33 files changed, 197 insertions, 63 deletions

diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index c44950d3eb7b..b7ae0a0dd5b6 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -2400,6 +2400,7 @@ allocerr:
 error:
         freeurbs(cs);
         usb_set_intfdata(interface, NULL);
+        usb_put_dev(udev);
         gigaset_freecs(cs);
         return rc;
 }
diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
index 824108cd9fd5..12430be6448a 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -287,7 +287,8 @@ static int c_can_plat_probe(struct platform_device *pdev)
                         break;
                 }
 
-                priv->raminit_ctrlreg = devm_ioremap_resource(&pdev->dev, res);
+                priv->raminit_ctrlreg = devm_ioremap(&pdev->dev, res->start,
+                                                     resource_size(res));
                 if (IS_ERR(priv->raminit_ctrlreg) || priv->instance < 0)
                         dev_info(&pdev->dev, "control memory is not used for raminit\n");
                 else
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
index c83584a26713..5a1891faba8a 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
@@ -339,7 +339,8 @@ static int xgbe_probe(struct platform_device *pdev)
         /* Calculate the number of Tx and Rx rings to be created */
         pdata->tx_ring_count = min_t(unsigned int, num_online_cpus(),
                                      pdata->hw_feat.tx_ch_cnt);
-        if (netif_set_real_num_tx_queues(netdev, pdata->tx_ring_count)) {
+        ret = netif_set_real_num_tx_queues(netdev, pdata->tx_ring_count);
+        if (ret) {
                 dev_err(dev, "error setting real tx queue count\n");
                 goto err_io;
         }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index 4cab09d3f807..8206a293e6b4 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -346,6 +346,7 @@ struct sw_tx_bd {
         u8              flags;
 /* Set on the first BD descriptor when there is a split BD */
 #define BNX2X_TSO_SPLIT_BD              (1<<0)
+#define BNX2X_HAS_SECOND_PBD            (1<<1)
 };
 
 struct sw_rx_page {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 4b875da1c7ed..c43e7238de21 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -227,6 +227,12 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
         --nbd;
         bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
 
+        if (tx_buf->flags & BNX2X_HAS_SECOND_PBD) {
+                /* Skip second parse bd... */
+                --nbd;
+                bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
+        }
+
         /* TSO headers+data bds share a common mapping. See bnx2x_tx_split() */
         if (tx_buf->flags & BNX2X_TSO_SPLIT_BD) {
                 tx_data_bd = &txdata->tx_desc_ring[bd_idx].reg_bd;
@@ -3889,6 +3895,9 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         /* set encapsulation flag in start BD */
                         SET_FLAG(tx_start_bd->general_data,
                                  ETH_TX_START_BD_TUNNEL_EXIST, 1);
+
+                        tx_buf->flags |= BNX2X_HAS_SECOND_PBD;
+
                         nbd++;
                 } else if (xmit_type & XMIT_CSUM) {
                         /* Set PBD in checksum offload case w/o encapsulation */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index bd0600cf7266..25eddd90f482 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -379,6 +379,7 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                         break;
                 case PORT_FIBRE:
                 case PORT_DA:
+                case PORT_NONE:
                         if (!(bp->port.supported[0] & SUPPORTED_FIBRE ||
                               bp->port.supported[1] & SUPPORTED_FIBRE)) {
                                 DP(BNX2X_MSG_ETHTOOL,
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 16281ad2da12..4e615debe472 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1149,6 +1149,11 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto out;
         }
 
+        if (skb_padto(skb, ETH_ZLEN)) {
+                ret = NETDEV_TX_OK;
+                goto out;
+        }
+
         /* set the SKB transmit checksum */
         if (priv->desc_64b_en) {
                 ret = bcmgenet_put_tx_csum(dev, skb);
diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
index fd411d6e19a2..d813bfb1a847 100644
--- a/drivers/net/ethernet/sun/sunvnet.c
+++ b/drivers/net/ethernet/sun/sunvnet.c
@@ -610,6 +610,13 @@ static int __vnet_tx_trigger(struct vnet_port *port)
         return err;
 }
 
+static inline bool port_is_up(struct vnet_port *vnet)
+{
+        struct vio_driver_state *vio = &vnet->vio;
+
+        return !!(vio->hs_state & VIO_HS_COMPLETE);
+}
+
 struct vnet_port *__tx_port_find(struct vnet *vp, struct sk_buff *skb)
 {
         unsigned int hash = vnet_hashfn(skb->data);
@@ -617,14 +624,19 @@ struct vnet_port *__tx_port_find(struct vnet *vp, struct sk_buff *skb)
         struct vnet_port *port;
 
         hlist_for_each_entry(port, hp, hash) {
+                if (!port_is_up(port))
+                        continue;
                 if (ether_addr_equal(port->raddr, skb->data))
                         return port;
         }
-        port = NULL;
-        if (!list_empty(&vp->port_list))
-                port = list_entry(vp->port_list.next, struct vnet_port, list);
-
-        return port;
+        list_for_each_entry(port, &vp->port_list, list) {
+                if (!port->switch_port)
+                        continue;
+                if (!port_is_up(port))
+                        continue;
+                return port;
+        }
+        return NULL;
 }
 
 struct vnet_port *tx_port_find(struct vnet *vp, struct sk_buff *skb)
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 4ed38eaecea8..d97d5f39a04e 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -378,8 +378,10 @@ static int netvsc_init_buf(struct hv_device *device)
 
         net_device->send_section_map =
                 kzalloc(net_device->map_words * sizeof(ulong), GFP_KERNEL);
-        if (net_device->send_section_map == NULL)
+        if (net_device->send_section_map == NULL) {
+                ret = -ENOMEM;
                 goto cleanup;
+        }
 
         goto exit;
 
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 4eaadcfcb0fe..203651ebccb0 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -255,6 +255,7 @@ int mdiobus_register(struct mii_bus *bus)
 
         bus->dev.parent = bus->parent;
         bus->dev.class = &mdio_bus_class;
+        bus->dev.driver = bus->parent->driver;
         bus->dev.groups = NULL;
         dev_set_name(&bus->dev, "%s", bus->id);
 
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 35d753d22f78..22c57be4dfa0 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -355,7 +355,7 @@ int phy_device_register(struct phy_device *phydev)
         phydev->bus->phy_map[phydev->addr] = phydev;
 
         /* Run all of the fixups for this PHY */
-        err = phy_init_hw(phydev);
+        err = phy_scan_fixups(phydev);
         if (err) {
                 pr_err("PHY %d failed to initialize\n", phydev->addr);
                 goto out;
@@ -575,6 +575,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                       u32 flags, phy_interface_t interface)
 {
         struct device *d = &phydev->dev;
+        struct module *bus_module;
         int err;
 
         /* Assume that if there is no driver, that it doesn't
@@ -599,6 +600,14 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
                 return -EBUSY;
         }
 
+        /* Increment the bus module reference count */
+        bus_module = phydev->bus->dev.driver ?
+                     phydev->bus->dev.driver->owner : NULL;
+        if (!try_module_get(bus_module)) {
+                dev_err(&dev->dev, "failed to get the bus module\n");
+                return -EIO;
+        }
+
         phydev->attached_dev = dev;
         dev->phydev = phydev;
 
@@ -664,6 +673,10 @@ EXPORT_SYMBOL(phy_attach);
 void phy_detach(struct phy_device *phydev)
 {
         int i;
+
+        if (phydev->bus->dev.driver)
+                module_put(phydev->bus->dev.driver->owner);
+
         phydev->attached_dev->phydev = NULL;
         phydev->attached_dev = NULL;
         phy_suspend(phydev);
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 9ea4bfe5d318..2a32d9167d3b 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -341,6 +341,22 @@ next_desc:
                 usb_driver_release_interface(driver, info->data);
                 return -ENODEV;
         }
+
+        /* Some devices don't initialise properly. In particular
+         * the packet filter is not reset. There are devices that
+         * don't do reset all the way. So the packet filter should
+         * be set to a sane initial value.
+         */
+        usb_control_msg(dev->udev,
+                        usb_sndctrlpipe(dev->udev, 0),
+                        USB_CDC_SET_ETHERNET_PACKET_FILTER,
+                        USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+                        USB_CDC_PACKET_TYPE_ALL_MULTICAST | USB_CDC_PACKET_TYPE_DIRECTED | USB_CDC_PACKET_TYPE_BROADCAST,
+                        intf->cur_altsetting->desc.bInterfaceNumber,
+                        NULL,
+                        0,
+                        USB_CTRL_SET_TIMEOUT
+                );
         return 0;
 
 bad_desc:
diff --git a/drivers/net/usb/cdc_subset.c b/drivers/net/usb/cdc_subset.c
index 91f0919fe278..3ef411efd86e 100644
--- a/drivers/net/usb/cdc_subset.c
+++ b/drivers/net/usb/cdc_subset.c
@@ -85,9 +85,34 @@ static int always_connected (struct usbnet *dev)
  *
  *-------------------------------------------------------------------------*/
 
+static void m5632_recover(struct usbnet *dev)
+{
+        struct usb_device       *udev = dev->udev;
+        struct usb_interface    *intf = dev->intf;
+        int r;
+
+        r = usb_lock_device_for_reset(udev, intf);
+        if (r < 0)
+                return;
+
+        usb_reset_device(udev);
+        usb_unlock_device(udev);
+}
+
+static int dummy_prereset(struct usb_interface *intf)
+{
+        return 0;
+}
+
+static int dummy_postreset(struct usb_interface *intf)
+{
+        return 0;
+}
+
 static const struct driver_info ali_m5632_info = {
         .description =  "ALi M5632",
         .flags       = FLAG_POINTTOPOINT,
+        .recover     = m5632_recover,
 };
 
 #endif
@@ -332,6 +357,8 @@ static struct usb_driver cdc_subset_driver = {
         .probe =        usbnet_probe,
         .suspend =      usbnet_suspend,
         .resume =       usbnet_resume,
+        .pre_reset =    dummy_prereset,
+        .post_reset =   dummy_postreset,
         .disconnect =   usbnet_disconnect,
         .id_table =     products,
         .disable_hub_initiated_lpm = 1,
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index 7bad2d316637..3eab74c7c554 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -282,7 +282,7 @@
 /* USB_DEV_STAT */
 #define STAT_SPEED_MASK         0x0006
 #define STAT_SPEED_HIGH         0x0000
-#define STAT_SPEED_FULL         0x0001
+#define STAT_SPEED_FULL         0x0002
 
 /* USB_TX_AGG */
 #define TX_AGG_MAX_THRESHOLD    0x03
@@ -2292,9 +2292,8 @@ static void r8152b_exit_oob(struct r8152 *tp)
         /* rx share fifo credit full threshold */
         ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RXFIFO_CTRL0, RXFIFO_THR1_NORMAL);
 
-        ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_DEV_STAT);
-        ocp_data &= STAT_SPEED_MASK;
-        if (ocp_data == STAT_SPEED_FULL) {
+        if (tp->udev->speed == USB_SPEED_FULL ||
+            tp->udev->speed == USB_SPEED_LOW) {
                 /* rx share fifo credit near full threshold */
                 ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RXFIFO_CTRL1,
                                 RXFIFO_THR2_FULL);
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index f9e96c427558..5173821a9575 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1218,8 +1218,12 @@ void usbnet_tx_timeout (struct net_device *net)
 
         unlink_urbs (dev, &dev->txq);
         tasklet_schedule (&dev->bh);
-
-        // FIXME: device recovery -- reset?
+        /* this needs to be handled individually because the generic layer
+         * doesn't know what is sufficient and could not restore private
+         * information if a remedy of an unconditional reset were used.
+         */
+        if (dev->driver_info->recover)
+                (dev->driver_info->recover)(dev);
 }
 EXPORT_SYMBOL_GPL(usbnet_tx_timeout);
 
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index ade33ef82823..9f79192c9aa0 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -339,7 +339,7 @@ static int vxlan_fdb_info(struct sk_buff *skb, struct vxlan_dev *vxlan,
         ndm->ndm_state = fdb->state;
         ndm->ndm_ifindex = vxlan->dev->ifindex;
         ndm->ndm_flags = fdb->flags;
-        ndm->ndm_type = NDA_DST;
+        ndm->ndm_type = RTN_UNICAST;
 
         if (send_eth && nla_put(skb, NDA_LLADDR, ETH_ALEN, &fdb->eth_addr))
                 goto nla_put_failure;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 66acb2cbd9df..7c28cb55610b 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -887,6 +887,15 @@ ath_tx_get_tid_subframe(struct ath_softc *sc, struct ath_txq *txq,
 
                 tx_info = IEEE80211_SKB_CB(skb);
                 tx_info->flags &= ~IEEE80211_TX_CTL_CLEAR_PS_FILT;
+
+                /*
+                 * No aggregation session is running, but there may be frames
+                 * from a previous session or a failed attempt in the queue.
+                 * Send them out as normal data frames
+                 */
+                if (!tid->active)
+                        tx_info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+
                 if (!(tx_info->flags & IEEE80211_TX_CTL_AMPDU)) {
                         bf->bf_state.bf_type = 0;
                         return bf;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index 725ba49576bf..8b79081d4885 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -1072,8 +1072,12 @@ static int iwl_mvm_mac_ctxt_cmd_ap(struct iwl_mvm *mvm,
         /* Fill the common data for all mac context types */
         iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
 
-        /* Also enable probe requests to pass */
-        cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST);
+        /*
+         * pass probe requests and beacons from other APs (needed
+         * for ht protection)
+         */
+        cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST |
+                                        MAC_FILTER_IN_BEACON);
 
         /* Fill the data specific for ap mode */
         iwl_mvm_mac_ctxt_cmd_fill_ap(mvm, vif, &cmd.ap,
@@ -1094,6 +1098,13 @@ static int iwl_mvm_mac_ctxt_cmd_go(struct iwl_mvm *mvm,
         /* Fill the common data for all mac context types */
         iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
 
+        /*
+         * pass probe requests and beacons from other APs (needed
+         * for ht protection)
+         */
+        cmd.filter_flags |= cpu_to_le32(MAC_FILTER_IN_PROBE_REQUEST |
+                                        MAC_FILTER_IN_BEACON);
+
         /* Fill the data specific for GO mode */
         iwl_mvm_mac_ctxt_cmd_fill_ap(mvm, vif, &cmd.go.ap,
                                      action == FW_CTXT_ACTION_ADD);
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 9bfb90680cdc..98556d03c1ed 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -303,13 +303,6 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
         }
 
-        if (mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT &&
-            !iwlwifi_mod_params.uapsd_disable) {
-                hw->flags |= IEEE80211_HW_SUPPORTS_UAPSD;
-                hw->uapsd_queues = IWL_UAPSD_AC_INFO;
-                hw->uapsd_max_sp_len = IWL_UAPSD_MAX_SP;
-        }
-
         hw->sta_data_size = sizeof(struct iwl_mvm_sta);
         hw->vif_data_size = sizeof(struct iwl_mvm_vif);
         hw->chanctx_data_size = sizeof(u16);
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 0662e98fef72..26088feb6608 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -148,6 +148,9 @@ struct driver_info {
         struct sk_buff  *(*tx_fixup)(struct usbnet *dev,
                                 struct sk_buff *skb, gfp_t flags);
 
+        /* recover from timeout */
+        void    (*recover)(struct usbnet *dev);
+
         /* early initialization code, can sleep. This is for minidrivers
          * having 'subminidrivers' that need to do extra initialization
          * right after minidriver have initialized hardware. */
diff --git a/include/net/ip.h b/include/net/ip.h
index 0e795df05ec9..7596eb22e1ce 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -309,16 +309,7 @@ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb)
         }
 }
 
-#define IP_IDENTS_SZ 2048u
-extern atomic_t *ip_idents;
-
-static inline u32 ip_idents_reserve(u32 hash, int segs)
-{
-        atomic_t *id_ptr = ip_idents + hash % IP_IDENTS_SZ;
-
-        return atomic_add_return(segs, id_ptr) - segs;
-}
-
+u32 ip_idents_reserve(u32 hash, int segs);
 void __ip_select_ident(struct iphdr *iph, int segs);
 
 static inline void ip_select_ident_segs(struct sk_buff *skb, struct sock *sk, int segs)
diff --git a/net/compat.c b/net/compat.c
index 9a76eaf63184..bc8aeefddf3f 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -85,7 +85,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
 {
         int tot_len;
 
-        if (kern_msg->msg_namelen) {
+        if (kern_msg->msg_name && kern_msg->msg_namelen) {
                 if (mode == VERIFY_READ) {
                         int err = move_addr_to_kernel(kern_msg->msg_name,
                                                       kern_msg->msg_namelen,
@@ -93,10 +93,11 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
                         if (err < 0)
                                 return err;
                 }
-                if (kern_msg->msg_name)
-                        kern_msg->msg_name = kern_address;
-        } else
+                kern_msg->msg_name = kern_address;
+        } else {
                 kern_msg->msg_name = NULL;
+                kern_msg->msg_namelen = 0;
+        }
 
         tot_len = iov_from_user_compat_to_kern(kern_iov,
                                           (struct compat_iovec __user *)kern_msg->msg_iov,
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 827dd6beb49c..e1ec45ab1e63 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -39,7 +39,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
 {
         int size, ct, err;
 
-        if (m->msg_namelen) {
+        if (m->msg_name && m->msg_namelen) {
                 if (mode == VERIFY_READ) {
                         void __user *namep;
                         namep = (void __user __force *) m->msg_name;
@@ -48,10 +48,10 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
                         if (err < 0)
                                 return err;
                 }
-                if (m->msg_name)
-                        m->msg_name = address;
+                m->msg_name = address;
         } else {
                 m->msg_name = NULL;
+                m->msg_namelen = 0;
         }
 
         size = m->msg_iovlen * sizeof(struct iovec);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 559890b0f0a2..ef31fef25e5a 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2249,7 +2249,7 @@ static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
         ndm->ndm_pad1    = 0;
         ndm->ndm_pad2    = 0;
         ndm->ndm_flags   = pn->flags | NTF_PROXY;
-        ndm->ndm_type    = NDA_DST;
+        ndm->ndm_type    = RTN_UNICAST;
         ndm->ndm_ifindex = pn->dev->ifindex;
         ndm->ndm_state   = NUD_NONE;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 3162ea923ded..190199851c9a 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -457,8 +457,31 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
         return neigh_create(&arp_tbl, pkey, dev);
 }
 
-atomic_t *ip_idents __read_mostly;
-EXPORT_SYMBOL(ip_idents);
+#define IP_IDENTS_SZ 2048u
+struct ip_ident_bucket {
+        atomic_t        id;
+        u32             stamp32;
+};
+
+static struct ip_ident_bucket *ip_idents __read_mostly;
+
+/* In order to protect privacy, we add a perturbation to identifiers
+ * if one generator is seldom used. This makes hard for an attacker
+ * to infer how many packets were sent between two points in time.
+ */
+u32 ip_idents_reserve(u32 hash, int segs)
+{
+        struct ip_ident_bucket *bucket = ip_idents + hash % IP_IDENTS_SZ;
+        u32 old = ACCESS_ONCE(bucket->stamp32);
+        u32 now = (u32)jiffies;
+        u32 delta = 0;
+
+        if (old != now && cmpxchg(&bucket->stamp32, old, now) == old)
+                delta = prandom_u32_max(now - old);
+
+        return atomic_add_return(segs + delta, &bucket->id) - segs;
+}
+EXPORT_SYMBOL(ip_idents_reserve);
 
 void __ip_select_ident(struct iphdr *iph, int segs)
 {
@@ -467,7 +490,10 @@ void __ip_select_ident(struct iphdr *iph, int segs)
 
         net_get_random_once(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd));
 
-        hash = jhash_1word((__force u32)iph->daddr, ip_idents_hashrnd);
+        hash = jhash_3words((__force u32)iph->daddr,
+                            (__force u32)iph->saddr,
+                            iph->protocol,
+                            ip_idents_hashrnd);
         id = ip_idents_reserve(hash, segs);
         iph->id = htons(id);
 }
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index cb9df0eb4023..45702b8cd141 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -545,6 +545,8 @@ static void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
         net_get_random_once(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
 
         hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd);
+        hash = __ipv6_addr_jhash(&rt->rt6i_src.addr, hash);
+
         id = ip_idents_reserve(hash, 1);
         fhdr->identification = htonl(id);
 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index d7513a503be1..592f4b152ba8 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -472,12 +472,15 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
-        struct rate_control_ref *ref = local->rate_ctrl;
+        struct rate_control_ref *ref = NULL;
         struct timespec uptime;
         u64 packets = 0;
         u32 thr = 0;
         int i, ac;
 
+        if (test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
+                ref = local->rate_ctrl;
+
         sinfo->generation = sdata->local->sta_generation;
 
         sinfo->filled = STATION_INFO_INACTIVE_TIME |
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 5214686d9fd1..1a252c606ad0 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -414,6 +414,9 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         if (ieee80211_has_order(hdr->frame_control))
                 return TX_CONTINUE;
 
+        if (ieee80211_is_probe_req(hdr->frame_control))
+                return TX_CONTINUE;
+
         if (tx->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
                 info->hw_queue = tx->sdata->vif.cab_queue;
 
@@ -463,6 +466,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 {
         struct sta_info *sta = tx->sta;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
         struct ieee80211_local *local = tx->local;
 
         if (unlikely(!sta))
@@ -473,6 +477,12 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                      !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
                 int ac = skb_get_queue_mapping(tx->skb);
 
+                if (ieee80211_is_mgmt(hdr->frame_control) &&
+                    !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
+                        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
+                        return TX_CONTINUE;
+                }
+
                 ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n",
                        sta->sta.addr, sta->sta.aid, ac);
                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
@@ -531,19 +541,9 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
 {
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
-
         if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
                 return TX_CONTINUE;
 
-        if (ieee80211_is_mgmt(hdr->frame_control) &&
-            !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
-                if (tx->flags & IEEE80211_TX_UNICAST)
-                        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
-                return TX_CONTINUE;
-        }
-
         if (tx->flags & IEEE80211_TX_UNICAST)
                 return ieee80211_tx_h_unicast_ps_buf(tx);
         else
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index a8eb0a89326a..610e19c0e13f 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -797,7 +797,6 @@ static void ip_vs_conn_expire(unsigned long data)
                         ip_vs_control_del(cp);
 
                 if (cp->flags & IP_VS_CONN_F_NFCT) {
-                        ip_vs_conn_drop_conntrack(cp);
                         /* Do not access conntracks during subsys cleanup
                          * because nf_conntrack_find_get can not be used after
                          * conntrack cleanup for the net.
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 9de23a222d3f..06a9ee6b2d3a 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1097,6 +1097,7 @@ void sctp_assoc_update(struct sctp_association *asoc,
         asoc->c = new->c;
         asoc->peer.rwnd = new->peer.rwnd;
         asoc->peer.sack_needed = new->peer.sack_needed;
+        asoc->peer.auth_capable = new->peer.auth_capable;
         asoc->peer.i = new->peer.i;
         sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL,
                          asoc->peer.i.initial_tsn, GFP_ATOMIC);
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 560ed77084e9..7cc887f9da11 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -2094,7 +2094,8 @@ TRACE_EVENT(cfg80211_michael_mic_failure,
                 MAC_ASSIGN(addr, addr);
                 __entry->key_type = key_type;
                 __entry->key_id = key_id;
-                memcpy(__entry->tsc, tsc, 6);
+                if (tsc)
+                        memcpy(__entry->tsc, tsc, 6);
         ),
         TP_printk(NETDEV_PR_FMT ", " MAC_PR_FMT ", key type: %d, key id: %d, tsc: %pm",
                   NETDEV_PR_ARG, MAC_PR_ARG(addr), __entry->key_type,
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index a8ef5108e0d8..0525d78ba328 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2097,6 +2097,8 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
                                 goto no_transform;
                         }
 
+                        dst_hold(&xdst->u.dst);
+                        xdst->u.dst.flags |= DST_NOCACHE;
                         route = xdst->route;
                 }
         }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 412d9dc3a873..d4db6ebb089d 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -177,9 +177,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
                     attrs[XFRMA_ALG_AEAD]       ||
                     attrs[XFRMA_ALG_CRYPT]      ||
                     attrs[XFRMA_ALG_COMP]       ||
-                    attrs[XFRMA_TFCPAD]         ||
-                    (ntohl(p->id.spi) >= 0x10000))
-
+                    attrs[XFRMA_TFCPAD])
                         goto out;
                 break;
 
@@ -207,7 +205,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
                     attrs[XFRMA_ALG_AUTH]       ||
                     attrs[XFRMA_ALG_AUTH_TRUNC] ||
                     attrs[XFRMA_ALG_CRYPT]      ||
-                    attrs[XFRMA_TFCPAD])
+                    attrs[XFRMA_TFCPAD]         ||
+                    (ntohl(p->id.spi) >= 0x10000))
                         goto out;
                 break;