25 files changed, 169 insertions, 130 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 31a046213274..6a6e4ac72287 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9231,6 +9231,7 @@ F:	include/media/videobuf2-*
 
 VIRTIO CONSOLE DRIVER
 M:      Amit Shah <amit.shah@redhat.com>
+L:      virtio-dev@lists.oasis-open.org
 L:      virtualization@lists.linux-foundation.org
 S:      Maintained
 F:      drivers/char/virtio_console.c
@@ -9240,6 +9241,7 @@ F:	include/uapi/linux/virtio_console.h
 VIRTIO CORE, NET AND BLOCK DRIVERS
 M:      Rusty Russell <rusty@rustcorp.com.au>
 M:      "Michael S. Tsirkin" <mst@redhat.com>
+L:      virtio-dev@lists.oasis-open.org
 L:      virtualization@lists.linux-foundation.org
 S:      Maintained
 F:      drivers/virtio/
@@ -9252,6 +9254,7 @@ F:	include/uapi/linux/virtio_*.h
 VIRTIO HOST (VHOST)
 M:      "Michael S. Tsirkin" <mst@redhat.com>
 L:      kvm@vger.kernel.org
+L:      virtio-dev@lists.oasis-open.org
 L:      virtualization@lists.linux-foundation.org
 L:      netdev@vger.kernel.org
 S:      Maintained
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index 9ed155ad0f97..271b5e971568 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -641,10 +641,10 @@ load_ind:
                         emit(ARM_MUL(r_A, r_A, r_X), ctx);
                         break;
                 case BPF_S_ALU_DIV_K:
-                        /* current k == reciprocal_value(userspace k) */
+                        if (k == 1)
+                                break;
                         emit_mov_i(r_scratch, k, ctx);
-                        /* A = top 32 bits of the product */
-                        emit(ARM_UMULL(r_scratch, r_A, r_A, r_scratch), ctx);
+                        emit_udiv(r_A, r_A, r_scratch, ctx);
                         break;
                 case BPF_S_ALU_DIV_X:
                         update_on_xread(ctx);
diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
index f33113a6141e..70b3674dac4e 100644
--- a/arch/parisc/include/uapi/asm/socket.h
+++ b/arch/parisc/include/uapi/asm/socket.h
@@ -75,6 +75,6 @@
 
 #define SO_BUSY_POLL            0x4027
 
-#define SO_MAX_PACING_RATE      0x4048
+#define SO_MAX_PACING_RATE      0x4028
 
 #endif /* _UAPI_ASM_SOCKET_H */
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index ac3c2a10dafd..555034f8505e 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -223,10 +223,11 @@ static int bpf_jit_build_body(struct sk_filter *fp, u32 *image,
                         }
                         PPC_DIVWU(r_A, r_A, r_X);
                         break;
-                case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K); */
+                case BPF_S_ALU_DIV_K: /* A /= K */
+                        if (K == 1)
+                                break;
                         PPC_LI32(r_scratch1, K);
-                        /* Top 32 bits of 64bit result -> A */
-                        PPC_MULHWU(r_A, r_A, r_scratch1);
+                        PPC_DIVWU(r_A, r_A, r_scratch1);
                         break;
                 case BPF_S_ALU_AND_X:
                         ctx->seen |= SEEN_XREG;
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 16871da37371..708d60e40066 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -368,14 +368,16 @@ static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
                 EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
                 /* lhi %r4,0 */
                 EMIT4(0xa7480000);
-                /* dr %r4,%r12 */
-                EMIT2(0x1d4c);
+                /* dlr %r4,%r12 */
+                EMIT4(0xb997004c);
                 break;
-        case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K) */
-                /* m %r4,<d(K)>(%r13) */
-                EMIT4_DISP(0x5c40d000, EMIT_CONST(K));
-                /* lr %r5,%r4 */
-                EMIT2(0x1854);
+        case BPF_S_ALU_DIV_K: /* A /= K */
+                if (K == 1)
+                        break;
+                /* lhi %r4,0 */
+                EMIT4(0xa7480000);
+                /* dl %r4,<d(K)>(%r13) */
+                EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
                 break;
         case BPF_S_ALU_MOD_X: /* A %= X */
                 jit->seen |= SEEN_XREG | SEEN_RET0;
@@ -385,16 +387,21 @@ static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
                 EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
                 /* lhi %r4,0 */
                 EMIT4(0xa7480000);
-                /* dr %r4,%r12 */
-                EMIT2(0x1d4c);
+                /* dlr %r4,%r12 */
+                EMIT4(0xb997004c);
                 /* lr %r5,%r4 */
                 EMIT2(0x1854);
                 break;
         case BPF_S_ALU_MOD_K: /* A %= K */
+                if (K == 1) {
+                        /* lhi %r5,0 */
+                        EMIT4(0xa7580000);
+                        break;
+                }
                 /* lhi %r4,0 */
                 EMIT4(0xa7480000);
-                /* d %r4,<d(K)>(%r13) */
-                EMIT4_DISP(0x5d40d000, EMIT_CONST(K));
+                /* dl %r4,<d(K)>(%r13) */
+                EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
                 /* lr %r5,%r4 */
                 EMIT2(0x1854);
                 break;
diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
index 218b6b23c378..01fe9946d388 100644
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -497,9 +497,20 @@ void bpf_jit_compile(struct sk_filter *fp)
                         case BPF_S_ALU_MUL_K:   /* A *= K */
                                 emit_alu_K(MUL, K);
                                 break;
-                        case BPF_S_ALU_DIV_K:   /* A /= K */
-                                emit_alu_K(MUL, K);
-                                emit_read_y(r_A);
+                        case BPF_S_ALU_DIV_K:   /* A /= K with K != 0*/
+                                if (K == 1)
+                                        break;
+                                emit_write_y(G0);
+#ifdef CONFIG_SPARC32
+                                /* The Sparc v8 architecture requires
+                                 * three instructions between a %y
+                                 * register write and the first use.
+                                 */
+                                emit_nop();
+                                emit_nop();
+                                emit_nop();
+#endif
+                                emit_alu_K(DIV, K);
                                 break;
                         case BPF_S_ALU_DIV_X:   /* A /= X; */
                                 emit_cmpi(r_X, 0);
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 26328e800869..4ed75dd81d05 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -359,15 +359,21 @@ void bpf_jit_compile(struct sk_filter *fp)
                                 EMIT2(0x89, 0xd0);      /* mov %edx,%eax */
                                 break;
                         case BPF_S_ALU_MOD_K: /* A %= K; */
+                                if (K == 1) {
+                                        CLEAR_A();
+                                        break;
+                                }
                                 EMIT2(0x31, 0xd2);      /* xor %edx,%edx */
                                 EMIT1(0xb9);EMIT(K, 4); /* mov imm32,%ecx */
                                 EMIT2(0xf7, 0xf1);      /* div %ecx */
                                 EMIT2(0x89, 0xd0);      /* mov %edx,%eax */
                                 break;
-                        case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K); */
-                                EMIT3(0x48, 0x69, 0xc0); /* imul imm32,%rax,%rax */
-                                EMIT(K, 4);
-                                EMIT4(0x48, 0xc1, 0xe8, 0x20); /* shr $0x20,%rax */
+                        case BPF_S_ALU_DIV_K: /* A /= K */
+                                if (K == 1)
+                                        break;
+                                EMIT2(0x31, 0xd2);      /* xor %edx,%edx */
+                                EMIT1(0xb9);EMIT(K, 4); /* mov imm32,%ecx */
+                                EMIT2(0xf7, 0xf1);      /* div %ecx */
                                 break;
                         case BPF_S_ALU_AND_X:
                                 seen |= SEEN_XREG;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 8b3107b2fcc1..0067b975873f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -12942,25 +12942,26 @@ static void __bnx2x_remove(struct pci_dev *pdev,
                 pci_set_power_state(pdev, PCI_D3hot);
         }
 
-        if (bp->regview)
-                iounmap(bp->regview);
+        if (remove_netdev) {
+                if (bp->regview)
+                        iounmap(bp->regview);
 
-        /* for vf doorbells are part of the regview and were unmapped along with
-         * it. FW is only loaded by PF.
-         */
-        if (IS_PF(bp)) {
-                if (bp->doorbells)
-                        iounmap(bp->doorbells);
+                /* For vfs, doorbells are part of the regview and were unmapped
+                 * along with it. FW is only loaded by PF.
+                 */
+                if (IS_PF(bp)) {
+                        if (bp->doorbells)
+                                iounmap(bp->doorbells);
 
-                bnx2x_release_firmware(bp);
-        }
-        bnx2x_free_mem_bp(bp);
+                        bnx2x_release_firmware(bp);
+                }
+                bnx2x_free_mem_bp(bp);
 
-        if (remove_netdev)
                 free_netdev(dev);
 
-        if (atomic_read(&pdev->enable_cnt) == 1)
-                pci_release_regions(pdev);
+                if (atomic_read(&pdev->enable_cnt) == 1)
+                        pci_release_regions(pdev);
+        }
 
         pci_disable_device(pdev);
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
index cb05be905def..81e8402a74b4 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
@@ -423,7 +423,7 @@ u64 cxgb4_select_ntuple(struct net_device *dev,
          * in the Compressed Filter Tuple.
          */
         if (tp->vlan_shift >= 0 && l2t->vlan != VLAN_NONE)
-                ntuple |= (F_FT_VLAN_VLD | l2t->vlan) << tp->vlan_shift;
+                ntuple |= (u64)(F_FT_VLAN_VLD | l2t->vlan) << tp->vlan_shift;
 
         if (tp->port_shift >= 0)
                 ntuple |= (u64)l2t->lport << tp->port_shift;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index bf40fdaecfa3..a37039d353c5 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1776,6 +1776,7 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
         struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
         struct be_queue_info *rxq = &rxo->q;
         struct page *pagep = NULL;
+        struct device *dev = &adapter->pdev->dev;
         struct be_eth_rx_d *rxd;
         u64 page_dmaaddr = 0, frag_dmaaddr;
         u32 posted, page_offset = 0;
@@ -1788,9 +1789,15 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
                                 rx_stats(rxo)->rx_post_fail++;
                                 break;
                         }
-                        page_dmaaddr = dma_map_page(&adapter->pdev->dev, pagep,
-                                                    0, adapter->big_page_size,
+                        page_dmaaddr = dma_map_page(dev, pagep, 0,
+                                                    adapter->big_page_size,
                                                     DMA_FROM_DEVICE);
+                        if (dma_mapping_error(dev, page_dmaaddr)) {
+                                put_page(pagep);
+                                pagep = NULL;
+                                rx_stats(rxo)->rx_post_fail++;
+                                break;
+                        }
                         page_info->page_offset = 0;
                 } else {
                         get_page(pagep);
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index c30d41d6e426..6d14eea17918 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -6174,7 +6174,7 @@ static int __e1000_resume(struct pci_dev *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int e1000_suspend(struct device *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
@@ -6193,7 +6193,7 @@ static int e1000_resume(struct device *dev)
 
         return __e1000_resume(pdev);
 }
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 
 #ifdef CONFIG_PM_RUNTIME
 static int e1000_runtime_suspend(struct device *dev)
@@ -7015,13 +7015,11 @@ static DEFINE_PCI_DEVICE_TABLE(e1000_pci_tbl) = {
 };
 MODULE_DEVICE_TABLE(pci, e1000_pci_tbl);
 
-#ifdef CONFIG_PM
 static const struct dev_pm_ops e1000_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(e1000_suspend, e1000_resume)
         SET_RUNTIME_PM_OPS(e1000_runtime_suspend, e1000_runtime_resume,
                            e1000_idle)
 };
-#endif
 
 /* PCI Device API Driver */
 static struct pci_driver e1000_driver = {
@@ -7029,11 +7027,9 @@ static struct pci_driver e1000_driver = {
         .id_table = e1000_pci_tbl,
         .probe    = e1000_probe,
         .remove   = e1000_remove,
-#ifdef CONFIG_PM
         .driver   = {
                 .pm = &e1000_pm_ops,
         },
-#endif
         .shutdown = e1000_shutdown,
         .err_handler = &e1000_err_handler
 };
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 449f506d2e8f..f705aeeba767 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -4765,6 +4765,8 @@ static int qlge_probe(struct pci_dev *pdev,
                             NETIF_F_RXCSUM;
         ndev->features = ndev->hw_features;
         ndev->vlan_features = ndev->hw_features;
+        /* vlan gets same features (except vlan filter) */
+        ndev->vlan_features &= ~NETIF_F_HW_VLAN_CTAG_FILTER;
 
         if (test_bit(QL_DMA64, &qdev->flags))
                 ndev->features |= NETIF_F_HIGHDMA;
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index cce6c4bc556a..ef312bc6b865 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -1618,6 +1618,7 @@ static void rhine_reset_task(struct work_struct *work)
                 goto out_unlock;
 
         napi_disable(&rp->napi);
+        netif_tx_disable(dev);
         spin_lock_bh(&rp->lock);
 
         /* clear all descriptors */
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 14aa48fa8d7e..e80219877730 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -614,6 +614,18 @@ static const struct usb_device_id products[] = {
          USB_DEVICE(0x0a46, 0x9621),    /* DM9621A USB to Fast Ethernet Adapter */
          .driver_info = (unsigned long)&dm9601_info,
         },
+        {
+         USB_DEVICE(0x0a46, 0x9622),    /* DM9622 USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+        },
+        {
+         USB_DEVICE(0x0a46, 0x0269),    /* DM962OA USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+        },
+        {
+         USB_DEVICE(0x0a46, 0x1269),    /* DM9621A USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+        },
         {},                     // END
 };
 
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 8494bb53ebdc..aba04f561760 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1245,7 +1245,7 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb)
                 return -ENOMEM;
 
         urb->num_sgs = num_sgs;
-        sg_init_table(urb->sg, urb->num_sgs);
+        sg_init_table(urb->sg, urb->num_sgs + 1);
 
         sg_set_buf(&urb->sg[s++], skb->data, skb_headlen(skb));
         total_len += skb_headlen(skb);
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 76d54270f2e2..65bb13035598 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -165,7 +165,6 @@ struct inet6_dev {
         struct net_device       *dev;
 
         struct list_head        addr_list;
-        int                     valid_ll_addr_cnt;
 
         struct ifmcaddr6        *mc_list;
         struct ifmcaddr6        *mc_tomb;
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 1511f64a6cea..faba0f61ad53 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -277,7 +277,7 @@ int batadv_max_header_len(void)
                            sizeof(struct batadv_coded_packet));
 #endif
 
-        return header_len;
+        return header_len + ETH_HLEN;
 }
 
 /**
diff --git a/net/core/filter.c b/net/core/filter.c
index 01b780856db2..ad30d626a5bd 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -36,7 +36,6 @@
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
 #include <linux/filter.h>
-#include <linux/reciprocal_div.h>
 #include <linux/ratelimit.h>
 #include <linux/seccomp.h>
 #include <linux/if_vlan.h>
@@ -166,7 +165,7 @@ unsigned int sk_run_filter(const struct sk_buff *skb,
                         A /= X;
                         continue;
                 case BPF_S_ALU_DIV_K:
-                        A = reciprocal_divide(A, K);
+                        A /= K;
                         continue;
                 case BPF_S_ALU_MOD_X:
                         if (X == 0)
@@ -553,11 +552,6 @@ int sk_chk_filter(struct sock_filter *filter, unsigned int flen)
                 /* Some instructions need special checks */
                 switch (code) {
                 case BPF_S_ALU_DIV_K:
-                        /* check for division by zero */
-                        if (ftest->k == 0)
-                                return -EINVAL;
-                        ftest->k = reciprocal_value(ftest->k);
-                        break;
                 case BPF_S_ALU_MOD_K:
                         /* check for division by zero */
                         if (ftest->k == 0)
@@ -853,27 +847,7 @@ void sk_decode_filter(struct sock_filter *filt, struct sock_filter *to)
         to->code = decodes[code];
         to->jt = filt->jt;
         to->jf = filt->jf;
-
-        if (code == BPF_S_ALU_DIV_K) {
-                /*
-                 * When loaded this rule user gave us X, which was
-                 * translated into R = r(X). Now we calculate the
-                 * RR = r(R) and report it back. If next time this
-                 * value is loaded and RRR = r(RR) is calculated
-                 * then the R == RRR will be true.
-                 *
-                 * One exception. X == 1 translates into R == 0 and
-                 * we can't calculate RR out of it with r().
-                 */
-
-                if (filt->k == 0)
-                        to->k = 1;
-                else
-                        to->k = reciprocal_value(filt->k);
-
-                BUG_ON(reciprocal_value(to->k) != filt->k);
-        } else
-                to->k = filt->k;
+        to->k = filt->k;
 }
 
 int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf, unsigned int len)
diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index d08c7a43dcd1..89b265aea151 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -221,8 +221,10 @@ int ieee802154_add_iface(struct sk_buff *skb, struct genl_info *info)
 
         if (info->attrs[IEEE802154_ATTR_DEV_TYPE]) {
                 type = nla_get_u8(info->attrs[IEEE802154_ATTR_DEV_TYPE]);
-                if (type >= __IEEE802154_DEV_MAX)
-                        return -EINVAL;
+                if (type >= __IEEE802154_DEV_MAX) {
+                        rc = -EINVAL;
+                        goto nla_put_failure;
+                }
         }
 
         dev = phy->add_iface(phy, devname, type);
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index a0f52dac8940..e34dccbc4d70 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -930,12 +930,15 @@ skip_listen_ht:
                 spin_lock_bh(lock);
                 sk_nulls_for_each(sk, node, &head->chain) {
                         int res;
+                        int state;
 
                         if (!net_eq(sock_net(sk), net))
                                 continue;
                         if (num < s_num)
                                 goto next_normal;
-                        if (!(r->idiag_states & (1 << sk->sk_state)))
+                        state = (sk->sk_state == TCP_TIME_WAIT) ?
+                                inet_twsk(sk)->tw_substate : sk->sk_state;
+                        if (!(r->idiag_states & (1 << state)))
                                 goto next_normal;
                         if (r->sdiag_family != AF_UNSPEC &&
                             sk->sk_family != r->sdiag_family)
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 62212c772a4b..1672409f5ba5 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -157,9 +157,12 @@ static struct mr_table *ipmr_get_table(struct net *net, u32 id)
 static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
                            struct mr_table **mrt)
 {
-        struct ipmr_result res;
-        struct fib_lookup_arg arg = { .result = &res, };
         int err;
+        struct ipmr_result res;
+        struct fib_lookup_arg arg = {
+                .result = &res,
+                .flags = FIB_LOOKUP_NOREF,
+        };
 
         err = fib_rules_lookup(net->ipv4.mr_rules_ops,
                                flowi4_to_flowi(flp4), 0, &arg);
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 06493736fbc8..098b3a29f6f3 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -22,6 +22,9 @@
 
 int sysctl_tcp_nometrics_save __read_mostly;
 
+static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *addr,
+                                                   struct net *net, unsigned int hash);
+
 struct tcp_fastopen_metrics {
         u16     mss;
         u16     syn_loss:10;            /* Recurring Fast Open SYN losses */
@@ -130,16 +133,41 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm, struct dst_entry *dst,
         }
 }
 
+#define TCP_METRICS_TIMEOUT             (60 * 60 * HZ)
+
+static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst)
+{
+        if (tm && unlikely(time_after(jiffies, tm->tcpm_stamp + TCP_METRICS_TIMEOUT)))
+                tcpm_suck_dst(tm, dst, false);
+}
+
+#define TCP_METRICS_RECLAIM_DEPTH       5
+#define TCP_METRICS_RECLAIM_PTR         (struct tcp_metrics_block *) 0x1UL
+
 static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
                                           struct inetpeer_addr *addr,
-                                          unsigned int hash,
-                                          bool reclaim)
+                                          unsigned int hash)
 {
         struct tcp_metrics_block *tm;
         struct net *net;
+        bool reclaim = false;
 
         spin_lock_bh(&tcp_metrics_lock);
         net = dev_net(dst->dev);
+
+        /* While waiting for the spin-lock the cache might have been populated
+         * with this entry and so we have to check again.
+         */
+        tm = __tcp_get_metrics(addr, net, hash);
+        if (tm == TCP_METRICS_RECLAIM_PTR) {
+                reclaim = true;
+                tm = NULL;
+        }
+        if (tm) {
+                tcpm_check_stamp(tm, dst);
+                goto out_unlock;
+        }
+
         if (unlikely(reclaim)) {
                 struct tcp_metrics_block *oldest;
 
@@ -169,17 +197,6 @@ out_unlock:
         return tm;
 }
 
-#define TCP_METRICS_TIMEOUT             (60 * 60 * HZ)
-
-static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst)
-{
-        if (tm && unlikely(time_after(jiffies, tm->tcpm_stamp + TCP_METRICS_TIMEOUT)))
-                tcpm_suck_dst(tm, dst, false);
-}
-
-#define TCP_METRICS_RECLAIM_DEPTH       5
-#define TCP_METRICS_RECLAIM_PTR         (struct tcp_metrics_block *) 0x1UL
-
 static struct tcp_metrics_block *tcp_get_encode(struct tcp_metrics_block *tm, int depth)
 {
         if (tm)
@@ -282,7 +299,6 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
         struct inetpeer_addr addr;
         unsigned int hash;
         struct net *net;
-        bool reclaim;
 
         addr.family = sk->sk_family;
         switch (addr.family) {
@@ -304,13 +320,10 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
         hash = hash_32(hash, net->ipv4.tcp_metrics_hash_log);
 
         tm = __tcp_get_metrics(&addr, net, hash);
-        reclaim = false;
-        if (tm == TCP_METRICS_RECLAIM_PTR) {
-                reclaim = true;
+        if (tm == TCP_METRICS_RECLAIM_PTR)
                 tm = NULL;
-        }
         if (!tm && create)
-                tm = tcpm_new(dst, &addr, hash, reclaim);
+                tm = tcpm_new(dst, &addr, hash);
         else
                 tcpm_check_stamp(tm, dst);
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index abe46a4228ce..4b6b720971b9 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3189,6 +3189,22 @@ out:
         in6_ifa_put(ifp);
 }
 
+/* ifp->idev must be at least read locked */
+static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp)
+{
+        struct inet6_ifaddr *ifpiter;
+        struct inet6_dev *idev = ifp->idev;
+
+        list_for_each_entry(ifpiter, &idev->addr_list, if_list) {
+                if (ifp != ifpiter && ifpiter->scope == IFA_LINK &&
+                    (ifpiter->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|
+                                       IFA_F_OPTIMISTIC|IFA_F_DADFAILED)) ==
+                    IFA_F_PERMANENT)
+                        return false;
+        }
+        return true;
+}
+
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
 {
         struct net_device *dev = ifp->idev->dev;
@@ -3208,14 +3224,11 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
          */
 
         read_lock_bh(&ifp->idev->lock);
-        spin_lock(&ifp->lock);
-        send_mld = ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL &&
-                   ifp->idev->valid_ll_addr_cnt == 1;
+        send_mld = ifp->scope == IFA_LINK && ipv6_lonely_lladdr(ifp);
         send_rs = send_mld &&
                   ipv6_accept_ra(ifp->idev) &&
                   ifp->idev->cnf.rtr_solicits > 0 &&
                   (dev->flags&IFF_LOOPBACK) == 0;
-        spin_unlock(&ifp->lock);
         read_unlock_bh(&ifp->idev->lock);
 
         /* While dad is in progress mld report's source address is in6_addrany.
@@ -4512,19 +4525,6 @@ errout:
                 rtnl_set_sk_err(net, RTNLGRP_IPV6_PREFIX, err);
 }
 
-static void update_valid_ll_addr_cnt(struct inet6_ifaddr *ifp, int count)
-{
-        write_lock_bh(&ifp->idev->lock);
-        spin_lock(&ifp->lock);
-        if (((ifp->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|
-                            IFA_F_DADFAILED)) == IFA_F_PERMANENT) &&
-            (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL))
-                ifp->idev->valid_ll_addr_cnt += count;
-        WARN_ON(ifp->idev->valid_ll_addr_cnt < 0);
-        spin_unlock(&ifp->lock);
-        write_unlock_bh(&ifp->idev->lock);
-}
-
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 {
         struct net *net = dev_net(ifp->idev->dev);
@@ -4533,8 +4533,6 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 
         switch (event) {
         case RTM_NEWADDR:
-                update_valid_ll_addr_cnt(ifp, 1);
-
                 /*
                  * If the address was optimistic
                  * we inserted the route at the start of
@@ -4550,8 +4548,6 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                                               ifp->idev->dev, 0, 0);
                 break;
         case RTM_DELADDR:
-                update_valid_ll_addr_cnt(ifp, -1);
-
                 if (ifp->idev->cnf.forwarding)
                         addrconf_leave_anycast(ifp);
                 addrconf_leave_solict(ifp->idev, &ifp->addr);
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index f365310bfcca..0eb4038a4d63 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -141,9 +141,12 @@ static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
 static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
                             struct mr6_table **mrt)
 {
-        struct ip6mr_result res;
-        struct fib_lookup_arg arg = { .result = &res, };
         int err;
+        struct ip6mr_result res;
+        struct fib_lookup_arg arg = {
+                .result = &res,
+                .flags = FIB_LOOKUP_NOREF,
+        };
 
         err = fib_rules_lookup(net->ipv6.mr6_rules_ops,
                                flowi6_to_flowi(flp6), 0, &arg);
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 8eb9501e3d60..b7ebe23cdedf 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -421,8 +421,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
                                  struct rds_ib_refill_cache *cache)
 {
         unsigned long flags;
-        struct list_head *old;
-        struct list_head __percpu *chpfirst;
+        struct list_head *old, *chpfirst;
 
         local_irq_save(flags);
 
@@ -432,7 +431,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
         else /* put on front */
                 list_add_tail(new_item, chpfirst);
 
-        __this_cpu_write(chpfirst, new_item);
+        __this_cpu_write(cache->percpu->first, new_item);
         __this_cpu_inc(cache->percpu->count);
 
         if (__this_cpu_read(cache->percpu->count) < RDS_IB_RECYCLE_BATCH_COUNT)
@@ -452,7 +451,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
         } while (old);
 
 
-        __this_cpu_write(chpfirst, NULL);
+        __this_cpu_write(cache->percpu->first, NULL);
         __this_cpu_write(cache->percpu->count, 0);
 end:
         local_irq_restore(flags);