31 files changed, 217 insertions, 134 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 37054306dc9f..8fd05d4e3b0a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2098,7 +2098,7 @@ S:	Supported
 F:      drivers/scsi/bfa/
 
 BROCADE BNA 10 GIGABIT ETHERNET DRIVER
-M:      Rasesh Mody <rmody@brocade.com>
+M:      Rasesh Mody <rasesh.mody@qlogic.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/brocade/bna/
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 2fee73b878c2..823d01c5684c 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -3236,8 +3236,9 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
 
                 skb->protocol = eth_type_trans(skb, bp->dev);
 
-                if ((len > (bp->dev->mtu + ETH_HLEN)) &&
-                        (ntohs(skb->protocol) != 0x8100)) {
+                if (len > (bp->dev->mtu + ETH_HLEN) &&
+                    skb->protocol != htons(0x8100) &&
+                    skb->protocol != htons(ETH_P_8021AD)) {
 
                         dev_kfree_skb(skb);
                         goto next_rx;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index e7d3a620d96a..ba499489969a 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -6918,7 +6918,8 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                 skb->protocol = eth_type_trans(skb, tp->dev);
 
                 if (len > (tp->dev->mtu + ETH_HLEN) &&
-                    skb->protocol != htons(ETH_P_8021Q)) {
+                    skb->protocol != htons(ETH_P_8021Q) &&
+                    skb->protocol != htons(ETH_P_8021AD)) {
                         dev_kfree_skb_any(skb);
                         goto drop_it_no_recycle;
                 }
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index ca5d7798b265..e1e02fba4fcc 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -30,7 +30,6 @@
 #include <linux/of_device.h>
 #include <linux/of_mdio.h>
 #include <linux/of_net.h>
-#include <linux/pinctrl/consumer.h>
 
 #include "macb.h"
 
@@ -2071,7 +2070,6 @@ static int __init macb_probe(struct platform_device *pdev)
         struct phy_device *phydev;
         u32 config;
         int err = -ENXIO;
-        struct pinctrl *pinctrl;
         const char *mac;
 
         regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -2080,15 +2078,6 @@ static int __init macb_probe(struct platform_device *pdev)
                 goto err_out;
         }
 
-        pinctrl = devm_pinctrl_get_select_default(&pdev->dev);
-        if (IS_ERR(pinctrl)) {
-                err = PTR_ERR(pinctrl);
-                if (err == -EPROBE_DEFER)
-                        goto err_out;
-
-                dev_warn(&pdev->dev, "No pinctrl provided\n");
-        }
-
         err = -ENOMEM;
         dev = alloc_etherdev(sizeof(*bp));
         if (!dev)
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 7e2d5d57c598..871e3a5bda38 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -78,13 +78,13 @@ MODULE_PARM_DESC(msi_x, "attempt to use MSI-X if nonzero");
 #endif /* CONFIG_PCI_MSI */
 
 static uint8_t num_vfs[3] = {0, 0, 0};
-static int num_vfs_argc = 3;
+static int num_vfs_argc;
 module_param_array(num_vfs, byte , &num_vfs_argc, 0444);
 MODULE_PARM_DESC(num_vfs, "enable #num_vfs functions if num_vfs > 0\n"
                           "num_vfs=port1,port2,port1+2");
 
 static uint8_t probe_vf[3] = {0, 0, 0};
-static int probe_vfs_argc = 3;
+static int probe_vfs_argc;
 module_param_array(probe_vf, byte, &probe_vfs_argc, 0444);
 MODULE_PARM_DESC(probe_vf, "number of vfs to probe by pf driver (num_vfs > 0)\n"
                            "probe_vf=port1,port2,port1+2");
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
index 32058614151a..5c4068353f66 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
@@ -135,6 +135,7 @@ void netxen_release_tx_buffers(struct netxen_adapter *adapter)
         int i, j;
         struct nx_host_tx_ring *tx_ring = adapter->tx_ring;
 
+        spin_lock(&adapter->tx_clean_lock);
         cmd_buf = tx_ring->cmd_buf_arr;
         for (i = 0; i < tx_ring->num_desc; i++) {
                 buffrag = cmd_buf->frag_array;
@@ -158,6 +159,7 @@ void netxen_release_tx_buffers(struct netxen_adapter *adapter)
                 }
                 cmd_buf++;
         }
+        spin_unlock(&adapter->tx_clean_lock);
 }
 
 void netxen_free_sw_resources(struct netxen_adapter *adapter)
@@ -1792,9 +1794,9 @@ int netxen_process_cmd_ring(struct netxen_adapter *adapter)
                         break;
         }
 
-        if (count && netif_running(netdev)) {
-                tx_ring->sw_consumer = sw_consumer;
+        tx_ring->sw_consumer = sw_consumer;
 
+        if (count && netif_running(netdev)) {
                 smp_mb();
 
                 if (netif_queue_stopped(netdev) && netif_carrier_ok(netdev))
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 1159031f885b..5ec5a2b0e989 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -1186,7 +1186,6 @@ __netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
                 return;
 
         smp_mb();
-        spin_lock(&adapter->tx_clean_lock);
         netif_carrier_off(netdev);
         netif_tx_disable(netdev);
 
@@ -1204,7 +1203,6 @@ __netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
         netxen_napi_disable(adapter);
 
         netxen_release_tx_buffers(adapter);
-        spin_unlock(&adapter->tx_clean_lock);
 }
 
 /* Usage: During suspend and firmware recovery module */
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
index 86783e1afcf7..3172cdf591fe 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -1177,9 +1177,8 @@ static void qlcnic_83xx_setup_idc_parameters(struct qlcnic_adapter *adapter)
 {
         u32 idc_params, val;
 
-        if (qlcnic_83xx_lockless_flash_read32(adapter,
-                                              QLC_83XX_IDC_FLASH_PARAM_ADDR,
-                                              (u8 *)&idc_params, 1)) {
+        if (qlcnic_83xx_flash_read32(adapter, QLC_83XX_IDC_FLASH_PARAM_ADDR,
+                                     (u8 *)&idc_params, 1)) {
                 dev_info(&adapter->pdev->dev,
                          "%s:failed to get IDC params from flash\n", __func__);
                 adapter->dev_init_timeo = QLC_83XX_IDC_INIT_TIMEOUT_SECS;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 141f116eb868..494e8105adee 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -1333,21 +1333,21 @@ static void qlcnic_get_ethtool_stats(struct net_device *dev,
         struct qlcnic_host_tx_ring *tx_ring;
         struct qlcnic_esw_statistics port_stats;
         struct qlcnic_mac_statistics mac_stats;
-        int index, ret, length, size, tx_size, ring;
+        int index, ret, length, size, ring;
         char *p;
 
-        tx_size = adapter->drv_tx_rings * QLCNIC_TX_STATS_LEN;
+        memset(data, 0, stats->n_stats * sizeof(u64));
 
-        memset(data, 0, tx_size * sizeof(u64));
         for (ring = 0, index = 0; ring < adapter->drv_tx_rings; ring++) {
-                if (test_bit(__QLCNIC_DEV_UP, &adapter->state)) {
+                if (adapter->is_up == QLCNIC_ADAPTER_UP_MAGIC) {
                         tx_ring = &adapter->tx_ring[ring];
                         data = qlcnic_fill_tx_queue_stats(data, tx_ring);
                         qlcnic_update_stats(adapter);
+                } else {
+                        data += QLCNIC_TX_STATS_LEN;
                 }
         }
 
-        memset(data, 0, stats->n_stats * sizeof(u64));
         length = QLCNIC_STATS_LEN;
         for (index = 0; index < length; index++) {
                 p = (char *)adapter + qlcnic_gstrings_stats[index].stat_offset;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 6e6ee226de04..b0c1521e08a3 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2786,8 +2786,15 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
         if (IS_ERR(priv->stmmac_clk)) {
                 dev_warn(priv->device, "%s: warning: cannot get CSR clock\n",
                          __func__);
-                ret = PTR_ERR(priv->stmmac_clk);
-                goto error_clk_get;
+                /* If failed to obtain stmmac_clk and specific clk_csr value
+                 * is NOT passed from the platform, probe fail.
+                 */
+                if (!priv->plat->clk_csr) {
+                        ret = PTR_ERR(priv->stmmac_clk);
+                        goto error_clk_get;
+                } else {
+                        priv->stmmac_clk = NULL;
+                }
         }
         clk_prepare_enable(priv->stmmac_clk);
 
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index a9c5eaadc426..0fcb5e7eb073 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -387,6 +387,7 @@ static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net)
         int  hdr_offset;
         u32 net_trans_info;
         u32 hash;
+        u32 skb_length = skb->len;
 
 
         /* We will atmost need two pages to describe the rndis
@@ -562,7 +563,7 @@ do_send:
 
 drop:
         if (ret == 0) {
-                net->stats.tx_bytes += skb->len;
+                net->stats.tx_bytes += skb_length;
                 net->stats.tx_packets++;
         } else {
                 kfree(packet);
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 3381c4f91a8c..0c6adaaf898c 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -112,17 +112,15 @@ out:
         return err;
 }
 
+/* Requires RTNL */
 static int macvtap_set_queue(struct net_device *dev, struct file *file,
                              struct macvtap_queue *q)
 {
         struct macvlan_dev *vlan = netdev_priv(dev);
-        int err = -EBUSY;
 
-        rtnl_lock();
         if (vlan->numqueues == MAX_MACVTAP_QUEUES)
-                goto out;
+                return -EBUSY;
 
-        err = 0;
         rcu_assign_pointer(q->vlan, vlan);
         rcu_assign_pointer(vlan->taps[vlan->numvtaps], q);
         sock_hold(&q->sk);
@@ -136,9 +134,7 @@ static int macvtap_set_queue(struct net_device *dev, struct file *file,
         vlan->numvtaps++;
         vlan->numqueues++;
 
-out:
-        rtnl_unlock();
-        return err;
+        return 0;
 }
 
 static int macvtap_disable_queue(struct macvtap_queue *q)
@@ -454,11 +450,12 @@ static void macvtap_sock_destruct(struct sock *sk)
 static int macvtap_open(struct inode *inode, struct file *file)
 {
         struct net *net = current->nsproxy->net_ns;
-        struct net_device *dev = dev_get_by_macvtap_minor(iminor(inode));
+        struct net_device *dev;
         struct macvtap_queue *q;
-        int err;
+        int err = -ENODEV;
 
-        err = -ENODEV;
+        rtnl_lock();
+        dev = dev_get_by_macvtap_minor(iminor(inode));
         if (!dev)
                 goto out;
 
@@ -498,6 +495,7 @@ out:
         if (dev)
                 dev_put(dev);
 
+        rtnl_unlock();
         return err;
 }
 
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 74760e8143e3..604ef210a4de 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -24,7 +24,7 @@
 #include <net/ip6_checksum.h>
 
 /* Version Information */
-#define DRIVER_VERSION "v1.06.0 (2014/03/03)"
+#define DRIVER_VERSION "v1.06.1 (2014/10/01)"
 #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
 #define DRIVER_DESC "Realtek RTL8152/RTL8153 Based USB Ethernet Adapters"
 #define MODULENAME "r8152"
@@ -1949,10 +1949,34 @@ static void rxdy_gated_en(struct r8152 *tp, bool enable)
         ocp_write_word(tp, MCU_TYPE_PLA, PLA_MISC_1, ocp_data);
 }
 
+static int rtl_start_rx(struct r8152 *tp)
+{
+        int i, ret = 0;
+
+        INIT_LIST_HEAD(&tp->rx_done);
+        for (i = 0; i < RTL8152_MAX_RX; i++) {
+                INIT_LIST_HEAD(&tp->rx_info[i].list);
+                ret = r8152_submit_rx(tp, &tp->rx_info[i], GFP_KERNEL);
+                if (ret)
+                        break;
+        }
+
+        return ret;
+}
+
+static int rtl_stop_rx(struct r8152 *tp)
+{
+        int i;
+
+        for (i = 0; i < RTL8152_MAX_RX; i++)
+                usb_kill_urb(tp->rx_info[i].urb);
+
+        return 0;
+}
+
 static int rtl_enable(struct r8152 *tp)
 {
         u32 ocp_data;
-        int i, ret;
 
         r8152b_reset_packet_filter(tp);
 
@@ -1962,14 +1986,7 @@ static int rtl_enable(struct r8152 *tp)
 
         rxdy_gated_en(tp, false);
 
-        INIT_LIST_HEAD(&tp->rx_done);
-        ret = 0;
-        for (i = 0; i < RTL8152_MAX_RX; i++) {
-                INIT_LIST_HEAD(&tp->rx_info[i].list);
-                ret |= r8152_submit_rx(tp, &tp->rx_info[i], GFP_KERNEL);
-        }
-
-        return ret;
+        return rtl_start_rx(tp);
 }
 
 static int rtl8152_enable(struct r8152 *tp)
@@ -2053,8 +2070,7 @@ static void rtl_disable(struct r8152 *tp)
                 mdelay(1);
         }
 
-        for (i = 0; i < RTL8152_MAX_RX; i++)
-                usb_kill_urb(tp->rx_info[i].urb);
+        rtl_stop_rx(tp);
 
         rtl8152_nic_reset(tp);
 }
@@ -2185,28 +2201,6 @@ static void rtl_phy_reset(struct r8152 *tp)
         }
 }
 
-static void rtl_clear_bp(struct r8152 *tp)
-{
-        ocp_write_dword(tp, MCU_TYPE_PLA, PLA_BP_0, 0);
-        ocp_write_dword(tp, MCU_TYPE_PLA, PLA_BP_2, 0);
-        ocp_write_dword(tp, MCU_TYPE_PLA, PLA_BP_4, 0);
-        ocp_write_dword(tp, MCU_TYPE_PLA, PLA_BP_6, 0);
-        ocp_write_dword(tp, MCU_TYPE_USB, USB_BP_0, 0);
-        ocp_write_dword(tp, MCU_TYPE_USB, USB_BP_2, 0);
-        ocp_write_dword(tp, MCU_TYPE_USB, USB_BP_4, 0);
-        ocp_write_dword(tp, MCU_TYPE_USB, USB_BP_6, 0);
-        mdelay(3);
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_BP_BA, 0);
-        ocp_write_word(tp, MCU_TYPE_USB, USB_BP_BA, 0);
-}
-
-static void r8153_clear_bp(struct r8152 *tp)
-{
-        ocp_write_byte(tp, MCU_TYPE_PLA, PLA_BP_EN, 0);
-        ocp_write_byte(tp, MCU_TYPE_USB, USB_BP_EN, 0);
-        rtl_clear_bp(tp);
-}
-
 static void r8153_teredo_off(struct r8152 *tp)
 {
         u32 ocp_data;
@@ -2249,8 +2243,6 @@ static void r8152b_hw_phy_cfg(struct r8152 *tp)
                 r8152_mdio_write(tp, MII_BMCR, data);
         }
 
-        rtl_clear_bp(tp);
-
         set_bit(PHY_RESET, &tp->flags);
 }
 
@@ -2401,8 +2393,6 @@ static void r8153_hw_phy_cfg(struct r8152 *tp)
                 r8152_mdio_write(tp, MII_BMCR, data);
         }
 
-        r8153_clear_bp(tp);
-
         if (tp->version == RTL_VER_03) {
                 data = ocp_reg_read(tp, OCP_EEE_CFG);
                 data &= ~CTAP_SHORT_EN;
@@ -3083,13 +3073,14 @@ static int rtl8152_suspend(struct usb_interface *intf, pm_message_t message)
                 clear_bit(WORK_ENABLE, &tp->flags);
                 usb_kill_urb(tp->intr_urb);
                 cancel_delayed_work_sync(&tp->schedule);
+                tasklet_disable(&tp->tl);
                 if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
+                        rtl_stop_rx(tp);
                         rtl_runtime_suspend_enable(tp, true);
                 } else {
-                        tasklet_disable(&tp->tl);
                         tp->rtl_ops.down(tp);
-                        tasklet_enable(&tp->tl);
                 }
+                tasklet_enable(&tp->tl);
         }
 
         return 0;
@@ -3108,17 +3099,18 @@ static int rtl8152_resume(struct usb_interface *intf)
                 if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
                         rtl_runtime_suspend_enable(tp, false);
                         clear_bit(SELECTIVE_SUSPEND, &tp->flags);
+                        set_bit(WORK_ENABLE, &tp->flags);
                         if (tp->speed & LINK_STATUS)
-                                tp->rtl_ops.disable(tp);
+                                rtl_start_rx(tp);
                 } else {
                         tp->rtl_ops.up(tp);
                         rtl8152_set_speed(tp, AUTONEG_ENABLE,
                                 tp->mii.supports_gmii ? SPEED_1000 : SPEED_100,
                                 DUPLEX_FULL);
+                        tp->speed = 0;
+                        netif_carrier_off(tp->netdev);
+                        set_bit(WORK_ENABLE, &tp->flags);
                 }
-                tp->speed = 0;
-                netif_carrier_off(tp->netdev);
-                set_bit(WORK_ENABLE, &tp->flags);
                 usb_submit_urb(tp->intr_urb, GFP_KERNEL);
         }
 
@@ -3405,7 +3397,7 @@ static void rtl8153_unload(struct r8152 *tp)
         if (test_bit(RTL8152_UNPLUG, &tp->flags))
                 return;
 
-        r8153_power_cut_en(tp, true);
+        r8153_power_cut_en(tp, false);
 }
 
 static int rtl_ops_init(struct r8152 *tp, const struct usb_device_id *id)
@@ -3558,7 +3550,11 @@ static void rtl8152_disconnect(struct usb_interface *intf)
 
         usb_set_intfdata(intf, NULL);
         if (tp) {
-                set_bit(RTL8152_UNPLUG, &tp->flags);
+                struct usb_device *udev = tp->udev;
+
+                if (udev->state == USB_STATE_NOTATTACHED)
+                        set_bit(RTL8152_UNPLUG, &tp->flags);
+
                 tasklet_kill(&tp->tl);
                 unregister_netdev(tp->netdev);
                 tp->rtl_ops.unload(tp);
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 9bcb220bd4ad..cf485f9aa563 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -114,16 +114,13 @@ struct rt6_info {
         u32                             rt6i_flags;
         struct rt6key                   rt6i_src;
         struct rt6key                   rt6i_prefsrc;
-        u32                             rt6i_metric;
 
         struct inet6_dev                *rt6i_idev;
         unsigned long                   _rt6i_peer;
 
-        u32                             rt6i_genid;
-
+        u32                             rt6i_metric;
         /* more non-fragment space at head required */
         unsigned short                  rt6i_nfheader_len;
-
         u8                              rt6i_protocol;
 };
 
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 361d26077196..e0d64667a4b3 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -352,26 +352,12 @@ static inline void rt_genid_bump_ipv4(struct net *net)
         atomic_inc(&net->ipv4.rt_genid);
 }
 
-#if IS_ENABLED(CONFIG_IPV6)
-static inline int rt_genid_ipv6(struct net *net)
-{
-        return atomic_read(&net->ipv6.rt_genid);
-}
-
-static inline void rt_genid_bump_ipv6(struct net *net)
-{
-        atomic_inc(&net->ipv6.rt_genid);
-}
-#else
-static inline int rt_genid_ipv6(struct net *net)
-{
-        return 0;
-}
-
+extern void (*__fib6_flush_trees)(struct net *net);
 static inline void rt_genid_bump_ipv6(struct net *net)
 {
+        if (__fib6_flush_trees)
+                __fib6_flush_trees(net);
 }
-#endif
 
 #if IS_ENABLED(CONFIG_IEEE802154_6LOWPAN)
 static inline struct netns_ieee802154_lowpan *
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 7b36e4d40ed7..16d02639d334 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -588,13 +588,13 @@ EXPORT_SYMBOL_GPL(rhashtable_init);
  * rhashtable_destroy - destroy hash table
  * @ht:         the hash table to destroy
  *
- * Frees the bucket array.
+ * Frees the bucket array. This function is not rcu safe, therefore the caller
+ * has to make sure that no resizing may happen by unpublishing the hashtable
+ * and waiting for the quiescent cycle before releasing the bucket array.
  */
 void rhashtable_destroy(const struct rhashtable *ht)
 {
-        const struct bucket_table *tbl = rht_dereference(ht->tbl, ht);
-
-        bucket_table_free(tbl);
+        bucket_table_free(ht->tbl);
 }
 EXPORT_SYMBOL_GPL(rhashtable_destroy);
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index da1378a3e2c7..8d289697cc7a 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3152,6 +3152,9 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
                 NAPI_GRO_CB(skb)->free = NAPI_GRO_FREE_STOLEN_HEAD;
                 goto done;
         }
+        /* switch back to head shinfo */
+        pinfo = skb_shinfo(p);
+
         if (pinfo->frag_list)
                 goto merge;
         if (skb_gro_len(p) != pinfo->gso_size)
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index bd41dd1948b6..bda4bb8ae260 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -764,9 +764,14 @@ int ip_tunnel_ioctl(struct net_device *dev, struct ip_tunnel_parm *p, int cmd)
 
                 t = ip_tunnel_find(itn, p, itn->fb_tunnel_dev->type);
 
-                if (!t && (cmd == SIOCADDTUNNEL)) {
-                        t = ip_tunnel_create(net, itn, p);
-                        err = PTR_ERR_OR_ZERO(t);
+                if (cmd == SIOCADDTUNNEL) {
+                        if (!t) {
+                                t = ip_tunnel_create(net, itn, p);
+                                err = PTR_ERR_OR_ZERO(t);
+                                break;
+                        }
+
+                        err = -EEXIST;
                         break;
                 }
                 if (dev != itn->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 173e7ea54c70..cbadb942c332 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -746,7 +746,7 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow
         }
 
         n = ipv4_neigh_lookup(&rt->dst, NULL, &new_gw);
-        if (n) {
+        if (!IS_ERR(n)) {
                 if (!(n->nud_state & NUD_VALID)) {
                         neigh_event_send(n, NULL);
                 } else {
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3342ee64f2e3..3e118dfddd02 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4780,10 +4780,11 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 
                 if (ip6_del_rt(ifp->rt))
                         dst_free(&ifp->rt->dst);
+
+                rt_genid_bump_ipv6(net);
                 break;
         }
         atomic_inc(&net->ipv6.dev_addr_genid);
-        rt_genid_bump_ipv6(net);
 }
 
 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index e6960457f625..98cc4cd570e2 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -8,6 +8,13 @@
 #include <net/addrconf.h>
 #include <net/ip.h>
 
+/* if ipv6 module registers this function is used by xfrm to force all
+ * sockets to relookup their nodes - this is fairly expensive, be
+ * careful
+ */
+void (*__fib6_flush_trees)(struct net *);
+EXPORT_SYMBOL(__fib6_flush_trees);
+
 #define IPV6_ADDR_SCOPE_TYPE(scope)     ((scope) << 16)
 
 static inline unsigned int ipv6_addr_scope2type(unsigned int scope)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 76b7f5ee8f4c..97b9fa8de377 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1605,6 +1605,24 @@ static void fib6_prune_clones(struct net *net, struct fib6_node *fn)
         fib6_clean_tree(net, fn, fib6_prune_clone, 1, NULL);
 }
 
+static int fib6_update_sernum(struct rt6_info *rt, void *arg)
+{
+        __u32 sernum = *(__u32 *)arg;
+
+        if (rt->rt6i_node &&
+            rt->rt6i_node->fn_sernum != sernum)
+                rt->rt6i_node->fn_sernum = sernum;
+
+        return 0;
+}
+
+static void fib6_flush_trees(struct net *net)
+{
+        __u32 new_sernum = fib6_new_sernum();
+
+        fib6_clean_all(net, fib6_update_sernum, &new_sernum);
+}
+
 /*
  *      Garbage collection
  */
@@ -1788,6 +1806,8 @@ int __init fib6_init(void)
                               NULL);
         if (ret)
                 goto out_unregister_subsys;
+
+        __fib6_flush_trees = fib6_flush_trees;
 out:
         return ret;
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 5f19dfbc4c6a..f304471477dc 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -314,6 +314,8 @@ static struct ip6_tnl *ip6gre_tunnel_locate(struct net *net,
         struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
 
         t = ip6gre_tunnel_find(net, parms, ARPHRD_IP6GRE);
+        if (t && create)
+                return NULL;
         if (t || !create)
                 return t;
 
@@ -1724,4 +1726,5 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("D. Kozlov (xeb@mail.ru)");
 MODULE_DESCRIPTION("GRE over IPv6 tunneling device");
 MODULE_ALIAS_RTNL_LINK("ip6gre");
+MODULE_ALIAS_RTNL_LINK("ip6gretap");
 MODULE_ALIAS_NETDEV("ip6gre0");
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index f9de5a695072..69a84b464009 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -364,8 +364,12 @@ static struct ip6_tnl *ip6_tnl_locate(struct net *net,
              (t = rtnl_dereference(*tp)) != NULL;
              tp = &t->next) {
                 if (ipv6_addr_equal(local, &t->parms.laddr) &&
-                    ipv6_addr_equal(remote, &t->parms.raddr))
+                    ipv6_addr_equal(remote, &t->parms.raddr)) {
+                        if (create)
+                                return NULL;
+
                         return t;
+                }
         }
         if (!create)
                 return NULL;
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 7f52fd9fa7b0..5833a2244467 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -253,8 +253,12 @@ static struct ip6_tnl *vti6_locate(struct net *net, struct __ip6_tnl_parm *p,
              (t = rtnl_dereference(*tp)) != NULL;
              tp = &t->next) {
                 if (ipv6_addr_equal(local, &t->parms.laddr) &&
-                    ipv6_addr_equal(remote, &t->parms.raddr))
+                    ipv6_addr_equal(remote, &t->parms.raddr)) {
+                        if (create)
+                                return NULL;
+
                         return t;
+                }
         }
         if (!create)
                 return NULL;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f23fbd28a501..bafde82324c5 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -314,7 +314,6 @@ static inline struct rt6_info *ip6_dst_alloc(struct net *net,
 
                 memset(dst + 1, 0, sizeof(*rt) - sizeof(*dst));
                 rt6_init_peer(rt, table ? &table->tb6_peers : net->ipv6.peers);
-                rt->rt6i_genid = rt_genid_ipv6(net);
                 INIT_LIST_HEAD(&rt->rt6i_siblings);
         }
         return rt;
@@ -1098,9 +1097,6 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
          * DST_OBSOLETE_FORCE_CHK which forces validation calls down
          * into this function always.
          */
-        if (rt->rt6i_genid != rt_genid_ipv6(dev_net(rt->dst.dev)))
-                return NULL;
-
         if (!rt->rt6i_node || (rt->rt6i_node->fn_sernum != cookie))
                 return NULL;
 
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index b5c1d3aadb41..6d77cce481d5 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -847,6 +847,7 @@ config NETFILTER_XT_TARGET_TPROXY
         tristate '"TPROXY" target transparent proxying support'
         depends on NETFILTER_XTABLES
         depends on NETFILTER_ADVANCED
+        depends on (IPV6 || IPV6=n)
         depends on IP_NF_MANGLE
         select NF_DEFRAG_IPV4
         select NF_DEFRAG_IPV6 if IP6_NF_IPTABLES
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index c138b8fbe280..f37f0716a9fc 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -222,6 +222,51 @@ replay:
         }
 }
 
+struct nfnl_err {
+        struct list_head        head;
+        struct nlmsghdr         *nlh;
+        int                     err;
+};
+
+static int nfnl_err_add(struct list_head *list, struct nlmsghdr *nlh, int err)
+{
+        struct nfnl_err *nfnl_err;
+
+        nfnl_err = kmalloc(sizeof(struct nfnl_err), GFP_KERNEL);
+        if (nfnl_err == NULL)
+                return -ENOMEM;
+
+        nfnl_err->nlh = nlh;
+        nfnl_err->err = err;
+        list_add_tail(&nfnl_err->head, list);
+
+        return 0;
+}
+
+static void nfnl_err_del(struct nfnl_err *nfnl_err)
+{
+        list_del(&nfnl_err->head);
+        kfree(nfnl_err);
+}
+
+static void nfnl_err_reset(struct list_head *err_list)
+{
+        struct nfnl_err *nfnl_err, *next;
+
+        list_for_each_entry_safe(nfnl_err, next, err_list, head)
+                nfnl_err_del(nfnl_err);
+}
+
+static void nfnl_err_deliver(struct list_head *err_list, struct sk_buff *skb)
+{
+        struct nfnl_err *nfnl_err, *next;
+
+        list_for_each_entry_safe(nfnl_err, next, err_list, head) {
+                netlink_ack(skb, nfnl_err->nlh, nfnl_err->err);
+                nfnl_err_del(nfnl_err);
+        }
+}
+
 static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
                                 u_int16_t subsys_id)
 {
@@ -230,6 +275,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
         const struct nfnetlink_subsystem *ss;
         const struct nfnl_callback *nc;
         bool success = true, done = false;
+        static LIST_HEAD(err_list);
         int err;
 
         if (subsys_id >= NFNL_SUBSYS_COUNT)
@@ -287,6 +333,7 @@ replay:
                 type = nlh->nlmsg_type;
                 if (type == NFNL_MSG_BATCH_BEGIN) {
                         /* Malformed: Batch begin twice */
+                        nfnl_err_reset(&err_list);
                         success = false;
                         goto done;
                 } else if (type == NFNL_MSG_BATCH_END) {
@@ -333,6 +380,7 @@ replay:
                          * original skb.
                          */
                         if (err == -EAGAIN) {
+                                nfnl_err_reset(&err_list);
                                 ss->abort(skb);
                                 nfnl_unlock(subsys_id);
                                 kfree_skb(nskb);
@@ -341,11 +389,24 @@ replay:
                 }
 ack:
                 if (nlh->nlmsg_flags & NLM_F_ACK || err) {
+                        /* Errors are delivered once the full batch has been
+                         * processed, this avoids that the same error is
+                         * reported several times when replaying the batch.
+                         */
+                        if (nfnl_err_add(&err_list, nlh, err) < 0) {
+                                /* We failed to enqueue an error, reset the
+                                 * list of errors and send OOM to userspace
+                                 * pointing to the batch header.
+                                 */
+                                nfnl_err_reset(&err_list);
+                                netlink_ack(skb, nlmsg_hdr(oskb), -ENOMEM);
+                                success = false;
+                                goto done;
+                        }
                         /* We don't stop processing the batch on errors, thus,
                          * userspace gets all the errors that the batch
                          * triggers.
                          */
-                        netlink_ack(skb, nlh, err);
                         if (err)
                                 success = false;
                 }
@@ -361,6 +422,7 @@ done:
         else
                 ss->abort(skb);
 
+        nfnl_err_deliver(&err_list, oskb);
         nfnl_unlock(subsys_id);
         kfree_skb(nskb);
 }
diff --git a/net/netfilter/nft_hash.c b/net/netfilter/nft_hash.c
index 28fb8f38e6ba..8892b7b6184a 100644
--- a/net/netfilter/nft_hash.c
+++ b/net/netfilter/nft_hash.c
@@ -180,15 +180,17 @@ static int nft_hash_init(const struct nft_set *set,
 static void nft_hash_destroy(const struct nft_set *set)
 {
         const struct rhashtable *priv = nft_set_priv(set);
-        const struct bucket_table *tbl;
+        const struct bucket_table *tbl = priv->tbl;
         struct nft_hash_elem *he, *next;
         unsigned int i;
 
-        tbl = rht_dereference(priv->tbl, priv);
-        for (i = 0; i < tbl->size; i++)
-                rht_for_each_entry_safe(he, next, tbl->buckets[i], priv, node)
+        for (i = 0; i < tbl->size; i++) {
+                for (he = rht_entry(tbl->buckets[i], struct nft_hash_elem, node);
+                     he != NULL; he = next) {
+                        next = rht_entry(he->node.next, struct nft_hash_elem, node);
                         nft_hash_elem_destroy(set, he);
-
+                }
+        }
         rhashtable_destroy(priv);
 }
 
diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c
index e1836ff88199..46214f245665 100644
--- a/net/netfilter/nft_rbtree.c
+++ b/net/netfilter/nft_rbtree.c
@@ -234,13 +234,11 @@ static void nft_rbtree_destroy(const struct nft_set *set)
         struct nft_rbtree_elem *rbe;
         struct rb_node *node;
 
-        spin_lock_bh(&nft_rbtree_lock);
         while ((node = priv->root.rb_node) != NULL) {
                 rb_erase(node, &priv->root);
                 rbe = rb_entry(node, struct nft_rbtree_elem, node);
                 nft_rbtree_elem_destroy(set, rbe);
         }
-        spin_unlock_bh(&nft_rbtree_lock);
 }
 
 static bool nft_rbtree_estimate(const struct nft_set_desc *desc, u32 features,
diff --git a/net/sched/ematch.c b/net/sched/ematch.c
index 3a633debb6df..ad57f4444b9c 100644
--- a/net/sched/ematch.c
+++ b/net/sched/ematch.c
@@ -526,9 +526,11 @@ pop_stack:
                 match_idx = stack[--stackp];
                 cur_match = tcf_em_get_match(tree, match_idx);
 
-                if (tcf_em_early_end(cur_match, res))
+                if (tcf_em_early_end(cur_match, res)) {
+                        if (tcf_em_is_inverted(cur_match))
+                                res = !res;
                         goto pop_stack;
-                else {
+                } else {
                         match_idx++;
                         goto proceed;
                 }