by: David S. Miller <davem@davemloft.net>

17 files changed, 150 insertions, 85 deletions

diff --git a/net/can/af_can.c b/net/can/af_can.c
index 66e08040ced7..32d710eaf1fc 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -259,6 +259,9 @@ int can_send(struct sk_buff *skb, int loop)
                 goto inval_skb;
         }
 
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+        skb_reset_mac_header(skb);
         skb_reset_network_header(skb);
         skb_reset_transport_header(skb);
 
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 2c8d98e728c0..145a50c4d566 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -659,27 +659,30 @@ EXPORT_SYMBOL(ip_defrag);
 struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
 {
         struct iphdr iph;
+        int netoff;
         u32 len;
 
         if (skb->protocol != htons(ETH_P_IP))
                 return skb;
 
-        if (skb_copy_bits(skb, 0, &iph, sizeof(iph)) < 0)
+        netoff = skb_network_offset(skb);
+
+        if (skb_copy_bits(skb, netoff, &iph, sizeof(iph)) < 0)
                 return skb;
 
         if (iph.ihl < 5 || iph.version != 4)
                 return skb;
 
         len = ntohs(iph.tot_len);
-        if (skb->len < len || len < (iph.ihl * 4))
+        if (skb->len < netoff + len || len < (iph.ihl * 4))
                 return skb;
 
         if (ip_is_fragment(&iph)) {
                 skb = skb_share_check(skb, GFP_ATOMIC);
                 if (skb) {
-                        if (!pskb_may_pull(skb, iph.ihl*4))
+                        if (!pskb_may_pull(skb, netoff + iph.ihl * 4))
                                 return skb;
-                        if (pskb_trim_rcsum(skb, len))
+                        if (pskb_trim_rcsum(skb, netoff + len))
                                 return skb;
                         memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
                         if (ip_defrag(skb, user))
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 31d8c71986b4..5cd99271d3a6 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -432,17 +432,32 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
                 kfree_skb(skb);
 }
 
-static bool ipv4_pktinfo_prepare_errqueue(const struct sock *sk,
-                                          const struct sk_buff *skb,
-                                          int ee_origin)
+/* IPv4 supports cmsg on all imcp errors and some timestamps
+ *
+ * Timestamp code paths do not initialize the fields expected by cmsg:
+ * the PKTINFO fields in skb->cb[]. Fill those in here.
+ */
+static bool ipv4_datagram_support_cmsg(const struct sock *sk,
+                                       struct sk_buff *skb,
+                                       int ee_origin)
 {
-        struct in_pktinfo *info = PKTINFO_SKB_CB(skb);
+        struct in_pktinfo *info;
+
+        if (ee_origin == SO_EE_ORIGIN_ICMP)
+                return true;
 
-        if ((ee_origin != SO_EE_ORIGIN_TIMESTAMPING) ||
-            (!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG)) ||
+        if (ee_origin == SO_EE_ORIGIN_LOCAL)
+                return false;
+
+        /* Support IP_PKTINFO on tstamp packets if requested, to correlate
+         * timestamp with egress dev. Not possible for packets without dev
+         * or without payload (SOF_TIMESTAMPING_OPT_TSONLY).
+         */
+        if ((!(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_CMSG)) ||
             (!skb->dev))
                 return false;
 
+        info = PKTINFO_SKB_CB(skb);
         info->ipi_spec_dst.s_addr = ip_hdr(skb)->saddr;
         info->ipi_ifindex = skb->dev->ifindex;
         return true;
@@ -483,7 +498,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 
         serr = SKB_EXT_ERR(skb);
 
-        if (sin && skb->len) {
+        if (sin && serr->port) {
                 sin->sin_family = AF_INET;
                 sin->sin_addr.s_addr = *(__be32 *)(skb_network_header(skb) +
                                                    serr->addr_offset);
@@ -496,9 +511,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
         sin = &errhdr.offender;
         memset(sin, 0, sizeof(*sin));
 
-        if (skb->len &&
-            (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
-             ipv4_pktinfo_prepare_errqueue(sk, skb, serr->ee.ee_origin))) {
+        if (ipv4_datagram_support_cmsg(sk, skb, serr->ee.ee_origin)) {
                 sin->sin_family = AF_INET;
                 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
                 if (inet_sk(sk)->cmsg_flags)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 3648e7f32f3d..fd88f868776f 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -259,6 +259,9 @@ int ping_init_sock(struct sock *sk)
         kgid_t low, high;
         int ret = 0;
 
+        if (sk->sk_family == AF_INET6)
+                sk->sk_ipv6only = 1;
+
         inet_get_ping_group_range_net(net, &low, &high);
         if (gid_lte(low, group) && gid_lte(group, high))
                 return 0;
@@ -305,6 +308,11 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
                 if (addr_len < sizeof(*addr))
                         return -EINVAL;
 
+                if (addr->sin_family != AF_INET &&
+                    !(addr->sin_family == AF_UNSPEC &&
+                      addr->sin_addr.s_addr == htonl(INADDR_ANY)))
+                        return -EAFNOSUPPORT;
+
                 pr_debug("ping_check_bind_addr(sk=%p,addr=%pI4,port=%d)\n",
                          sk, &addr->sin_addr.s_addr, ntohs(addr->sin_port));
 
@@ -330,7 +338,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
                         return -EINVAL;
 
                 if (addr->sin6_family != AF_INET6)
-                        return -EINVAL;
+                        return -EAFNOSUPPORT;
 
                 pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n",
                          sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port));
@@ -715,7 +723,7 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                 if (msg->msg_namelen < sizeof(*usin))
                         return -EINVAL;
                 if (usin->sin_family != AF_INET)
-                        return -EINVAL;
+                        return -EAFNOSUPPORT;
                 daddr = usin->sin_addr.s_addr;
                 /* no remote port */
         } else {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index d939c35001f9..62f38428279a 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -835,17 +835,13 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
                                        int large_allowed)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        u32 new_size_goal, size_goal, hlen;
+        u32 new_size_goal, size_goal;
 
         if (!large_allowed || !sk_can_gso(sk))
                 return mss_now;
 
-        /* Maybe we should/could use sk->sk_prot->max_header here ? */
-        hlen = inet_csk(sk)->icsk_af_ops->net_header_len +
-               inet_csk(sk)->icsk_ext_hdr_len +
-               tp->tcp_header_len;
-
-        new_size_goal = sk->sk_gso_max_size - 1 - hlen;
+        /* Note : tcp_tso_autosize() will eventually split this later */
+        new_size_goal = sk->sk_gso_max_size - 1 - MAX_TCP_HEADER;
         new_size_goal = tcp_bound_to_half_wnd(tp, new_size_goal);
 
         /* We try hard to avoid divides here */
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index c215be70cac0..ace8daca5c83 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -325,14 +325,34 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
         kfree_skb(skb);
 }
 
-static void ip6_datagram_prepare_pktinfo_errqueue(struct sk_buff *skb)
+/* IPv6 supports cmsg on all origins aside from SO_EE_ORIGIN_LOCAL.
+ *
+ * At one point, excluding local errors was a quick test to identify icmp/icmp6
+ * errors. This is no longer true, but the test remained, so the v6 stack,
+ * unlike v4, also honors cmsg requests on all wifi and timestamp errors.
+ *
+ * Timestamp code paths do not initialize the fields expected by cmsg:
+ * the PKTINFO fields in skb->cb[]. Fill those in here.
+ */
+static bool ip6_datagram_support_cmsg(struct sk_buff *skb,
+                                      struct sock_exterr_skb *serr)
 {
-        int ifindex = skb->dev ? skb->dev->ifindex : -1;
+        if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP ||
+            serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6)
+                return true;
+
+        if (serr->ee.ee_origin == SO_EE_ORIGIN_LOCAL)
+                return false;
+
+        if (!skb->dev)
+                return false;
 
         if (skb->protocol == htons(ETH_P_IPV6))
-                IP6CB(skb)->iif = ifindex;
+                IP6CB(skb)->iif = skb->dev->ifindex;
         else
-                PKTINFO_SKB_CB(skb)->ipi_ifindex = ifindex;
+                PKTINFO_SKB_CB(skb)->ipi_ifindex = skb->dev->ifindex;
+
+        return true;
 }
 
 /*
@@ -369,7 +389,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 
         serr = SKB_EXT_ERR(skb);
 
-        if (sin && skb->len) {
+        if (sin && serr->port) {
                 const unsigned char *nh = skb_network_header(skb);
                 sin->sin6_family = AF_INET6;
                 sin->sin6_flowinfo = 0;
@@ -394,14 +414,11 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
         memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
         sin = &errhdr.offender;
         memset(sin, 0, sizeof(*sin));
-        if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL && skb->len) {
+
+        if (ip6_datagram_support_cmsg(skb, serr)) {
                 sin->sin6_family = AF_INET6;
-                if (np->rxopt.all) {
-                        if (serr->ee.ee_origin != SO_EE_ORIGIN_ICMP &&
-                            serr->ee.ee_origin != SO_EE_ORIGIN_ICMP6)
-                                ip6_datagram_prepare_pktinfo_errqueue(skb);
+                if (np->rxopt.all)
                         ip6_datagram_recv_common_ctl(sk, msg, skb);
-                }
                 if (skb->protocol == htons(ETH_P_IPV6)) {
                         sin->sin6_addr = ipv6_hdr(skb)->saddr;
                         if (np->rxopt.all)
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index fee25c0ed1f5..263a5164a6f5 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -101,9 +101,10 @@ int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 
         if (msg->msg_name) {
                 DECLARE_SOCKADDR(struct sockaddr_in6 *, u, msg->msg_name);
-                if (msg->msg_namelen < sizeof(struct sockaddr_in6) ||
-                    u->sin6_family != AF_INET6) {
+                if (msg->msg_namelen < sizeof(*u))
                         return -EINVAL;
+                if (u->sin6_family != AF_INET6) {
+                        return -EAFNOSUPPORT;
                 }
                 if (sk->sk_bound_dev_if &&
                     sk->sk_bound_dev_if != u->sin6_scope_id) {
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 9940a41efca1..683346d2d633 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -798,7 +798,9 @@ static void ircomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
         orig_jiffies = jiffies;
 
         /* Set poll time to 200 ms */
-        poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200));
+        poll_time = msecs_to_jiffies(200);
+        if (timeout)
+                poll_time = min_t(unsigned long, timeout, poll_time);
 
         spin_lock_irqsave(&self->spinlock, flags);
         while (self->tx_skb && self->tx_skb->len) {
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index f96229cdb6e1..08d95559b6f7 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -913,6 +913,8 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
                         IP_VS_DBG(2, "BACKUP, add new conn. failed\n");
                         return;
                 }
+                if (!(flags & IP_VS_CONN_F_TEMPLATE))
+                        kfree(param->pe_data);
         }
 
         if (opt)
@@ -1186,6 +1188,7 @@ static inline int ip_vs_proc_sync_conn(struct net *net, __u8 *p, __u8 *msg_end)
                                 (opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL)
                                 );
 #endif
+        ip_vs_pe_put(param.pe);
         return 0;
         /* Error exit */
 out:
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 284b20ce566b..ea51833c8f5a 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -227,7 +227,7 @@ nft_rule_deactivate_next(struct net *net, struct nft_rule *rule)
 
 static inline void nft_rule_clear(struct net *net, struct nft_rule *rule)
 {
-        rule->genmask = 0;
+        rule->genmask &= ~(1 << gencursor_next(net));
 }
 
 static int
@@ -1712,9 +1712,12 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
         }
         nla_nest_end(skb, list);
 
-        if (rule->ulen &&
-            nla_put(skb, NFTA_RULE_USERDATA, rule->ulen, nft_userdata(rule)))
-                goto nla_put_failure;
+        if (rule->udata) {
+                struct nft_userdata *udata = nft_userdata(rule);
+                if (nla_put(skb, NFTA_RULE_USERDATA, udata->len + 1,
+                            udata->data) < 0)
+                        goto nla_put_failure;
+        }
 
         nlmsg_end(skb, nlh);
         return 0;
@@ -1897,11 +1900,12 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
         struct nft_table *table;
         struct nft_chain *chain;
         struct nft_rule *rule, *old_rule = NULL;
+        struct nft_userdata *udata;
         struct nft_trans *trans = NULL;
         struct nft_expr *expr;
         struct nft_ctx ctx;
         struct nlattr *tmp;
-        unsigned int size, i, n, ulen = 0;
+        unsigned int size, i, n, ulen = 0, usize = 0;
         int err, rem;
         bool create;
         u64 handle, pos_handle;
@@ -1969,12 +1973,19 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
                         n++;
                 }
         }
+        /* Check for overflow of dlen field */
+        err = -EFBIG;
+        if (size >= 1 << 12)
+                goto err1;
 
-        if (nla[NFTA_RULE_USERDATA])
+        if (nla[NFTA_RULE_USERDATA]) {
                 ulen = nla_len(nla[NFTA_RULE_USERDATA]);
+                if (ulen > 0)
+                        usize = sizeof(struct nft_userdata) + ulen;
+        }
 
         err = -ENOMEM;
-        rule = kzalloc(sizeof(*rule) + size + ulen, GFP_KERNEL);
+        rule = kzalloc(sizeof(*rule) + size + usize, GFP_KERNEL);
         if (rule == NULL)
                 goto err1;
 
@@ -1982,10 +1993,13 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 
         rule->handle = handle;
         rule->dlen   = size;
-        rule->ulen   = ulen;
+        rule->udata  = ulen ? 1 : 0;
 
-        if (ulen)
-                nla_memcpy(nft_userdata(rule), nla[NFTA_RULE_USERDATA], ulen);
+        if (ulen) {
+                udata = nft_userdata(rule);
+                udata->len = ulen - 1;
+                nla_memcpy(udata->data, nla[NFTA_RULE_USERDATA], ulen);
+        }
 
         expr = nft_expr_first(rule);
         for (i = 0; i < n; i++) {
@@ -2032,12 +2046,6 @@ static int nf_tables_newrule(struct sock *nlsk, struct sk_buff *skb,
 
 err3:
         list_del_rcu(&rule->list);
-        if (trans) {
-                list_del_rcu(&nft_trans_rule(trans)->list);
-                nft_rule_clear(net, nft_trans_rule(trans));
-                nft_trans_destroy(trans);
-                chain->use++;
-        }
 err2:
         nf_tables_rule_destroy(&ctx, rule);
 err1:
@@ -3613,12 +3621,11 @@ static int nf_tables_commit(struct sk_buff *skb)
                                                  &te->elem,
                                                  NFT_MSG_DELSETELEM, 0);
                         te->set->ops->get(te->set, &te->elem);
-                        te->set->ops->remove(te->set, &te->elem);
                         nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
-                        if (te->elem.flags & NFT_SET_MAP) {
-                                nft_data_uninit(&te->elem.data,
-                                                te->set->dtype);
-                        }
+                        if (te->set->flags & NFT_SET_MAP &&
+                            !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
+                                nft_data_uninit(&te->elem.data, te->set->dtype);
+                        te->set->ops->remove(te->set, &te->elem);
                         nft_trans_destroy(trans);
                         break;
                 }
@@ -3659,7 +3666,7 @@ static int nf_tables_abort(struct sk_buff *skb)
 {
         struct net *net = sock_net(skb->sk);
         struct nft_trans *trans, *next;
-        struct nft_set *set;
+        struct nft_trans_elem *te;
 
         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
                 switch (trans->msg_type) {
@@ -3720,9 +3727,13 @@ static int nf_tables_abort(struct sk_buff *skb)
                         break;
                 case NFT_MSG_NEWSETELEM:
                         nft_trans_elem_set(trans)->nelems--;
-                        set = nft_trans_elem_set(trans);
-                        set->ops->get(set, &nft_trans_elem(trans));
-                        set->ops->remove(set, &nft_trans_elem(trans));
+                        te = (struct nft_trans_elem *)trans->data;
+                        te->set->ops->get(te->set, &te->elem);
+                        nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
+                        if (te->set->flags & NFT_SET_MAP &&
+                            !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
+                                nft_data_uninit(&te->elem.data, te->set->dtype);
+                        te->set->ops->remove(te->set, &te->elem);
                         nft_trans_destroy(trans);
                         break;
                 case NFT_MSG_DELSETELEM:
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 29fbcf25f88f..0b0fd4e36294 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -125,7 +125,7 @@ static void
 nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                            const struct nft_ctx *ctx,
                            struct xt_target *target, void *info,
-                           union nft_entry *entry, u8 proto, bool inv)
+                           union nft_entry *entry, u16 proto, bool inv)
 {
         par->net        = ctx->net;
         par->table      = ctx->table->name;
@@ -139,7 +139,7 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                 break;
         case NFPROTO_BRIDGE:
-                entry->ebt.ethproto = proto;
+                entry->ebt.ethproto = (__force __be16)proto;
                 entry->ebt.invflags = inv ? EBT_IPROTO : 0;
                 break;
         case NFPROTO_ARP:
@@ -175,7 +175,7 @@ static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1]
         [NFTA_RULE_COMPAT_FLAGS]        = { .type = NLA_U32 },
 };
 
-static int nft_parse_compat(const struct nlattr *attr, u8 *proto, bool *inv)
+static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv)
 {
         struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1];
         u32 flags;
@@ -207,7 +207,7 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         struct xt_target *target = expr->ops->data;
         struct xt_tgchk_param par;
         size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO]));
-        u8 proto = 0;
+        u16 proto = 0;
         bool inv = false;
         union nft_entry e = {};
         int ret;
@@ -338,7 +338,7 @@ static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = {
 static void
 nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                           struct xt_match *match, void *info,
-                          union nft_entry *entry, u8 proto, bool inv)
+                          union nft_entry *entry, u16 proto, bool inv)
 {
         par->net        = ctx->net;
         par->table      = ctx->table->name;
@@ -352,7 +352,7 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                 entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0;
                 break;
         case NFPROTO_BRIDGE:
-                entry->ebt.ethproto = proto;
+                entry->ebt.ethproto = (__force __be16)proto;
                 entry->ebt.invflags = inv ? EBT_IPROTO : 0;
                 break;
         case NFPROTO_ARP:
@@ -391,7 +391,7 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         struct xt_match *match = expr->ops->data;
         struct xt_mtchk_param par;
         size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO]));
-        u8 proto = 0;
+        u16 proto = 0;
         bool inv = false;
         union nft_entry e = {};
         int ret;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 8167aecc1594..b91ac5946ad1 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3139,11 +3139,18 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
         return 0;
 }
 
-static void packet_dev_mclist(struct net_device *dev, struct packet_mclist *i, int what)
+static void packet_dev_mclist_delete(struct net_device *dev,
+                                     struct packet_mclist **mlp)
 {
-        for ( ; i; i = i->next) {
-                if (i->ifindex == dev->ifindex)
-                        packet_dev_mc(dev, i, what);
+        struct packet_mclist *ml;
+
+        while ((ml = *mlp) != NULL) {
+                if (ml->ifindex == dev->ifindex) {
+                        packet_dev_mc(dev, ml, -1);
+                        *mlp = ml->next;
+                        kfree(ml);
+                } else
+                        mlp = &ml->next;
         }
 }
 
@@ -3220,12 +3227,11 @@ static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
                                         packet_dev_mc(dev, ml, -1);
                                 kfree(ml);
                         }
-                        rtnl_unlock();
-                        return 0;
+                        break;
                 }
         }
         rtnl_unlock();
-        return -EADDRNOTAVAIL;
+        return 0;
 }
 
 static void packet_flush_mclist(struct sock *sk)
@@ -3575,7 +3581,7 @@ static int packet_notifier(struct notifier_block *this,
                 switch (msg) {
                 case NETDEV_UNREGISTER:
                         if (po->mclist)
-                                packet_dev_mclist(dev, po->mclist, -1);
+                                packet_dev_mclist_delete(dev, &po->mclist);
                         /* fallthrough */
 
                 case NETDEV_DOWN:
diff --git a/net/rxrpc/ar-error.c b/net/rxrpc/ar-error.c
index 5394b6be46ec..0610efa83d72 100644
--- a/net/rxrpc/ar-error.c
+++ b/net/rxrpc/ar-error.c
@@ -42,7 +42,8 @@ void rxrpc_UDP_error_report(struct sock *sk)
                 _leave("UDP socket errqueue empty");
                 return;
         }
-        if (!skb->len) {
+        serr = SKB_EXT_ERR(skb);
+        if (!skb->len && serr->ee.ee_origin == SO_EE_ORIGIN_TIMESTAMPING) {
                 _leave("UDP empty message");
                 kfree_skb(skb);
                 return;
@@ -50,7 +51,6 @@ void rxrpc_UDP_error_report(struct sock *sk)
 
         rxrpc_new_skb(skb);
 
-        serr = SKB_EXT_ERR(skb);
         addr = *(__be32 *)(skb_network_header(skb) + serr->addr_offset);
         port = serr->port;
 
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 33fb105d4352..5199bb1a017e 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -921,7 +921,7 @@ static unsigned int cache_poll(struct file *filp, poll_table *wait,
         poll_wait(filp, &queue_wait, wait);
 
         /* alway allow write */
-        mask = POLL_OUT | POLLWRNORM;
+        mask = POLLOUT | POLLWRNORM;
 
         if (!rp)
                 return mask;
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 7e9acd9361c5..91ffde82fa0c 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -738,8 +738,9 @@ rpcrdma_reply_handler(struct rpcrdma_rep *rep)
         struct rpc_xprt *xprt = rep->rr_xprt;
         struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt);
         __be32 *iptr;
-        int credits, rdmalen, status;
+        int rdmalen, status;
         unsigned long cwnd;
+        u32 credits;
 
         /* Check status. If bad, signal disconnect and return rep to pool */
         if (rep->rr_len == ~0U) {
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index d1b70397c60f..0a16fb6f0885 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -285,7 +285,7 @@ rpcr_to_rdmar(struct rpc_rqst *rqst)
  */
 struct rpcrdma_buffer {
         spinlock_t      rb_lock;        /* protects indexes */
-        int             rb_max_requests;/* client max requests */
+        u32             rb_max_requests;/* client max requests */
         struct list_head rb_mws;        /* optional memory windows/fmrs/frmrs */
         struct list_head rb_all;
         int             rb_send_index;
diff --git a/net/tipc/link.c b/net/tipc/link.c
index a4cf364316de..14f09b3cb87c 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -464,10 +464,11 @@ void tipc_link_reset(struct tipc_link *l_ptr)
         /* Clean up all queues, except inputq: */
         __skb_queue_purge(&l_ptr->outqueue);
         __skb_queue_purge(&l_ptr->deferred_queue);
-        skb_queue_splice_init(&l_ptr->wakeupq, &l_ptr->inputq);
-        if (!skb_queue_empty(&l_ptr->inputq))
+        if (!owner->inputq)
+                owner->inputq = &l_ptr->inputq;
+        skb_queue_splice_init(&l_ptr->wakeupq, owner->inputq);
+        if (!skb_queue_empty(owner->inputq))
                 owner->action_flags |= TIPC_MSG_EVT;
-        owner->inputq = &l_ptr->inputq;
         l_ptr->next_out = NULL;
         l_ptr->unacked_window = 0;
         l_ptr->checkpoint = 1;