37 files changed, 400 insertions, 473 deletions
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 70011e029ac1..b8bc1a3d5cf1 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -126,9 +126,6 @@
 static struct list_head inetsw[SOCK_MAX];
 static DEFINE_SPINLOCK(inetsw_lock);
-struct ipv4_config ipv4_config;
-EXPORT_SYMBOL(ipv4_config);
 /* New destruction routine */
 void inet_sock_destruct(struct sock *sk)
@@ -342,7 +339,7 @@ lookup_protocol:
                        inet->hdrincl = 1;
        }
-        if (ipv4_config.no_pmtu_disc)
+        if (net->ipv4.sysctl_ip_no_pmtu_disc)
                inet->pmtudisc = IP_PMTUDISC_DONT;
        else
                inet->pmtudisc = IP_PMTUDISC_WANT;
@@ -1133,7 +1130,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
        fl4 = &inet->cork.fl.u.ip4;
        rt = ip_route_connect(fl4, daddr, 0, RT_CONN_FLAGS(sk),
                              sk->sk_bound_dev_if, sk->sk_protocol,
-                              inet->inet_sport, inet->inet_dport, sk, false);
+                              inet->inet_sport, inet->inet_dport, sk);
        if (IS_ERR(rt))
                return PTR_ERR(rt);
@@ -1377,8 +1374,12 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
                if (!NAPI_GRO_CB(p)->same_flow)
                        continue;
-                iph2 = ip_hdr(p);
+                iph2 = (struct iphdr *)(p->data + off);
+                /* The above works because, with the exception of the top
+                 * (inner most) layer, we only aggregate pkts with the same
+                 * hdr length so all the hdrs we'll need to verify will start
+                 * at the same offset.
+                 */
                if ((iph->protocol ^ iph2->protocol) |
                    ((__force u32)iph->saddr ^ (__force u32)iph2->saddr) |
                    ((__force u32)iph->daddr ^ (__force u32)iph2->daddr)) {
@@ -1397,6 +1398,11 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
        }
        NAPI_GRO_CB(skb)->flush |= flush;
+        skb_set_network_header(skb, off);
+        /* The above will be needed by the transport layer if there is one
+         * immediately following this IP hdr.
+         */
        skb_gro_pull(skb, sizeof(*iph));
        skb_set_transport_header(skb, skb_gro_offset(skb));
@@ -1411,10 +1417,10 @@ out:
        return pp;
 }
-static int inet_gro_complete(struct sk_buff *skb)
+static int inet_gro_complete(struct sk_buff *skb, int nhoff)
 {
-        __be16 newlen = htons(skb->len - skb_network_offset(skb));
+        __be16 newlen = htons(skb->len - nhoff);
-        struct iphdr *iph = ip_hdr(skb);
+        struct iphdr *iph = (struct iphdr *)(skb->data + nhoff);
        const struct net_offload *ops;
        int proto = iph->protocol;
        int err = -ENOSYS;
@@ -1427,7 +1433,11 @@ static int inet_gro_complete(struct sk_buff *skb)
        if (WARN_ON(!ops || !ops->callbacks.gro_complete))
                goto out_unlock;
-        err = ops->callbacks.gro_complete(skb);
+        /* Only need to add sizeof(*iph) to get to the next hdr below
+         * because any hdr with option will have been flushed in
+         * inet_gro_receive().
+         */
+        err = ops->callbacks.gro_complete(skb, nhoff + sizeof(*iph));
 out_unlock:
        rcu_read_unlock();
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 7808093cede6..5bf408b466b1 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -166,18 +166,20 @@ struct neigh_table arp_tbl = {
        .id             = "arp_cache",
        .parms          = {
                .tbl                    = &arp_tbl,
-                .base_reachable_time    = 30 * HZ,
-                .retrans_time           = 1 * HZ,
-                .gc_staletime           = 60 * HZ,
                .reachable_time         = 30 * HZ,
-                .delay_probe_time       = 5 * HZ,
+                .data   = {
-                .queue_len_bytes        = 64*1024,
+                        [NEIGH_VAR_MCAST_PROBES] = 3,
-                .ucast_probes           = 3,
+                        [NEIGH_VAR_UCAST_PROBES] = 3,
-                .mcast_probes           = 3,
+                        [NEIGH_VAR_RETRANS_TIME] = 1 * HZ,
-                .anycast_delay          = 1 * HZ,
+                        [NEIGH_VAR_BASE_REACHABLE_TIME] = 30 * HZ,
-                .proxy_delay            = (8 * HZ) / 10,
+                        [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
-                .proxy_qlen             = 64,
+                        [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
-                .locktime               = 1 * HZ,
+                        [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
+                        [NEIGH_VAR_PROXY_QLEN] = 64,
+                        [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
+                        [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
+                        [NEIGH_VAR_LOCKTIME] = 1 * HZ,
+                },
        },
        .gc_interval    = 30 * HZ,
        .gc_thresh1     = 128,
@@ -359,14 +361,14 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
        if (!saddr)
                saddr = inet_select_addr(dev, target, RT_SCOPE_LINK);
-        probes -= neigh->parms->ucast_probes;
+        probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
        if (probes < 0) {
                if (!(neigh->nud_state & NUD_VALID))
                        pr_debug("trying to ucast probe in NUD_INVALID\n");
                neigh_ha_snapshot(dst_ha, neigh, dev);
                dst_hw = dst_ha;
        } else {
-                probes -= neigh->parms->app_probes;
+                probes -= NEIGH_VAR(neigh->parms, APP_PROBES);
                if (probes < 0) {
                        neigh_app_ns(neigh);
                        return;
@@ -379,6 +381,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
 static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
 {
+        struct net *net = dev_net(in_dev->dev);
        int scope;
        switch (IN_DEV_ARP_IGNORE(in_dev)) {
@@ -397,6 +400,7 @@ static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
        case 3: /* Do not reply for scope host addresses */
                sip = 0;
                scope = RT_SCOPE_LINK;
+                in_dev = NULL;
                break;
        case 4: /* Reserved */
        case 5:
@@ -408,7 +412,7 @@ static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
        default:
                return 0;
        }
-        return !inet_confirm_addr(in_dev, sip, tip, scope);
+        return !inet_confirm_addr(net, in_dev, sip, tip, scope);
 }
 static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
@@ -871,7 +875,7 @@ static int arp_process(struct sk_buff *skb)
                                if (NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED ||
                                    skb->pkt_type == PACKET_HOST ||
-                                    in_dev->arp_parms->proxy_delay == 0) {
+                                    NEIGH_VAR(in_dev->arp_parms, PROXY_DELAY) == 0) {
                                        arp_send(ARPOP_REPLY, ETH_P_ARP, sip,
                                                 dev, tip, sha, dev->dev_addr,
                                                 sha);
@@ -910,7 +914,8 @@ static int arp_process(struct sk_buff *skb)
                   agents are active. Taking the first reply prevents
                   arp trashing and chooses the fastest router.
                 */
-                override = time_after(jiffies, n->updated + n->parms->locktime);
+                override = time_after(jiffies, n->updated +
+                                               NEIGH_VAR(n->parms, LOCKTIME));
                /* Broadcast replies and request packets
                   do not assert neighbour reachability.
@@ -1107,7 +1112,7 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev)
        return err;
 }
-int arp_invalidate(struct net_device *dev, __be32 ip)
+static int arp_invalidate(struct net_device *dev, __be32 ip)
 {
        struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev);
        int err = -ENXIO;
@@ -1122,7 +1127,6 @@ int arp_invalidate(struct net_device *dev, __be32 ip)
        return err;
 }
-EXPORT_SYMBOL(arp_invalidate);
 static int arp_req_delete_public(struct net *net, struct arpreq *r,
                struct net_device *dev)
@@ -1284,7 +1288,7 @@ void __init arp_init(void)
        dev_add_pack(&arp_packet_type);
        arp_proc_init();
 #ifdef CONFIG_SYSCTL
-        neigh_sysctl_register(NULL, &arp_tbl.parms, "ipv4", NULL);
+        neigh_sysctl_register(NULL, &arp_tbl.parms, NULL);
 #endif
        register_netdevice_notifier(&arp_netdev_notifier);
 }
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 667c1d4ca984..69e77c8ff285 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -31,8 +31,7 @@
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */
@@ -1336,8 +1335,7 @@ static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
        secattr->flags |= NETLBL_SECATTR_MLS_LVL;
        if (tag_len > 4) {
-                secattr->attr.mls.cat =
+                secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
-                                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
                if (secattr->attr.mls.cat == NULL)
                        return -ENOMEM;
@@ -1432,8 +1430,7 @@ static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
        secattr->flags |= NETLBL_SECATTR_MLS_LVL;
        if (tag_len > 4) {
-                secattr->attr.mls.cat =
+                secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
-                                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
                if (secattr->attr.mls.cat == NULL)
                        return -ENOMEM;
@@ -1527,8 +1524,7 @@ static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
        secattr->flags |= NETLBL_SECATTR_MLS_LVL;
        if (tag_len > 4) {
-                secattr->attr.mls.cat =
+                secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
-                                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
                if (secattr->attr.mls.cat == NULL)
                        return -ENOMEM;
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 19e36376d2a0..8b5134c582f1 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -53,7 +53,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        rt = ip_route_connect(fl4, usin->sin_addr.s_addr, saddr,
                              RT_CONN_FLAGS(sk), oif,
                              sk->sk_protocol,
-                              inet->inet_sport, usin->sin_port, sk, true);
+                              inet->inet_sport, usin->sin_port, sk);
        if (IS_ERR(rt)) {
                err = PTR_ERR(rt);
                if (err == -ENETUNREACH)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a1b5bcbd04ae..0feebd5de295 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -99,6 +99,7 @@ static const struct nla_policy ifa_ipv4_policy[IFA_MAX+1] = {
        [IFA_BROADCAST]         = { .type = NLA_U32 },
        [IFA_LABEL]             = { .type = NLA_STRING, .len = IFNAMSIZ - 1 },
        [IFA_CACHEINFO]         = { .len = sizeof(struct ifa_cacheinfo) },
+        [IFA_FLAGS]             = { .type = NLA_U32 },
 };
 #define IN4_ADDR_HSIZE_SHIFT    8
@@ -500,6 +501,7 @@ static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
                return -ENOBUFS;
        }
        ipv4_devconf_setall(in_dev);
+        neigh_parms_data_state_setall(in_dev->arp_parms);
        if (ifa->ifa_dev != in_dev) {
                WARN_ON(ifa->ifa_dev);
                in_dev_hold(in_dev);
@@ -747,6 +749,7 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
                goto errout;
        ipv4_devconf_setall(in_dev);
+        neigh_parms_data_state_setall(in_dev->arp_parms);
        in_dev_hold(in_dev);
        if (tb[IFA_ADDRESS] == NULL)
@@ -755,7 +758,8 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
        INIT_HLIST_NODE(&ifa->hash);
        ifa->ifa_prefixlen = ifm->ifa_prefixlen;
        ifa->ifa_mask = inet_make_mask(ifm->ifa_prefixlen);
-        ifa->ifa_flags = ifm->ifa_flags;
+        ifa->ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) :
+                                         ifm->ifa_flags;
        ifa->ifa_scope = ifm->ifa_scope;
        ifa->ifa_dev = in_dev;
@@ -1236,22 +1240,21 @@ static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
 /*
 * Confirm that local IP address exists using wildcards:
- * - in_dev: only on this interface, 0=any interface
+ * - net: netns to check, cannot be NULL
+ * - in_dev: only on this interface, NULL=any interface
 * - dst: only in the same subnet as dst, 0=any dst
 * - local: address, 0=autoselect the local address
 * - scope: maximum allowed scope value for the local address
 */
-__be32 inet_confirm_addr(struct in_device *in_dev,
+__be32 inet_confirm_addr(struct net *net, struct in_device *in_dev,
                         __be32 dst, __be32 local, int scope)
 {
        __be32 addr = 0;
        struct net_device *dev;
-        struct net *net;
-        if (scope != RT_SCOPE_LINK)
+        if (in_dev != NULL)
                return confirm_addr_indev(in_dev, dst, local, scope);
-        net = dev_net(in_dev->dev);
        rcu_read_lock();
        for_each_netdev_rcu(net, dev) {
                in_dev = __in_dev_get_rcu(dev);
@@ -1435,7 +1438,8 @@ static size_t inet_nlmsg_size(void)
               + nla_total_size(4) /* IFA_ADDRESS */
               + nla_total_size(4) /* IFA_LOCAL */
               + nla_total_size(4) /* IFA_BROADCAST */
-               + nla_total_size(IFNAMSIZ); /* IFA_LABEL */
+               + nla_total_size(IFNAMSIZ) /* IFA_LABEL */
+               + nla_total_size(4);  /* IFA_FLAGS */
 }
 static inline u32 cstamp_delta(unsigned long cstamp)
@@ -1503,6 +1507,7 @@ static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
             nla_put_be32(skb, IFA_BROADCAST, ifa->ifa_broadcast)) ||
            (ifa->ifa_label[0] &&
             nla_put_string(skb, IFA_LABEL, ifa->ifa_label)) ||
+            nla_put_u32(skb, IFA_FLAGS, ifa->ifa_flags) ||
            put_cacheinfo(skb, ifa->ifa_cstamp, ifa->ifa_tstamp,
                          preferred, valid))
                goto nla_put_failure;
@@ -1691,6 +1696,8 @@ static int inet_netconf_msgsize_devconf(int type)
                size += nla_total_size(4);
        if (type == -1 || type == NETCONFA_MC_FORWARDING)
                size += nla_total_size(4);
+        if (type == -1 || type == NETCONFA_PROXY_NEIGH)
+                size += nla_total_size(4);
        return size;
 }
@@ -1727,6 +1734,10 @@ static int inet_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
            nla_put_s32(skb, NETCONFA_MC_FORWARDING,
                        IPV4_DEVCONF(*devconf, MC_FORWARDING)) < 0)
                goto nla_put_failure;
+        if ((type == -1 || type == NETCONFA_PROXY_NEIGH) &&
+            nla_put_s32(skb, NETCONFA_PROXY_NEIGH,
+                        IPV4_DEVCONF(*devconf, PROXY_ARP)) < 0)
+                goto nla_put_failure;
        return nlmsg_end(skb, nlh);
@@ -1764,6 +1775,7 @@ static const struct nla_policy devconf_ipv4_policy[NETCONFA_MAX+1] = {
        [NETCONFA_IFINDEX]      = { .len = sizeof(int) },
        [NETCONFA_FORWARDING]   = { .len = sizeof(int) },
        [NETCONFA_RP_FILTER]    = { .len = sizeof(int) },
+        [NETCONFA_PROXY_NEIGH]  = { .len = sizeof(int) },
 };
 static int inet_netconf_get_devconf(struct sk_buff *in_skb,
@@ -1945,6 +1957,19 @@ static void inet_forward_change(struct net *net)
        }
 }
+static int devinet_conf_ifindex(struct net *net, struct ipv4_devconf *cnf)
+{
+        if (cnf == net->ipv4.devconf_dflt)
+                return NETCONFA_IFINDEX_DEFAULT;
+        else if (cnf == net->ipv4.devconf_all)
+                return NETCONFA_IFINDEX_ALL;
+        else {
+                struct in_device *idev
+                        = container_of(cnf, struct in_device, cnf);
+                return idev->dev->ifindex;
+        }
+}
 static int devinet_conf_proc(struct ctl_table *ctl, int write,
                             void __user *buffer,
                             size_t *lenp, loff_t *ppos)
@@ -1957,6 +1982,7 @@ static int devinet_conf_proc(struct ctl_table *ctl, int write,
                struct ipv4_devconf *cnf = ctl->extra1;
                struct net *net = ctl->extra2;
                int i = (int *)ctl->data - cnf->data;
+                int ifindex;
                set_bit(i, cnf->state);
@@ -1966,23 +1992,19 @@ static int devinet_conf_proc(struct ctl_table *ctl, int write,
                    i == IPV4_DEVCONF_ROUTE_LOCALNET - 1)
                        if ((new_value == 0) && (old_value != 0))
                                rt_cache_flush(net);
                if (i == IPV4_DEVCONF_RP_FILTER - 1 &&
                    new_value != old_value) {
-                        int ifindex;
+                        ifindex = devinet_conf_ifindex(net, cnf);
-                        if (cnf == net->ipv4.devconf_dflt)
-                                ifindex = NETCONFA_IFINDEX_DEFAULT;
-                        else if (cnf == net->ipv4.devconf_all)
-                                ifindex = NETCONFA_IFINDEX_ALL;
-                        else {
-                                struct in_device *idev =
-                                        container_of(cnf, struct in_device,
-                                                     cnf);
-                                ifindex = idev->dev->ifindex;
-                        }
                        inet_netconf_notify_devconf(net, NETCONFA_RP_FILTER,
                                                    ifindex, cnf);
                }
+                if (i == IPV4_DEVCONF_PROXY_ARP - 1 &&
+                    new_value != old_value) {
+                        ifindex = devinet_conf_ifindex(net, cnf);
+                        inet_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
+                                                    ifindex, cnf);
+                }
        }
        return ret;
@@ -2160,7 +2182,7 @@ static void __devinet_sysctl_unregister(struct ipv4_devconf *cnf)
 static void devinet_sysctl_register(struct in_device *idev)
 {
-        neigh_sysctl_register(idev->dev, idev->arp_parms, "ipv4", NULL);
+        neigh_sysctl_register(idev->dev, idev->arp_parms, NULL);
        __devinet_sysctl_register(dev_net(idev->dev), idev->dev->name,
                                        &idev->cnf);
 }
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index 388d113fd289..1e4f6600b31d 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -33,8 +33,6 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event, u32 tb_id,
 void rtmsg_fib(int event, __be32 key, struct fib_alias *fa, int dst_len,
               u32 tb_id, const struct nl_info *info, unsigned int nlm_flags);
 struct fib_alias *fib_find_alias(struct list_head *fah, u8 tos, u32 prio);
-int fib_detect_death(struct fib_info *fi, int order,
-                     struct fib_info **last_resort, int *last_idx, int dflt);
 static inline void fib_result_assign(struct fib_result *res,
                                     struct fib_info *fi)
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 523be38e37de..f2e15738534d 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -104,7 +104,10 @@ errout:
 static bool fib4_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg)
 {
        struct fib_result *result = (struct fib_result *) arg->result;
-        struct net_device *dev = result->fi->fib_dev;
+        struct net_device *dev = NULL;
+        if (result->fi)
+                dev = result->fi->fib_dev;
        /* do not accept result if the route does
         * not meet the required prefix length
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index e63f47a4e651..b53f0bf84dca 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -426,8 +426,9 @@ struct fib_alias *fib_find_alias(struct list_head *fah, u8 tos, u32 prio)
        return NULL;
 }
-int fib_detect_death(struct fib_info *fi, int order,
+static int fib_detect_death(struct fib_info *fi, int order,
-                     struct fib_info **last_resort, int *last_idx, int dflt)
+                            struct fib_info **last_resort, int *last_idx,
+                            int dflt)
 {
        struct neighbour *n;
        int state = NUD_NONE;
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 5c0e8bc6e5ba..fb3c5637199d 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -705,7 +705,9 @@ static void icmp_unreach(struct sk_buff *skb)
                case ICMP_PORT_UNREACH:
                        break;
                case ICMP_FRAG_NEEDED:
-                        if (ipv4_config.no_pmtu_disc) {
+                        if (net->ipv4.sysctl_ip_no_pmtu_disc == 2) {
+                                goto out;
+                        } else if (net->ipv4.sysctl_ip_no_pmtu_disc) {
                                LIMIT_NETDEBUG(KERN_INFO pr_fmt("%pI4: fragmentation needed and DF set\n"),
                                               &iph->daddr);
                        } else {
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 7defdc9ba167..84c4329cbd30 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -310,7 +310,7 @@ igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
        struct ip_sf_list *psf;
        int scount = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (!is_in(pmc, psf, type, gdeleted, sdeleted))
                        continue;
                scount++;
@@ -463,7 +463,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
        }
        first = 1;
        psf_prev = NULL;
-        for (psf=*psf_list; psf; psf=psf_next) {
+        for (psf = *psf_list; psf; psf = psf_next) {
                __be32 *psrc;
                psf_next = psf->sf_next;
@@ -520,7 +520,7 @@ empty_source:
                        return skb;
                if (pmc->crcount || isquery) {
                        /* make sure we have room for group header */
-                        if (skb && AVAILABLE(skb)<sizeof(struct igmpv3_grec)) {
+                        if (skb && AVAILABLE(skb) < sizeof(struct igmpv3_grec)) {
                                igmpv3_sendpack(skb);
                                skb = NULL; /* add_grhead will get a new one */
                        }
@@ -576,7 +576,7 @@ static void igmpv3_clear_zeros(struct ip_sf_list **ppsf)
        struct ip_sf_list *psf_prev, *psf_next, *psf;
        psf_prev = NULL;
-        for (psf=*ppsf; psf; psf = psf_next) {
+        for (psf = *ppsf; psf; psf = psf_next) {
                psf_next = psf->sf_next;
                if (psf->sf_crcount == 0) {
                        if (psf_prev)
@@ -600,7 +600,7 @@ static void igmpv3_send_cr(struct in_device *in_dev)
        /* deleted MCA's */
        pmc_prev = NULL;
-        for (pmc=in_dev->mc_tomb; pmc; pmc=pmc_next) {
+        for (pmc = in_dev->mc_tomb; pmc; pmc = pmc_next) {
                pmc_next = pmc->next;
                if (pmc->sfmode == MCAST_INCLUDE) {
                        type = IGMPV3_BLOCK_OLD_SOURCES;
@@ -764,7 +764,7 @@ static void igmp_ifc_event(struct in_device *in_dev)
 static void igmp_timer_expire(unsigned long data)
 {
-        struct ip_mc_list *im=(struct ip_mc_list *)data;
+        struct ip_mc_list *im = (struct ip_mc_list *)data;
        struct in_device *in_dev = im->interface;
        spin_lock(&im->lock);
@@ -794,10 +794,10 @@ static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
        int i, scount;
        scount = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (scount == nsrcs)
                        break;
-                for (i=0; i<nsrcs; i++) {
+                for (i = 0; i < nsrcs; i++) {
                        /* skip inactive filters */
                        if (psf->sf_count[MCAST_INCLUDE] ||
                            pmc->sfcount[MCAST_EXCLUDE] !=
@@ -825,10 +825,10 @@ static int igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
        /* mark INCLUDE-mode sources */
        scount = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (scount == nsrcs)
                        break;
-                for (i=0; i<nsrcs; i++)
+                for (i = 0; i < nsrcs; i++)
                        if (srcs[i] == psf->sf_inaddr) {
                                psf->sf_gsresp = 1;
                                scount++;
@@ -1103,7 +1103,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
                pmc->tomb = im->tomb;
                pmc->sources = im->sources;
                im->tomb = im->sources = NULL;
-                for (psf=pmc->sources; psf; psf=psf->sf_next)
+                for (psf = pmc->sources; psf; psf = psf->sf_next)
                        psf->sf_crcount = pmc->crcount;
        }
        spin_unlock_bh(&im->lock);
@@ -1121,7 +1121,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr)
        spin_lock_bh(&in_dev->mc_tomb_lock);
        pmc_prev = NULL;
-        for (pmc=in_dev->mc_tomb; pmc; pmc=pmc->next) {
+        for (pmc = in_dev->mc_tomb; pmc; pmc = pmc->next) {
                if (pmc->multiaddr == multiaddr)
                        break;
                pmc_prev = pmc;
@@ -1134,7 +1134,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr)
        }
        spin_unlock_bh(&in_dev->mc_tomb_lock);
        if (pmc) {
-                for (psf=pmc->tomb; psf; psf=psf_next) {
+                for (psf = pmc->tomb; psf; psf = psf_next) {
                        psf_next = psf->sf_next;
                        kfree(psf);
                }
@@ -1167,7 +1167,7 @@ static void igmpv3_clear_delrec(struct in_device *in_dev)
                psf = pmc->tomb;
                pmc->tomb = NULL;
                spin_unlock_bh(&pmc->lock);
-                for (; psf; psf=psf_next) {
+                for (; psf; psf = psf_next) {
                        psf_next = psf->sf_next;
                        kfree(psf);
                }
@@ -1557,7 +1557,7 @@ static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
        int rv = 0;
        psf_prev = NULL;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (psf->sf_inaddr == *psfsrc)
                        break;
                psf_prev = psf;
@@ -1630,7 +1630,7 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                pmc->sfcount[sfmode]--;
        }
        err = 0;
-        for (i=0; i<sfcount; i++) {
+        for (i = 0; i < sfcount; i++) {
                int rv = ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
                changerec |= rv > 0;
@@ -1650,7 +1650,7 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
                        IGMP_Unsolicited_Report_Count;
                in_dev->mr_ifc_count = pmc->crcount;
-                for (psf=pmc->sources; psf; psf = psf->sf_next)
+                for (psf = pmc->sources; psf; psf = psf->sf_next)
                        psf->sf_crcount = 0;
                igmp_ifc_event(pmc->interface);
        } else if (sf_setstate(pmc) || changerec) {
@@ -1671,7 +1671,7 @@ static int ip_mc_add1_src(struct ip_mc_list *pmc, int sfmode,
        struct ip_sf_list *psf, *psf_prev;
        psf_prev = NULL;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (psf->sf_inaddr == *psfsrc)
                        break;
                psf_prev = psf;
@@ -1699,7 +1699,7 @@ static void sf_markstate(struct ip_mc_list *pmc)
        struct ip_sf_list *psf;
        int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
-        for (psf=pmc->sources; psf; psf=psf->sf_next)
+        for (psf = pmc->sources; psf; psf = psf->sf_next)
                if (pmc->sfcount[MCAST_EXCLUDE]) {
                        psf->sf_oldin = mca_xcount ==
                                psf->sf_count[MCAST_EXCLUDE] &&
@@ -1716,7 +1716,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
        int new_in, rv;
        rv = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                if (pmc->sfcount[MCAST_EXCLUDE]) {
                        new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
                                !psf->sf_count[MCAST_INCLUDE];
@@ -1726,7 +1726,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
                        if (!psf->sf_oldin) {
                                struct ip_sf_list *prev = NULL;
-                                for (dpsf=pmc->tomb; dpsf; dpsf=dpsf->sf_next) {
+                                for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next) {
                                        if (dpsf->sf_inaddr == psf->sf_inaddr)
                                                break;
                                        prev = dpsf;
@@ -1748,7 +1748,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
                         * add or update "delete" records if an active filter
                         * is now inactive
                         */
-                        for (dpsf=pmc->tomb; dpsf; dpsf=dpsf->sf_next)
+                        for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next)
                                if (dpsf->sf_inaddr == psf->sf_inaddr)
                                        break;
                        if (!dpsf) {
@@ -1800,7 +1800,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
        if (!delta)
                pmc->sfcount[sfmode]++;
        err = 0;
-        for (i=0; i<sfcount; i++) {
+        for (i = 0; i < sfcount; i++) {
                err = ip_mc_add1_src(pmc, sfmode, &psfsrc[i]);
                if (err)
                        break;
@@ -1810,7 +1810,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                if (!delta)
                        pmc->sfcount[sfmode]--;
-                for (j=0; j<i; j++)
+                for (j = 0; j < i; j++)
                        (void) ip_mc_del1_src(pmc, sfmode, &psfsrc[j]);
        } else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
 #ifdef CONFIG_IP_MULTICAST
@@ -1829,7 +1829,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
                        IGMP_Unsolicited_Report_Count;
                in_dev->mr_ifc_count = pmc->crcount;
-                for (psf=pmc->sources; psf; psf = psf->sf_next)
+                for (psf = pmc->sources; psf; psf = psf->sf_next)
                        psf->sf_crcount = 0;
                igmp_ifc_event(in_dev);
        } else if (sf_setstate(pmc)) {
@@ -1844,12 +1844,12 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc)
 {
        struct ip_sf_list *psf, *nextpsf;
-        for (psf=pmc->tomb; psf; psf=nextpsf) {
+        for (psf = pmc->tomb; psf; psf = nextpsf) {
                nextpsf = psf->sf_next;
                kfree(psf);
        }
        pmc->tomb = NULL;
-        for (psf=pmc->sources; psf; psf=nextpsf) {
+        for (psf = pmc->sources; psf; psf = nextpsf) {
                nextpsf = psf->sf_next;
                kfree(psf);
        }
@@ -2043,7 +2043,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                if (!psl)
                        goto done;      /* err = -EADDRNOTAVAIL */
                rv = !0;
-                for (i=0; i<psl->sl_count; i++) {
+                for (i = 0; i < psl->sl_count; i++) {
                        rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
                                sizeof(__be32));
                        if (rv == 0)
@@ -2062,7 +2062,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
                        &mreqs->imr_sourceaddr, 1);
-                for (j=i+1; j<psl->sl_count; j++)
+                for (j = i+1; j < psl->sl_count; j++)
                        psl->sl_addr[j-1] = psl->sl_addr[j];
                psl->sl_count--;
                err = 0;
@@ -2088,7 +2088,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                newpsl->sl_max = count;
                newpsl->sl_count = count - IP_SFBLOCK;
                if (psl) {
-                        for (i=0; i<psl->sl_count; i++)
+                        for (i = 0; i < psl->sl_count; i++)
                                newpsl->sl_addr[i] = psl->sl_addr[i];
                        /* decrease mem now to avoid the memleak warning */
                        atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
@@ -2098,7 +2098,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                psl = newpsl;
        }
        rv = 1; /* > 0 for insert logic below if sl_count is 0 */
-        for (i=0; i<psl->sl_count; i++) {
+        for (i = 0; i < psl->sl_count; i++) {
                rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
                        sizeof(__be32));
                if (rv == 0)
@@ -2106,7 +2106,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
        }
        if (rv == 0)            /* address already there is an error */
                goto done;
-        for (j=psl->sl_count-1; j>=i; j--)
+        for (j = psl->sl_count-1; j >= i; j--)
                psl->sl_addr[j+1] = psl->sl_addr[j];
        psl->sl_addr[i] = mreqs->imr_sourceaddr;
        psl->sl_count++;
@@ -2305,7 +2305,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
            copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) {
                return -EFAULT;
        }
-        for (i=0; i<copycount; i++) {
+        for (i = 0; i < copycount; i++) {
                struct sockaddr_storage ss;
                psin = (struct sockaddr_in *)&ss;
@@ -2350,7 +2350,7 @@ int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
        if (!psl)
                goto unlock;
-        for (i=0; i<psl->sl_count; i++) {
+        for (i = 0; i < psl->sl_count; i++) {
                if (psl->sl_addr[i] == rmt_addr)
                        break;
        }
@@ -2423,7 +2423,7 @@ int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u
                rv = 1;
        } else if (im) {
                if (src_addr) {
-                        for (psf=im->sources; psf; psf=psf->sf_next) {
+                        for (psf = im->sources; psf; psf = psf->sf_next) {
                                if (psf->sf_inaddr == src_addr)
                                        break;
                        }
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index 1975f52933c5..f17ea49b28fb 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -230,29 +230,6 @@ static void lro_add_packet(struct net_lro_desc *lro_desc, struct sk_buff *skb,
        lro_desc->last_skb = skb;
 }
-static void lro_add_frags(struct net_lro_desc *lro_desc,
-                          int len, int hlen, int truesize,
-                          struct skb_frag_struct *skb_frags,
-                          struct iphdr *iph, struct tcphdr *tcph)
-{
-        struct sk_buff *skb = lro_desc->parent;
-        int tcp_data_len = TCP_PAYLOAD_LENGTH(iph, tcph);
-        lro_add_common(lro_desc, iph, tcph, tcp_data_len);
-        skb->truesize += truesize;
-        skb_frags[0].page_offset += hlen;
-        skb_frag_size_sub(&skb_frags[0], hlen);
-        while (tcp_data_len > 0) {
-                *(lro_desc->next_frag) = *skb_frags;
-                tcp_data_len -= skb_frag_size(skb_frags);
-                lro_desc->next_frag++;
-                skb_frags++;
-                skb_shinfo(skb)->nr_frags++;
-        }
-}
 static int lro_check_tcp_conn(struct net_lro_desc *lro_desc,
                              struct iphdr *iph,
@@ -371,128 +348,6 @@ out:
        return 1;
 }
-static struct sk_buff *lro_gen_skb(struct net_lro_mgr *lro_mgr,
-                                   struct skb_frag_struct *frags,
-                                   int len, int true_size,
-                                   void *mac_hdr,
-                                   int hlen, __wsum sum,
-                                   u32 ip_summed)
-{
-        struct sk_buff *skb;
-        struct skb_frag_struct *skb_frags;
-        int data_len = len;
-        int hdr_len = min(len, hlen);
-        skb = netdev_alloc_skb(lro_mgr->dev, hlen + lro_mgr->frag_align_pad);
-        if (!skb)
-                return NULL;
-        skb_reserve(skb, lro_mgr->frag_align_pad);
-        skb->len = len;
-        skb->data_len = len - hdr_len;
-        skb->truesize += true_size;
-        skb->tail += hdr_len;
-        memcpy(skb->data, mac_hdr, hdr_len);
-        skb_frags = skb_shinfo(skb)->frags;
-        while (data_len > 0) {
-                *skb_frags = *frags;
-                data_len -= skb_frag_size(frags);
-                skb_frags++;
-                frags++;
-                skb_shinfo(skb)->nr_frags++;
-        }
-        skb_shinfo(skb)->frags[0].page_offset += hdr_len;
-        skb_frag_size_sub(&skb_shinfo(skb)->frags[0], hdr_len);
-        skb->ip_summed = ip_summed;
-        skb->csum = sum;
-        skb->protocol = eth_type_trans(skb, lro_mgr->dev);
-        return skb;
-}
-static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
-                                          struct skb_frag_struct *frags,
-                                          int len, int true_size,
-                                          void *priv, __wsum sum)
-{
-        struct net_lro_desc *lro_desc;
-        struct iphdr *iph;
-        struct tcphdr *tcph;
-        struct sk_buff *skb;
-        u64 flags;
-        void *mac_hdr;
-        int mac_hdr_len;
-        int hdr_len = LRO_MAX_PG_HLEN;
-        int vlan_hdr_len = 0;
-        if (!lro_mgr->get_frag_header ||
-            lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
-                                     (void *)&tcph, &flags, priv)) {
-                mac_hdr = skb_frag_address(frags);
-                goto out1;
-        }
-        if (!(flags & LRO_IPV4) || !(flags & LRO_TCP))
-                goto out1;
-        hdr_len = (int)((void *)(tcph) + TCP_HDR_LEN(tcph) - mac_hdr);
-        mac_hdr_len = (int)((void *)(iph) - mac_hdr);
-        lro_desc = lro_get_desc(lro_mgr, lro_mgr->lro_arr, iph, tcph);
-        if (!lro_desc)
-                goto out1;
-        if (!lro_desc->active) { /* start new lro session */
-                if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, NULL))
-                        goto out1;
-                skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
-                                  hdr_len, 0, lro_mgr->ip_summed_aggr);
-                if (!skb)
-                        goto out;
-                if ((skb->protocol == htons(ETH_P_8021Q)) &&
-                    !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
-                        vlan_hdr_len = VLAN_HLEN;
-                iph = (void *)(skb->data + vlan_hdr_len);
-                tcph = (void *)((u8 *)skb->data + vlan_hdr_len
-                                + IP_HDR_LEN(iph));
-                lro_init_desc(lro_desc, skb, iph, tcph);
-                LRO_INC_STATS(lro_mgr, aggregated);
-                return NULL;
-        }
-        if (lro_desc->tcp_next_seq != ntohl(tcph->seq))
-                goto out2;
-        if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, lro_desc))
-                goto out2;
-        lro_add_frags(lro_desc, len, hdr_len, true_size, frags, iph, tcph);
-        LRO_INC_STATS(lro_mgr, aggregated);
-        if ((skb_shinfo(lro_desc->parent)->nr_frags >= lro_mgr->max_aggr) ||
-            lro_desc->parent->len > (0xFFFF - lro_mgr->dev->mtu))
-                lro_flush(lro_mgr, lro_desc);
-        return NULL;
-out2: /* send aggregated packets to the stack */
-        lro_flush(lro_mgr, lro_desc);
-out1:  /* Original packet has to be posted to the stack */
-        skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
-                          hdr_len, sum, lro_mgr->ip_summed);
-out:
-        return skb;
-}
 void lro_receive_skb(struct net_lro_mgr *lro_mgr,
                     struct sk_buff *skb,
                     void *priv)
@@ -506,23 +361,6 @@ void lro_receive_skb(struct net_lro_mgr *lro_mgr,
 }
 EXPORT_SYMBOL(lro_receive_skb);
-void lro_receive_frags(struct net_lro_mgr *lro_mgr,
-                       struct skb_frag_struct *frags,
-                       int len, int true_size, void *priv, __wsum sum)
-{
-        struct sk_buff *skb;
-        skb = __lro_proc_segment(lro_mgr, frags, len, true_size, priv, sum);
-        if (!skb)
-                return;
-        if (lro_mgr->features & LRO_F_NAPI)
-                netif_receive_skb(skb);
-        else
-                netif_rx(skb);
-}
-EXPORT_SYMBOL(lro_receive_frags);
 void lro_flush_all(struct net_lro_mgr *lro_mgr)
 {
        int i;
@@ -534,14 +372,3 @@ void lro_flush_all(struct net_lro_mgr *lro_mgr)
        }
 }
 EXPORT_SYMBOL(lro_flush_all);
-void lro_flush_pkt(struct net_lro_mgr *lro_mgr,
-                  struct iphdr *iph, struct tcphdr *tcph)
-{
-        struct net_lro_desc *lro_desc;
-        lro_desc = lro_get_desc(lro_mgr, lro_mgr->lro_arr, iph, tcph);
-        if (lro_desc->active)
-                lro_flush(lro_mgr, lro_desc);
-}
-EXPORT_SYMBOL(lro_flush_pkt);
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 33d5537881ed..48f424465112 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -109,13 +109,6 @@ static inline void flush_check(struct inet_peer_base *base, int family)
        }
 }
-void inetpeer_invalidate_family(int family)
-{
-        atomic_t *fp = inetpeer_seq_ptr(family);
-        atomic_inc(fp);
-}
 #define PEER_MAXDEPTH 40 /* sufficient for about 2^27 nodes */
 /* Exported for sysctl_net_ipv4.  */
@@ -227,7 +220,7 @@ static int addr_compare(const struct inetpeer_addr *a,
        stackptr = _stack;                                      \
        *stackptr++ = &_base->root;                             \
        for (u = rcu_deref_locked(_base->root, _base);          \
-             u != peer_avl_empty; ) {                           \
+             u != peer_avl_empty;) {                            \
                int cmp = addr_compare(_daddr, &u->daddr);      \
                if (cmp == 0)                                   \
                        break;                                  \
@@ -282,7 +275,7 @@ static struct inet_peer *lookup_rcu(const struct inetpeer_addr *daddr,
        *stackptr++ = &start->avl_left;                         \
        v = &start->avl_left;                                   \
        for (u = rcu_deref_locked(*v, base);                    \
-             u->avl_right != peer_avl_empty_rcu; ) {            \
+             u->avl_right != peer_avl_empty_rcu;) {             \
                v = &u->avl_right;                              \
                *stackptr++ = v;                                \
                u = rcu_deref_locked(*v, base);                 \
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 2481993a4970..c10a3ce5cbff 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -704,7 +704,7 @@ struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
                        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
                        if (ip_defrag(skb, user))
                                return NULL;
-                        skb->rxhash = 0;
+                        skb_clear_hash(skb);
                }
        }
        return skb;
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index ec7264514a82..dd9d90b44f97 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -167,7 +167,7 @@ int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
                soffset -= 4;
                if (soffset > 3) {
                        memcpy(&faddr, &start[soffset-1], 4);
-                        for (soffset-=4, doffset=4; soffset > 3; soffset-=4, doffset+=4)
+                        for (soffset -= 4, doffset = 4; soffset > 3; soffset -= 4, doffset += 4)
                                memcpy(&dptr[doffset-1], &start[soffset-1], 4);
                        /*
                         * RFC1812 requires to fix illegal source routes.
@@ -227,7 +227,7 @@ void ip_options_fragment(struct sk_buff *skb)
                        continue;
                }
                optlen = optptr[1];
-                if (optlen<2 || optlen>l)
+                if (optlen < 2 || optlen > l)
                  return;
                if (!IPOPT_COPIED(*optptr))
                        memset(optptr, IPOPT_NOOP, optlen);
@@ -276,7 +276,7 @@ int ip_options_compile(struct net *net,
        for (l = opt->optlen; l > 0; ) {
                switch (*optptr) {
                      case IPOPT_END:
-                        for (optptr++, l--; l>0; optptr++, l--) {
+                        for (optptr++, l--; l > 0; optptr++, l--) {
                                if (*optptr != IPOPT_END) {
                                        *optptr = IPOPT_END;
                                        opt->is_changed = 1;
@@ -289,7 +289,7 @@ int ip_options_compile(struct net *net,
                        continue;
                }
                optlen = optptr[1];
-                if (optlen<2 || optlen>l) {
+                if (optlen < 2 || optlen > l) {
                        pp_ptr = optptr;
                        goto error;
                }
@@ -572,7 +572,7 @@ void ip_forward_options(struct sk_buff *skb)
                optptr = raw + opt->srr;
-                for ( srrptr=optptr[2], srrspace = optptr[1];
+                for ( srrptr = optptr[2], srrspace = optptr[1];
                     srrptr <= srrspace;
                     srrptr += 4
                     ) {
@@ -628,7 +628,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
        if (rt->rt_type != RTN_LOCAL)
                return -EINVAL;
-        for (srrptr=optptr[2], srrspace = optptr[1]; srrptr <= srrspace; srrptr += 4) {
+        for (srrptr = optptr[2], srrspace = optptr[1]; srrptr <= srrspace; srrptr += 4) {
                if (srrptr + 3 > srrspace) {
                        icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((opt->srr+2)<<24));
                        return -EINVAL;
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 3f858266fa7e..a9fc435dc89f 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -386,7 +386,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
 /*
 *      Handle MSG_ERRQUEUE
 */
-int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
+int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
        struct sock_exterr_skb *serr;
        struct sk_buff *skb, *skb2;
@@ -423,6 +423,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len)
                                                   serr->addr_offset);
                sin->sin_port = serr->port;
                memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
+                *addr_len = sizeof(*sin);
        }
        memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
@@ -1050,7 +1051,7 @@ e_inval:
 *
 * To support IP_CMSG_PKTINFO option, we store rt_iif and specific
 * destination in skb->cb[] before dst drop.
- * This way, receiver doesnt make cache line misses to read rtable.
+ * This way, receiver doesn't make cache line misses to read rtable.
 */
 void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
 {
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 42ffbc8d65c6..6156f4ef5e91 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -56,7 +56,7 @@ int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
        skb_scrub_packet(skb, xnet);
-        skb->rxhash = 0;
+        skb_clear_hash(skb);
        skb_dst_set(skb, &rt->dst);
        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
@@ -107,8 +107,7 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto)
        nf_reset(skb);
        secpath_reset(skb);
-        if (!skb->l4_rxhash)
+        skb_clear_hash_if_not_l4(skb);
-                skb->rxhash = 0;
        skb_dst_drop(skb);
        skb->vlan_tci = 0;
        skb_set_queue_mapping(skb, 0);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 62212c772a4b..421a24934ffd 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -425,6 +425,7 @@ struct net_device *ipmr_new_tunnel(struct net *net, struct vifctl *v)
                                goto failure;
                        ipv4_devconf_setall(in_dev);
+                        neigh_parms_data_state_setall(in_dev->arp_parms);
                        IPV4_DEVCONF(in_dev->cnf, RP_FILTER) = 0;
                        if (dev_open(dev))
@@ -517,6 +518,7 @@ static struct net_device *ipmr_reg_vif(struct net *net, struct mr_table *mrt)
        }
        ipv4_devconf_setall(in_dev);
+        neigh_parms_data_state_setall(in_dev->arp_parms);
        IPV4_DEVCONF(in_dev->cnf, RP_FILTER) = 0;
        rcu_read_unlock();
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index f13bd91d9a56..a313c3fbeb46 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -423,6 +423,7 @@ static void synproxy_tg4_destroy(const struct xt_tgdtor_param *par)
 static struct xt_target synproxy_tg4_reg __read_mostly = {
        .name           = "SYNPROXY",
        .family         = NFPROTO_IPV4,
+        .hooks          = (1 << NF_INET_LOCAL_IN) | (1 << NF_INET_FORWARD),
        .target         = synproxy_tg4,
        .targetsize     = sizeof(struct xt_synproxy_info),
        .checkentry     = synproxy_tg4_check,
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 5f011cc89cd9..d551e31b416e 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -34,8 +34,7 @@
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
 *
 * Author: James Morris <jmorris@intercode.com.au>
 *
@@ -462,14 +461,14 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
        }
        if (subid < 40) {
-                optr [0] = 0;
+                optr[0] = 0;
-                optr [1] = subid;
+                optr[1] = subid;
        } else if (subid < 80) {
-                optr [0] = 1;
+                optr[0] = 1;
-                optr [1] = subid - 40;
+                optr[1] = subid - 40;
        } else {
-                optr [0] = 2;
+                optr[0] = 2;
-                optr [1] = subid - 80;
+                optr[1] = subid - 80;
        }
        *len = 2;
diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
index fff5ba1a33b7..4a5e94ac314a 100644
--- a/net/ipv4/netfilter/nft_reject_ipv4.c
+++ b/net/ipv4/netfilter/nft_reject_ipv4.c
@@ -72,7 +72,7 @@ static int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
 {
        const struct nft_reject *priv = nft_expr_priv(expr);
-        if (nla_put_be32(skb, NFTA_REJECT_TYPE, priv->type))
+        if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
                goto nla_put_failure;
        switch (priv->type) {
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 876c6ca2d8f9..cae5262a337c 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -53,8 +53,12 @@
 #include <net/transp_v6.h>
 #endif
+struct ping_table {
+        struct hlist_nulls_head hash[PING_HTABLE_SIZE];
+        rwlock_t                lock;
+};
-struct ping_table ping_table;
+static struct ping_table ping_table;
 struct pingv6_ops pingv6_ops;
 EXPORT_SYMBOL_GPL(pingv6_ops);
@@ -668,8 +672,8 @@ int ping_common_sendmsg(int family, struct msghdr *msg, size_t len,
 }
 EXPORT_SYMBOL_GPL(ping_common_sendmsg);
-int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+static int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
-                    size_t len)
+                           size_t len)
 {
        struct net *net = sock_net(sk);
        struct flowi4 fl4;
@@ -772,7 +776,7 @@ int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                err = PTR_ERR(rt);
                rt = NULL;
                if (err == -ENETUNREACH)
-                        IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
+                        IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
                goto out;
        }
@@ -841,10 +845,11 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        if (flags & MSG_ERRQUEUE) {
                if (family == AF_INET) {
-                        return ip_recv_error(sk, msg, len);
+                        return ip_recv_error(sk, msg, len, addr_len);
 #if IS_ENABLED(CONFIG_IPV6)
                } else if (family == AF_INET6) {
-                        return pingv6_ops.ipv6_recv_error(sk, msg, len);
+                        return pingv6_ops.ipv6_recv_error(sk, msg, len,
+                                                          addr_len);
 #endif
                }
        }
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 4a0335854b89..8ecd7ad959b4 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -279,6 +279,7 @@ static const struct snmp_mib snmp4_net_list[] = {
        SNMP_MIB_ITEM("TCPFastOpenCookieReqd", LINUX_MIB_TCPFASTOPENCOOKIEREQD),
        SNMP_MIB_ITEM("TCPSpuriousRtxHostQueues", LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES),
        SNMP_MIB_ITEM("BusyPollRxPackets", LINUX_MIB_BUSYPOLLRXPACKETS),
+        SNMP_MIB_ITEM("TCPAutoCorking", LINUX_MIB_TCPAUTOCORKING),
        SNMP_MIB_SENTINEL
 };
diff --git a/net/ipv4/protocol.c b/net/ipv4/protocol.c
index ce848461acbb..46d6a1c923a8 100644
--- a/net/ipv4/protocol.c
+++ b/net/ipv4/protocol.c
@@ -31,10 +31,6 @@
 const struct net_protocol __rcu *inet_protos[MAX_INET_PROTOS] __read_mostly;
 const struct net_offload __rcu *inet_offloads[MAX_INET_PROTOS] __read_mostly;
-/*
- *      Add a protocol handler to the hash tables
- */
 int inet_add_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
        if (!prot->netns_ok) {
@@ -55,10 +51,6 @@ int inet_add_offload(const struct net_offload *prot, unsigned char protocol)
 }
 EXPORT_SYMBOL(inet_add_offload);
-/*
- *      Remove a protocol from the hash tables.
- */
 int inet_del_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
        int ret;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 5cb8ddb505ee..81e6cfd5a365 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -575,7 +575,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                           RT_SCOPE_UNIVERSE,
                           inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
-                           inet_sk_flowi_flags(sk) | FLOWI_FLAG_CAN_SLEEP |
+                           inet_sk_flowi_flags(sk) |
                            (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
                           daddr, saddr, 0, 0);
@@ -697,7 +697,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                goto out;
        if (flags & MSG_ERRQUEUE) {
-                err = ip_recv_error(sk, msg, len);
+                err = ip_recv_error(sk, msg, len, addr_len);
                goto out;
        }
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index b95331e6c077..f2ed13c2125f 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -121,7 +121,7 @@ static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
        cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
        /* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
-        diff = (count - (cookie >> COOKIEBITS)) & ((__u32) - 1 >> COOKIEBITS);
+        diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
        if (diff >= MAX_SYNCOOKIE_AGE)
                return (__u32)-1;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 3d69ec8dac57..1d2480ac2bb6 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -286,13 +286,6 @@ static struct ctl_table ipv4_table[] = {
                .extra2         = &ip_ttl_max,
        },
        {
-                .procname       = "ip_no_pmtu_disc",
-                .data           = &ipv4_config.no_pmtu_disc,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
                .procname       = "ip_nonlocal_bind",
                .data           = &sysctl_ip_nonlocal_bind,
                .maxlen         = sizeof(int),
@@ -707,7 +700,7 @@ static struct ctl_table ipv4_table[] = {
                .mode           = 0644,
                .proc_handler   = proc_dointvec
        },
-        {
+        {
                .procname       = "tcp_thin_dupack",
                .data           = &sysctl_tcp_thin_dupack,
                .maxlen         = sizeof(int),
@@ -733,6 +726,15 @@ static struct ctl_table ipv4_table[] = {
                .extra2         = &gso_max_segs,
        },
        {
+                .procname       = "tcp_autocorking",
+                .data           = &sysctl_tcp_autocorking,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &one,
+        },
+        {
                .procname       = "udp_mem",
                .data           = &sysctl_udp_mem,
                .maxlen         = sizeof(sysctl_udp_mem),
@@ -822,6 +824,13 @@ static struct ctl_table ipv4_net_table[] = {
                .mode           = 0644,
                .proc_handler   = ipv4_local_port_range,
        },
+        {
+                .procname       = "ip_no_pmtu_disc",
+                .data           = &init_net.ipv4.sysctl_ip_no_pmtu_disc,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
        { }
 };
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 3dc0c6cf02a8..d099f9a055c6 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -285,6 +285,8 @@ int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
 int sysctl_tcp_min_tso_segs __read_mostly = 2;
+int sysctl_tcp_autocorking __read_mostly = 1;
 struct percpu_counter tcp_orphan_count;
 EXPORT_SYMBOL_GPL(tcp_orphan_count);
@@ -619,19 +621,58 @@ static inline void tcp_mark_urg(struct tcp_sock *tp, int flags)
                tp->snd_up = tp->write_seq;
 }
-static inline void tcp_push(struct sock *sk, int flags, int mss_now,
+/* If a not yet filled skb is pushed, do not send it if
-                            int nonagle)
+ * we have data packets in Qdisc or NIC queues :
+ * Because TX completion will happen shortly, it gives a chance
+ * to coalesce future sendmsg() payload into this skb, without
+ * need for a timer, and with no latency trade off.
+ * As packets containing data payload have a bigger truesize
+ * than pure acks (dataless) packets, the last checks prevent
+ * autocorking if we only have an ACK in Qdisc/NIC queues,
+ * or if TX completion was delayed after we processed ACK packet.
+ */
+static bool tcp_should_autocork(struct sock *sk, struct sk_buff *skb,
+                                int size_goal)
 {
-        if (tcp_send_head(sk)) {
+        return skb->len < size_goal &&
-                struct tcp_sock *tp = tcp_sk(sk);
+               sysctl_tcp_autocorking &&
+               skb != tcp_write_queue_head(sk) &&
+               atomic_read(&sk->sk_wmem_alloc) > skb->truesize;
+}
+static void tcp_push(struct sock *sk, int flags, int mss_now,
+                     int nonagle, int size_goal)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb;
-                if (!(flags & MSG_MORE) || forced_push(tp))
+        if (!tcp_send_head(sk))
-                        tcp_mark_push(tp, tcp_write_queue_tail(sk));
+                return;
+        skb = tcp_write_queue_tail(sk);
+        if (!(flags & MSG_MORE) || forced_push(tp))
+                tcp_mark_push(tp, skb);
+        tcp_mark_urg(tp, flags);
+        if (tcp_should_autocork(sk, skb, size_goal)) {
-                tcp_mark_urg(tp, flags);
+                /* avoid atomic op if TSQ_THROTTLED bit is already set */
-                __tcp_push_pending_frames(sk, mss_now,
+                if (!test_bit(TSQ_THROTTLED, &tp->tsq_flags)) {
-                                          (flags & MSG_MORE) ? TCP_NAGLE_CORK : nonagle);
+                        NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAUTOCORKING);
+                        set_bit(TSQ_THROTTLED, &tp->tsq_flags);
+                }
+                /* It is possible TX completion already happened
+                 * before we set TSQ_THROTTLED.
+                 */
+                if (atomic_read(&sk->sk_wmem_alloc) > skb->truesize)
+                        return;
        }
+        if (flags & MSG_MORE)
+                nonagle = TCP_NAGLE_CORK;
+        __tcp_push_pending_frames(sk, mss_now, nonagle);
 }
 static int tcp_splice_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb,
@@ -934,7 +975,8 @@ new_segment:
 wait_for_sndbuf:
                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
-                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+                tcp_push(sk, flags & ~MSG_MORE, mss_now,
+                         TCP_NAGLE_PUSH, size_goal);
                if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                        goto do_error;
@@ -944,7 +986,7 @@ wait_for_memory:
 out:
        if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
-                tcp_push(sk, flags, mss_now, tp->nonagle);
+                tcp_push(sk, flags, mss_now, tp->nonagle, size_goal);
        return copied;
 do_error:
@@ -1225,7 +1267,8 @@ wait_for_sndbuf:
                        set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
                        if (copied)
-                                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+                                tcp_push(sk, flags & ~MSG_MORE, mss_now,
+                                         TCP_NAGLE_PUSH, size_goal);
                        if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                                goto do_error;
@@ -1236,7 +1279,7 @@ wait_for_memory:
 out:
        if (copied)
-                tcp_push(sk, flags, mss_now, tp->nonagle);
+                tcp_push(sk, flags, mss_now, tp->nonagle, size_goal);
        release_sock(sk);
        return copied + copied_syn;
@@ -1425,7 +1468,7 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
        do {
                if (dma_async_is_tx_complete(tp->ucopy.dma_chan,
                                              last_issued, &done,
-                                              &used) == DMA_SUCCESS) {
+                                              &used) == DMA_COMPLETE) {
                        /* Safe to free early-copied skbs now */
                        __skb_queue_purge(&sk->sk_async_wait_queue);
                        break;
@@ -1433,7 +1476,7 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
                        struct sk_buff *skb;
                        while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
                               (dma_async_is_complete(skb->dma_cookie, done,
-                                                      used) == DMA_SUCCESS)) {
+                                                      used) == DMA_COMPLETE)) {
                                __skb_dequeue(&sk->sk_async_wait_queue);
                                kfree_skb(skb);
                        }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c53b7f35c51d..65cf90e063d5 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -766,7 +766,7 @@ static void tcp_update_pacing_rate(struct sock *sk)
 /* Calculate rto without backoff.  This is the second half of Van Jacobson's
 * routine referred to above.
 */
-void tcp_set_rto(struct sock *sk)
+static void tcp_set_rto(struct sock *sk)
 {
        const struct tcp_sock *tp = tcp_sk(sk);
        /* Old crap is replaced with new one. 8)
@@ -3686,7 +3686,7 @@ const u8 *tcp_parse_md5sig_option(const struct tcphdr *th)
                int opcode = *ptr++;
                int opsize;
-                switch(opcode) {
+                switch (opcode) {
                case TCPOPT_EOL:
                        return NULL;
                case TCPOPT_NOP:
@@ -4046,7 +4046,7 @@ static void tcp_sack_remove(struct tcp_sock *tp)
                        WARN_ON(before(tp->rcv_nxt, sp->end_seq));
                        /* Zap this SACK, by moving forward any other SACKS. */
-                        for (i=this_sack+1; i < num_sacks; i++)
+                        for (i = this_sack+1; i < num_sacks; i++)
                                tp->selective_acks[i-1] = tp->selective_acks[i];
                        num_sacks--;
                        continue;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 59a6f8b90cd9..7297b56c28c7 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -173,11 +173,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        rt = ip_route_connect(fl4, nexthop, inet->inet_saddr,
                              RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                              IPPROTO_TCP,
-                              orig_sport, orig_dport, sk, true);
+                              orig_sport, orig_dport, sk);
        if (IS_ERR(rt)) {
                err = PTR_ERR(rt);
                if (err == -ENETUNREACH)
-                        IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
+                        IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
                return err;
        }
@@ -827,7 +827,7 @@ static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
        const struct inet_request_sock *ireq = inet_rsk(req);
        struct flowi4 fl4;
        int err = -1;
-        struct sk_buff * skb;
+        struct sk_buff *skb;
        /* First, grab a route. */
        if (!dst && (dst = inet_csk_route_req(sk, &fl4, req)) == NULL)
diff --git a/net/ipv4/tcp_memcontrol.c b/net/ipv4/tcp_memcontrol.c
index 03e9154f7e68..f7e522c558ba 100644
--- a/net/ipv4/tcp_memcontrol.c
+++ b/net/ipv4/tcp_memcontrol.c
@@ -6,13 +6,6 @@
 #include <linux/memcontrol.h>
 #include <linux/module.h>
-static void memcg_tcp_enter_memory_pressure(struct sock *sk)
-{
-        if (sk->sk_cgrp->memory_pressure)
-                sk->sk_cgrp->memory_pressure = 1;
-}
-EXPORT_SYMBOL(memcg_tcp_enter_memory_pressure);
 int tcp_init_cgroup(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
 {
        /*
@@ -60,7 +53,6 @@ EXPORT_SYMBOL(tcp_destroy_cgroup);
 static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
 {
        struct cg_proto *cg_proto;
-        u64 old_lim;
        int i;
        int ret;
@@ -71,7 +63,6 @@ static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
        if (val > RES_COUNTER_MAX)
                val = RES_COUNTER_MAX;
-        old_lim = res_counter_read_u64(&cg_proto->memory_allocated, RES_LIMIT);
        ret = res_counter_set_limit(&cg_proto->memory_allocated, val);
        if (ret)
                return ret;
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index a2b68a108eae..2658a27f540d 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -240,7 +240,7 @@ int tcp_gro_complete(struct sk_buff *skb)
 {
        struct tcphdr *th = tcp_hdr(skb);
-        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_start = (unsigned char *)th - skb->head;
        skb->csum_offset = offsetof(struct tcphdr, check);
        skb->ip_summed = CHECKSUM_PARTIAL;
@@ -272,45 +272,45 @@ static int tcp_v4_gso_send_check(struct sk_buff *skb)
 static struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 {
+        /* Use the IP hdr immediately proceeding for this transport */
        const struct iphdr *iph = skb_gro_network_header(skb);
        __wsum wsum;
-        __sum16 sum;
+        /* Don't bother verifying checksum if we're going to flush anyway. */
+        if (NAPI_GRO_CB(skb)->flush)
+                goto skip_csum;
+        wsum = skb->csum;
        switch (skb->ip_summed) {
+        case CHECKSUM_NONE:
+                wsum = skb_checksum(skb, skb_gro_offset(skb), skb_gro_len(skb),
+                                    0);
+                /* fall through */
        case CHECKSUM_COMPLETE:
                if (!tcp_v4_check(skb_gro_len(skb), iph->saddr, iph->daddr,
-                                  skb->csum)) {
+                                  wsum)) {
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
                        break;
                }
-flush:
                NAPI_GRO_CB(skb)->flush = 1;
                return NULL;
-        case CHECKSUM_NONE:
-                wsum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
-                                          skb_gro_len(skb), IPPROTO_TCP, 0);
-                sum = csum_fold(skb_checksum(skb,
-                                             skb_gro_offset(skb),
-                                             skb_gro_len(skb),
-                                             wsum));
-                if (sum)
-                        goto flush;
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                break;
        }
+skip_csum:
        return tcp_gro_receive(head, skb);
 }
-static int tcp4_gro_complete(struct sk_buff *skb)
+static int tcp4_gro_complete(struct sk_buff *skb, int thoff)
 {
        const struct iphdr *iph = ip_hdr(skb);
        struct tcphdr *th = tcp_hdr(skb);
-        th->check = ~tcp_v4_check(skb->len - skb_transport_offset(skb),
+        th->check = ~tcp_v4_check(skb->len - thoff, iph->saddr,
-                                  iph->saddr, iph->daddr, 0);
+                                  iph->daddr, 0);
        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
        return tcp_gro_complete(skb);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7820f3a7dd70..03d26b85eab8 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -363,15 +363,17 @@ static inline void TCP_ECN_send(struct sock *sk, struct sk_buff *skb,
 */
 static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
 {
+        struct skb_shared_info *shinfo = skb_shinfo(skb);
        skb->ip_summed = CHECKSUM_PARTIAL;
        skb->csum = 0;
        TCP_SKB_CB(skb)->tcp_flags = flags;
        TCP_SKB_CB(skb)->sacked = 0;
-        skb_shinfo(skb)->gso_segs = 1;
+        shinfo->gso_segs = 1;
-        skb_shinfo(skb)->gso_size = 0;
+        shinfo->gso_size = 0;
-        skb_shinfo(skb)->gso_type = 0;
+        shinfo->gso_type = 0;
        TCP_SKB_CB(skb)->seq = seq;
        if (flags & (TCPHDR_SYN | TCPHDR_FIN))
@@ -406,7 +408,7 @@ struct tcp_out_options {
 * Beware: Something in the Internet is very sensitive to the ordering of
 * TCP options, we learned this through the hard way, so be careful here.
 * Luckily we can at least blame others for their non-compliance but from
- * inter-operatibility perspective it seems that we're somewhat stuck with
+ * inter-operability perspective it seems that we're somewhat stuck with
 * the ordering which we have been using if we want to keep working with
 * those broken things (not that it currently hurts anybody as there isn't
 * particular reason why the ordering would need to be changed).
@@ -679,7 +681,7 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
 *
 * Its important tcp_wfree() can be replaced by sock_wfree() in the event skb
 * needs to be reallocated in a driver.
- * The invariant being skb->truesize substracted from sk->sk_wmem_alloc
+ * The invariant being skb->truesize subtracted from sk->sk_wmem_alloc
 *
 * Since transmit from skb destructor is forbidden, we use a tasklet
 * to process all sockets that eventually need to send more skbs.
@@ -699,9 +701,9 @@ static void tcp_tsq_handler(struct sock *sk)
                tcp_write_xmit(sk, tcp_current_mss(sk), 0, 0, GFP_ATOMIC);
 }
 /*
- * One tasklest per cpu tries to send more skbs.
+ * One tasklet per cpu tries to send more skbs.
 * We run in tasklet context but need to disable irqs when
- * transfering tsq->head because tcp_wfree() might
+ * transferring tsq->head because tcp_wfree() might
 * interrupt us (non NAPI drivers)
 */
 static void tcp_tasklet_func(unsigned long data)
@@ -795,7 +797,7 @@ void __init tcp_tasklet_init(void)
 /*
 * Write buffer destructor automatically called from kfree_skb.
- * We cant xmit new skbs from this context, as we might already
+ * We can't xmit new skbs from this context, as we might already
 * hold qdisc lock.
 */
 void tcp_wfree(struct sk_buff *skb)
@@ -986,6 +988,8 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                                 unsigned int mss_now)
 {
+        struct skb_shared_info *shinfo = skb_shinfo(skb);
        /* Make sure we own this skb before messing gso_size/gso_segs */
        WARN_ON_ONCE(skb_cloned(skb));
@@ -993,13 +997,13 @@ static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                /* Avoid the costly divide in the normal
                 * non-TSO case.
                 */
-                skb_shinfo(skb)->gso_segs = 1;
+                shinfo->gso_segs = 1;
-                skb_shinfo(skb)->gso_size = 0;
+                shinfo->gso_size = 0;
-                skb_shinfo(skb)->gso_type = 0;
+                shinfo->gso_type = 0;
        } else {
-                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
+                shinfo->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
-                skb_shinfo(skb)->gso_size = mss_now;
+                shinfo->gso_size = mss_now;
-                skb_shinfo(skb)->gso_type = sk->sk_gso_type;
+                shinfo->gso_type = sk->sk_gso_type;
        }
 }
@@ -1146,6 +1150,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
 */
 static void __pskb_trim_head(struct sk_buff *skb, int len)
 {
+        struct skb_shared_info *shinfo;
        int i, k, eat;
        eat = min_t(int, len, skb_headlen(skb));
@@ -1157,23 +1162,24 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
        }
        eat = len;
        k = 0;
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+        shinfo = skb_shinfo(skb);
-                int size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
+        for (i = 0; i < shinfo->nr_frags; i++) {
+                int size = skb_frag_size(&shinfo->frags[i]);
                if (size <= eat) {
                        skb_frag_unref(skb, i);
                        eat -= size;
                } else {
-                        skb_shinfo(skb)->frags[k] = skb_shinfo(skb)->frags[i];
+                        shinfo->frags[k] = shinfo->frags[i];
                        if (eat) {
-                                skb_shinfo(skb)->frags[k].page_offset += eat;
+                                shinfo->frags[k].page_offset += eat;
-                                skb_frag_size_sub(&skb_shinfo(skb)->frags[k], eat);
+                                skb_frag_size_sub(&shinfo->frags[k], eat);
                                eat = 0;
                        }
                        k++;
                }
        }
-        skb_shinfo(skb)->nr_frags = k;
+        shinfo->nr_frags = k;
        skb_reset_tail_pointer(skb);
        skb->data_len -= len;
@@ -1378,23 +1384,51 @@ static void tcp_cwnd_validate(struct sock *sk)
        }
 }
-/* Returns the portion of skb which can be sent right away without
+/* Minshall's variant of the Nagle send check. */
- * introducing MSS oddities to segment boundaries. In rare cases where
+static bool tcp_minshall_check(const struct tcp_sock *tp)
- * mss_now != mss_cache, we will request caller to create a small skb
+{
- * per input skb which could be mostly avoided here (if desired).
+        return after(tp->snd_sml, tp->snd_una) &&
- *
+                !after(tp->snd_sml, tp->snd_nxt);
- * We explicitly want to create a request for splitting write queue tail
+}
- * to a small skb for Nagle purposes while avoiding unnecessary modulos,
- * thus all the complexity (cwnd_len is always MSS multiple which we
+/* Update snd_sml if this skb is under mss
- * return whenever allowed by the other factors). Basically we need the
+ * Note that a TSO packet might end with a sub-mss segment
- * modulo only when the receiver window alone is the limiting factor or
+ * The test is really :
- * when we would be allowed to send the split-due-to-Nagle skb fully.
+ * if ((skb->len % mss) != 0)
+ *        tp->snd_sml = TCP_SKB_CB(skb)->end_seq;
+ * But we can avoid doing the divide again given we already have
+ *  skb_pcount = skb->len / mss_now
+ */
+static void tcp_minshall_update(struct tcp_sock *tp, unsigned int mss_now,
+                                const struct sk_buff *skb)
+{
+        if (skb->len < tcp_skb_pcount(skb) * mss_now)
+                tp->snd_sml = TCP_SKB_CB(skb)->end_seq;
+}
+/* Return false, if packet can be sent now without violation Nagle's rules:
+ * 1. It is full sized. (provided by caller in %partial bool)
+ * 2. Or it contains FIN. (already checked by caller)
+ * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
+ * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
+ *    With Minshall's modification: all sent small packets are ACKed.
 */
-static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
+static bool tcp_nagle_check(bool partial, const struct tcp_sock *tp,
-                                        unsigned int mss_now, unsigned int max_segs)
+                            unsigned int mss_now, int nonagle)
+{
+        return partial &&
+                ((nonagle & TCP_NAGLE_CORK) ||
+                 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
+}
+/* Returns the portion of skb which can be sent right away */
+static unsigned int tcp_mss_split_point(const struct sock *sk,
+                                        const struct sk_buff *skb,
+                                        unsigned int mss_now,
+                                        unsigned int max_segs,
+                                        int nonagle)
 {
        const struct tcp_sock *tp = tcp_sk(sk);
-        u32 needed, window, max_len;
+        u32 partial, needed, window, max_len;
        window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
        max_len = mss_now * max_segs;
@@ -1407,7 +1441,15 @@ static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_b
        if (max_len <= needed)
                return max_len;
-        return needed - needed % mss_now;
+        partial = needed % mss_now;
+        /* If last segment is not a full MSS, check if Nagle rules allow us
+         * to include this last segment in this skb.
+         * Otherwise, we'll split the skb at last MSS boundary
+         */
+        if (tcp_nagle_check(partial != 0, tp, mss_now, nonagle))
+                return needed - partial;
+        return needed;
 }
 /* Can at least one segment of SKB be sent right now, according to the
@@ -1447,28 +1489,6 @@ static int tcp_init_tso_segs(const struct sock *sk, struct sk_buff *skb,
        return tso_segs;
 }
-/* Minshall's variant of the Nagle send check. */
-static inline bool tcp_minshall_check(const struct tcp_sock *tp)
-{
-        return after(tp->snd_sml, tp->snd_una) &&
-                !after(tp->snd_sml, tp->snd_nxt);
-}
-/* Return false, if packet can be sent now without violation Nagle's rules:
- * 1. It is full sized.
- * 2. Or it contains FIN. (already checked by caller)
- * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
- * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
- *    With Minshall's modification: all sent small packets are ACKed.
- */
-static inline bool tcp_nagle_check(const struct tcp_sock *tp,
-                                  const struct sk_buff *skb,
-                                  unsigned int mss_now, int nonagle)
-{
-        return skb->len < mss_now &&
-                ((nonagle & TCP_NAGLE_CORK) ||
-                 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
-}
 /* Return true if the Nagle test allows this packet to be
 * sent now.
@@ -1489,7 +1509,7 @@ static inline bool tcp_nagle_test(const struct tcp_sock *tp, const struct sk_buf
        if (tcp_urg_mode(tp) || (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN))
                return true;
-        if (!tcp_nagle_check(tp, skb, cur_mss, nonagle))
+        if (!tcp_nagle_check(skb->len < cur_mss, tp, cur_mss, nonagle))
                return true;
        return false;
@@ -1892,7 +1912,8 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                        limit = tcp_mss_split_point(sk, skb, mss_now,
                                                    min_t(unsigned int,
                                                          cwnd_quota,
-                                                          sk->sk_gso_max_segs));
+                                                          sk->sk_gso_max_segs),
+                                                    nonagle);
                if (skb->len > limit &&
                    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
@@ -2756,7 +2777,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 EXPORT_SYMBOL(tcp_make_synack);
 /* Do all connect socket setups that can be done AF independent. */
-void tcp_connect_init(struct sock *sk)
+static void tcp_connect_init(struct sock *sk)
 {
        const struct dst_entry *dst = __sk_dst_get(sk);
        struct tcp_sock *tp = tcp_sk(sk);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 8b97d71e193b..1f2d37613c9e 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -38,7 +38,7 @@ MODULE_DESCRIPTION("TCP cwnd snooper");
 MODULE_LICENSE("GPL");
 MODULE_VERSION("1.1");
-static int port __read_mostly = 0;
+static int port __read_mostly;
 MODULE_PARM_DESC(port, "Port to match (0=all)");
 module_param(port, int, 0);
@@ -46,7 +46,7 @@ static unsigned int bufsize __read_mostly = 4096;
 MODULE_PARM_DESC(bufsize, "Log buffer size in packets (4096)");
 module_param(bufsize, uint, 0);
-static unsigned int fwmark __read_mostly = 0;
+static unsigned int fwmark __read_mostly;
 MODULE_PARM_DESC(fwmark, "skb mark to match (0=no mark)");
 module_param(fwmark, uint, 0);
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index a347a078ee07..1a8d271f994d 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -3,7 +3,7 @@
 *   YeAH TCP
 *
 * For further details look at:
- *    http://wil.cs.caltech.edu/pfldnet2007/paper/YeAH_TCP.pdf
+ *   https://web.archive.org/web/20080316215752/http://wil.cs.caltech.edu/pfldnet2007/paper/YeAH_TCP.pdf
 *
 */
 #include <linux/mm.h>
@@ -15,13 +15,13 @@
 #include "tcp_vegas.h"
-#define TCP_YEAH_ALPHA       80 //lin number of packets queued at the bottleneck
+#define TCP_YEAH_ALPHA       80 /* number of packets queued at the bottleneck */
-#define TCP_YEAH_GAMMA        1 //lin fraction of queue to be removed per rtt
+#define TCP_YEAH_GAMMA        1 /* fraction of queue to be removed per rtt */
-#define TCP_YEAH_DELTA        3 //log minimum fraction of cwnd to be removed on loss
+#define TCP_YEAH_DELTA        3 /* log minimum fraction of cwnd to be removed on loss */
-#define TCP_YEAH_EPSILON      1 //log maximum fraction to be removed on early decongestion
+#define TCP_YEAH_EPSILON      1 /* log maximum fraction to be removed on early decongestion */
-#define TCP_YEAH_PHY          8 //lin maximum delta from base
+#define TCP_YEAH_PHY          8 /* maximum delta from base */
-#define TCP_YEAH_RHO         16 //lin minimum number of consecutive rtt to consider competition on loss
+#define TCP_YEAH_RHO         16 /* minimum number of consecutive rtt to consider competition on loss */
-#define TCP_YEAH_ZETA        50 //lin minimum number of state switchs to reset reno_count
+#define TCP_YEAH_ZETA        50 /* minimum number of state switches to reset reno_count */
 #define TCP_SCALABLE_AI_CNT      100U
@@ -214,9 +214,9 @@ static u32 tcp_yeah_ssthresh(struct sock *sk) {
        if (yeah->doing_reno_now < TCP_YEAH_RHO) {
                reduction = yeah->lastQ;
-                reduction = min( reduction, max(tp->snd_cwnd>>1, 2U) );
+                reduction = min(reduction, max(tp->snd_cwnd>>1, 2U));
-                reduction = max( reduction, tp->snd_cwnd >> TCP_YEAH_DELTA);
+                reduction = max(reduction, tp->snd_cwnd >> TCP_YEAH_DELTA);
        } else
                reduction = max(tp->snd_cwnd>>1, 2U);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 5944d7d668dd..d5d24ecde6a5 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -560,15 +560,11 @@ static inline struct sock *__udp4_lib_lookup_skb(struct sk_buff *skb,
                                                 __be16 sport, __be16 dport,
                                                 struct udp_table *udptable)
 {
-        struct sock *sk;
        const struct iphdr *iph = ip_hdr(skb);
-        if (unlikely(sk = skb_steal_sock(skb)))
+        return __udp4_lib_lookup(dev_net(skb_dst(skb)->dev), iph->saddr, sport,
-                return sk;
+                                 iph->daddr, dport, inet_iif(skb),
-        else
+                                 udptable);
-                return __udp4_lib_lookup(dev_net(skb_dst(skb)->dev), iph->saddr, sport,
-                                         iph->daddr, dport, inet_iif(skb),
-                                         udptable);
 }
 struct sock *udp4_lib_lookup(struct net *net, __be32 saddr, __be16 sport,
@@ -990,7 +986,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                fl4 = &fl4_stack;
                flowi4_init_output(fl4, ipc.oif, sk->sk_mark, tos,
                                   RT_SCOPE_UNIVERSE, sk->sk_protocol,
-                                   inet_sk_flowi_flags(sk)|FLOWI_FLAG_CAN_SLEEP,
+                                   inet_sk_flowi_flags(sk),
                                   faddr, saddr, dport, inet->inet_sport);
                security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
@@ -999,7 +995,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                        err = PTR_ERR(rt);
                        rt = NULL;
                        if (err == -ENETUNREACH)
-                                IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
+                                IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
                        goto out;
                }
@@ -1098,6 +1094,9 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset,
        struct udp_sock *up = udp_sk(sk);
        int ret;
+        if (flags & MSG_SENDPAGE_NOTLAST)
+                flags |= MSG_MORE;
        if (!up->pending) {
                struct msghdr msg = {   .msg_flags = flags|MSG_MORE };
@@ -1236,7 +1235,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        bool slow;
        if (flags & MSG_ERRQUEUE)
-                return ip_recv_error(sk, msg, len);
+                return ip_recv_error(sk, msg, len, addr_len);
 try_again:
        skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
@@ -1600,12 +1599,16 @@ static void flush_stack(struct sock **stack, unsigned int count,
                kfree_skb(skb1);
 }
-static void udp_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+/* For TCP sockets, sk_rx_dst is protected by socket lock
+ * For UDP, we use xchg() to guard against concurrent changes.
+ */
+static void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
 {
-        struct dst_entry *dst = skb_dst(skb);
+        struct dst_entry *old;
        dst_hold(dst);
-        sk->sk_rx_dst = dst;
+        old = xchg(&sk->sk_rx_dst, dst);
+        dst_release(old);
 }
 /*
@@ -1736,15 +1739,16 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        if (udp4_csum_init(skb, uh, proto))
                goto csum_error;
-        if (skb->sk) {
+        sk = skb_steal_sock(skb);
+        if (sk) {
+                struct dst_entry *dst = skb_dst(skb);
                int ret;
-                sk = skb->sk;
-                if (unlikely(sk->sk_rx_dst == NULL))
+                if (unlikely(sk->sk_rx_dst != dst))
-                        udp_sk_rx_dst_set(sk, skb);
+                        udp_sk_rx_dst_set(sk, dst);
                ret = udp_queue_rcv_skb(sk, skb);
+                sock_put(sk);
                /* a return value > 0 means to resubmit the input, but
                 * it wants the return to be -protocol, or 0
                 */
@@ -1910,17 +1914,20 @@ static struct sock *__udp4_lib_demux_lookup(struct net *net,
 void udp_v4_early_demux(struct sk_buff *skb)
 {
-        const struct iphdr *iph = ip_hdr(skb);
+        struct net *net = dev_net(skb->dev);
-        const struct udphdr *uh = udp_hdr(skb);
+        const struct iphdr *iph;
+        const struct udphdr *uh;
        struct sock *sk;
        struct dst_entry *dst;
-        struct net *net = dev_net(skb->dev);
        int dif = skb->dev->ifindex;
        /* validate the packet */
        if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr)))
                return;
+        iph = ip_hdr(skb);
+        uh = udp_hdr(skb);
        if (skb->pkt_type == PACKET_BROADCAST ||
            skb->pkt_type == PACKET_MULTICAST)
                sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index e3db3f915114..71acd0014f2d 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -48,7 +48,7 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
                hdrlen += IPV4_BEET_PHMAXLEN - (optlen & 4);
        skb_set_network_header(skb, -x->props.header_len -
-                                    hdrlen + (XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph)));
+                                    hdrlen + (XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph)));
        if (x->sel.family != AF_INET6)
                skb->network_header += IPV4_BEET_PHMAXLEN;
        skb->mac_header = skb->network_header +
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 0b2a0641526a..542074c00c78 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -16,7 +16,7 @@
 static int xfrm4_init_flags(struct xfrm_state *x)
 {
-        if (ipv4_config.no_pmtu_disc)
+        if (xs_net(x)->ipv4.sysctl_ip_no_pmtu_disc)
                x->props.flags |= XFRM_STATE_NOPMTUDISC;
        return 0;
 }