58 files changed, 1124 insertions, 937 deletions
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index 4b81e91c80fe..f8c49ce5b283 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -11,7 +11,7 @@ obj-y     := route.o inetpeer.o protocol.o \
             tcp_offload.o datagram.o raw.o udp.o udplite.o \
             udp_offload.o arp.o icmp.o devinet.o af_inet.o igmp.o \
             fib_frontend.o fib_semantics.o fib_trie.o \
-             inet_fragment.o ping.o ip_tunnel_core.o
+             inet_fragment.o ping.o ip_tunnel_core.o gre_offload.o
 obj-$(CONFIG_NET_IP_TUNNEL) += ip_tunnel.o
 obj-$(CONFIG_SYSCTL) += sysctl_net_ipv4.o
@@ -19,7 +19,7 @@ obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_IP_MULTIPLE_TABLES) += fib_rules.o
 obj-$(CONFIG_IP_MROUTE) += ipmr.o
 obj-$(CONFIG_NET_IPIP) += ipip.o
-gre-y := gre_demux.o gre_offload.o
+gre-y := gre_demux.o
 obj-$(CONFIG_NET_IPGRE_DEMUX) += gre.o
 obj-$(CONFIG_NET_IPGRE) += ip_gre.o
 obj-$(CONFIG_NET_IPVTI) += ip_vti.o
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 70011e029ac1..ecd2c3f245ce 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -126,9 +126,6 @@
 static struct list_head inetsw[SOCK_MAX];
 static DEFINE_SPINLOCK(inetsw_lock);
-struct ipv4_config ipv4_config;
-EXPORT_SYMBOL(ipv4_config);
 /* New destruction routine */
 void inet_sock_destruct(struct sock *sk)
@@ -342,7 +339,7 @@ lookup_protocol:
                        inet->hdrincl = 1;
        }
-        if (ipv4_config.no_pmtu_disc)
+        if (net->ipv4.sysctl_ip_no_pmtu_disc)
                inet->pmtudisc = IP_PMTUDISC_DONT;
        else
                inet->pmtudisc = IP_PMTUDISC_WANT;
@@ -1133,7 +1130,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
        fl4 = &inet->cork.fl.u.ip4;
        rt = ip_route_connect(fl4, daddr, 0, RT_CONN_FLAGS(sk),
                              sk->sk_bound_dev_if, sk->sk_protocol,
-                              inet->inet_sport, inet->inet_dport, sk, false);
+                              inet->inet_sport, inet->inet_dport, sk);
        if (IS_ERR(rt))
                return PTR_ERR(rt);
@@ -1377,8 +1374,12 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
                if (!NAPI_GRO_CB(p)->same_flow)
                        continue;
-                iph2 = ip_hdr(p);
+                iph2 = (struct iphdr *)(p->data + off);
+                /* The above works because, with the exception of the top
+                 * (inner most) layer, we only aggregate pkts with the same
+                 * hdr length so all the hdrs we'll need to verify will start
+                 * at the same offset.
+                 */
                if ((iph->protocol ^ iph2->protocol) |
                    ((__force u32)iph->saddr ^ (__force u32)iph2->saddr) |
                    ((__force u32)iph->daddr ^ (__force u32)iph2->daddr)) {
@@ -1390,13 +1391,24 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
                NAPI_GRO_CB(p)->flush |=
                        (iph->ttl ^ iph2->ttl) |
                        (iph->tos ^ iph2->tos) |
-                        (__force int)((iph->frag_off ^ iph2->frag_off) & htons(IP_DF)) |
+                        ((iph->frag_off ^ iph2->frag_off) & htons(IP_DF));
-                        ((u16)(ntohs(iph2->id) + NAPI_GRO_CB(p)->count) ^ id);
+                /* Save the IP ID check to be included later when we get to
+                 * the transport layer so only the inner most IP ID is checked.
+                 * This is because some GSO/TSO implementations do not
+                 * correctly increment the IP ID for the outer hdrs.
+                 */
+                NAPI_GRO_CB(p)->flush_id =
+                            ((u16)(ntohs(iph2->id) + NAPI_GRO_CB(p)->count) ^ id);
                NAPI_GRO_CB(p)->flush |= flush;
        }
        NAPI_GRO_CB(skb)->flush |= flush;
+        skb_set_network_header(skb, off);
+        /* The above will be needed by the transport layer if there is one
+         * immediately following this IP hdr.
+         */
        skb_gro_pull(skb, sizeof(*iph));
        skb_set_transport_header(skb, skb_gro_offset(skb));
@@ -1411,10 +1423,10 @@ out:
        return pp;
 }
-static int inet_gro_complete(struct sk_buff *skb)
+static int inet_gro_complete(struct sk_buff *skb, int nhoff)
 {
-        __be16 newlen = htons(skb->len - skb_network_offset(skb));
+        __be16 newlen = htons(skb->len - nhoff);
-        struct iphdr *iph = ip_hdr(skb);
+        struct iphdr *iph = (struct iphdr *)(skb->data + nhoff);
        const struct net_offload *ops;
        int proto = iph->protocol;
        int err = -ENOSYS;
@@ -1427,7 +1439,11 @@ static int inet_gro_complete(struct sk_buff *skb)
        if (WARN_ON(!ops || !ops->callbacks.gro_complete))
                goto out_unlock;
-        err = ops->callbacks.gro_complete(skb);
+        /* Only need to add sizeof(*iph) to get to the next hdr below
+         * because any hdr with option will have been flushed in
+         * inet_gro_receive().
+         */
+        err = ops->callbacks.gro_complete(skb, nhoff + sizeof(*iph));
 out_unlock:
        rcu_read_unlock();
@@ -1529,6 +1545,7 @@ static const struct net_protocol tcp_protocol = {
        .err_handler    =       tcp_v4_err,
        .no_policy      =       1,
        .netns_ok       =       1,
+        .icmp_strict_tag_validation = 1,
 };
 static const struct net_protocol udp_protocol = {
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 7808093cede6..1a9b99e04465 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -166,18 +166,20 @@ struct neigh_table arp_tbl = {
        .id             = "arp_cache",
        .parms          = {
                .tbl                    = &arp_tbl,
-                .base_reachable_time    = 30 * HZ,
-                .retrans_time           = 1 * HZ,
-                .gc_staletime           = 60 * HZ,
                .reachable_time         = 30 * HZ,
-                .delay_probe_time       = 5 * HZ,
+                .data   = {
-                .queue_len_bytes        = 64*1024,
+                        [NEIGH_VAR_MCAST_PROBES] = 3,
-                .ucast_probes           = 3,
+                        [NEIGH_VAR_UCAST_PROBES] = 3,
-                .mcast_probes           = 3,
+                        [NEIGH_VAR_RETRANS_TIME] = 1 * HZ,
-                .anycast_delay          = 1 * HZ,
+                        [NEIGH_VAR_BASE_REACHABLE_TIME] = 30 * HZ,
-                .proxy_delay            = (8 * HZ) / 10,
+                        [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
-                .proxy_qlen             = 64,
+                        [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
-                .locktime               = 1 * HZ,
+                        [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
+                        [NEIGH_VAR_PROXY_QLEN] = 64,
+                        [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
+                        [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
+                        [NEIGH_VAR_LOCKTIME] = 1 * HZ,
+                },
        },
        .gc_interval    = 30 * HZ,
        .gc_thresh1     = 128,
@@ -359,14 +361,14 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
        if (!saddr)
                saddr = inet_select_addr(dev, target, RT_SCOPE_LINK);
-        probes -= neigh->parms->ucast_probes;
+        probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
        if (probes < 0) {
                if (!(neigh->nud_state & NUD_VALID))
                        pr_debug("trying to ucast probe in NUD_INVALID\n");
                neigh_ha_snapshot(dst_ha, neigh, dev);
                dst_hw = dst_ha;
        } else {
-                probes -= neigh->parms->app_probes;
+                probes -= NEIGH_VAR(neigh->parms, APP_PROBES);
                if (probes < 0) {
                        neigh_app_ns(neigh);
                        return;
@@ -379,6 +381,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
 static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
 {
+        struct net *net = dev_net(in_dev->dev);
        int scope;
        switch (IN_DEV_ARP_IGNORE(in_dev)) {
@@ -397,6 +400,7 @@ static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
        case 3: /* Do not reply for scope host addresses */
                sip = 0;
                scope = RT_SCOPE_LINK;
+                in_dev = NULL;
                break;
        case 4: /* Reserved */
        case 5:
@@ -408,7 +412,7 @@ static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
        default:
                return 0;
        }
-        return !inet_confirm_addr(in_dev, sip, tip, scope);
+        return !inet_confirm_addr(net, in_dev, sip, tip, scope);
 }
 static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
@@ -728,6 +732,7 @@ static int arp_process(struct sk_buff *skb)
        int addr_type;
        struct neighbour *n;
        struct net *net = dev_net(dev);
+        bool is_garp = false;
        /* arp_rcv below verifies the ARP header and verifies the device
         * is ARP'able.
@@ -871,7 +876,7 @@ static int arp_process(struct sk_buff *skb)
                                if (NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED ||
                                    skb->pkt_type == PACKET_HOST ||
-                                    in_dev->arp_parms->proxy_delay == 0) {
+                                    NEIGH_VAR(in_dev->arp_parms, PROXY_DELAY) == 0) {
                                        arp_send(ARPOP_REPLY, ETH_P_ARP, sip,
                                                 dev, tip, sha, dev->dev_addr,
                                                 sha);
@@ -894,10 +899,12 @@ static int arp_process(struct sk_buff *skb)
                   It is possible, that this option should be enabled for some
                   devices (strip is candidate)
                 */
+                is_garp = arp->ar_op == htons(ARPOP_REQUEST) && tip == sip &&
+                          inet_addr_type(net, sip) == RTN_UNICAST;
                if (n == NULL &&
-                    (arp->ar_op == htons(ARPOP_REPLY) ||
+                    ((arp->ar_op == htons(ARPOP_REPLY)  &&
-                     (arp->ar_op == htons(ARPOP_REQUEST) && tip == sip)) &&
+                      inet_addr_type(net, sip) == RTN_UNICAST) || is_garp))
-                    inet_addr_type(net, sip) == RTN_UNICAST)
                        n = __neigh_lookup(&arp_tbl, &sip, dev, 1);
        }
@@ -910,7 +917,10 @@ static int arp_process(struct sk_buff *skb)
                   agents are active. Taking the first reply prevents
                   arp trashing and chooses the fastest router.
                 */
-                override = time_after(jiffies, n->updated + n->parms->locktime);
+                override = time_after(jiffies,
+                                      n->updated +
+                                      NEIGH_VAR(n->parms, LOCKTIME)) ||
+                           is_garp;
                /* Broadcast replies and request packets
                   do not assert neighbour reachability.
@@ -1107,7 +1117,7 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev)
        return err;
 }
-int arp_invalidate(struct net_device *dev, __be32 ip)
+static int arp_invalidate(struct net_device *dev, __be32 ip)
 {
        struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev);
        int err = -ENXIO;
@@ -1122,7 +1132,6 @@ int arp_invalidate(struct net_device *dev, __be32 ip)
        return err;
 }
-EXPORT_SYMBOL(arp_invalidate);
 static int arp_req_delete_public(struct net *net, struct arpreq *r,
                struct net_device *dev)
@@ -1284,7 +1293,7 @@ void __init arp_init(void)
        dev_add_pack(&arp_packet_type);
        arp_proc_init();
 #ifdef CONFIG_SYSCTL
-        neigh_sysctl_register(NULL, &arp_tbl.parms, "ipv4", NULL);
+        neigh_sysctl_register(NULL, &arp_tbl.parms, NULL);
 #endif
        register_netdevice_notifier(&arp_netdev_notifier);
 }
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 667c1d4ca984..69e77c8ff285 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -31,8 +31,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
@@ -1336,8 +1335,7 @@ static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
        secattr->flags |= NETLBL_SECATTR_MLS_LVL;
        if (tag_len > 4) {
-                secattr->attr.mls.cat =
+                secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
-                                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
                if (secattr->attr.mls.cat == NULL)
                        return -ENOMEM;
@@ -1432,8 +1430,7 @@ static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
        secattr->flags |= NETLBL_SECATTR_MLS_LVL;
        if (tag_len > 4) {
-                secattr->attr.mls.cat =
+                secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
-                                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
                if (secattr->attr.mls.cat == NULL)
                        return -ENOMEM;
@@ -1527,8 +1524,7 @@ static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
        secattr->flags |= NETLBL_SECATTR_MLS_LVL;
        if (tag_len > 4) {
-                secattr->attr.mls.cat =
+                secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
-                                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
                if (secattr->attr.mls.cat == NULL)
                        return -ENOMEM;
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 19e36376d2a0..8b5134c582f1 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -53,7 +53,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        rt = ip_route_connect(fl4, usin->sin_addr.s_addr, saddr,
                              RT_CONN_FLAGS(sk), oif,
                              sk->sk_protocol,
-                              inet->inet_sport, usin->sin_port, sk, true);
+                              inet->inet_sport, usin->sin_port, sk);
        if (IS_ERR(rt)) {
                err = PTR_ERR(rt);
                if (err == -ENETUNREACH)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a1b5bcbd04ae..ac2dff3c2c1c 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -99,6 +99,7 @@ static const struct nla_policy ifa_ipv4_policy[IFA_MAX+1] = {
        [IFA_BROADCAST]         = { .type = NLA_U32 },
        [IFA_LABEL]             = { .type = NLA_STRING, .len = IFNAMSIZ - 1 },
        [IFA_CACHEINFO]         = { .len = sizeof(struct ifa_cacheinfo) },
+        [IFA_FLAGS]             = { .type = NLA_U32 },
 };
 #define IN4_ADDR_HSIZE_SHIFT    8
@@ -463,7 +464,7 @@ static int __inet_insert_ifa(struct in_ifaddr *ifa, struct nlmsghdr *nlh,
        }
        if (!(ifa->ifa_flags & IFA_F_SECONDARY)) {
-                net_srandom(ifa->ifa_local);
+                prandom_seed((__force u32) ifa->ifa_local);
                ifap = last_primary;
        }
@@ -473,7 +474,7 @@ static int __inet_insert_ifa(struct in_ifaddr *ifa, struct nlmsghdr *nlh,
        inet_hash_insert(dev_net(in_dev->dev), ifa);
        cancel_delayed_work(&check_lifetime_work);
-        schedule_delayed_work(&check_lifetime_work, 0);
+        queue_delayed_work(system_power_efficient_wq, &check_lifetime_work, 0);
        /* Send message first, then call notifier.
           Notifier will trigger FIB update, so that
@@ -500,6 +501,7 @@ static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
                return -ENOBUFS;
        }
        ipv4_devconf_setall(in_dev);
+        neigh_parms_data_state_setall(in_dev->arp_parms);
        if (ifa->ifa_dev != in_dev) {
                WARN_ON(ifa->ifa_dev);
                in_dev_hold(in_dev);
@@ -682,7 +684,8 @@ static void check_lifetime(struct work_struct *work)
        if (time_before(next_sched, now + ADDRCONF_TIMER_FUZZ_MAX))
                next_sched = now + ADDRCONF_TIMER_FUZZ_MAX;
-        schedule_delayed_work(&check_lifetime_work, next_sched - now);
+        queue_delayed_work(system_power_efficient_wq, &check_lifetime_work,
+                        next_sched - now);
 }
 static void set_ifa_lifetime(struct in_ifaddr *ifa, __u32 valid_lft,
@@ -747,6 +750,7 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
                goto errout;
        ipv4_devconf_setall(in_dev);
+        neigh_parms_data_state_setall(in_dev->arp_parms);
        in_dev_hold(in_dev);
        if (tb[IFA_ADDRESS] == NULL)
@@ -755,7 +759,8 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
        INIT_HLIST_NODE(&ifa->hash);
        ifa->ifa_prefixlen = ifm->ifa_prefixlen;
        ifa->ifa_mask = inet_make_mask(ifm->ifa_prefixlen);
-        ifa->ifa_flags = ifm->ifa_flags;
+        ifa->ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) :
+                                         ifm->ifa_flags;
        ifa->ifa_scope = ifm->ifa_scope;
        ifa->ifa_dev = in_dev;
@@ -838,7 +843,8 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
                ifa = ifa_existing;
                set_ifa_lifetime(ifa, valid_lft, prefered_lft);
                cancel_delayed_work(&check_lifetime_work);
-                schedule_delayed_work(&check_lifetime_work, 0);
+                queue_delayed_work(system_power_efficient_wq,
+                                &check_lifetime_work, 0);
                rtmsg_ifa(RTM_NEWADDR, ifa, nlh, NETLINK_CB(skb).portid);
                blocking_notifier_call_chain(&inetaddr_chain, NETDEV_UP, ifa);
        }
@@ -1236,22 +1242,21 @@ static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
 /*
 * Confirm that local IP address exists using wildcards:
- * - in_dev: only on this interface, 0=any interface
+ * - net: netns to check, cannot be NULL
+ * - in_dev: only on this interface, NULL=any interface
 * - dst: only in the same subnet as dst, 0=any dst
 * - local: address, 0=autoselect the local address
 * - scope: maximum allowed scope value for the local address
 */
-__be32 inet_confirm_addr(struct in_device *in_dev,
+__be32 inet_confirm_addr(struct net *net, struct in_device *in_dev,
                         __be32 dst, __be32 local, int scope)
 {
        __be32 addr = 0;
        struct net_device *dev;
-        struct net *net;
-        if (scope != RT_SCOPE_LINK)
+        if (in_dev != NULL)
                return confirm_addr_indev(in_dev, dst, local, scope);
-        net = dev_net(in_dev->dev);
        rcu_read_lock();
        for_each_netdev_rcu(net, dev) {
                in_dev = __in_dev_get_rcu(dev);
@@ -1382,6 +1387,8 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                                memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
                                set_ifa_lifetime(ifa, INFINITY_LIFE_TIME,
                                                 INFINITY_LIFE_TIME);
+                                ipv4_devconf_setall(in_dev);
+                                neigh_parms_data_state_setall(in_dev->arp_parms);
                                inet_insert_ifa(ifa);
                        }
                }
@@ -1435,7 +1442,8 @@ static size_t inet_nlmsg_size(void)
               + nla_total_size(4) /* IFA_ADDRESS */
               + nla_total_size(4) /* IFA_LOCAL */
               + nla_total_size(4) /* IFA_BROADCAST */
-               + nla_total_size(IFNAMSIZ); /* IFA_LABEL */
+               + nla_total_size(IFNAMSIZ) /* IFA_LABEL */
+               + nla_total_size(4);  /* IFA_FLAGS */
 }
 static inline u32 cstamp_delta(unsigned long cstamp)
@@ -1503,6 +1511,7 @@ static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
             nla_put_be32(skb, IFA_BROADCAST, ifa->ifa_broadcast)) ||
            (ifa->ifa_label[0] &&
             nla_put_string(skb, IFA_LABEL, ifa->ifa_label)) ||
+            nla_put_u32(skb, IFA_FLAGS, ifa->ifa_flags) ||
            put_cacheinfo(skb, ifa->ifa_cstamp, ifa->ifa_tstamp,
                          preferred, valid))
                goto nla_put_failure;
@@ -1691,6 +1700,8 @@ static int inet_netconf_msgsize_devconf(int type)
                size += nla_total_size(4);
        if (type == -1 || type == NETCONFA_MC_FORWARDING)
                size += nla_total_size(4);
+        if (type == -1 || type == NETCONFA_PROXY_NEIGH)
+                size += nla_total_size(4);
        return size;
 }
@@ -1727,6 +1738,10 @@ static int inet_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
            nla_put_s32(skb, NETCONFA_MC_FORWARDING,
                        IPV4_DEVCONF(*devconf, MC_FORWARDING)) < 0)
                goto nla_put_failure;
+        if ((type == -1 || type == NETCONFA_PROXY_NEIGH) &&
+            nla_put_s32(skb, NETCONFA_PROXY_NEIGH,
+                        IPV4_DEVCONF(*devconf, PROXY_ARP)) < 0)
+                goto nla_put_failure;
        return nlmsg_end(skb, nlh);
@@ -1764,6 +1779,7 @@ static const struct nla_policy devconf_ipv4_policy[NETCONFA_MAX+1] = {
        [NETCONFA_IFINDEX]      = { .len = sizeof(int) },
        [NETCONFA_FORWARDING]   = { .len = sizeof(int) },
        [NETCONFA_RP_FILTER]    = { .len = sizeof(int) },
+        [NETCONFA_PROXY_NEIGH]  = { .len = sizeof(int) },
 };
 static int inet_netconf_get_devconf(struct sk_buff *in_skb,
@@ -1945,6 +1961,19 @@ static void inet_forward_change(struct net *net)
        }
 }
+static int devinet_conf_ifindex(struct net *net, struct ipv4_devconf *cnf)
+{
+        if (cnf == net->ipv4.devconf_dflt)
+                return NETCONFA_IFINDEX_DEFAULT;
+        else if (cnf == net->ipv4.devconf_all)
+                return NETCONFA_IFINDEX_ALL;
+        else {
+                struct in_device *idev
+                        = container_of(cnf, struct in_device, cnf);
+                return idev->dev->ifindex;
+        }
+}
 static int devinet_conf_proc(struct ctl_table *ctl, int write,
                             void __user *buffer,
                             size_t *lenp, loff_t *ppos)
@@ -1957,6 +1986,7 @@ static int devinet_conf_proc(struct ctl_table *ctl, int write,
                struct ipv4_devconf *cnf = ctl->extra1;
                struct net *net = ctl->extra2;
                int i = (int *)ctl->data - cnf->data;
+                int ifindex;
                set_bit(i, cnf->state);
@@ -1966,23 +1996,19 @@ static int devinet_conf_proc(struct ctl_table *ctl, int write,
                    i == IPV4_DEVCONF_ROUTE_LOCALNET - 1)
                        if ((new_value == 0) && (old_value != 0))
                                rt_cache_flush(net);
                if (i == IPV4_DEVCONF_RP_FILTER - 1 &&
                    new_value != old_value) {
-                        int ifindex;
+                        ifindex = devinet_conf_ifindex(net, cnf);
-                        if (cnf == net->ipv4.devconf_dflt)
-                                ifindex = NETCONFA_IFINDEX_DEFAULT;
-                        else if (cnf == net->ipv4.devconf_all)
-                                ifindex = NETCONFA_IFINDEX_ALL;
-                        else {
-                                struct in_device *idev =
-                                        container_of(cnf, struct in_device,
-                                                     cnf);
-                                ifindex = idev->dev->ifindex;
-                        }
                        inet_netconf_notify_devconf(net, NETCONFA_RP_FILTER,
                                                    ifindex, cnf);
                }
+                if (i == IPV4_DEVCONF_PROXY_ARP - 1 &&
+                    new_value != old_value) {
+                        ifindex = devinet_conf_ifindex(net, cnf);
+                        inet_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
+                                                    ifindex, cnf);
+                }
        }
        return ret;
@@ -2160,7 +2186,7 @@ static void __devinet_sysctl_unregister(struct ipv4_devconf *cnf)
 static void devinet_sysctl_register(struct in_device *idev)
 {
-        neigh_sysctl_register(idev->dev, idev->arp_parms, "ipv4", NULL);
+        neigh_sysctl_register(idev->dev, idev->arp_parms, NULL);
        __devinet_sysctl_register(dev_net(idev->dev), idev->dev->name,
                                        &idev->cnf);
 }
@@ -2298,7 +2324,7 @@ void __init devinet_init(void)
        register_gifconf(PF_INET, inet_gifconf);
        register_netdevice_notifier(&ip_netdev_notifier);
-        schedule_delayed_work(&check_lifetime_work, 0);
+        queue_delayed_work(system_power_efficient_wq, &check_lifetime_work, 0);
        rtnl_af_register(&inet_af_ops);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index d846304b7b89..c7539e22868b 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1047,6 +1047,8 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
        }
        in_dev = __in_dev_get_rtnl(dev);
+        if (!in_dev)
+                return NOTIFY_DONE;
        switch (event) {
        case NETDEV_UP:
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index 388d113fd289..1e4f6600b31d 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -33,8 +33,6 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event, u32 tb_id,
 void rtmsg_fib(int event, __be32 key, struct fib_alias *fa, int dst_len,
               u32 tb_id, const struct nl_info *info, unsigned int nlm_flags);
 struct fib_alias *fib_find_alias(struct list_head *fah, u8 tos, u32 prio);
-int fib_detect_death(struct fib_info *fi, int order,
-                     struct fib_info **last_resort, int *last_idx, int dflt);
 static inline void fib_result_assign(struct fib_result *res,
                                     struct fib_info *fi)
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index e63f47a4e651..b53f0bf84dca 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -426,8 +426,9 @@ struct fib_alias *fib_find_alias(struct list_head *fah, u8 tos, u32 prio)
        return NULL;
 }
-int fib_detect_death(struct fib_info *fi, int order,
+static int fib_detect_death(struct fib_info *fi, int order,
-                     struct fib_info **last_resort, int *last_idx, int dflt)
+                            struct fib_info **last_resort, int *last_idx,
+                            int dflt)
 {
        struct neighbour *n;
        int state = NUD_NONE;
diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
index 5893e99e8299..1863422fb7d5 100644
--- a/net/ipv4/gre_demux.c
+++ b/net/ipv4/gre_demux.c
@@ -355,14 +355,7 @@ static int __init gre_init(void)
                goto err_gre;
        }
-        if (gre_offload_init()) {
-                pr_err("can't add protocol offload\n");
-                goto err_gso;
-        }
        return 0;
-err_gso:
-        gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
 err_gre:
        inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
 err:
@@ -371,8 +364,6 @@ err:
 static void __exit gre_exit(void)
 {
-        gre_offload_exit();
        gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
        inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
 }
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index 2cd02f32f99f..f1d32280cb54 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -11,6 +11,7 @@
 */
 #include <linux/skbuff.h>
+#include <linux/init.h>
 #include <net/protocol.h>
 #include <net/gre.h>
@@ -26,7 +27,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
 {
        struct sk_buff *segs = ERR_PTR(-EINVAL);
        netdev_features_t enc_features;
-        int ghl = GRE_HEADER_SECTION;
+        int ghl;
        struct gre_base_hdr *greh;
        u16 mac_offset = skb->mac_header;
        int mac_len = skb->mac_len;
@@ -49,15 +50,11 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
        greh = (struct gre_base_hdr *)skb_transport_header(skb);
-        if (greh->flags & GRE_KEY)
+        ghl = skb_inner_network_header(skb) - skb_transport_header(skb);
-                ghl += GRE_HEADER_SECTION;
+        if (unlikely(ghl < sizeof(*greh)))
-        if (greh->flags & GRE_SEQ)
+                goto out;
-                ghl += GRE_HEADER_SECTION;
-        if (greh->flags & GRE_CSUM) {
+        csum = !!(greh->flags & GRE_CSUM);
-                ghl += GRE_HEADER_SECTION;
-                csum = true;
-        } else
-                csum = false;
        if (unlikely(!pskb_may_pull(skb, ghl)))
                goto out;
@@ -116,19 +113,175 @@ out:
        return segs;
 }
+/* Compute the whole skb csum in s/w and store it, then verify GRO csum
+ * starting from gro_offset.
+ */
+static __sum16 gro_skb_checksum(struct sk_buff *skb)
+{
+        __sum16 sum;
+        skb->csum = skb_checksum(skb, 0, skb->len, 0);
+        NAPI_GRO_CB(skb)->csum = csum_sub(skb->csum,
+                csum_partial(skb->data, skb_gro_offset(skb), 0));
+        sum = csum_fold(NAPI_GRO_CB(skb)->csum);
+        if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE)) {
+                if (unlikely(!sum))
+                        netdev_rx_csum_fault(skb->dev);
+        } else
+                skb->ip_summed = CHECKSUM_COMPLETE;
+        return sum;
+}
+static struct sk_buff **gre_gro_receive(struct sk_buff **head,
+                                        struct sk_buff *skb)
+{
+        struct sk_buff **pp = NULL;
+        struct sk_buff *p;
+        const struct gre_base_hdr *greh;
+        unsigned int hlen, grehlen;
+        unsigned int off;
+        int flush = 1;
+        struct packet_offload *ptype;
+        __be16 type;
+        off = skb_gro_offset(skb);
+        hlen = off + sizeof(*greh);
+        greh = skb_gro_header_fast(skb, off);
+        if (skb_gro_header_hard(skb, hlen)) {
+                greh = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!greh))
+                        goto out;
+        }
+        /* Only support version 0 and K (key), C (csum) flags. Note that
+         * although the support for the S (seq#) flag can be added easily
+         * for GRO, this is problematic for GSO hence can not be enabled
+         * here because a GRO pkt may end up in the forwarding path, thus
+         * requiring GSO support to break it up correctly.
+         */
+        if ((greh->flags & ~(GRE_KEY|GRE_CSUM)) != 0)
+                goto out;
+        type = greh->protocol;
+        rcu_read_lock();
+        ptype = gro_find_receive_by_type(type);
+        if (ptype == NULL)
+                goto out_unlock;
+        grehlen = GRE_HEADER_SECTION;
+        if (greh->flags & GRE_KEY)
+                grehlen += GRE_HEADER_SECTION;
+        if (greh->flags & GRE_CSUM)
+                grehlen += GRE_HEADER_SECTION;
+        hlen = off + grehlen;
+        if (skb_gro_header_hard(skb, hlen)) {
+                greh = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!greh))
+                        goto out_unlock;
+        }
+        if (greh->flags & GRE_CSUM) { /* Need to verify GRE csum first */
+                __sum16 csum = 0;
+                if (skb->ip_summed == CHECKSUM_COMPLETE)
+                        csum = csum_fold(NAPI_GRO_CB(skb)->csum);
+                /* Don't trust csum error calculated/reported by h/w */
+                if (skb->ip_summed == CHECKSUM_NONE || csum != 0)
+                        csum = gro_skb_checksum(skb);
+                /* GRE CSUM is the 1's complement of the 1's complement sum
+                 * of the GRE hdr plus payload so it should add up to 0xffff
+                 * (and 0 after csum_fold()) just like the IPv4 hdr csum.
+                 */
+                if (csum)
+                        goto out_unlock;
+        }
+        flush = 0;
+        for (p = *head; p; p = p->next) {
+                const struct gre_base_hdr *greh2;
+                if (!NAPI_GRO_CB(p)->same_flow)
+                        continue;
+                /* The following checks are needed to ensure only pkts
+                 * from the same tunnel are considered for aggregation.
+                 * The criteria for "the same tunnel" includes:
+                 * 1) same version (we only support version 0 here)
+                 * 2) same protocol (we only support ETH_P_IP for now)
+                 * 3) same set of flags
+                 * 4) same key if the key field is present.
+                 */
+                greh2 = (struct gre_base_hdr *)(p->data + off);
+                if (greh2->flags != greh->flags ||
+                    greh2->protocol != greh->protocol) {
+                        NAPI_GRO_CB(p)->same_flow = 0;
+                        continue;
+                }
+                if (greh->flags & GRE_KEY) {
+                        /* compare keys */
+                        if (*(__be32 *)(greh2+1) != *(__be32 *)(greh+1)) {
+                                NAPI_GRO_CB(p)->same_flow = 0;
+                                continue;
+                        }
+                }
+        }
+        skb_gro_pull(skb, grehlen);
+        /* Adjusted NAPI_GRO_CB(skb)->csum after skb_gro_pull()*/
+        skb_gro_postpull_rcsum(skb, greh, grehlen);
+        pp = ptype->callbacks.gro_receive(head, skb);
+out_unlock:
+        rcu_read_unlock();
+out:
+        NAPI_GRO_CB(skb)->flush |= flush;
+        return pp;
+}
+static int gre_gro_complete(struct sk_buff *skb, int nhoff)
+{
+        struct gre_base_hdr *greh = (struct gre_base_hdr *)(skb->data + nhoff);
+        struct packet_offload *ptype;
+        unsigned int grehlen = sizeof(*greh);
+        int err = -ENOENT;
+        __be16 type;
+        type = greh->protocol;
+        if (greh->flags & GRE_KEY)
+                grehlen += GRE_HEADER_SECTION;
+        if (greh->flags & GRE_CSUM)
+                grehlen += GRE_HEADER_SECTION;
+        rcu_read_lock();
+        ptype = gro_find_complete_by_type(type);
+        if (ptype != NULL)
+                err = ptype->callbacks.gro_complete(skb, nhoff + grehlen);
+        rcu_read_unlock();
+        return err;
+}
 static const struct net_offload gre_offload = {
        .callbacks = {
                .gso_send_check = gre_gso_send_check,
                .gso_segment = gre_gso_segment,
+                .gro_receive = gre_gro_receive,
+                .gro_complete = gre_gro_complete,
        },
 };
-int __init gre_offload_init(void)
+static int __init gre_offload_init(void)
 {
        return inet_add_offload(&gre_offload, IPPROTO_GRE);
 }
+device_initcall(gre_offload_init);
-void __exit gre_offload_exit(void)
-{
-        inet_del_offload(&gre_offload, IPPROTO_GRE);
-}
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 5c0e8bc6e5ba..0134663fdbce 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -668,6 +668,16 @@ static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
        rcu_read_unlock();
 }
+static bool icmp_tag_validation(int proto)
+{
+        bool ok;
+        rcu_read_lock();
+        ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
+        rcu_read_unlock();
+        return ok;
+}
 /*
 *      Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEED, ICMP_QUENCH, and
 *      ICMP_PARAMETERPROB.
@@ -705,10 +715,22 @@ static void icmp_unreach(struct sk_buff *skb)
                case ICMP_PORT_UNREACH:
                        break;
                case ICMP_FRAG_NEEDED:
-                        if (ipv4_config.no_pmtu_disc) {
+                        /* for documentation of the ip_no_pmtu_disc
+                         * values please see
+                         * Documentation/networking/ip-sysctl.txt
+                         */
+                        switch (net->ipv4.sysctl_ip_no_pmtu_disc) {
+                        default:
                                LIMIT_NETDEBUG(KERN_INFO pr_fmt("%pI4: fragmentation needed and DF set\n"),
                                               &iph->daddr);
-                        } else {
+                                break;
+                        case 2:
+                                goto out;
+                        case 3:
+                                if (!icmp_tag_validation(iph->protocol))
+                                        goto out;
+                                /* fall through */
+                        case 0:
                                info = ntohs(icmph->un.frag.mtu);
                                if (!info)
                                        goto out;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 7defdc9ba167..97e4d1655d26 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -211,7 +211,7 @@ static void igmp_stop_timer(struct ip_mc_list *im)
 /* It must be called with locked im->lock */
 static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
 {
-        int tv = net_random() % max_delay;
+        int tv = prandom_u32() % max_delay;
        im->tm_running = 1;
        if (!mod_timer(&im->timer, jiffies+tv+2))
@@ -220,7 +220,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
 static void igmp_gq_start_timer(struct in_device *in_dev)
 {
-        int tv = net_random() % in_dev->mr_maxdelay;
+        int tv = prandom_u32() % in_dev->mr_maxdelay;
        in_dev->mr_gq_running = 1;
        if (!mod_timer(&in_dev->mr_gq_timer, jiffies+tv+2))
@@ -229,7 +229,7 @@ static void igmp_gq_start_timer(struct in_device *in_dev)
 static void igmp_ifc_start_timer(struct in_device *in_dev, int delay)
 {
-        int tv = net_random() % delay;
+        int tv = prandom_u32() % delay;
        if (!mod_timer(&in_dev->mr_ifc_timer, jiffies+tv+2))
                in_dev_hold(in_dev);
@@ -310,7 +310,7 @@ igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
        struct ip_sf_list *psf;
        int scount = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (!is_in(pmc, psf, type, gdeleted, sdeleted))
                        continue;
                scount++;
@@ -463,7 +463,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
        }
        first = 1;
        psf_prev = NULL;
-        for (psf=*psf_list; psf; psf=psf_next) {
+        for (psf = *psf_list; psf; psf = psf_next) {
                __be32 *psrc;
                psf_next = psf->sf_next;
@@ -520,7 +520,7 @@ empty_source:
                        return skb;
                if (pmc->crcount || isquery) {
                        /* make sure we have room for group header */
-                        if (skb && AVAILABLE(skb)<sizeof(struct igmpv3_grec)) {
+                        if (skb && AVAILABLE(skb) < sizeof(struct igmpv3_grec)) {
                                igmpv3_sendpack(skb);
                                skb = NULL; /* add_grhead will get a new one */
                        }
@@ -576,7 +576,7 @@ static void igmpv3_clear_zeros(struct ip_sf_list **ppsf)
        struct ip_sf_list *psf_prev, *psf_next, *psf;
        psf_prev = NULL;
-        for (psf=*ppsf; psf; psf = psf_next) {
+        for (psf = *ppsf; psf; psf = psf_next) {
                psf_next = psf->sf_next;
                if (psf->sf_crcount == 0) {
                        if (psf_prev)
@@ -600,7 +600,7 @@ static void igmpv3_send_cr(struct in_device *in_dev)
        /* deleted MCA's */
        pmc_prev = NULL;
-        for (pmc=in_dev->mc_tomb; pmc; pmc=pmc_next) {
+        for (pmc = in_dev->mc_tomb; pmc; pmc = pmc_next) {
                pmc_next = pmc->next;
                if (pmc->sfmode == MCAST_INCLUDE) {
                        type = IGMPV3_BLOCK_OLD_SOURCES;
@@ -764,7 +764,7 @@ static void igmp_ifc_event(struct in_device *in_dev)
 static void igmp_timer_expire(unsigned long data)
 {
-        struct ip_mc_list *im=(struct ip_mc_list *)data;
+        struct ip_mc_list *im = (struct ip_mc_list *)data;
        struct in_device *in_dev = im->interface;
        spin_lock(&im->lock);
@@ -794,10 +794,10 @@ static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
        int i, scount;
        scount = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (scount == nsrcs)
                        break;
-                for (i=0; i<nsrcs; i++) {
+                for (i = 0; i < nsrcs; i++) {
                        /* skip inactive filters */
                        if (psf->sf_count[MCAST_INCLUDE] ||
                            pmc->sfcount[MCAST_EXCLUDE] !=
@@ -825,10 +825,10 @@ static int igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
        /* mark INCLUDE-mode sources */
        scount = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (scount == nsrcs)
                        break;
-                for (i=0; i<nsrcs; i++)
+                for (i = 0; i < nsrcs; i++)
                        if (srcs[i] == psf->sf_inaddr) {
                                psf->sf_gsresp = 1;
                                scount++;
@@ -1103,7 +1103,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
                pmc->tomb = im->tomb;
                pmc->sources = im->sources;
                im->tomb = im->sources = NULL;
-                for (psf=pmc->sources; psf; psf=psf->sf_next)
+                for (psf = pmc->sources; psf; psf = psf->sf_next)
                        psf->sf_crcount = pmc->crcount;
        }
        spin_unlock_bh(&im->lock);
@@ -1121,7 +1121,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr)
        spin_lock_bh(&in_dev->mc_tomb_lock);
        pmc_prev = NULL;
-        for (pmc=in_dev->mc_tomb; pmc; pmc=pmc->next) {
+        for (pmc = in_dev->mc_tomb; pmc; pmc = pmc->next) {
                if (pmc->multiaddr == multiaddr)
                        break;
                pmc_prev = pmc;
@@ -1134,7 +1134,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr)
        }
        spin_unlock_bh(&in_dev->mc_tomb_lock);
        if (pmc) {
-                for (psf=pmc->tomb; psf; psf=psf_next) {
+                for (psf = pmc->tomb; psf; psf = psf_next) {
                        psf_next = psf->sf_next;
                        kfree(psf);
                }
@@ -1167,7 +1167,7 @@ static void igmpv3_clear_delrec(struct in_device *in_dev)
                psf = pmc->tomb;
                pmc->tomb = NULL;
                spin_unlock_bh(&pmc->lock);
-                for (; psf; psf=psf_next) {
+                for (; psf; psf = psf_next) {
                        psf_next = psf->sf_next;
                        kfree(psf);
                }
@@ -1557,7 +1557,7 @@ static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
        int rv = 0;
        psf_prev = NULL;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (psf->sf_inaddr == *psfsrc)
                        break;
                psf_prev = psf;
@@ -1630,7 +1630,7 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                pmc->sfcount[sfmode]--;
        }
        err = 0;
-        for (i=0; i<sfcount; i++) {
+        for (i = 0; i < sfcount; i++) {
                int rv = ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
                changerec |= rv > 0;
@@ -1650,7 +1650,7 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
                        IGMP_Unsolicited_Report_Count;
                in_dev->mr_ifc_count = pmc->crcount;
-                for (psf=pmc->sources; psf; psf = psf->sf_next)
+                for (psf = pmc->sources; psf; psf = psf->sf_next)
                        psf->sf_crcount = 0;
                igmp_ifc_event(pmc->interface);
        } else if (sf_setstate(pmc) || changerec) {
@@ -1671,7 +1671,7 @@ static int ip_mc_add1_src(struct ip_mc_list *pmc, int sfmode,
        struct ip_sf_list *psf, *psf_prev;
        psf_prev = NULL;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (psf->sf_inaddr == *psfsrc)
                        break;
                psf_prev = psf;
@@ -1699,7 +1699,7 @@ static void sf_markstate(struct ip_mc_list *pmc)
        struct ip_sf_list *psf;
        int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
-        for (psf=pmc->sources; psf; psf=psf->sf_next)
+        for (psf = pmc->sources; psf; psf = psf->sf_next)
                if (pmc->sfcount[MCAST_EXCLUDE]) {
                        psf->sf_oldin = mca_xcount ==
                                psf->sf_count[MCAST_EXCLUDE] &&
@@ -1716,7 +1716,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
        int new_in, rv;
        rv = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (pmc->sfcount[MCAST_EXCLUDE]) {
                        new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
                                !psf->sf_count[MCAST_INCLUDE];
@@ -1726,7 +1726,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
                        if (!psf->sf_oldin) {
                                struct ip_sf_list *prev = NULL;
-                                for (dpsf=pmc->tomb; dpsf; dpsf=dpsf->sf_next) {
+                                for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next) {
                                        if (dpsf->sf_inaddr == psf->sf_inaddr)
                                                break;
                                        prev = dpsf;
@@ -1748,7 +1748,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
                         * add or update "delete" records if an active filter
                         * is now inactive
                         */
-                        for (dpsf=pmc->tomb; dpsf; dpsf=dpsf->sf_next)
+                        for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next)
                                if (dpsf->sf_inaddr == psf->sf_inaddr)
                                        break;
                        if (!dpsf) {
@@ -1800,7 +1800,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
        if (!delta)
                pmc->sfcount[sfmode]++;
        err = 0;
-        for (i=0; i<sfcount; i++) {
+        for (i = 0; i < sfcount; i++) {
                err = ip_mc_add1_src(pmc, sfmode, &psfsrc[i]);
                if (err)
                        break;
@@ -1810,7 +1810,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                if (!delta)
                        pmc->sfcount[sfmode]--;
-                for (j=0; j<i; j++)
+                for (j = 0; j < i; j++)
                        (void) ip_mc_del1_src(pmc, sfmode, &psfsrc[j]);
        } else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
 #ifdef CONFIG_IP_MULTICAST
@@ -1829,7 +1829,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
                        IGMP_Unsolicited_Report_Count;
                in_dev->mr_ifc_count = pmc->crcount;
-                for (psf=pmc->sources; psf; psf = psf->sf_next)
+                for (psf = pmc->sources; psf; psf = psf->sf_next)
                        psf->sf_crcount = 0;
                igmp_ifc_event(in_dev);
        } else if (sf_setstate(pmc)) {
@@ -1844,12 +1844,12 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc)
 {
        struct ip_sf_list *psf, *nextpsf;
-        for (psf=pmc->tomb; psf; psf=nextpsf) {
+        for (psf = pmc->tomb; psf; psf = nextpsf) {
                nextpsf = psf->sf_next;
                kfree(psf);
        }
        pmc->tomb = NULL;
-        for (psf=pmc->sources; psf; psf=nextpsf) {
+        for (psf = pmc->sources; psf; psf = nextpsf) {
                nextpsf = psf->sf_next;
                kfree(psf);
        }
@@ -2043,7 +2043,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                if (!psl)
                        goto done;      /* err = -EADDRNOTAVAIL */
                rv = !0;
-                for (i=0; i<psl->sl_count; i++) {
+                for (i = 0; i < psl->sl_count; i++) {
                        rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
                                sizeof(__be32));
                        if (rv == 0)
@@ -2062,7 +2062,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
                        &mreqs->imr_sourceaddr, 1);
-                for (j=i+1; j<psl->sl_count; j++)
+                for (j = i+1; j < psl->sl_count; j++)
                        psl->sl_addr[j-1] = psl->sl_addr[j];
                psl->sl_count--;
                err = 0;
@@ -2088,7 +2088,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                newpsl->sl_max = count;
                newpsl->sl_count = count - IP_SFBLOCK;
                if (psl) {
-                        for (i=0; i<psl->sl_count; i++)
+                        for (i = 0; i < psl->sl_count; i++)
                                newpsl->sl_addr[i] = psl->sl_addr[i];
                        /* decrease mem now to avoid the memleak warning */
                        atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
@@ -2098,7 +2098,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                psl = newpsl;
        }
        rv = 1; /* > 0 for insert logic below if sl_count is 0 */
-        for (i=0; i<psl->sl_count; i++) {
+        for (i = 0; i < psl->sl_count; i++) {
                rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
                        sizeof(__be32));
                if (rv == 0)
@@ -2106,7 +2106,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
        }
        if (rv == 0)            /* address already there is an error */
                goto done;
-        for (j=psl->sl_count-1; j>=i; j--)
+        for (j = psl->sl_count-1; j >= i; j--)
                psl->sl_addr[j+1] = psl->sl_addr[j];
        psl->sl_addr[i] = mreqs->imr_sourceaddr;
        psl->sl_count++;
@@ -2305,7 +2305,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
            copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) {
                return -EFAULT;
        }
-        for (i=0; i<copycount; i++) {
+        for (i = 0; i < copycount; i++) {
                struct sockaddr_storage ss;
                psin = (struct sockaddr_in *)&ss;
@@ -2350,7 +2350,7 @@ int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
        if (!psl)
                goto unlock;
-        for (i=0; i<psl->sl_count; i++) {
+        for (i = 0; i < psl->sl_count; i++) {
                if (psl->sl_addr[i] == rmt_addr)
                        break;
        }
@@ -2423,7 +2423,7 @@ int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u
                rv = 1;
        } else if (im) {
                if (src_addr) {
-                        for (psf=im->sources; psf; psf=psf->sf_next) {
+                        for (psf = im->sources; psf; psf = psf->sf_next) {
                                if (psf->sf_inaddr == src_addr)
                                        break;
                        }
@@ -2762,6 +2762,7 @@ static struct pernet_operations igmp_net_ops = {
        .init = igmp_net_init,
        .exit = igmp_net_exit,
 };
+#endif
 static int igmp_netdev_event(struct notifier_block *this,
                             unsigned long event, void *ptr)
@@ -2785,8 +2786,9 @@ static struct notifier_block igmp_notifier = {
        .notifier_call = igmp_netdev_event,
 };
-int __init igmp_mc_proc_init(void)
+int __init igmp_mc_init(void)
 {
+#if defined(CONFIG_PROC_FS)
        int err;
        err = register_pernet_subsys(&igmp_net_ops);
@@ -2800,5 +2802,7 @@ int __init igmp_mc_proc_init(void)
 reg_notif_fail:
        unregister_pernet_subsys(&igmp_net_ops);
        return err;
-}
+#else
+        return register_netdevice_notifier(&igmp_notifier);
 #endif
+}
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index fc0e649cc002..0d1e2cb877ec 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -109,7 +109,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
 again:
                inet_get_local_port_range(net, &low, &high);
                remaining = (high - low) + 1;
-                smallest_rover = rover = net_random() % remaining + low;
+                smallest_rover = rover = prandom_u32() % remaining + low;
                smallest_size = -1;
                do {
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index 1975f52933c5..f17ea49b28fb 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -230,29 +230,6 @@ static void lro_add_packet(struct net_lro_desc *lro_desc, struct sk_buff *skb,
        lro_desc->last_skb = skb;
 }
-static void lro_add_frags(struct net_lro_desc *lro_desc,
-                          int len, int hlen, int truesize,
-                          struct skb_frag_struct *skb_frags,
-                          struct iphdr *iph, struct tcphdr *tcph)
-{
-        struct sk_buff *skb = lro_desc->parent;
-        int tcp_data_len = TCP_PAYLOAD_LENGTH(iph, tcph);
-        lro_add_common(lro_desc, iph, tcph, tcp_data_len);
-        skb->truesize += truesize;
-        skb_frags[0].page_offset += hlen;
-        skb_frag_size_sub(&skb_frags[0], hlen);
-        while (tcp_data_len > 0) {
-                *(lro_desc->next_frag) = *skb_frags;
-                tcp_data_len -= skb_frag_size(skb_frags);
-                lro_desc->next_frag++;
-                skb_frags++;
-                skb_shinfo(skb)->nr_frags++;
-        }
-}
 static int lro_check_tcp_conn(struct net_lro_desc *lro_desc,
                              struct iphdr *iph,
@@ -371,128 +348,6 @@ out:
        return 1;
 }
-static struct sk_buff *lro_gen_skb(struct net_lro_mgr *lro_mgr,
-                                   struct skb_frag_struct *frags,
-                                   int len, int true_size,
-                                   void *mac_hdr,
-                                   int hlen, __wsum sum,
-                                   u32 ip_summed)
-{
-        struct sk_buff *skb;
-        struct skb_frag_struct *skb_frags;
-        int data_len = len;
-        int hdr_len = min(len, hlen);
-        skb = netdev_alloc_skb(lro_mgr->dev, hlen + lro_mgr->frag_align_pad);
-        if (!skb)
-                return NULL;
-        skb_reserve(skb, lro_mgr->frag_align_pad);
-        skb->len = len;
-        skb->data_len = len - hdr_len;
-        skb->truesize += true_size;
-        skb->tail += hdr_len;
-        memcpy(skb->data, mac_hdr, hdr_len);
-        skb_frags = skb_shinfo(skb)->frags;
-        while (data_len > 0) {
-                *skb_frags = *frags;
-                data_len -= skb_frag_size(frags);
-                skb_frags++;
-                frags++;
-                skb_shinfo(skb)->nr_frags++;
-        }
-        skb_shinfo(skb)->frags[0].page_offset += hdr_len;
-        skb_frag_size_sub(&skb_shinfo(skb)->frags[0], hdr_len);
-        skb->ip_summed = ip_summed;
-        skb->csum = sum;
-        skb->protocol = eth_type_trans(skb, lro_mgr->dev);
-        return skb;
-}
-static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
-                                          struct skb_frag_struct *frags,
-                                          int len, int true_size,
-                                          void *priv, __wsum sum)
-{
-        struct net_lro_desc *lro_desc;
-        struct iphdr *iph;
-        struct tcphdr *tcph;
-        struct sk_buff *skb;
-        u64 flags;
-        void *mac_hdr;
-        int mac_hdr_len;
-        int hdr_len = LRO_MAX_PG_HLEN;
-        int vlan_hdr_len = 0;
-        if (!lro_mgr->get_frag_header ||
-            lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
-                                     (void *)&tcph, &flags, priv)) {
-                mac_hdr = skb_frag_address(frags);
-                goto out1;
-        }
-        if (!(flags & LRO_IPV4) || !(flags & LRO_TCP))
-                goto out1;
-        hdr_len = (int)((void *)(tcph) + TCP_HDR_LEN(tcph) - mac_hdr);
-        mac_hdr_len = (int)((void *)(iph) - mac_hdr);
-        lro_desc = lro_get_desc(lro_mgr, lro_mgr->lro_arr, iph, tcph);
-        if (!lro_desc)
-                goto out1;
-        if (!lro_desc->active) { /* start new lro session */
-                if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, NULL))
-                        goto out1;
-                skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
-                                  hdr_len, 0, lro_mgr->ip_summed_aggr);
-                if (!skb)
-                        goto out;
-                if ((skb->protocol == htons(ETH_P_8021Q)) &&
-                    !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
-                        vlan_hdr_len = VLAN_HLEN;
-                iph = (void *)(skb->data + vlan_hdr_len);
-                tcph = (void *)((u8 *)skb->data + vlan_hdr_len
-                                + IP_HDR_LEN(iph));
-                lro_init_desc(lro_desc, skb, iph, tcph);
-                LRO_INC_STATS(lro_mgr, aggregated);
-                return NULL;
-        }
-        if (lro_desc->tcp_next_seq != ntohl(tcph->seq))
-                goto out2;
-        if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, lro_desc))
-                goto out2;
-        lro_add_frags(lro_desc, len, hdr_len, true_size, frags, iph, tcph);
-        LRO_INC_STATS(lro_mgr, aggregated);
-        if ((skb_shinfo(lro_desc->parent)->nr_frags >= lro_mgr->max_aggr) ||
-            lro_desc->parent->len > (0xFFFF - lro_mgr->dev->mtu))
-                lro_flush(lro_mgr, lro_desc);
-        return NULL;
-out2: /* send aggregated packets to the stack */
-        lro_flush(lro_mgr, lro_desc);
-out1:  /* Original packet has to be posted to the stack */
-        skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
-                          hdr_len, sum, lro_mgr->ip_summed);
-out:
-        return skb;
-}
 void lro_receive_skb(struct net_lro_mgr *lro_mgr,
                     struct sk_buff *skb,
                     void *priv)
@@ -506,23 +361,6 @@ void lro_receive_skb(struct net_lro_mgr *lro_mgr,
 }
 EXPORT_SYMBOL(lro_receive_skb);
-void lro_receive_frags(struct net_lro_mgr *lro_mgr,
-                       struct skb_frag_struct *frags,
-                       int len, int true_size, void *priv, __wsum sum)
-{
-        struct sk_buff *skb;
-        skb = __lro_proc_segment(lro_mgr, frags, len, true_size, priv, sum);
-        if (!skb)
-                return;
-        if (lro_mgr->features & LRO_F_NAPI)
-                netif_receive_skb(skb);
-        else
-                netif_rx(skb);
-}
-EXPORT_SYMBOL(lro_receive_frags);
 void lro_flush_all(struct net_lro_mgr *lro_mgr)
 {
        int i;
@@ -534,14 +372,3 @@ void lro_flush_all(struct net_lro_mgr *lro_mgr)
        }
 }
 EXPORT_SYMBOL(lro_flush_all);
-void lro_flush_pkt(struct net_lro_mgr *lro_mgr,
-                  struct iphdr *iph, struct tcphdr *tcph)
-{
-        struct net_lro_desc *lro_desc;
-        lro_desc = lro_get_desc(lro_mgr, lro_mgr->lro_arr, iph, tcph);
-        if (lro_desc->active)
-                lro_flush(lro_mgr, lro_desc);
-}
-EXPORT_SYMBOL(lro_flush_pkt);
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 33d5537881ed..48f424465112 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -109,13 +109,6 @@ static inline void flush_check(struct inet_peer_base *base, int family)
        }
 }
-void inetpeer_invalidate_family(int family)
-{
-        atomic_t *fp = inetpeer_seq_ptr(family);
-        atomic_inc(fp);
-}
 #define PEER_MAXDEPTH 40 /* sufficient for about 2^27 nodes */
 /* Exported for sysctl_net_ipv4.  */
@@ -227,7 +220,7 @@ static int addr_compare(const struct inetpeer_addr *a,
        stackptr = _stack;                                      \
        *stackptr++ = &_base->root;                             \
        for (u = rcu_deref_locked(_base->root, _base);          \
-             u != peer_avl_empty; ) {                           \
+             u != peer_avl_empty;) {                            \
                int cmp = addr_compare(_daddr, &u->daddr);      \
                if (cmp == 0)                                   \
                        break;                                  \
@@ -282,7 +275,7 @@ static struct inet_peer *lookup_rcu(const struct inetpeer_addr *daddr,
        *stackptr++ = &start->avl_left;                         \
        v = &start->avl_left;                                   \
        for (u = rcu_deref_locked(*v, base);                    \
-             u->avl_right != peer_avl_empty_rcu; ) {            \
+             u->avl_right != peer_avl_empty_rcu;) {             \
                v = &u->avl_right;                              \
                *stackptr++ = v;                                \
                u = rcu_deref_locked(*v, base);                 \
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 694de3b7aebf..e9f1217a8afd 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -54,6 +54,7 @@ static int ip_forward_finish(struct sk_buff *skb)
 int ip_forward(struct sk_buff *skb)
 {
+        u32 mtu;
        struct iphdr *iph;      /* Our header */
        struct rtable *rt;      /* Route we use */
        struct ip_options *opt  = &(IPCB(skb)->opt);
@@ -88,11 +89,13 @@ int ip_forward(struct sk_buff *skb)
        if (opt->is_strictroute && rt->rt_uses_gateway)
                goto sr_failed;
-        if (unlikely(skb->len > dst_mtu(&rt->dst) && !skb_is_gso(skb) &&
+        IPCB(skb)->flags |= IPSKB_FORWARDED;
+        mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
+        if (unlikely(skb->len > mtu && !skb_is_gso(skb) &&
                     (ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) {
                IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS);
                icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
-                          htonl(dst_mtu(&rt->dst)));
+                          htonl(mtu));
                goto drop;
        }
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 2481993a4970..c10a3ce5cbff 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -704,7 +704,7 @@ struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
                        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
                        if (ip_defrag(skb, user))
                                return NULL;
-                        skb->rxhash = 0;
+                        skb_clear_hash(skb);
                }
        }
        return skb;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index e560ef34cf4b..ec4f762efda5 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -178,7 +178,7 @@ static int ipgre_err(struct sk_buff *skb, u32 info,
        else
                itn = net_generic(net, ipgre_net_id);
-        iph = (const struct iphdr *)skb->data;
+        iph = (const struct iphdr *)(icmp_hdr(skb) + 1);
        t = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags,
                             iph->daddr, iph->saddr, tpi->key);
@@ -278,7 +278,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
        return NETDEV_TX_OK;
 free_skb:
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
 out:
        dev->stats.tx_dropped++;
        return NETDEV_TX_OK;
@@ -301,7 +301,7 @@ static netdev_tx_t gre_tap_xmit(struct sk_buff *skb,
        return NETDEV_TX_OK;
 free_skb:
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
 out:
        dev->stats.tx_dropped++;
        return NETDEV_TX_OK;
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 054a3e97d822..3d4da2c16b6a 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -314,7 +314,7 @@ static int ip_rcv_finish(struct sk_buff *skb)
        const struct iphdr *iph = ip_hdr(skb);
        struct rtable *rt;
-        if (sysctl_ip_early_demux && !skb_dst(skb)) {
+        if (sysctl_ip_early_demux && !skb_dst(skb) && skb->sk == NULL) {
                const struct net_protocol *ipprot;
                int protocol = iph->protocol;
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index ec7264514a82..f4ab72e19af9 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -167,7 +167,7 @@ int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
                soffset -= 4;
                if (soffset > 3) {
                        memcpy(&faddr, &start[soffset-1], 4);
-                        for (soffset-=4, doffset=4; soffset > 3; soffset-=4, doffset+=4)
+                        for (soffset -= 4, doffset = 4; soffset > 3; soffset -= 4, doffset += 4)
                                memcpy(&dptr[doffset-1], &start[soffset-1], 4);
                        /*
                         * RFC1812 requires to fix illegal source routes.
@@ -227,7 +227,7 @@ void ip_options_fragment(struct sk_buff *skb)
                        continue;
                }
                optlen = optptr[1];
-                if (optlen<2 || optlen>l)
+                if (optlen < 2 || optlen > l)
                  return;
                if (!IPOPT_COPIED(*optptr))
                        memset(optptr, IPOPT_NOOP, optlen);
@@ -275,27 +275,27 @@ int ip_options_compile(struct net *net,
        for (l = opt->optlen; l > 0; ) {
                switch (*optptr) {
-                      case IPOPT_END:
+                case IPOPT_END:
-                        for (optptr++, l--; l>0; optptr++, l--) {
+                        for (optptr++, l--; l > 0; optptr++, l--) {
                                if (*optptr != IPOPT_END) {
                                        *optptr = IPOPT_END;
                                        opt->is_changed = 1;
                                }
                        }
                        goto eol;
-                      case IPOPT_NOOP:
+                case IPOPT_NOOP:
                        l--;
                        optptr++;
                        continue;
                }
                optlen = optptr[1];
-                if (optlen<2 || optlen>l) {
+                if (optlen < 2 || optlen > l) {
                        pp_ptr = optptr;
                        goto error;
                }
                switch (*optptr) {
-                      case IPOPT_SSRR:
+                case IPOPT_SSRR:
-                      case IPOPT_LSRR:
+                case IPOPT_LSRR:
                        if (optlen < 3) {
                                pp_ptr = optptr + 1;
                                goto error;
@@ -321,7 +321,7 @@ int ip_options_compile(struct net *net,
                        opt->is_strictroute = (optptr[0] == IPOPT_SSRR);
                        opt->srr = optptr - iph;
                        break;
-                      case IPOPT_RR:
+                case IPOPT_RR:
                        if (opt->rr) {
                                pp_ptr = optptr;
                                goto error;
@@ -349,7 +349,7 @@ int ip_options_compile(struct net *net,
                        }
                        opt->rr = optptr - iph;
                        break;
-                      case IPOPT_TIMESTAMP:
+                case IPOPT_TIMESTAMP:
                        if (opt->ts) {
                                pp_ptr = optptr;
                                goto error;
@@ -369,13 +369,13 @@ int ip_options_compile(struct net *net,
                                        goto error;
                                }
                                switch (optptr[3]&0xF) {
-                                      case IPOPT_TS_TSONLY:
+                                case IPOPT_TS_TSONLY:
                                        if (skb)
                                                timeptr = &optptr[optptr[2]-1];
                                        opt->ts_needtime = 1;
                                        optptr[2] += 4;
                                        break;
-                                      case IPOPT_TS_TSANDADDR:
+                                case IPOPT_TS_TSANDADDR:
                                        if (optptr[2]+7 > optptr[1]) {
                                                pp_ptr = optptr + 2;
                                                goto error;
@@ -389,7 +389,7 @@ int ip_options_compile(struct net *net,
                                        opt->ts_needtime = 1;
                                        optptr[2] += 8;
                                        break;
-                                      case IPOPT_TS_PRESPEC:
+                                case IPOPT_TS_PRESPEC:
                                        if (optptr[2]+7 > optptr[1]) {
                                                pp_ptr = optptr + 2;
                                                goto error;
@@ -405,7 +405,7 @@ int ip_options_compile(struct net *net,
                                        opt->ts_needtime = 1;
                                        optptr[2] += 8;
                                        break;
-                                      default:
+                                default:
                                        if (!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) {
                                                pp_ptr = optptr + 3;
                                                goto error;
@@ -433,7 +433,7 @@ int ip_options_compile(struct net *net,
                        }
                        opt->ts = optptr - iph;
                        break;
-                      case IPOPT_RA:
+                case IPOPT_RA:
                        if (optlen < 4) {
                                pp_ptr = optptr + 1;
                                goto error;
@@ -441,7 +441,7 @@ int ip_options_compile(struct net *net,
                        if (optptr[2] == 0 && optptr[3] == 0)
                                opt->router_alert = optptr - iph;
                        break;
-                      case IPOPT_CIPSO:
+                case IPOPT_CIPSO:
                        if ((!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) || opt->cipso) {
                                pp_ptr = optptr;
                                goto error;
@@ -452,9 +452,9 @@ int ip_options_compile(struct net *net,
                                goto error;
                        }
                        break;
-                      case IPOPT_SEC:
+                case IPOPT_SEC:
-                      case IPOPT_SID:
+                case IPOPT_SID:
-                      default:
+                default:
                        if (!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) {
                                pp_ptr = optptr;
                                goto error;
@@ -572,7 +572,7 @@ void ip_forward_options(struct sk_buff *skb)
                optptr = raw + opt->srr;
-                for ( srrptr=optptr[2], srrspace = optptr[1];
+                for ( srrptr = optptr[2], srrspace = optptr[1];
                     srrptr <= srrspace;
                     srrptr += 4
                     ) {
@@ -628,7 +628,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
        if (rt->rt_type != RTN_LOCAL)
                return -EINVAL;
-        for (srrptr=optptr[2], srrspace = optptr[1]; srrptr <= srrspace; srrptr += 4) {
+        for (srrptr = optptr[2], srrspace = optptr[1]; srrptr <= srrspace; srrptr += 4) {
                if (srrptr + 3 > srrspace) {
                        icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((opt->srr+2)<<24));
                        return -EINVAL;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index df184616493f..8971780aec7c 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -449,6 +449,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
        __be16 not_last_frag;
        struct rtable *rt = skb_rtable(skb);
        int err = 0;
+        bool forwarding = IPCB(skb)->flags & IPSKB_FORWARDED;
        dev = rt->dst.dev;
@@ -458,12 +459,13 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
        iph = ip_hdr(skb);
+        mtu = ip_dst_mtu_maybe_forward(&rt->dst, forwarding);
        if (unlikely(((iph->frag_off & htons(IP_DF)) && !skb->local_df) ||
                     (IPCB(skb)->frag_max_size &&
-                      IPCB(skb)->frag_max_size > dst_mtu(&rt->dst)))) {
+                      IPCB(skb)->frag_max_size > mtu))) {
                IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
                icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
-                          htonl(ip_skb_dst_mtu(skb)));
+                          htonl(mtu));
                kfree_skb(skb);
                return -EMSGSIZE;
        }
@@ -473,7 +475,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         */
        hlen = iph->ihl * 4;
-        mtu = dst_mtu(&rt->dst) - hlen; /* Size of data space */
+        mtu = mtu - hlen;       /* Size of data space */
 #ifdef CONFIG_BRIDGE_NETFILTER
        if (skb->nf_bridge)
                mtu -= nf_bridge_mtu_reduction(skb);
@@ -1551,7 +1553,7 @@ void __init ip_init(void)
        ip_rt_init();
        inet_initpeers();
-#if defined(CONFIG_IP_MULTICAST) && defined(CONFIG_PROC_FS)
+#if defined(CONFIG_IP_MULTICAST)
-        igmp_mc_proc_init();
+        igmp_mc_init();
 #endif
 }
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index ddf32a6bc415..580dd96666e0 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -56,7 +56,6 @@
 /*
 *      SOL_IP control messages.
 */
-#define PKTINFO_SKB_CB(__skb) ((struct in_pktinfo *)((__skb)->cb))
 static void ip_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
 {
@@ -390,7 +389,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
        struct sock_exterr_skb *serr;
        struct sk_buff *skb, *skb2;
-        struct sockaddr_in *sin;
+        DECLARE_SOCKADDR(struct sockaddr_in *, sin, msg->msg_name);
        struct {
                struct sock_extended_err ee;
                struct sockaddr_in       offender;
@@ -416,7 +415,6 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
        serr = SKB_EXT_ERR(skb);
-        sin = (struct sockaddr_in *)msg->msg_name;
        if (sin) {
                sin->sin_family = AF_INET;
                sin->sin_addr.s_addr = *(__be32 *)(skb_network_header(skb) +
@@ -1051,14 +1049,15 @@ e_inval:
 *
 * To support IP_CMSG_PKTINFO option, we store rt_iif and specific
 * destination in skb->cb[] before dst drop.
- * This way, receiver doesnt make cache line misses to read rtable.
+ * This way, receiver doesn't make cache line misses to read rtable.
 */
 void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
 {
        struct in_pktinfo *pktinfo = PKTINFO_SKB_CB(skb);
+        bool prepare = (inet_sk(sk)->cmsg_flags & IP_CMSG_PKTINFO) ||
+                       ipv6_sk_rxinfo(sk);
-        if ((inet_sk(sk)->cmsg_flags & IP_CMSG_PKTINFO) &&
+        if (prepare && skb_rtable(skb)) {
-            skb_rtable(skb)) {
                pktinfo->ipi_ifindex = inet_iif(skb);
                pktinfo->ipi_spec_dst.s_addr = fib_compute_spec_dst(skb);
        } else {
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 90ff9570d7d4..bd28f386bd02 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -40,6 +40,7 @@
 #include <linux/if_ether.h>
 #include <linux/if_vlan.h>
 #include <linux/rculist.h>
+#include <linux/err.h>
 #include <net/sock.h>
 #include <net/ip.h>
@@ -61,13 +62,69 @@
 #include <net/ip6_route.h>
 #endif
-static unsigned int ip_tunnel_hash(struct ip_tunnel_net *itn,
+static unsigned int ip_tunnel_hash(__be32 key, __be32 remote)
-                                   __be32 key, __be32 remote)
 {
        return hash_32((__force u32)key ^ (__force u32)remote,
                         IP_TNL_HASH_BITS);
 }
+static void __tunnel_dst_set(struct ip_tunnel_dst *idst,
+                             struct dst_entry *dst)
+{
+        struct dst_entry *old_dst;
+        if (dst) {
+                if (dst->flags & DST_NOCACHE)
+                        dst = NULL;
+                else
+                        dst_clone(dst);
+        }
+        old_dst = xchg((__force struct dst_entry **)&idst->dst, dst);
+        dst_release(old_dst);
+}
+static void tunnel_dst_set(struct ip_tunnel *t, struct dst_entry *dst)
+{
+        __tunnel_dst_set(this_cpu_ptr(t->dst_cache), dst);
+}
+static void tunnel_dst_reset(struct ip_tunnel *t)
+{
+        tunnel_dst_set(t, NULL);
+}
+static void tunnel_dst_reset_all(struct ip_tunnel *t)
+{
+        int i;
+        for_each_possible_cpu(i)
+                __tunnel_dst_set(per_cpu_ptr(t->dst_cache, i), NULL);
+}
+static struct dst_entry *tunnel_dst_get(struct ip_tunnel *t)
+{
+        struct dst_entry *dst;
+        rcu_read_lock();
+        dst = rcu_dereference(this_cpu_ptr(t->dst_cache)->dst);
+        if (dst)
+                dst_hold(dst);
+        rcu_read_unlock();
+        return dst;
+}
+static struct dst_entry *tunnel_dst_check(struct ip_tunnel *t, u32 cookie)
+{
+        struct dst_entry *dst = tunnel_dst_get(t);
+        if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
+                tunnel_dst_reset(t);
+                return NULL;
+        }
+        return dst;
+}
 /* Often modified stats are per cpu, other are shared (netdev->stats) */
 struct rtnl_link_stats64 *ip_tunnel_get_stats64(struct net_device *dev,
                                                struct rtnl_link_stats64 *tot)
@@ -75,7 +132,8 @@ struct rtnl_link_stats64 *ip_tunnel_get_stats64(struct net_device *dev,
        int i;
        for_each_possible_cpu(i) {
-                const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
+                const struct pcpu_sw_netstats *tstats =
+                                                   per_cpu_ptr(dev->tstats, i);
                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
                unsigned int start;
@@ -146,7 +204,7 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
        struct ip_tunnel *t, *cand = NULL;
        struct hlist_head *head;
-        hash = ip_tunnel_hash(itn, key, remote);
+        hash = ip_tunnel_hash(key, remote);
        head = &itn->tunnels[hash];
        hlist_for_each_entry_rcu(t, head, hash_node) {
@@ -178,7 +236,7 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
                        cand = t;
        }
-        hash = ip_tunnel_hash(itn, key, 0);
+        hash = ip_tunnel_hash(key, 0);
        head = &itn->tunnels[hash];
        hlist_for_each_entry_rcu(t, head, hash_node) {
@@ -234,7 +292,7 @@ static struct hlist_head *ip_bucket(struct ip_tunnel_net *itn,
        else
                remote = 0;
-        h = ip_tunnel_hash(itn, parms->i_key, remote);
+        h = ip_tunnel_hash(parms->i_key, remote);
        return &itn->tunnels[h];
 }
@@ -318,11 +376,10 @@ failed:
        return ERR_PTR(err);
 }
-static inline struct rtable *ip_route_output_tunnel(struct net *net,
+static inline void init_tunnel_flow(struct flowi4 *fl4,
-                                                    struct flowi4 *fl4,
+                                    int proto,
-                                                    int proto,
+                                    __be32 daddr, __be32 saddr,
-                                                    __be32 daddr, __be32 saddr,
+                                    __be32 key, __u8 tos, int oif)
-                                                    __be32 key, __u8 tos, int oif)
 {
        memset(fl4, 0, sizeof(*fl4));
        fl4->flowi4_oif = oif;
@@ -331,7 +388,6 @@ static inline struct rtable *ip_route_output_tunnel(struct net *net,
        fl4->flowi4_tos = tos;
        fl4->flowi4_proto = proto;
        fl4->fl4_gre_key = key;
-        return ip_route_output_key(net, fl4);
 }
 static int ip_tunnel_bind_dev(struct net_device *dev)
@@ -350,14 +406,14 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
                struct flowi4 fl4;
                struct rtable *rt;
-                rt = ip_route_output_tunnel(tunnel->net, &fl4,
+                init_tunnel_flow(&fl4, iph->protocol, iph->daddr,
-                                            tunnel->parms.iph.protocol,
+                                 iph->saddr, tunnel->parms.o_key,
-                                            iph->daddr, iph->saddr,
+                                 RT_TOS(iph->tos), tunnel->parms.link);
-                                            tunnel->parms.o_key,
+                rt = ip_route_output_key(tunnel->net, &fl4);
-                                            RT_TOS(iph->tos),
-                                            tunnel->parms.link);
                if (!IS_ERR(rt)) {
                        tdev = rt->dst.dev;
+                        tunnel_dst_set(tunnel, &rt->dst);
                        ip_rt_put(rt);
                }
                if (dev->type != ARPHRD_ETHER)
@@ -405,7 +461,7 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,
 int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
                  const struct tnl_ptk_info *tpi, bool log_ecn_error)
 {
-        struct pcpu_tstats *tstats;
+        struct pcpu_sw_netstats *tstats;
        const struct iphdr *iph = ip_hdr(skb);
        int err;
@@ -528,10 +584,11 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
        struct flowi4 fl4;
        u8     tos, ttl;
        __be16 df;
-        struct rtable *rt;              /* Route to the other host */
+        struct rtable *rt = NULL;       /* Route to the other host */
        unsigned int max_headroom;      /* The extra header space needed */
        __be32 dst;
        int err;
+        bool connected = true;
        inner_iph = (const struct iphdr *)skb_inner_network_header(skb);
@@ -581,27 +638,39 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
 #endif
                else
                        goto tx_error;
+                connected = false;
        }
        tos = tnl_params->tos;
        if (tos & 0x1) {
                tos &= ~0x1;
-                if (skb->protocol == htons(ETH_P_IP))
+                if (skb->protocol == htons(ETH_P_IP)) {
                        tos = inner_iph->tos;
-                else if (skb->protocol == htons(ETH_P_IPV6))
+                        connected = false;
+                } else if (skb->protocol == htons(ETH_P_IPV6)) {
                        tos = ipv6_get_dsfield((const struct ipv6hdr *)inner_iph);
+                        connected = false;
+                }
        }
-        rt = ip_route_output_tunnel(tunnel->net, &fl4,
+        init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr,
-                                    protocol,
+                         tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link);
-                                    dst, tnl_params->saddr,
-                                    tunnel->parms.o_key,
+        if (connected)
-                                    RT_TOS(tos),
+                rt = (struct rtable *)tunnel_dst_check(tunnel, 0);
-                                    tunnel->parms.link);
-        if (IS_ERR(rt)) {
+        if (!rt) {
-                dev->stats.tx_carrier_errors++;
+                rt = ip_route_output_key(tunnel->net, &fl4);
-                goto tx_error;
+                if (IS_ERR(rt)) {
+                        dev->stats.tx_carrier_errors++;
+                        goto tx_error;
+                }
+                if (connected)
+                        tunnel_dst_set(tunnel, &rt->dst);
        }
        if (rt->dst.dev == dev) {
                ip_rt_put(rt);
                dev->stats.collisions++;
@@ -618,6 +687,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                                tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
                        tunnel->err_count--;
+                        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
                        dst_link_failure(skb);
                } else
                        tunnel->err_count = 0;
@@ -647,7 +717,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
        if (skb_cow_head(skb, dev->needed_headroom)) {
                dev->stats.tx_dropped++;
-                dev_kfree_skb(skb);
+                kfree_skb(skb);
                return;
        }
@@ -663,7 +733,7 @@ tx_error_icmp:
 #endif
 tx_error:
        dev->stats.tx_errors++;
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_xmit);
@@ -696,6 +766,7 @@ static void ip_tunnel_update(struct ip_tunnel_net *itn,
                if (set_mtu)
                        dev->mtu = mtu;
        }
+        tunnel_dst_reset_all(t);
        netdev_state_change(dev);
 }
@@ -811,6 +882,7 @@ static void ip_tunnel_dev_free(struct net_device *dev)
        struct ip_tunnel *tunnel = netdev_priv(dev);
        gro_cells_destroy(&tunnel->gro_cells);
+        free_percpu(tunnel->dst_cache);
        free_percpu(dev->tstats);
        free_netdev(dev);
 }
@@ -859,7 +931,7 @@ int ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
        }
        rtnl_unlock();
-        return PTR_RET(itn->fb_tunnel_dev);
+        return PTR_ERR_OR_ZERO(itn->fb_tunnel_dev);
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_init_net);
@@ -979,18 +1051,25 @@ int ip_tunnel_init(struct net_device *dev)
        int i, err;
        dev->destructor = ip_tunnel_dev_free;
-        dev->tstats = alloc_percpu(struct pcpu_tstats);
+        dev->tstats = alloc_percpu(struct pcpu_sw_netstats);
        if (!dev->tstats)
                return -ENOMEM;
        for_each_possible_cpu(i) {
-                struct pcpu_tstats *ipt_stats;
+                struct pcpu_sw_netstats *ipt_stats;
                ipt_stats = per_cpu_ptr(dev->tstats, i);
                u64_stats_init(&ipt_stats->syncp);
        }
+        tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
+        if (!tunnel->dst_cache) {
+                free_percpu(dev->tstats);
+                return -ENOMEM;
+        }
        err = gro_cells_init(&tunnel->gro_cells, dev);
        if (err) {
+                free_percpu(tunnel->dst_cache);
                free_percpu(dev->tstats);
                return err;
        }
@@ -1015,6 +1094,8 @@ void ip_tunnel_uninit(struct net_device *dev)
        /* fb_tunnel_dev will be unregisted in net-exit call. */
        if (itn->fb_tunnel_dev != dev)
                ip_tunnel_del(netdev_priv(dev));
+        tunnel_dst_reset_all(tunnel);
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_uninit);
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 42ffbc8d65c6..6156f4ef5e91 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -56,7 +56,7 @@ int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
        skb_scrub_packet(skb, xnet);
-        skb->rxhash = 0;
+        skb_clear_hash(skb);
        skb_dst_set(skb, &rt->dst);
        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
@@ -107,8 +107,7 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto)
        nf_reset(skb);
        secpath_reset(skb);
-        if (!skb->l4_rxhash)
+        skb_clear_hash_if_not_l4(skb);
-                skb->rxhash = 0;
        skb_dst_drop(skb);
        skb->vlan_tci = 0;
        skb_set_queue_mapping(skb, 0);
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 52b802a0cd8c..48eafae51769 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -60,7 +60,7 @@ static int vti_rcv(struct sk_buff *skb)
        tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
                                  iph->saddr, iph->daddr, 0);
        if (tunnel != NULL) {
-                struct pcpu_tstats *tstats;
+                struct pcpu_sw_netstats *tstats;
                u32 oldmark = skb->mark;
                int ret;
@@ -162,7 +162,7 @@ tx_error_icmp:
        dst_link_failure(skb);
 tx_error:
        dev->stats.tx_errors++;
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
        return NETDEV_TX_OK;
 }
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index fe3e9f7f1f0b..812b18351462 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -228,7 +228,7 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
        return NETDEV_TX_OK;
 tx_error:
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
 out:
        dev->stats.tx_errors++;
        return NETDEV_TX_OK;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 1672409f5ba5..b9b3472975ba 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -428,6 +428,7 @@ struct net_device *ipmr_new_tunnel(struct net *net, struct vifctl *v)
                                goto failure;
                        ipv4_devconf_setall(in_dev);
+                        neigh_parms_data_state_setall(in_dev->arp_parms);
                        IPV4_DEVCONF(in_dev->cnf, RP_FILTER) = 0;
                        if (dev_open(dev))
@@ -520,6 +521,7 @@ static struct net_device *ipmr_reg_vif(struct net *net, struct mr_table *mrt)
        }
        ipv4_devconf_setall(in_dev);
+        neigh_parms_data_state_setall(in_dev->arp_parms);
        IPV4_DEVCONF(in_dev->cnf, RP_FILTER) = 0;
        rcu_read_unlock();
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 40d56073cd19..81c6910cfa92 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -39,23 +39,33 @@ config NF_CONNTRACK_PROC_COMPAT
 config NF_TABLES_IPV4
        depends on NF_TABLES
        tristate "IPv4 nf_tables support"
+        help
-config NFT_REJECT_IPV4
+          This option enables the IPv4 support for nf_tables.
-        depends on NF_TABLES_IPV4
-        tristate "nf_tables IPv4 reject support"
 config NFT_CHAIN_ROUTE_IPV4
        depends on NF_TABLES_IPV4
        tristate "IPv4 nf_tables route chain support"
+        help
+          This option enables the "route" chain for IPv4 in nf_tables. This
+          chain type is used to force packet re-routing after mangling header
+          fields such as the source, destination, type of service and
+          the packet mark.
 config NFT_CHAIN_NAT_IPV4
        depends on NF_TABLES_IPV4
        depends on NF_NAT_IPV4 && NFT_NAT
        tristate "IPv4 nf_tables nat chain support"
+        help
+          This option enables the "nat" chain for IPv4 in nf_tables. This
+          chain type is used to perform Network Address Translation (NAT)
+          packet transformations such as the source, destination address and
+          source and destination ports.
 config NF_TABLES_ARP
        depends on NF_TABLES
        tristate "ARP nf_tables support"
+        help
+          This option enables the ARP support for nf_tables.
 config IP_NF_IPTABLES
        tristate "IP tables support (required for filtering/masq/NAT)"
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 19df72b7ba88..c16be9d58420 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -28,7 +28,6 @@ obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o
 obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o
 obj-$(CONFIG_NF_TABLES_IPV4) += nf_tables_ipv4.o
-obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o
 obj-$(CONFIG_NF_TABLES_ARP) += nf_tables_arp.o
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index b969131ad1c1..5b6e0df4ccff 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -17,10 +17,6 @@
 #include <linux/udp.h>
 #include <linux/icmp.h>
 #include <net/icmp.h>
-#include <net/ip.h>
-#include <net/tcp.h>
-#include <net/route.h>
-#include <net/dst.h>
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netfilter_ipv4/ipt_REJECT.h>
@@ -28,128 +24,12 @@
 #include <linux/netfilter_bridge.h>
 #endif
+#include <net/netfilter/ipv4/nf_reject.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv4");
-/* Send RST reply */
-static void send_reset(struct sk_buff *oldskb, int hook)
-{
-        struct sk_buff *nskb;
-        const struct iphdr *oiph;
-        struct iphdr *niph;
-        const struct tcphdr *oth;
-        struct tcphdr _otcph, *tcph;
-        /* IP header checks: fragment. */
-        if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
-                return;
-        oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb),
-                                 sizeof(_otcph), &_otcph);
-        if (oth == NULL)
-                return;
-        /* No RST for RST. */
-        if (oth->rst)
-                return;
-        if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
-                return;
-        /* Check checksum */
-        if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
-                return;
-        oiph = ip_hdr(oldskb);
-        nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
-                         LL_MAX_HEADER, GFP_ATOMIC);
-        if (!nskb)
-                return;
-        skb_reserve(nskb, LL_MAX_HEADER);
-        skb_reset_network_header(nskb);
-        niph = (struct iphdr *)skb_put(nskb, sizeof(struct iphdr));
-        niph->version   = 4;
-        niph->ihl       = sizeof(struct iphdr) / 4;
-        niph->tos       = 0;
-        niph->id        = 0;
-        niph->frag_off  = htons(IP_DF);
-        niph->protocol  = IPPROTO_TCP;
-        niph->check     = 0;
-        niph->saddr     = oiph->daddr;
-        niph->daddr     = oiph->saddr;
-        skb_reset_transport_header(nskb);
-        tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
-        memset(tcph, 0, sizeof(*tcph));
-        tcph->source    = oth->dest;
-        tcph->dest      = oth->source;
-        tcph->doff      = sizeof(struct tcphdr) / 4;
-        if (oth->ack)
-                tcph->seq = oth->ack_seq;
-        else {
-                tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin +
-                                      oldskb->len - ip_hdrlen(oldskb) -
-                                      (oth->doff << 2));
-                tcph->ack = 1;
-        }
-        tcph->rst       = 1;
-        tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr,
-                                    niph->daddr, 0);
-        nskb->ip_summed = CHECKSUM_PARTIAL;
-        nskb->csum_start = (unsigned char *)tcph - nskb->head;
-        nskb->csum_offset = offsetof(struct tcphdr, check);
-        /* ip_route_me_harder expects skb->dst to be set */
-        skb_dst_set_noref(nskb, skb_dst(oldskb));
-        nskb->protocol = htons(ETH_P_IP);
-        if (ip_route_me_harder(nskb, RTN_UNSPEC))
-                goto free_nskb;
-        niph->ttl       = ip4_dst_hoplimit(skb_dst(nskb));
-        /* "Never happens" */
-        if (nskb->len > dst_mtu(skb_dst(nskb)))
-                goto free_nskb;
-        nf_ct_attach(nskb, oldskb);
-#ifdef CONFIG_BRIDGE_NETFILTER
-        /* If we use ip_local_out for bridged traffic, the MAC source on
-         * the RST will be ours, instead of the destination's.  This confuses
-         * some routers/firewalls, and they drop the packet.  So we need to
-         * build the eth header using the original destination's MAC as the
-         * source, and send the RST packet directly.
-         */
-        if (oldskb->nf_bridge) {
-                struct ethhdr *oeth = eth_hdr(oldskb);
-                nskb->dev = oldskb->nf_bridge->physindev;
-                niph->tot_len = htons(nskb->len);
-                ip_send_check(niph);
-                if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol),
-                                    oeth->h_source, oeth->h_dest, nskb->len) < 0)
-                        goto free_nskb;
-                dev_queue_xmit(nskb);
-        } else
-#endif
-                ip_local_out(nskb);
-        return;
- free_nskb:
-        kfree_skb(nskb);
-}
-static inline void send_unreach(struct sk_buff *skb_in, int code)
-{
-        icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
-}
 static unsigned int
 reject_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
@@ -157,28 +37,28 @@ reject_tg(struct sk_buff *skb, const struct xt_action_param *par)
        switch (reject->with) {
        case IPT_ICMP_NET_UNREACHABLE:
-                send_unreach(skb, ICMP_NET_UNREACH);
+                nf_send_unreach(skb, ICMP_NET_UNREACH);
                break;
        case IPT_ICMP_HOST_UNREACHABLE:
-                send_unreach(skb, ICMP_HOST_UNREACH);
+                nf_send_unreach(skb, ICMP_HOST_UNREACH);
                break;
        case IPT_ICMP_PROT_UNREACHABLE:
-                send_unreach(skb, ICMP_PROT_UNREACH);
+                nf_send_unreach(skb, ICMP_PROT_UNREACH);
                break;
        case IPT_ICMP_PORT_UNREACHABLE:
-                send_unreach(skb, ICMP_PORT_UNREACH);
+                nf_send_unreach(skb, ICMP_PORT_UNREACH);
                break;
        case IPT_ICMP_NET_PROHIBITED:
-                send_unreach(skb, ICMP_NET_ANO);
+                nf_send_unreach(skb, ICMP_NET_ANO);
                break;
        case IPT_ICMP_HOST_PROHIBITED:
-                send_unreach(skb, ICMP_HOST_ANO);
+                nf_send_unreach(skb, ICMP_HOST_ANO);
                break;
        case IPT_ICMP_ADMIN_PROHIBITED:
-                send_unreach(skb, ICMP_PKT_FILTERED);
+                nf_send_unreach(skb, ICMP_PKT_FILTERED);
                break;
        case IPT_TCP_RESET:
-                send_reset(skb, par->hooknum);
+                nf_send_reset(skb, par->hooknum);
        case IPT_ICMP_ECHOREPLY:
                /* Doesn't happen. */
                break;
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index ecd8bec411c9..8127dc802865 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -548,9 +548,3 @@ static void __exit nf_conntrack_l3proto_ipv4_fini(void)
 module_init(nf_conntrack_l3proto_ipv4_init);
 module_exit(nf_conntrack_l3proto_ipv4_fini);
-void need_ipv4_conntrack(void)
-{
-        return;
-}
-EXPORT_SYMBOL_GPL(need_ipv4_conntrack);
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 5f011cc89cd9..d551e31b416e 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -34,8 +34,7 @@
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 *
 * Author: James Morris <jmorris@intercode.com.au>
 *
@@ -462,14 +461,14 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
        }
        if (subid < 40) {
-                optr [0] = 0;
+                optr[0] = 0;
-                optr [1] = subid;
+                optr[1] = subid;
        } else if (subid < 80) {
-                optr [0] = 1;
+                optr[0] = 1;
-                optr [1] = subid - 40;
+                optr[1] = subid - 40;
        } else {
-                optr [0] = 2;
+                optr[0] = 2;
-                optr [1] = subid - 80;
+                optr[1] = subid - 80;
        }
        *len = 2;
diff --git a/net/ipv4/netfilter/nf_tables_arp.c b/net/ipv4/netfilter/nf_tables_arp.c
index 3e67ef1c676f..19412a4063fb 100644
--- a/net/ipv4/netfilter/nf_tables_arp.c
+++ b/net/ipv4/netfilter/nf_tables_arp.c
@@ -14,10 +14,30 @@
 #include <linux/netfilter_arp.h>
 #include <net/netfilter/nf_tables.h>
+static unsigned int
+nft_do_chain_arp(const struct nf_hook_ops *ops,
+                  struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  int (*okfn)(struct sk_buff *))
+{
+        struct nft_pktinfo pkt;
+        nft_set_pktinfo(&pkt, ops, skb, in, out);
+        return nft_do_chain(&pkt, ops);
+}
 static struct nft_af_info nft_af_arp __read_mostly = {
        .family         = NFPROTO_ARP,
        .nhooks         = NF_ARP_NUMHOOKS,
        .owner          = THIS_MODULE,
+        .nops           = 1,
+        .hooks          = {
+                [NF_ARP_IN]             = nft_do_chain_arp,
+                [NF_ARP_OUT]            = nft_do_chain_arp,
+                [NF_ARP_FORWARD]        = nft_do_chain_arp,
+        },
 };
 static int nf_tables_arp_init_net(struct net *net)
@@ -48,32 +68,14 @@ static struct pernet_operations nf_tables_arp_net_ops = {
        .exit   = nf_tables_arp_exit_net,
 };
-static unsigned int
+static const struct nf_chain_type filter_arp = {
-nft_do_chain_arp(const struct nf_hook_ops *ops,
-                  struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  int (*okfn)(struct sk_buff *))
-{
-        struct nft_pktinfo pkt;
-        nft_set_pktinfo(&pkt, ops, skb, in, out);
-        return nft_do_chain_pktinfo(&pkt, ops);
-}
-static struct nf_chain_type filter_arp = {
-        .family         = NFPROTO_ARP,
        .name           = "filter",
        .type           = NFT_CHAIN_T_DEFAULT,
+        .family         = NFPROTO_ARP,
+        .owner          = THIS_MODULE,
        .hook_mask      = (1 << NF_ARP_IN) |
                          (1 << NF_ARP_OUT) |
                          (1 << NF_ARP_FORWARD),
-        .fn             = {
-                [NF_ARP_IN]             = nft_do_chain_arp,
-                [NF_ARP_OUT]            = nft_do_chain_arp,
-                [NF_ARP_FORWARD]        = nft_do_chain_arp,
-        },
 };
 static int __init nf_tables_arp_init(void)
diff --git a/net/ipv4/netfilter/nf_tables_ipv4.c b/net/ipv4/netfilter/nf_tables_ipv4.c
index 0f4cbfeb19bd..6820c8c40842 100644
--- a/net/ipv4/netfilter/nf_tables_ipv4.c
+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
@@ -18,14 +18,25 @@
 #include <net/ip.h>
 #include <net/netfilter/nf_tables_ipv4.h>
+static unsigned int nft_do_chain_ipv4(const struct nf_hook_ops *ops,
+                                      struct sk_buff *skb,
+                                      const struct net_device *in,
+                                      const struct net_device *out,
+                                      int (*okfn)(struct sk_buff *))
+{
+        struct nft_pktinfo pkt;
+        nft_set_pktinfo_ipv4(&pkt, ops, skb, in, out);
+        return nft_do_chain(&pkt, ops);
+}
 static unsigned int nft_ipv4_output(const struct nf_hook_ops *ops,
                                    struct sk_buff *skb,
                                    const struct net_device *in,
                                    const struct net_device *out,
                                    int (*okfn)(struct sk_buff *))
 {
-        struct nft_pktinfo pkt;
        if (unlikely(skb->len < sizeof(struct iphdr) ||
                     ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) {
                if (net_ratelimit())
@@ -33,19 +44,24 @@ static unsigned int nft_ipv4_output(const struct nf_hook_ops *ops,
                                "packet\n");
                return NF_ACCEPT;
        }
-        nft_set_pktinfo_ipv4(&pkt, ops, skb, in, out);
-        return nft_do_chain_pktinfo(&pkt, ops);
+        return nft_do_chain_ipv4(ops, skb, in, out, okfn);
 }
-static struct nft_af_info nft_af_ipv4 __read_mostly = {
+struct nft_af_info nft_af_ipv4 __read_mostly = {
        .family         = NFPROTO_IPV4,
        .nhooks         = NF_INET_NUMHOOKS,
        .owner          = THIS_MODULE,
+        .nops           = 1,
        .hooks          = {
+                [NF_INET_LOCAL_IN]      = nft_do_chain_ipv4,
                [NF_INET_LOCAL_OUT]     = nft_ipv4_output,
+                [NF_INET_FORWARD]       = nft_do_chain_ipv4,
+                [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv4,
+                [NF_INET_POST_ROUTING]  = nft_do_chain_ipv4,
        },
 };
+EXPORT_SYMBOL_GPL(nft_af_ipv4);
 static int nf_tables_ipv4_init_net(struct net *net)
 {
@@ -75,42 +91,28 @@ static struct pernet_operations nf_tables_ipv4_net_ops = {
        .exit   = nf_tables_ipv4_exit_net,
 };
-static unsigned int
+static const struct nf_chain_type filter_ipv4 = {
-nft_do_chain_ipv4(const struct nf_hook_ops *ops,
-                  struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  int (*okfn)(struct sk_buff *))
-{
-        struct nft_pktinfo pkt;
-        nft_set_pktinfo_ipv4(&pkt, ops, skb, in, out);
-        return nft_do_chain_pktinfo(&pkt, ops);
-}
-static struct nf_chain_type filter_ipv4 = {
-        .family         = NFPROTO_IPV4,
        .name           = "filter",
        .type           = NFT_CHAIN_T_DEFAULT,
+        .family         = NFPROTO_IPV4,
+        .owner          = THIS_MODULE,
        .hook_mask      = (1 << NF_INET_LOCAL_IN) |
                          (1 << NF_INET_LOCAL_OUT) |
                          (1 << NF_INET_FORWARD) |
                          (1 << NF_INET_PRE_ROUTING) |
                          (1 << NF_INET_POST_ROUTING),
-        .fn             = {
-                [NF_INET_LOCAL_IN]      = nft_do_chain_ipv4,
-                [NF_INET_LOCAL_OUT]     = nft_ipv4_output,
-                [NF_INET_FORWARD]       = nft_do_chain_ipv4,
-                [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv4,
-                [NF_INET_POST_ROUTING]  = nft_do_chain_ipv4,
-        },
 };
 static int __init nf_tables_ipv4_init(void)
 {
+        int ret;
        nft_register_chain_type(&filter_ipv4);
-        return register_pernet_subsys(&nf_tables_ipv4_net_ops);
+        ret = register_pernet_subsys(&nf_tables_ipv4_net_ops);
+        if (ret < 0)
+                nft_unregister_chain_type(&filter_ipv4);
+        return ret;
 }
 static void __exit nf_tables_ipv4_exit(void)
diff --git a/net/ipv4/netfilter/nft_chain_nat_ipv4.c b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
index cf2c792cd971..b5b256d45e67 100644
--- a/net/ipv4/netfilter/nft_chain_nat_ipv4.c
+++ b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
@@ -75,7 +75,7 @@ static unsigned int nf_nat_fn(const struct nf_hook_ops *ops,
                nft_set_pktinfo_ipv4(&pkt, ops, skb, in, out);
-                ret = nft_do_chain_pktinfo(&pkt, ops);
+                ret = nft_do_chain(&pkt, ops);
                if (ret != NF_ACCEPT)
                        return ret;
                if (!nf_nat_initialized(ct, maniptype)) {
@@ -164,21 +164,21 @@ static unsigned int nf_nat_output(const struct nf_hook_ops *ops,
        return ret;
 }
-static struct nf_chain_type nft_chain_nat_ipv4 = {
+static const struct nf_chain_type nft_chain_nat_ipv4 = {
-        .family         = NFPROTO_IPV4,
        .name           = "nat",
        .type           = NFT_CHAIN_T_NAT,
+        .family         = NFPROTO_IPV4,
+        .owner          = THIS_MODULE,
        .hook_mask      = (1 << NF_INET_PRE_ROUTING) |
                          (1 << NF_INET_POST_ROUTING) |
                          (1 << NF_INET_LOCAL_OUT) |
                          (1 << NF_INET_LOCAL_IN),
-        .fn             = {
+        .hooks          = {
                [NF_INET_PRE_ROUTING]   = nf_nat_prerouting,
                [NF_INET_POST_ROUTING]  = nf_nat_postrouting,
                [NF_INET_LOCAL_OUT]     = nf_nat_output,
                [NF_INET_LOCAL_IN]      = nf_nat_fn,
        },
-        .me             = THIS_MODULE,
 };
 static int __init nft_chain_nat_init(void)
diff --git a/net/ipv4/netfilter/nft_chain_route_ipv4.c b/net/ipv4/netfilter/nft_chain_route_ipv4.c
index 4e6bf9a3d7aa..125b66766c0a 100644
--- a/net/ipv4/netfilter/nft_chain_route_ipv4.c
+++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c
@@ -47,7 +47,7 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops,
        daddr = iph->daddr;
        tos = iph->tos;
-        ret = nft_do_chain_pktinfo(&pkt, ops);
+        ret = nft_do_chain(&pkt, ops);
        if (ret != NF_DROP && ret != NF_QUEUE) {
                iph = ip_hdr(skb);
@@ -61,15 +61,15 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops,
        return ret;
 }
-static struct nf_chain_type nft_chain_route_ipv4 = {
+static const struct nf_chain_type nft_chain_route_ipv4 = {
-        .family         = NFPROTO_IPV4,
        .name           = "route",
        .type           = NFT_CHAIN_T_ROUTE,
+        .family         = NFPROTO_IPV4,
+        .owner          = THIS_MODULE,
        .hook_mask      = (1 << NF_INET_LOCAL_OUT),
-        .fn             = {
+        .hooks          = {
                [NF_INET_LOCAL_OUT]     = nf_route_table_hook,
        },
-        .me             = THIS_MODULE,
 };
 static int __init nft_chain_route_init(void)
diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
deleted file mode 100644
index 4a5e94ac314a..000000000000
--- a/net/ipv4/netfilter/nft_reject_ipv4.c
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * Development of this code funded by Astaro AG (http://www.astaro.com/)
- */
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/netlink.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter/nf_tables.h>
-#include <net/netfilter/nf_tables.h>
-#include <net/icmp.h>
-struct nft_reject {
-        enum nft_reject_types   type:8;
-        u8                      icmp_code;
-};
-static void nft_reject_eval(const struct nft_expr *expr,
-                              struct nft_data data[NFT_REG_MAX + 1],
-                              const struct nft_pktinfo *pkt)
-{
-        struct nft_reject *priv = nft_expr_priv(expr);
-        switch (priv->type) {
-        case NFT_REJECT_ICMP_UNREACH:
-                icmp_send(pkt->skb, ICMP_DEST_UNREACH, priv->icmp_code, 0);
-                break;
-        case NFT_REJECT_TCP_RST:
-                break;
-        }
-        data[NFT_REG_VERDICT].verdict = NF_DROP;
-}
-static const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
-        [NFTA_REJECT_TYPE]              = { .type = NLA_U32 },
-        [NFTA_REJECT_ICMP_CODE]         = { .type = NLA_U8 },
-};
-static int nft_reject_init(const struct nft_ctx *ctx,
-                           const struct nft_expr *expr,
-                           const struct nlattr * const tb[])
-{
-        struct nft_reject *priv = nft_expr_priv(expr);
-        if (tb[NFTA_REJECT_TYPE] == NULL)
-                return -EINVAL;
-        priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
-        switch (priv->type) {
-        case NFT_REJECT_ICMP_UNREACH:
-                if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
-                        return -EINVAL;
-                priv->icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
-        case NFT_REJECT_TCP_RST:
-                break;
-        default:
-                return -EINVAL;
-        }
-        return 0;
-}
-static int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
-{
-        const struct nft_reject *priv = nft_expr_priv(expr);
-        if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
-                goto nla_put_failure;
-        switch (priv->type) {
-        case NFT_REJECT_ICMP_UNREACH:
-                if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
-                        goto nla_put_failure;
-                break;
-        }
-        return 0;
-nla_put_failure:
-        return -1;
-}
-static struct nft_expr_type nft_reject_type;
-static const struct nft_expr_ops nft_reject_ops = {
-        .type           = &nft_reject_type,
-        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
-        .eval           = nft_reject_eval,
-        .init           = nft_reject_init,
-        .dump           = nft_reject_dump,
-};
-static struct nft_expr_type nft_reject_type __read_mostly = {
-        .name           = "reject",
-        .ops            = &nft_reject_ops,
-        .policy         = nft_reject_policy,
-        .maxattr        = NFTA_REJECT_MAX,
-        .owner          = THIS_MODULE,
-};
-static int __init nft_reject_module_init(void)
-{
-        return nft_register_expr(&nft_reject_type);
-}
-static void __exit nft_reject_module_exit(void)
-{
-        nft_unregister_expr(&nft_reject_type);
-}
-module_init(nft_reject_module_init);
-module_exit(nft_reject_module_exit);
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_ALIAS_NFT_EXPR("reject");
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 242e7f4ed6f4..2d11c094296e 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -53,8 +53,12 @@
 #include <net/transp_v6.h>
 #endif
+struct ping_table {
+        struct hlist_nulls_head hash[PING_HTABLE_SIZE];
+        rwlock_t                lock;
+};
-struct ping_table ping_table;
+static struct ping_table ping_table;
 struct pingv6_ops pingv6_ops;
 EXPORT_SYMBOL_GPL(pingv6_ops);
@@ -316,6 +320,9 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
                if (addr_len < sizeof(*addr))
                        return -EINVAL;
+                if (addr->sin6_family != AF_INET6)
+                        return -EINVAL;
                pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n",
                         sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port));
@@ -668,8 +675,8 @@ int ping_common_sendmsg(int family, struct msghdr *msg, size_t len,
 }
 EXPORT_SYMBOL_GPL(ping_common_sendmsg);
-int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+static int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
-                    size_t len)
+                           size_t len)
 {
        struct net *net = sock_net(sk);
        struct flowi4 fl4;
@@ -696,7 +703,7 @@ int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         */
        if (msg->msg_name) {
-                struct sockaddr_in *usin = (struct sockaddr_in *)msg->msg_name;
+                DECLARE_SOCKADDR(struct sockaddr_in *, usin, msg->msg_name);
                if (msg->msg_namelen < sizeof(*usin))
                        return -EINVAL;
                if (usin->sin_family != AF_INET)
@@ -869,7 +876,7 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        /* Copy the address and add cmsg data. */
        if (family == AF_INET) {
-                struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
+                DECLARE_SOCKADDR(struct sockaddr_in *, sin, msg->msg_name);
                if (sin) {
                        sin->sin_family = AF_INET;
@@ -886,8 +893,7 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        } else if (family == AF_INET6) {
                struct ipv6_pinfo *np = inet6_sk(sk);
                struct ipv6hdr *ip6 = ipv6_hdr(skb);
-                struct sockaddr_in6 *sin6 =
+                DECLARE_SOCKADDR(struct sockaddr_in6 *, sin6, msg->msg_name);
-                        (struct sockaddr_in6 *)msg->msg_name;
                if (sin6) {
                        sin6->sin6_family = AF_INET6;
@@ -903,7 +909,12 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                }
                if (inet6_sk(sk)->rxopt.all)
-                        pingv6_ops.ip6_datagram_recv_ctl(sk, msg, skb);
+                        pingv6_ops.ip6_datagram_recv_common_ctl(sk, msg, skb);
+                if (skb->protocol == htons(ETH_P_IPV6) &&
+                    inet6_sk(sk)->rxopt.all)
+                        pingv6_ops.ip6_datagram_recv_specific_ctl(sk, msg, skb);
+                else if (skb->protocol == htons(ETH_P_IP) && isk->cmsg_flags)
+                        ip_cmsg_recv(msg, skb);
 #endif
        } else {
                BUG();
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 4a0335854b89..a6c8a80ec9d6 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -279,6 +279,7 @@ static const struct snmp_mib snmp4_net_list[] = {
        SNMP_MIB_ITEM("TCPFastOpenCookieReqd", LINUX_MIB_TCPFASTOPENCOOKIEREQD),
        SNMP_MIB_ITEM("TCPSpuriousRtxHostQueues", LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES),
        SNMP_MIB_ITEM("BusyPollRxPackets", LINUX_MIB_BUSYPOLLRXPACKETS),
+        SNMP_MIB_ITEM("TCPAutoCorking", LINUX_MIB_TCPAUTOCORKING),
        SNMP_MIB_SENTINEL
 };
@@ -332,22 +333,22 @@ static void icmp_put(struct seq_file *seq)
        atomic_long_t *ptr = net->mib.icmpmsg_statistics->mibs;
        seq_puts(seq, "\nIcmp: InMsgs InErrors InCsumErrors");
-        for (i=0; icmpmibmap[i].name != NULL; i++)
+        for (i = 0; icmpmibmap[i].name != NULL; i++)
                seq_printf(seq, " In%s", icmpmibmap[i].name);
        seq_printf(seq, " OutMsgs OutErrors");
-        for (i=0; icmpmibmap[i].name != NULL; i++)
+        for (i = 0; icmpmibmap[i].name != NULL; i++)
                seq_printf(seq, " Out%s", icmpmibmap[i].name);
        seq_printf(seq, "\nIcmp: %lu %lu %lu",
                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_INMSGS),
                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_INERRORS),
                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_CSUMERRORS));
-        for (i=0; icmpmibmap[i].name != NULL; i++)
+        for (i = 0; icmpmibmap[i].name != NULL; i++)
                seq_printf(seq, " %lu",
                           atomic_long_read(ptr + icmpmibmap[i].index));
        seq_printf(seq, " %lu %lu",
                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_OUTMSGS),
                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_OUTERRORS));
-        for (i=0; icmpmibmap[i].name != NULL; i++)
+        for (i = 0; icmpmibmap[i].name != NULL; i++)
                seq_printf(seq, " %lu",
                           atomic_long_read(ptr + (icmpmibmap[i].index | 0x100)));
 }
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 23c3e5b5bb53..c04518f4850a 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -493,7 +493,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         */
        if (msg->msg_namelen) {
-                struct sockaddr_in *usin = (struct sockaddr_in *)msg->msg_name;
+                DECLARE_SOCKADDR(struct sockaddr_in *, usin, msg->msg_name);
                err = -EINVAL;
                if (msg->msg_namelen < sizeof(*usin))
                        goto out;
@@ -575,7 +575,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                           RT_SCOPE_UNIVERSE,
                           inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
-                           inet_sk_flowi_flags(sk) | FLOWI_FLAG_CAN_SLEEP |
+                           inet_sk_flowi_flags(sk) |
                            (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
                           daddr, saddr, 0, 0);
@@ -690,7 +690,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        struct inet_sock *inet = inet_sk(sk);
        size_t copied = 0;
        int err = -EOPNOTSUPP;
-        struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
+        DECLARE_SOCKADDR(struct sockaddr_in *, sin, msg->msg_name);
        struct sk_buff *skb;
        if (flags & MSG_OOB)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index f8da28278014..25071b48921c 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -112,9 +112,6 @@
 #define RT_FL_TOS(oldflp4) \
        ((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
-/* IPv4 datagram length is stored into 16bit field (tot_len) */
-#define IP_MAX_MTU      0xFFFF
 #define RT_GC_TIMEOUT (300*HZ)
 static int ip_rt_max_size;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index b95331e6c077..f2ed13c2125f 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -121,7 +121,7 @@ static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
        cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
        /* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
-        diff = (count - (cookie >> COOKIEBITS)) & ((__u32) - 1 >> COOKIEBITS);
+        diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
        if (diff >= MAX_SYNCOOKIE_AGE)
                return (__u32)-1;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 3d69ec8dac57..44eba052b43d 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -286,13 +286,6 @@ static struct ctl_table ipv4_table[] = {
                .extra2         = &ip_ttl_max,
        },
        {
-                .procname       = "ip_no_pmtu_disc",
-                .data           = &ipv4_config.no_pmtu_disc,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
                .procname       = "ip_nonlocal_bind",
                .data           = &sysctl_ip_nonlocal_bind,
                .maxlen         = sizeof(int),
@@ -707,7 +700,7 @@ static struct ctl_table ipv4_table[] = {
                .mode           = 0644,
                .proc_handler   = proc_dointvec
        },
-        {
+        {
                .procname       = "tcp_thin_dupack",
                .data           = &sysctl_tcp_thin_dupack,
                .maxlen         = sizeof(int),
@@ -733,6 +726,15 @@ static struct ctl_table ipv4_table[] = {
                .extra2         = &gso_max_segs,
        },
        {
+                .procname       = "tcp_autocorking",
+                .data           = &sysctl_tcp_autocorking,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &one,
+        },
+        {
                .procname       = "udp_mem",
                .data           = &sysctl_udp_mem,
                .maxlen         = sizeof(sysctl_udp_mem),
@@ -822,6 +824,20 @@ static struct ctl_table ipv4_net_table[] = {
                .mode           = 0644,
                .proc_handler   = ipv4_local_port_range,
        },
+        {
+                .procname       = "ip_no_pmtu_disc",
+                .data           = &init_net.ipv4.sysctl_ip_no_pmtu_disc,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "ip_forward_use_pmtu",
+                .data           = &init_net.ipv4.sysctl_ip_fwd_use_pmtu,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
        { }
 };
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 82de78603686..4475b3bb494d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -285,6 +285,8 @@ int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
 int sysctl_tcp_min_tso_segs __read_mostly = 2;
+int sysctl_tcp_autocorking __read_mostly = 1;
 struct percpu_counter tcp_orphan_count;
 EXPORT_SYMBOL_GPL(tcp_orphan_count);
@@ -379,7 +381,7 @@ void tcp_init_sock(struct sock *sk)
        struct inet_connection_sock *icsk = inet_csk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
-        skb_queue_head_init(&tp->out_of_order_queue);
+        __skb_queue_head_init(&tp->out_of_order_queue);
        tcp_init_xmit_timers(sk);
        tcp_prequeue_init(tp);
        INIT_LIST_HEAD(&tp->tsq_node);
@@ -619,19 +621,58 @@ static inline void tcp_mark_urg(struct tcp_sock *tp, int flags)
                tp->snd_up = tp->write_seq;
 }
-static inline void tcp_push(struct sock *sk, int flags, int mss_now,
+/* If a not yet filled skb is pushed, do not send it if
-                            int nonagle)
+ * we have data packets in Qdisc or NIC queues :
+ * Because TX completion will happen shortly, it gives a chance
+ * to coalesce future sendmsg() payload into this skb, without
+ * need for a timer, and with no latency trade off.
+ * As packets containing data payload have a bigger truesize
+ * than pure acks (dataless) packets, the last checks prevent
+ * autocorking if we only have an ACK in Qdisc/NIC queues,
+ * or if TX completion was delayed after we processed ACK packet.
+ */
+static bool tcp_should_autocork(struct sock *sk, struct sk_buff *skb,
+                                int size_goal)
 {
-        if (tcp_send_head(sk)) {
+        return skb->len < size_goal &&
-                struct tcp_sock *tp = tcp_sk(sk);
+               sysctl_tcp_autocorking &&
+               skb != tcp_write_queue_head(sk) &&
+               atomic_read(&sk->sk_wmem_alloc) > skb->truesize;
+}
+static void tcp_push(struct sock *sk, int flags, int mss_now,
+                     int nonagle, int size_goal)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb;
-                if (!(flags & MSG_MORE) || forced_push(tp))
+        if (!tcp_send_head(sk))
-                        tcp_mark_push(tp, tcp_write_queue_tail(sk));
+                return;
+        skb = tcp_write_queue_tail(sk);
+        if (!(flags & MSG_MORE) || forced_push(tp))
+                tcp_mark_push(tp, skb);
+        tcp_mark_urg(tp, flags);
+        if (tcp_should_autocork(sk, skb, size_goal)) {
-                tcp_mark_urg(tp, flags);
+                /* avoid atomic op if TSQ_THROTTLED bit is already set */
-                __tcp_push_pending_frames(sk, mss_now,
+                if (!test_bit(TSQ_THROTTLED, &tp->tsq_flags)) {
-                                          (flags & MSG_MORE) ? TCP_NAGLE_CORK : nonagle);
+                        NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAUTOCORKING);
+                        set_bit(TSQ_THROTTLED, &tp->tsq_flags);
+                }
+                /* It is possible TX completion already happened
+                 * before we set TSQ_THROTTLED.
+                 */
+                if (atomic_read(&sk->sk_wmem_alloc) > skb->truesize)
+                        return;
        }
+        if (flags & MSG_MORE)
+                nonagle = TCP_NAGLE_CORK;
+        __tcp_push_pending_frames(sk, mss_now, nonagle);
 }
 static int tcp_splice_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb,
@@ -934,7 +975,8 @@ new_segment:
 wait_for_sndbuf:
                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
-                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+                tcp_push(sk, flags & ~MSG_MORE, mss_now,
+                         TCP_NAGLE_PUSH, size_goal);
                if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                        goto do_error;
@@ -944,7 +986,7 @@ wait_for_memory:
 out:
        if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
-                tcp_push(sk, flags, mss_now, tp->nonagle);
+                tcp_push(sk, flags, mss_now, tp->nonagle, size_goal);
        return copied;
 do_error:
@@ -1225,7 +1267,8 @@ wait_for_sndbuf:
                        set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
                        if (copied)
-                                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+                                tcp_push(sk, flags & ~MSG_MORE, mss_now,
+                                         TCP_NAGLE_PUSH, size_goal);
                        if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                                goto do_error;
@@ -1236,7 +1279,7 @@ wait_for_memory:
 out:
        if (copied)
-                tcp_push(sk, flags, mss_now, tp->nonagle);
+                tcp_push(sk, flags, mss_now, tp->nonagle, size_goal);
        release_sock(sk);
        return copied + copied_syn;
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
index 8a520996f3d2..e498a62b8f97 100644
--- a/net/ipv4/tcp_illinois.c
+++ b/net/ipv4/tcp_illinois.c
@@ -23,7 +23,6 @@
 #define ALPHA_MIN       ((3*ALPHA_SCALE)/10)    /* ~0.3 */
 #define ALPHA_MAX       (10*ALPHA_SCALE)        /* 10.0 */
 #define ALPHA_BASE      ALPHA_SCALE             /* 1.0 */
-#define U32_MAX         ((u32)~0U)
 #define RTT_MAX         (U32_MAX / ALPHA_MAX)   /* 3.3 secs */
 #define BETA_SHIFT      6
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c53b7f35c51d..65cf90e063d5 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -766,7 +766,7 @@ static void tcp_update_pacing_rate(struct sock *sk)
 /* Calculate rto without backoff.  This is the second half of Van Jacobson's
 * routine referred to above.
 */
-void tcp_set_rto(struct sock *sk)
+static void tcp_set_rto(struct sock *sk)
 {
        const struct tcp_sock *tp = tcp_sk(sk);
        /* Old crap is replaced with new one. 8)
@@ -3686,7 +3686,7 @@ const u8 *tcp_parse_md5sig_option(const struct tcphdr *th)
                int opcode = *ptr++;
                int opsize;
-                switch(opcode) {
+                switch (opcode) {
                case TCPOPT_EOL:
                        return NULL;
                case TCPOPT_NOP:
@@ -4046,7 +4046,7 @@ static void tcp_sack_remove(struct tcp_sock *tp)
                        WARN_ON(before(tp->rcv_nxt, sp->end_seq));
                        /* Zap this SACK, by moving forward any other SACKS. */
-                        for (i=this_sack+1; i < num_sacks; i++)
+                        for (i = this_sack+1; i < num_sacks; i++)
                                tp->selective_acks[i-1] = tp->selective_acks[i];
                        num_sacks--;
                        continue;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 067213924751..3cf976510497 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -173,7 +173,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        rt = ip_route_connect(fl4, nexthop, inet->inet_saddr,
                              RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                              IPPROTO_TCP,
-                              orig_sport, orig_dport, sk, true);
+                              orig_sport, orig_dport, sk);
        if (IS_ERR(rt)) {
                err = PTR_ERR(rt);
                if (err == -ENETUNREACH)
@@ -827,7 +827,7 @@ static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
        const struct inet_request_sock *ireq = inet_rsk(req);
        struct flowi4 fl4;
        int err = -1;
-        struct sk_buff * skb;
+        struct sk_buff *skb;
        /* First, grab a route. */
        if (!dst && (dst = inet_csk_route_req(sk, &fl4, req)) == NULL)
@@ -1668,7 +1668,6 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
        }
        sk_setup_caps(newsk, dst);
-        tcp_mtup_init(newsk);
        tcp_sync_mss(newsk, dst_mtu(dst));
        newtp->advmss = dst_metric_advmss(dst);
        if (tcp_sk(sk)->rx_opt.user_mss &&
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 098b3a29f6f3..d547075d8300 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -22,7 +22,8 @@
 int sysctl_tcp_nometrics_save __read_mostly;
-static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *addr,
+static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *saddr,
+                                                   const struct inetpeer_addr *daddr,
                                                   struct net *net, unsigned int hash);
 struct tcp_fastopen_metrics {
@@ -34,7 +35,8 @@ struct tcp_fastopen_metrics {
 struct tcp_metrics_block {
        struct tcp_metrics_block __rcu  *tcpm_next;
-        struct inetpeer_addr            tcpm_addr;
+        struct inetpeer_addr            tcpm_saddr;
+        struct inetpeer_addr            tcpm_daddr;
        unsigned long                   tcpm_stamp;
        u32                             tcpm_ts;
        u32                             tcpm_ts_stamp;
@@ -145,7 +147,8 @@ static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst
 #define TCP_METRICS_RECLAIM_PTR         (struct tcp_metrics_block *) 0x1UL
 static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
-                                          struct inetpeer_addr *addr,
+                                          struct inetpeer_addr *saddr,
+                                          struct inetpeer_addr *daddr,
                                          unsigned int hash)
 {
        struct tcp_metrics_block *tm;
@@ -158,7 +161,7 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
        /* While waiting for the spin-lock the cache might have been populated
         * with this entry and so we have to check again.
         */
-        tm = __tcp_get_metrics(addr, net, hash);
+        tm = __tcp_get_metrics(saddr, daddr, net, hash);
        if (tm == TCP_METRICS_RECLAIM_PTR) {
                reclaim = true;
                tm = NULL;
@@ -183,7 +186,8 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
                if (!tm)
                        goto out_unlock;
        }
-        tm->tcpm_addr = *addr;
+        tm->tcpm_saddr = *saddr;
+        tm->tcpm_daddr = *daddr;
        tcpm_suck_dst(tm, dst, true);
@@ -206,7 +210,8 @@ static struct tcp_metrics_block *tcp_get_encode(struct tcp_metrics_block *tm, in
        return NULL;
 }
-static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *addr,
+static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *saddr,
+                                                   const struct inetpeer_addr *daddr,
                                                   struct net *net, unsigned int hash)
 {
        struct tcp_metrics_block *tm;
@@ -214,7 +219,8 @@ static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *a
        for (tm = rcu_dereference(net->ipv4.tcp_metrics_hash[hash].chain); tm;
             tm = rcu_dereference(tm->tcpm_next)) {
-                if (addr_same(&tm->tcpm_addr, addr))
+                if (addr_same(&tm->tcpm_saddr, saddr) &&
+                    addr_same(&tm->tcpm_daddr, daddr))
                        break;
                depth++;
        }
@@ -225,19 +231,22 @@ static struct tcp_metrics_block *__tcp_get_metrics_req(struct request_sock *req,
                                                       struct dst_entry *dst)
 {
        struct tcp_metrics_block *tm;
-        struct inetpeer_addr addr;
+        struct inetpeer_addr saddr, daddr;
        unsigned int hash;
        struct net *net;
-        addr.family = req->rsk_ops->family;
+        saddr.family = req->rsk_ops->family;
-        switch (addr.family) {
+        daddr.family = req->rsk_ops->family;
+        switch (daddr.family) {
        case AF_INET:
-                addr.addr.a4 = inet_rsk(req)->ir_rmt_addr;
+                saddr.addr.a4 = inet_rsk(req)->ir_loc_addr;
-                hash = (__force unsigned int) addr.addr.a4;
+                daddr.addr.a4 = inet_rsk(req)->ir_rmt_addr;
+                hash = (__force unsigned int) daddr.addr.a4;
                break;
 #if IS_ENABLED(CONFIG_IPV6)
        case AF_INET6:
-                *(struct in6_addr *)addr.addr.a6 = inet_rsk(req)->ir_v6_rmt_addr;
+                *(struct in6_addr *)saddr.addr.a6 = inet_rsk(req)->ir_v6_loc_addr;
+                *(struct in6_addr *)daddr.addr.a6 = inet_rsk(req)->ir_v6_rmt_addr;
                hash = ipv6_addr_hash(&inet_rsk(req)->ir_v6_rmt_addr);
                break;
 #endif
@@ -250,7 +259,8 @@ static struct tcp_metrics_block *__tcp_get_metrics_req(struct request_sock *req,
        for (tm = rcu_dereference(net->ipv4.tcp_metrics_hash[hash].chain); tm;
             tm = rcu_dereference(tm->tcpm_next)) {
-                if (addr_same(&tm->tcpm_addr, &addr))
+                if (addr_same(&tm->tcpm_saddr, &saddr) &&
+                    addr_same(&tm->tcpm_daddr, &daddr))
                        break;
        }
        tcpm_check_stamp(tm, dst);
@@ -260,32 +270,44 @@ static struct tcp_metrics_block *__tcp_get_metrics_req(struct request_sock *req,
 static struct tcp_metrics_block *__tcp_get_metrics_tw(struct inet_timewait_sock *tw)
 {
        struct tcp_metrics_block *tm;
-        struct inetpeer_addr addr;
+        struct inetpeer_addr saddr, daddr;
        unsigned int hash;
        struct net *net;
-        addr.family = tw->tw_family;
+        if (tw->tw_family == AF_INET) {
-        switch (addr.family) {
+                saddr.family = AF_INET;
-        case AF_INET:
+                saddr.addr.a4 = tw->tw_rcv_saddr;
-                addr.addr.a4 = tw->tw_daddr;
+                daddr.family = AF_INET;
-                hash = (__force unsigned int) addr.addr.a4;
+                daddr.addr.a4 = tw->tw_daddr;
-                break;
+                hash = (__force unsigned int) daddr.addr.a4;
+        }
 #if IS_ENABLED(CONFIG_IPV6)
-        case AF_INET6:
+        else if (tw->tw_family == AF_INET6) {
-                *(struct in6_addr *)addr.addr.a6 = tw->tw_v6_daddr;
+                if (ipv6_addr_v4mapped(&tw->tw_v6_daddr)) {
-                hash = ipv6_addr_hash(&tw->tw_v6_daddr);
+                        saddr.family = AF_INET;
-                break;
+                        saddr.addr.a4 = tw->tw_rcv_saddr;
+                        daddr.family = AF_INET;
+                        daddr.addr.a4 = tw->tw_daddr;
+                        hash = (__force unsigned int) daddr.addr.a4;
+                } else {
+                        saddr.family = AF_INET6;
+                        *(struct in6_addr *)saddr.addr.a6 = tw->tw_v6_rcv_saddr;
+                        daddr.family = AF_INET6;
+                        *(struct in6_addr *)daddr.addr.a6 = tw->tw_v6_daddr;
+                        hash = ipv6_addr_hash(&tw->tw_v6_daddr);
+                }
+        }
 #endif
-        default:
+        else
                return NULL;
-        }
        net = twsk_net(tw);
        hash = hash_32(hash, net->ipv4.tcp_metrics_hash_log);
        for (tm = rcu_dereference(net->ipv4.tcp_metrics_hash[hash].chain); tm;
             tm = rcu_dereference(tm->tcpm_next)) {
-                if (addr_same(&tm->tcpm_addr, &addr))
+                if (addr_same(&tm->tcpm_saddr, &saddr) &&
+                    addr_same(&tm->tcpm_daddr, &daddr))
                        break;
        }
        return tm;
@@ -296,34 +318,45 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
                                                 bool create)
 {
        struct tcp_metrics_block *tm;
-        struct inetpeer_addr addr;
+        struct inetpeer_addr saddr, daddr;
        unsigned int hash;
        struct net *net;
-        addr.family = sk->sk_family;
+        if (sk->sk_family == AF_INET) {
-        switch (addr.family) {
+                saddr.family = AF_INET;
-        case AF_INET:
+                saddr.addr.a4 = inet_sk(sk)->inet_saddr;
-                addr.addr.a4 = inet_sk(sk)->inet_daddr;
+                daddr.family = AF_INET;
-                hash = (__force unsigned int) addr.addr.a4;
+                daddr.addr.a4 = inet_sk(sk)->inet_daddr;
-                break;
+                hash = (__force unsigned int) daddr.addr.a4;
+        }
 #if IS_ENABLED(CONFIG_IPV6)
-        case AF_INET6:
+        else if (sk->sk_family == AF_INET6) {
-                *(struct in6_addr *)addr.addr.a6 = sk->sk_v6_daddr;
+                if (ipv6_addr_v4mapped(&sk->sk_v6_daddr)) {
-                hash = ipv6_addr_hash(&sk->sk_v6_daddr);
+                        saddr.family = AF_INET;
-                break;
+                        saddr.addr.a4 = inet_sk(sk)->inet_saddr;
+                        daddr.family = AF_INET;
+                        daddr.addr.a4 = inet_sk(sk)->inet_daddr;
+                        hash = (__force unsigned int) daddr.addr.a4;
+                } else {
+                        saddr.family = AF_INET6;
+                        *(struct in6_addr *)saddr.addr.a6 = sk->sk_v6_rcv_saddr;
+                        daddr.family = AF_INET6;
+                        *(struct in6_addr *)daddr.addr.a6 = sk->sk_v6_daddr;
+                        hash = ipv6_addr_hash(&sk->sk_v6_daddr);
+                }
+        }
 #endif
-        default:
+        else
                return NULL;
-        }
        net = dev_net(dst->dev);
        hash = hash_32(hash, net->ipv4.tcp_metrics_hash_log);
-        tm = __tcp_get_metrics(&addr, net, hash);
+        tm = __tcp_get_metrics(&saddr, &daddr, net, hash);
        if (tm == TCP_METRICS_RECLAIM_PTR)
                tm = NULL;
        if (!tm && create)
-                tm = tcpm_new(dst, &addr, hash);
+                tm = tcpm_new(dst, &saddr, &daddr, hash);
        else
                tcpm_check_stamp(tm, dst);
@@ -737,15 +770,21 @@ static int tcp_metrics_fill_info(struct sk_buff *msg,
        struct nlattr *nest;
        int i;
-        switch (tm->tcpm_addr.family) {
+        switch (tm->tcpm_daddr.family) {
        case AF_INET:
                if (nla_put_be32(msg, TCP_METRICS_ATTR_ADDR_IPV4,
-                                tm->tcpm_addr.addr.a4) < 0)
+                                tm->tcpm_daddr.addr.a4) < 0)
+                        goto nla_put_failure;
+                if (nla_put_be32(msg, TCP_METRICS_ATTR_SADDR_IPV4,
+                                tm->tcpm_saddr.addr.a4) < 0)
                        goto nla_put_failure;
                break;
        case AF_INET6:
                if (nla_put(msg, TCP_METRICS_ATTR_ADDR_IPV6, 16,
-                            tm->tcpm_addr.addr.a6) < 0)
+                            tm->tcpm_daddr.addr.a6) < 0)
+                        goto nla_put_failure;
+                if (nla_put(msg, TCP_METRICS_ATTR_SADDR_IPV6, 16,
+                            tm->tcpm_saddr.addr.a6) < 0)
                        goto nla_put_failure;
                break;
        default:
@@ -868,44 +907,66 @@ done:
        return skb->len;
 }
-static int parse_nl_addr(struct genl_info *info, struct inetpeer_addr *addr,
+static int __parse_nl_addr(struct genl_info *info, struct inetpeer_addr *addr,
-                         unsigned int *hash, int optional)
+                           unsigned int *hash, int optional, int v4, int v6)
 {
        struct nlattr *a;
-        a = info->attrs[TCP_METRICS_ATTR_ADDR_IPV4];
+        a = info->attrs[v4];
        if (a) {
                addr->family = AF_INET;
                addr->addr.a4 = nla_get_be32(a);
-                *hash = (__force unsigned int) addr->addr.a4;
+                if (hash)
+                        *hash = (__force unsigned int) addr->addr.a4;
                return 0;
        }
-        a = info->attrs[TCP_METRICS_ATTR_ADDR_IPV6];
+        a = info->attrs[v6];
        if (a) {
                if (nla_len(a) != sizeof(struct in6_addr))
                        return -EINVAL;
                addr->family = AF_INET6;
                memcpy(addr->addr.a6, nla_data(a), sizeof(addr->addr.a6));
-                *hash = ipv6_addr_hash((struct in6_addr *) addr->addr.a6);
+                if (hash)
+                        *hash = ipv6_addr_hash((struct in6_addr *) addr->addr.a6);
                return 0;
        }
        return optional ? 1 : -EAFNOSUPPORT;
 }
+static int parse_nl_addr(struct genl_info *info, struct inetpeer_addr *addr,
+                         unsigned int *hash, int optional)
+{
+        return __parse_nl_addr(info, addr, hash, optional,
+                               TCP_METRICS_ATTR_ADDR_IPV4,
+                               TCP_METRICS_ATTR_ADDR_IPV6);
+}
+static int parse_nl_saddr(struct genl_info *info, struct inetpeer_addr *addr)
+{
+        return __parse_nl_addr(info, addr, NULL, 0,
+                               TCP_METRICS_ATTR_SADDR_IPV4,
+                               TCP_METRICS_ATTR_SADDR_IPV6);
+}
 static int tcp_metrics_nl_cmd_get(struct sk_buff *skb, struct genl_info *info)
 {
        struct tcp_metrics_block *tm;
-        struct inetpeer_addr addr;
+        struct inetpeer_addr saddr, daddr;
        unsigned int hash;
        struct sk_buff *msg;
        struct net *net = genl_info_net(info);
        void *reply;
        int ret;
+        bool src = true;
-        ret = parse_nl_addr(info, &addr, &hash, 0);
+        ret = parse_nl_addr(info, &daddr, &hash, 0);
        if (ret < 0)
                return ret;
+        ret = parse_nl_saddr(info, &saddr);
+        if (ret < 0)
+                src = false;
        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!msg)
                return -ENOMEM;
@@ -920,7 +981,8 @@ static int tcp_metrics_nl_cmd_get(struct sk_buff *skb, struct genl_info *info)
        rcu_read_lock();
        for (tm = rcu_dereference(net->ipv4.tcp_metrics_hash[hash].chain); tm;
             tm = rcu_dereference(tm->tcpm_next)) {
-                if (addr_same(&tm->tcpm_addr, &addr)) {
+                if (addr_same(&tm->tcpm_daddr, &daddr) &&
+                    (!src || addr_same(&tm->tcpm_saddr, &saddr))) {
                        ret = tcp_metrics_fill_info(msg, tm);
                        break;
                }
@@ -975,32 +1037,38 @@ static int tcp_metrics_nl_cmd_del(struct sk_buff *skb, struct genl_info *info)
        struct tcpm_hash_bucket *hb;
        struct tcp_metrics_block *tm;
        struct tcp_metrics_block __rcu **pp;
-        struct inetpeer_addr addr;
+        struct inetpeer_addr saddr, daddr;
        unsigned int hash;
        struct net *net = genl_info_net(info);
        int ret;
+        bool src = true, found = false;
-        ret = parse_nl_addr(info, &addr, &hash, 1);
+        ret = parse_nl_addr(info, &daddr, &hash, 1);
        if (ret < 0)
                return ret;
        if (ret > 0)
                return tcp_metrics_flush_all(net);
+        ret = parse_nl_saddr(info, &saddr);
+        if (ret < 0)
+                src = false;
        hash = hash_32(hash, net->ipv4.tcp_metrics_hash_log);
        hb = net->ipv4.tcp_metrics_hash + hash;
        pp = &hb->chain;
        spin_lock_bh(&tcp_metrics_lock);
-        for (tm = deref_locked_genl(*pp); tm;
+        for (tm = deref_locked_genl(*pp); tm; tm = deref_locked_genl(*pp)) {
-             pp = &tm->tcpm_next, tm = deref_locked_genl(*pp)) {
+                if (addr_same(&tm->tcpm_daddr, &daddr) &&
-                if (addr_same(&tm->tcpm_addr, &addr)) {
+                    (!src || addr_same(&tm->tcpm_saddr, &saddr))) {
                        *pp = tm->tcpm_next;
-                        break;
+                        kfree_rcu(tm, rcu_head);
+                        found = true;
+                } else {
+                        pp = &tm->tcpm_next;
                }
        }
        spin_unlock_bh(&tcp_metrics_lock);
-        if (!tm)
+        if (!found)
                return -ESRCH;
-        kfree_rcu(tm, rcu_head);
        return 0;
 }
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 97b684159861..7a436c517e44 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -297,6 +297,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                        tw->tw_v6_daddr = sk->sk_v6_daddr;
                        tw->tw_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
                        tw->tw_tclass = np->tclass;
+                        tw->tw_flowlabel = np->flow_label >> 12;
                        tw->tw_ipv6only = np->ipv6only;
                }
 #endif
@@ -425,7 +426,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                tcp_set_ca_state(newsk, TCP_CA_Open);
                tcp_init_xmit_timers(newsk);
-                skb_queue_head_init(&newtp->out_of_order_queue);
+                __skb_queue_head_init(&newtp->out_of_order_queue);
                newtp->write_seq = newtp->pushed_seq = treq->snt_isn + 1;
                newtp->rx_opt.saw_tstamp = 0;
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index 05606353c7e7..b92b81718ca4 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -138,7 +138,6 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb,
 out:
        return segs;
 }
-EXPORT_SYMBOL(tcp_gso_segment);
 struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 {
@@ -197,7 +196,8 @@ struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
        goto out_check_final;
 found:
-        flush = NAPI_GRO_CB(p)->flush;
+        /* Include the IP ID check below from the inner most IP hdr */
+        flush = NAPI_GRO_CB(p)->flush | NAPI_GRO_CB(p)->flush_id;
        flush |= (__force int)(flags & TCP_FLAG_CWR);
        flush |= (__force int)((flags ^ tcp_flag_word(th2)) &
                  ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH));
@@ -230,17 +230,16 @@ out_check_final:
                pp = head;
 out:
-        NAPI_GRO_CB(skb)->flush |= flush;
+        NAPI_GRO_CB(skb)->flush |= (flush != 0);
        return pp;
 }
-EXPORT_SYMBOL(tcp_gro_receive);
 int tcp_gro_complete(struct sk_buff *skb)
 {
        struct tcphdr *th = tcp_hdr(skb);
-        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_start = (unsigned char *)th - skb->head;
        skb->csum_offset = offsetof(struct tcphdr, check);
        skb->ip_summed = CHECKSUM_PARTIAL;
@@ -272,6 +271,7 @@ static int tcp_v4_gso_send_check(struct sk_buff *skb)
 static struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 {
+        /* Use the IP hdr immediately proceeding for this transport */
        const struct iphdr *iph = skb_gro_network_header(skb);
        __wsum wsum;
@@ -279,7 +279,7 @@ static struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *
        if (NAPI_GRO_CB(skb)->flush)
                goto skip_csum;
-        wsum = skb->csum;
+        wsum = NAPI_GRO_CB(skb)->csum;
        switch (skb->ip_summed) {
        case CHECKSUM_NONE:
@@ -303,13 +303,13 @@ skip_csum:
        return tcp_gro_receive(head, skb);
 }
-static int tcp4_gro_complete(struct sk_buff *skb)
+static int tcp4_gro_complete(struct sk_buff *skb, int thoff)
 {
        const struct iphdr *iph = ip_hdr(skb);
        struct tcphdr *th = tcp_hdr(skb);
-        th->check = ~tcp_v4_check(skb->len - skb_transport_offset(skb),
+        th->check = ~tcp_v4_check(skb->len - thoff, iph->saddr,
-                                  iph->saddr, iph->daddr, 0);
+                                  iph->daddr, 0);
        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
        return tcp_gro_complete(skb);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7820f3a7dd70..03d26b85eab8 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -363,15 +363,17 @@ static inline void TCP_ECN_send(struct sock *sk, struct sk_buff *skb,
 */
 static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
 {
+        struct skb_shared_info *shinfo = skb_shinfo(skb);
        skb->ip_summed = CHECKSUM_PARTIAL;
        skb->csum = 0;
        TCP_SKB_CB(skb)->tcp_flags = flags;
        TCP_SKB_CB(skb)->sacked = 0;
-        skb_shinfo(skb)->gso_segs = 1;
+        shinfo->gso_segs = 1;
-        skb_shinfo(skb)->gso_size = 0;
+        shinfo->gso_size = 0;
-        skb_shinfo(skb)->gso_type = 0;
+        shinfo->gso_type = 0;
        TCP_SKB_CB(skb)->seq = seq;
        if (flags & (TCPHDR_SYN | TCPHDR_FIN))
@@ -406,7 +408,7 @@ struct tcp_out_options {
 * Beware: Something in the Internet is very sensitive to the ordering of
 * TCP options, we learned this through the hard way, so be careful here.
 * Luckily we can at least blame others for their non-compliance but from
- * inter-operatibility perspective it seems that we're somewhat stuck with
+ * inter-operability perspective it seems that we're somewhat stuck with
 * the ordering which we have been using if we want to keep working with
 * those broken things (not that it currently hurts anybody as there isn't
 * particular reason why the ordering would need to be changed).
@@ -679,7 +681,7 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
 *
 * Its important tcp_wfree() can be replaced by sock_wfree() in the event skb
 * needs to be reallocated in a driver.
- * The invariant being skb->truesize substracted from sk->sk_wmem_alloc
+ * The invariant being skb->truesize subtracted from sk->sk_wmem_alloc
 *
 * Since transmit from skb destructor is forbidden, we use a tasklet
 * to process all sockets that eventually need to send more skbs.
@@ -699,9 +701,9 @@ static void tcp_tsq_handler(struct sock *sk)
                tcp_write_xmit(sk, tcp_current_mss(sk), 0, 0, GFP_ATOMIC);
 }
 /*
- * One tasklest per cpu tries to send more skbs.
+ * One tasklet per cpu tries to send more skbs.
 * We run in tasklet context but need to disable irqs when
- * transfering tsq->head because tcp_wfree() might
+ * transferring tsq->head because tcp_wfree() might
 * interrupt us (non NAPI drivers)
 */
 static void tcp_tasklet_func(unsigned long data)
@@ -795,7 +797,7 @@ void __init tcp_tasklet_init(void)
 /*
 * Write buffer destructor automatically called from kfree_skb.
- * We cant xmit new skbs from this context, as we might already
+ * We can't xmit new skbs from this context, as we might already
 * hold qdisc lock.
 */
 void tcp_wfree(struct sk_buff *skb)
@@ -986,6 +988,8 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                                 unsigned int mss_now)
 {
+        struct skb_shared_info *shinfo = skb_shinfo(skb);
        /* Make sure we own this skb before messing gso_size/gso_segs */
        WARN_ON_ONCE(skb_cloned(skb));
@@ -993,13 +997,13 @@ static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                /* Avoid the costly divide in the normal
                 * non-TSO case.
                 */
-                skb_shinfo(skb)->gso_segs = 1;
+                shinfo->gso_segs = 1;
-                skb_shinfo(skb)->gso_size = 0;
+                shinfo->gso_size = 0;
-                skb_shinfo(skb)->gso_type = 0;
+                shinfo->gso_type = 0;
        } else {
-                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
+                shinfo->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
-                skb_shinfo(skb)->gso_size = mss_now;
+                shinfo->gso_size = mss_now;
-                skb_shinfo(skb)->gso_type = sk->sk_gso_type;
+                shinfo->gso_type = sk->sk_gso_type;
        }
 }
@@ -1146,6 +1150,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
 */
 static void __pskb_trim_head(struct sk_buff *skb, int len)
 {
+        struct skb_shared_info *shinfo;
        int i, k, eat;
        eat = min_t(int, len, skb_headlen(skb));
@@ -1157,23 +1162,24 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
        }
        eat = len;
        k = 0;
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+        shinfo = skb_shinfo(skb);
-                int size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
+        for (i = 0; i < shinfo->nr_frags; i++) {
+                int size = skb_frag_size(&shinfo->frags[i]);
                if (size <= eat) {
                        skb_frag_unref(skb, i);
                        eat -= size;
                } else {
-                        skb_shinfo(skb)->frags[k] = skb_shinfo(skb)->frags[i];
+                        shinfo->frags[k] = shinfo->frags[i];
                        if (eat) {
-                                skb_shinfo(skb)->frags[k].page_offset += eat;
+                                shinfo->frags[k].page_offset += eat;
-                                skb_frag_size_sub(&skb_shinfo(skb)->frags[k], eat);
+                                skb_frag_size_sub(&shinfo->frags[k], eat);
                                eat = 0;
                        }
                        k++;
                }
        }
-        skb_shinfo(skb)->nr_frags = k;
+        shinfo->nr_frags = k;
        skb_reset_tail_pointer(skb);
        skb->data_len -= len;
@@ -1378,23 +1384,51 @@ static void tcp_cwnd_validate(struct sock *sk)
        }
 }
-/* Returns the portion of skb which can be sent right away without
+/* Minshall's variant of the Nagle send check. */
- * introducing MSS oddities to segment boundaries. In rare cases where
+static bool tcp_minshall_check(const struct tcp_sock *tp)
- * mss_now != mss_cache, we will request caller to create a small skb
+{
- * per input skb which could be mostly avoided here (if desired).
+        return after(tp->snd_sml, tp->snd_una) &&
- *
+                !after(tp->snd_sml, tp->snd_nxt);
- * We explicitly want to create a request for splitting write queue tail
+}
- * to a small skb for Nagle purposes while avoiding unnecessary modulos,
- * thus all the complexity (cwnd_len is always MSS multiple which we
+/* Update snd_sml if this skb is under mss
- * return whenever allowed by the other factors). Basically we need the
+ * Note that a TSO packet might end with a sub-mss segment
- * modulo only when the receiver window alone is the limiting factor or
+ * The test is really :
- * when we would be allowed to send the split-due-to-Nagle skb fully.
+ * if ((skb->len % mss) != 0)
+ *        tp->snd_sml = TCP_SKB_CB(skb)->end_seq;
+ * But we can avoid doing the divide again given we already have
+ *  skb_pcount = skb->len / mss_now
+ */
+static void tcp_minshall_update(struct tcp_sock *tp, unsigned int mss_now,
+                                const struct sk_buff *skb)
+{
+        if (skb->len < tcp_skb_pcount(skb) * mss_now)
+                tp->snd_sml = TCP_SKB_CB(skb)->end_seq;
+}
+/* Return false, if packet can be sent now without violation Nagle's rules:
+ * 1. It is full sized. (provided by caller in %partial bool)
+ * 2. Or it contains FIN. (already checked by caller)
+ * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
+ * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
+ *    With Minshall's modification: all sent small packets are ACKed.
 */
-static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
+static bool tcp_nagle_check(bool partial, const struct tcp_sock *tp,
-                                        unsigned int mss_now, unsigned int max_segs)
+                            unsigned int mss_now, int nonagle)
+{
+        return partial &&
+                ((nonagle & TCP_NAGLE_CORK) ||
+                 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
+}
+/* Returns the portion of skb which can be sent right away */
+static unsigned int tcp_mss_split_point(const struct sock *sk,
+                                        const struct sk_buff *skb,
+                                        unsigned int mss_now,
+                                        unsigned int max_segs,
+                                        int nonagle)
 {
        const struct tcp_sock *tp = tcp_sk(sk);
-        u32 needed, window, max_len;
+        u32 partial, needed, window, max_len;
        window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
        max_len = mss_now * max_segs;
@@ -1407,7 +1441,15 @@ static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_b
        if (max_len <= needed)
                return max_len;
-        return needed - needed % mss_now;
+        partial = needed % mss_now;
+        /* If last segment is not a full MSS, check if Nagle rules allow us
+         * to include this last segment in this skb.
+         * Otherwise, we'll split the skb at last MSS boundary
+         */
+        if (tcp_nagle_check(partial != 0, tp, mss_now, nonagle))
+                return needed - partial;
+        return needed;
 }
 /* Can at least one segment of SKB be sent right now, according to the
@@ -1447,28 +1489,6 @@ static int tcp_init_tso_segs(const struct sock *sk, struct sk_buff *skb,
        return tso_segs;
 }
-/* Minshall's variant of the Nagle send check. */
-static inline bool tcp_minshall_check(const struct tcp_sock *tp)
-{
-        return after(tp->snd_sml, tp->snd_una) &&
-                !after(tp->snd_sml, tp->snd_nxt);
-}
-/* Return false, if packet can be sent now without violation Nagle's rules:
- * 1. It is full sized.
- * 2. Or it contains FIN. (already checked by caller)
- * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
- * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
- *    With Minshall's modification: all sent small packets are ACKed.
- */
-static inline bool tcp_nagle_check(const struct tcp_sock *tp,
-                                  const struct sk_buff *skb,
-                                  unsigned int mss_now, int nonagle)
-{
-        return skb->len < mss_now &&
-                ((nonagle & TCP_NAGLE_CORK) ||
-                 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
-}
 /* Return true if the Nagle test allows this packet to be
 * sent now.
@@ -1489,7 +1509,7 @@ static inline bool tcp_nagle_test(const struct tcp_sock *tp, const struct sk_buf
        if (tcp_urg_mode(tp) || (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN))
                return true;
-        if (!tcp_nagle_check(tp, skb, cur_mss, nonagle))
+        if (!tcp_nagle_check(skb->len < cur_mss, tp, cur_mss, nonagle))
                return true;
        return false;
@@ -1892,7 +1912,8 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                        limit = tcp_mss_split_point(sk, skb, mss_now,
                                                    min_t(unsigned int,
                                                          cwnd_quota,
-                                                          sk->sk_gso_max_segs));
+                                                          sk->sk_gso_max_segs),
+                                                    nonagle);
                if (skb->len > limit &&
                    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
@@ -2756,7 +2777,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 EXPORT_SYMBOL(tcp_make_synack);
 /* Do all connect socket setups that can be done AF independent. */
-void tcp_connect_init(struct sock *sk)
+static void tcp_connect_init(struct sock *sk)
 {
        const struct dst_entry *dst = __sk_dst_get(sk);
        struct tcp_sock *tp = tcp_sk(sk);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 8b97d71e193b..1f2d37613c9e 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -38,7 +38,7 @@ MODULE_DESCRIPTION("TCP cwnd snooper");
 MODULE_LICENSE("GPL");
 MODULE_VERSION("1.1");
-static int port __read_mostly = 0;
+static int port __read_mostly;
 MODULE_PARM_DESC(port, "Port to match (0=all)");
 module_param(port, int, 0);
@@ -46,7 +46,7 @@ static unsigned int bufsize __read_mostly = 4096;
 MODULE_PARM_DESC(bufsize, "Log buffer size in packets (4096)");
 module_param(bufsize, uint, 0);
-static unsigned int fwmark __read_mostly = 0;
+static unsigned int fwmark __read_mostly;
 MODULE_PARM_DESC(fwmark, "skb mark to match (0=no mark)");
 module_param(fwmark, uint, 0);
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index a347a078ee07..1a8d271f994d 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -3,7 +3,7 @@
 *   YeAH TCP
 *
 * For further details look at:
- *    http://wil.cs.caltech.edu/pfldnet2007/paper/YeAH_TCP.pdf
+ *   https://web.archive.org/web/20080316215752/http://wil.cs.caltech.edu/pfldnet2007/paper/YeAH_TCP.pdf
 *
 */
 #include <linux/mm.h>
@@ -15,13 +15,13 @@
 #include "tcp_vegas.h"
-#define TCP_YEAH_ALPHA       80 //lin number of packets queued at the bottleneck
+#define TCP_YEAH_ALPHA       80 /* number of packets queued at the bottleneck */
-#define TCP_YEAH_GAMMA        1 //lin fraction of queue to be removed per rtt
+#define TCP_YEAH_GAMMA        1 /* fraction of queue to be removed per rtt */
-#define TCP_YEAH_DELTA        3 //log minimum fraction of cwnd to be removed on loss
+#define TCP_YEAH_DELTA        3 /* log minimum fraction of cwnd to be removed on loss */
-#define TCP_YEAH_EPSILON      1 //log maximum fraction to be removed on early decongestion
+#define TCP_YEAH_EPSILON      1 /* log maximum fraction to be removed on early decongestion */
-#define TCP_YEAH_PHY          8 //lin maximum delta from base
+#define TCP_YEAH_PHY          8 /* maximum delta from base */
-#define TCP_YEAH_RHO         16 //lin minimum number of consecutive rtt to consider competition on loss
+#define TCP_YEAH_RHO         16 /* minimum number of consecutive rtt to consider competition on loss */
-#define TCP_YEAH_ZETA        50 //lin minimum number of state switchs to reset reno_count
+#define TCP_YEAH_ZETA        50 /* minimum number of state switches to reset reno_count */
 #define TCP_SCALABLE_AI_CNT      100U
@@ -214,9 +214,9 @@ static u32 tcp_yeah_ssthresh(struct sock *sk) {
        if (yeah->doing_reno_now < TCP_YEAH_RHO) {
                reduction = yeah->lastQ;
-                reduction = min( reduction, max(tp->snd_cwnd>>1, 2U) );
+                reduction = min(reduction, max(tp->snd_cwnd>>1, 2U));
-                reduction = max( reduction, tp->snd_cwnd >> TCP_YEAH_DELTA);
+                reduction = max(reduction, tp->snd_cwnd >> TCP_YEAH_DELTA);
        } else
                reduction = max(tp->snd_cwnd>>1, 2U);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index a7e4729e974b..77bd16fa9f34 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -223,7 +223,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                inet_get_local_port_range(net, &low, &high);
                remaining = (high - low) + 1;
-                rand = net_random();
+                rand = prandom_u32();
                first = (((u64)rand * remaining) >> 32) + low;
                /*
                 * force rand to be an odd multiple of UDP_HTABLE_SIZE
@@ -902,7 +902,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         *      Get and verify the address.
         */
        if (msg->msg_name) {
-                struct sockaddr_in *usin = (struct sockaddr_in *)msg->msg_name;
+                DECLARE_SOCKADDR(struct sockaddr_in *, usin, msg->msg_name);
                if (msg->msg_namelen < sizeof(*usin))
                        return -EINVAL;
                if (usin->sin_family != AF_INET) {
@@ -986,7 +986,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                fl4 = &fl4_stack;
                flowi4_init_output(fl4, ipc.oif, sk->sk_mark, tos,
                                   RT_SCOPE_UNIVERSE, sk->sk_protocol,
-                                   inet_sk_flowi_flags(sk)|FLOWI_FLAG_CAN_SLEEP,
+                                   inet_sk_flowi_flags(sk),
                                   faddr, saddr, dport, inet->inet_sport);
                security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
@@ -1226,7 +1226,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                size_t len, int noblock, int flags, int *addr_len)
 {
        struct inet_sock *inet = inet_sk(sk);
-        struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
+        DECLARE_SOCKADDR(struct sockaddr_in *, sin, msg->msg_name);
        struct sk_buff *skb;
        unsigned int ulen, copied;
        int peeked, off = 0;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 79c62bdcd3c5..25f5cee3a08a 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -14,6 +14,15 @@
 #include <net/udp.h>
 #include <net/protocol.h>
+static DEFINE_SPINLOCK(udp_offload_lock);
+static struct udp_offload_priv __rcu *udp_offload_base __read_mostly;
+struct udp_offload_priv {
+        struct udp_offload      *offload;
+        struct rcu_head         rcu;
+        struct udp_offload_priv __rcu *next;
+};
 static int udp4_ufo_send_check(struct sk_buff *skb)
 {
        if (!pskb_may_pull(skb, sizeof(struct udphdr)))
@@ -89,10 +98,144 @@ out:
        return segs;
 }
+int udp_add_offload(struct udp_offload *uo)
+{
+        struct udp_offload_priv __rcu **head = &udp_offload_base;
+        struct udp_offload_priv *new_offload = kzalloc(sizeof(*new_offload), GFP_KERNEL);
+        if (!new_offload)
+                return -ENOMEM;
+        new_offload->offload = uo;
+        spin_lock(&udp_offload_lock);
+        rcu_assign_pointer(new_offload->next, rcu_dereference(*head));
+        rcu_assign_pointer(*head, new_offload);
+        spin_unlock(&udp_offload_lock);
+        return 0;
+}
+EXPORT_SYMBOL(udp_add_offload);
+static void udp_offload_free_routine(struct rcu_head *head)
+{
+        struct udp_offload_priv *ou_priv = container_of(head, struct udp_offload_priv, rcu);
+        kfree(ou_priv);
+}
+void udp_del_offload(struct udp_offload *uo)
+{
+        struct udp_offload_priv __rcu **head = &udp_offload_base;
+        struct udp_offload_priv *uo_priv;
+        spin_lock(&udp_offload_lock);
+        uo_priv = rcu_dereference(*head);
+        for (; uo_priv != NULL;
+                uo_priv = rcu_dereference(*head)) {
+                if (uo_priv->offload == uo) {
+                        rcu_assign_pointer(*head, rcu_dereference(uo_priv->next));
+                        goto unlock;
+                }
+                head = &uo_priv->next;
+        }
+        pr_warn("udp_del_offload: didn't find offload for port %d\n", ntohs(uo->port));
+unlock:
+        spin_unlock(&udp_offload_lock);
+        if (uo_priv != NULL)
+                call_rcu(&uo_priv->rcu, udp_offload_free_routine);
+}
+EXPORT_SYMBOL(udp_del_offload);
+static struct sk_buff **udp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
+{
+        struct udp_offload_priv *uo_priv;
+        struct sk_buff *p, **pp = NULL;
+        struct udphdr *uh, *uh2;
+        unsigned int hlen, off;
+        int flush = 1;
+        if (NAPI_GRO_CB(skb)->udp_mark ||
+            (!skb->encapsulation && skb->ip_summed != CHECKSUM_COMPLETE))
+                goto out;
+        /* mark that this skb passed once through the udp gro layer */
+        NAPI_GRO_CB(skb)->udp_mark = 1;
+        off  = skb_gro_offset(skb);
+        hlen = off + sizeof(*uh);
+        uh   = skb_gro_header_fast(skb, off);
+        if (skb_gro_header_hard(skb, hlen)) {
+                uh = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!uh))
+                        goto out;
+        }
+        rcu_read_lock();
+        uo_priv = rcu_dereference(udp_offload_base);
+        for (; uo_priv != NULL; uo_priv = rcu_dereference(uo_priv->next)) {
+                if (uo_priv->offload->port == uh->dest &&
+                    uo_priv->offload->callbacks.gro_receive)
+                        goto unflush;
+        }
+        goto out_unlock;
+unflush:
+        flush = 0;
+        for (p = *head; p; p = p->next) {
+                if (!NAPI_GRO_CB(p)->same_flow)
+                        continue;
+                uh2 = (struct udphdr   *)(p->data + off);
+                if ((*(u32 *)&uh->source != *(u32 *)&uh2->source)) {
+                        NAPI_GRO_CB(p)->same_flow = 0;
+                        continue;
+                }
+        }
+        skb_gro_pull(skb, sizeof(struct udphdr)); /* pull encapsulating udp header */
+        pp = uo_priv->offload->callbacks.gro_receive(head, skb);
+out_unlock:
+        rcu_read_unlock();
+out:
+        NAPI_GRO_CB(skb)->flush |= flush;
+        return pp;
+}
+static int udp_gro_complete(struct sk_buff *skb, int nhoff)
+{
+        struct udp_offload_priv *uo_priv;
+        __be16 newlen = htons(skb->len - nhoff);
+        struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);
+        int err = -ENOSYS;
+        uh->len = newlen;
+        rcu_read_lock();
+        uo_priv = rcu_dereference(udp_offload_base);
+        for (; uo_priv != NULL; uo_priv = rcu_dereference(uo_priv->next)) {
+                if (uo_priv->offload->port == uh->dest &&
+                    uo_priv->offload->callbacks.gro_complete)
+                        break;
+        }
+        if (uo_priv != NULL)
+                err = uo_priv->offload->callbacks.gro_complete(skb, nhoff + sizeof(struct udphdr));
+        rcu_read_unlock();
+        return err;
+}
 static const struct net_offload udpv4_offload = {
        .callbacks = {
                .gso_send_check = udp4_ufo_send_check,
                .gso_segment = udp4_ufo_fragment,
+                .gro_receive  = udp_gro_receive,
+                .gro_complete = udp_gro_complete,
        },
 };
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index e3db3f915114..71acd0014f2d 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -48,7 +48,7 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
                hdrlen += IPV4_BEET_PHMAXLEN - (optlen & 4);
        skb_set_network_header(skb, -x->props.header_len -
-                                    hdrlen + (XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph)));
+                                    hdrlen + (XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph)));
        if (x->sel.family != AF_INET6)
                skb->network_header += IPV4_BEET_PHMAXLEN;
        skb->mac_header = skb->network_header +
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 0b2a0641526a..542074c00c78 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -16,7 +16,7 @@
 static int xfrm4_init_flags(struct xfrm_state *x)
 {
-        if (ipv4_config.no_pmtu_disc)
+        if (xs_net(x)->ipv4.sysctl_ip_no_pmtu_disc)
                x->props.flags |= XFRM_STATE_NOPMTUDISC;
        return 0;
 }