32 files changed, 387 insertions, 179 deletions
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 512159bf607f..8323bced8e5b 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -241,19 +241,19 @@ batadv_iv_ogm_orig_get(struct batadv_priv *bat_priv, const uint8_t *addr)
        size = bat_priv->num_ifaces * sizeof(uint8_t);
        orig_node->bat_iv.bcast_own_sum = kzalloc(size, GFP_ATOMIC);
        if (!orig_node->bat_iv.bcast_own_sum)
-                goto free_bcast_own;
+                goto free_orig_node;
        hash_added = batadv_hash_add(bat_priv->orig_hash, batadv_compare_orig,
                                     batadv_choose_orig, orig_node,
                                     &orig_node->hash_entry);
        if (hash_added != 0)
-                goto free_bcast_own;
+                goto free_orig_node;
        return orig_node;
-free_bcast_own:
-        kfree(orig_node->bat_iv.bcast_own);
 free_orig_node:
+        /* free twice, as batadv_orig_node_new sets refcount to 2 */
+        batadv_orig_node_free_ref(orig_node);
        batadv_orig_node_free_ref(orig_node);
        return NULL;
@@ -266,7 +266,7 @@ batadv_iv_ogm_neigh_new(struct batadv_hard_iface *hard_iface,
                        struct batadv_orig_node *orig_neigh)
 {
        struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
-        struct batadv_neigh_node *neigh_node;
+        struct batadv_neigh_node *neigh_node, *tmp_neigh_node;
        neigh_node = batadv_neigh_node_new(hard_iface, neigh_addr, orig_node);
        if (!neigh_node)
@@ -281,14 +281,24 @@ batadv_iv_ogm_neigh_new(struct batadv_hard_iface *hard_iface,
        neigh_node->orig_node = orig_neigh;
        neigh_node->if_incoming = hard_iface;
-        batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
-                   "Creating new neighbor %pM for orig_node %pM on interface %s\n",
-                   neigh_addr, orig_node->orig, hard_iface->net_dev->name);
        spin_lock_bh(&orig_node->neigh_list_lock);
-        hlist_add_head_rcu(&neigh_node->list, &orig_node->neigh_list);
+        tmp_neigh_node = batadv_neigh_node_get(orig_node, hard_iface,
+                                               neigh_addr);
+        if (!tmp_neigh_node) {
+                hlist_add_head_rcu(&neigh_node->list, &orig_node->neigh_list);
+        } else {
+                kfree(neigh_node);
+                batadv_hardif_free_ref(hard_iface);
+                neigh_node = tmp_neigh_node;
+        }
        spin_unlock_bh(&orig_node->neigh_list_lock);
+        if (!tmp_neigh_node)
+                batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
+                           "Creating new neighbor %pM for orig_node %pM on interface %s\n",
+                           neigh_addr, orig_node->orig,
+                           hard_iface->net_dev->name);
 out:
        return neigh_node;
 }
diff --git a/net/batman-adv/hard-interface.c b/net/batman-adv/hard-interface.c
index 3d417d3641c6..b851cc580853 100644
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -241,7 +241,7 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface)
 {
        struct batadv_priv *bat_priv = netdev_priv(soft_iface);
        const struct batadv_hard_iface *hard_iface;
-        int min_mtu = ETH_DATA_LEN;
+        int min_mtu = INT_MAX;
        rcu_read_lock();
        list_for_each_entry_rcu(hard_iface, &batadv_hardif_list, list) {
@@ -256,8 +256,6 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface)
        }
        rcu_read_unlock();
-        atomic_set(&bat_priv->packet_size_max, min_mtu);
        if (atomic_read(&bat_priv->fragmentation) == 0)
                goto out;
@@ -268,13 +266,21 @@ int batadv_hardif_min_mtu(struct net_device *soft_iface)
        min_mtu = min_t(int, min_mtu, BATADV_FRAG_MAX_FRAG_SIZE);
        min_mtu -= sizeof(struct batadv_frag_packet);
        min_mtu *= BATADV_FRAG_MAX_FRAGMENTS;
-        atomic_set(&bat_priv->packet_size_max, min_mtu);
-        /* with fragmentation enabled we can fragment external packets easily */
-        min_mtu = min_t(int, min_mtu, ETH_DATA_LEN);
 out:
-        return min_mtu - batadv_max_header_len();
+        /* report to the other components the maximum amount of bytes that
+         * batman-adv can send over the wire (without considering the payload
+         * overhead). For example, this value is used by TT to compute the
+         * maximum local table table size
+         */
+        atomic_set(&bat_priv->packet_size_max, min_mtu);
+        /* the real soft-interface MTU is computed by removing the payload
+         * overhead from the maximum amount of bytes that was just computed.
+         *
+         * However batman-adv does not support MTUs bigger than ETH_DATA_LEN
+         */
+        return min_t(int, min_mtu - batadv_max_header_len(), ETH_DATA_LEN);
 }
 /* adjusts the MTU if a new interface with a smaller MTU appeared. */
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 6df12a2e3605..853941629dc1 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -458,6 +458,42 @@ out:
 }
 /**
+ * batadv_neigh_node_get - retrieve a neighbour from the list
+ * @orig_node: originator which the neighbour belongs to
+ * @hard_iface: the interface where this neighbour is connected to
+ * @addr: the address of the neighbour
+ *
+ * Looks for and possibly returns a neighbour belonging to this originator list
+ * which is connected through the provided hard interface.
+ * Returns NULL if the neighbour is not found.
+ */
+struct batadv_neigh_node *
+batadv_neigh_node_get(const struct batadv_orig_node *orig_node,
+                      const struct batadv_hard_iface *hard_iface,
+                      const uint8_t *addr)
+{
+        struct batadv_neigh_node *tmp_neigh_node, *res = NULL;
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(tmp_neigh_node, &orig_node->neigh_list, list) {
+                if (!batadv_compare_eth(tmp_neigh_node->addr, addr))
+                        continue;
+                if (tmp_neigh_node->if_incoming != hard_iface)
+                        continue;
+                if (!atomic_inc_not_zero(&tmp_neigh_node->refcount))
+                        continue;
+                res = tmp_neigh_node;
+                break;
+        }
+        rcu_read_unlock();
+        return res;
+}
+/**
 * batadv_orig_ifinfo_free_rcu - free the orig_ifinfo object
 * @rcu: rcu pointer of the orig_ifinfo object
 */
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index 37be290f63f6..db3a9ed734cb 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -29,6 +29,10 @@ void batadv_orig_node_free_ref_now(struct batadv_orig_node *orig_node);
 struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
                                              const uint8_t *addr);
 struct batadv_neigh_node *
+batadv_neigh_node_get(const struct batadv_orig_node *orig_node,
+                      const struct batadv_hard_iface *hard_iface,
+                      const uint8_t *addr);
+struct batadv_neigh_node *
 batadv_neigh_node_new(struct batadv_hard_iface *hard_iface,
                      const uint8_t *neigh_addr,
                      struct batadv_orig_node *orig_node);
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 1ed9f7c9ecea..a953d5b196a3 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -688,7 +688,7 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
        int is_old_ttvn;
        /* check if there is enough data before accessing it */
-        if (pskb_may_pull(skb, hdr_len + ETH_HLEN) < 0)
+        if (!pskb_may_pull(skb, hdr_len + ETH_HLEN))
                return 0;
        /* create a copy of the skb (in case of for re-routing) to modify it. */
@@ -918,6 +918,8 @@ int batadv_recv_unicast_tvlv(struct sk_buff *skb,
        if (ret != NET_RX_SUCCESS)
                ret = batadv_route_unicast_packet(skb, recv_if);
+        else
+                consume_skb(skb);
        return ret;
 }
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index 579f5f00a385..843febd1e519 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -254,9 +254,9 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
                                   struct batadv_orig_node *orig_node,
                                   unsigned short vid)
 {
-        struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
+        struct ethhdr *ethhdr;
        struct batadv_unicast_packet *unicast_packet;
-        int ret = NET_XMIT_DROP;
+        int ret = NET_XMIT_DROP, hdr_size;
        if (!orig_node)
                goto out;
@@ -265,12 +265,16 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
        case BATADV_UNICAST:
                if (!batadv_send_skb_prepare_unicast(skb, orig_node))
                        goto out;
+                hdr_size = sizeof(*unicast_packet);
                break;
        case BATADV_UNICAST_4ADDR:
                if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, skb,
                                                           orig_node,
                                                           packet_subtype))
                        goto out;
+                hdr_size = sizeof(struct batadv_unicast_4addr_packet);
                break;
        default:
                /* this function supports UNICAST and UNICAST_4ADDR only. It
@@ -279,6 +283,7 @@ static int batadv_send_skb_unicast(struct batadv_priv *bat_priv,
                goto out;
        }
+        ethhdr = (struct ethhdr *)(skb->data + hdr_size);
        unicast_packet = (struct batadv_unicast_packet *)skb->data;
        /* inform the destination node that we are still missing a correct route
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index b6071f675a3e..959dde721c46 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -1975,6 +1975,7 @@ static uint32_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
        struct hlist_head *head;
        uint32_t i, crc_tmp, crc = 0;
        uint8_t flags;
+        __be16 tmp_vid;
        for (i = 0; i < hash->size; i++) {
                head = &hash->table[i];
@@ -2011,8 +2012,11 @@ static uint32_t batadv_tt_global_crc(struct batadv_priv *bat_priv,
                                                             orig_node))
                                continue;
-                        crc_tmp = crc32c(0, &tt_common->vid,
+                        /* use network order to read the VID: this ensures that
-                                         sizeof(tt_common->vid));
+                         * every node reads the bytes in the same order.
+                         */
+                        tmp_vid = htons(tt_common->vid);
+                        crc_tmp = crc32c(0, &tmp_vid, sizeof(tmp_vid));
                        /* compute the CRC on flags that have to be kept in sync
                         * among nodes
@@ -2046,6 +2050,7 @@ static uint32_t batadv_tt_local_crc(struct batadv_priv *bat_priv,
        struct hlist_head *head;
        uint32_t i, crc_tmp, crc = 0;
        uint8_t flags;
+        __be16 tmp_vid;
        for (i = 0; i < hash->size; i++) {
                head = &hash->table[i];
@@ -2064,8 +2069,11 @@ static uint32_t batadv_tt_local_crc(struct batadv_priv *bat_priv,
                        if (tt_common->flags & BATADV_TT_CLIENT_NEW)
                                continue;
-                        crc_tmp = crc32c(0, &tt_common->vid,
+                        /* use network order to read the VID: this ensures that
-                                         sizeof(tt_common->vid));
+                         * every node reads the bytes in the same order.
+                         */
+                        tmp_vid = htons(tt_common->vid);
+                        crc_tmp = crc32c(0, &tmp_vid, sizeof(tmp_vid));
                        /* compute the CRC on flags that have to be kept in sync
                         * among nodes
@@ -2262,6 +2270,7 @@ static bool batadv_tt_global_check_crc(struct batadv_orig_node *orig_node,
 {
        struct batadv_tvlv_tt_vlan_data *tt_vlan_tmp;
        struct batadv_orig_node_vlan *vlan;
+        uint32_t crc;
        int i;
        /* check if each received CRC matches the locally stored one */
@@ -2281,7 +2290,10 @@ static bool batadv_tt_global_check_crc(struct batadv_orig_node *orig_node,
                if (!vlan)
                        return false;
-                if (vlan->tt.crc != ntohl(tt_vlan_tmp->crc))
+                crc = vlan->tt.crc;
+                batadv_orig_node_vlan_free_ref(vlan);
+                if (crc != ntohl(tt_vlan_tmp->crc))
                        return false;
        }
@@ -3218,7 +3230,6 @@ static void batadv_tt_update_orig(struct batadv_priv *bat_priv,
                spin_lock_bh(&orig_node->tt_lock);
-                tt_change = (struct batadv_tvlv_tt_change *)tt_buff;
                batadv_tt_update_changes(bat_priv, orig_node, tt_num_changes,
                                         ttvn, tt_change);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 292e619db896..d9fb93451442 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -430,6 +430,16 @@ static void hidp_del_timer(struct hidp_session *session)
                del_timer(&session->timer);
 }
+static void hidp_process_report(struct hidp_session *session,
+                                int type, const u8 *data, int len, int intr)
+{
+        if (len > HID_MAX_BUFFER_SIZE)
+                len = HID_MAX_BUFFER_SIZE;
+        memcpy(session->input_buf, data, len);
+        hid_input_report(session->hid, type, session->input_buf, len, intr);
+}
 static void hidp_process_handshake(struct hidp_session *session,
                                        unsigned char param)
 {
@@ -502,7 +512,8 @@ static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
                        hidp_input_report(session, skb);
                if (session->hid)
-                        hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 0);
+                        hidp_process_report(session, HID_INPUT_REPORT,
+                                            skb->data, skb->len, 0);
                break;
        case HIDP_DATA_RTYPE_OTHER:
@@ -584,7 +595,8 @@ static void hidp_recv_intr_frame(struct hidp_session *session,
                        hidp_input_report(session, skb);
                if (session->hid) {
-                        hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 1);
+                        hidp_process_report(session, HID_INPUT_REPORT,
+                                            skb->data, skb->len, 1);
                        BT_DBG("report len %d", skb->len);
                }
        } else {
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index ab5241400cf7..8798492a6e99 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -24,6 +24,7 @@
 #define __HIDP_H
 #include <linux/types.h>
+#include <linux/hid.h>
 #include <linux/kref.h>
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/l2cap.h>
@@ -179,6 +180,9 @@ struct hidp_session {
        /* Used in hidp_output_raw_report() */
        int output_report_success; /* boolean */
+        /* temporary input buffer */
+        u8 input_buf[HID_MAX_BUFFER_SIZE];
 };
 /* HIDP init defines */
diff --git a/net/core/dev.c b/net/core/dev.c
index 4ad1b78c9c77..b1b0c8d4d7df 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2420,7 +2420,7 @@ EXPORT_SYMBOL(netdev_rx_csum_fault);
 * 2. No high memory really exists on this machine.
 */
-static int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
+static int illegal_highdma(const struct net_device *dev, struct sk_buff *skb)
 {
 #ifdef CONFIG_HIGHMEM
        int i;
@@ -2495,34 +2495,36 @@ static int dev_gso_segment(struct sk_buff *skb, netdev_features_t features)
 }
 static netdev_features_t harmonize_features(struct sk_buff *skb,
-        netdev_features_t features)
+                                            const struct net_device *dev,
+                                            netdev_features_t features)
 {
        if (skb->ip_summed != CHECKSUM_NONE &&
            !can_checksum_protocol(features, skb_network_protocol(skb))) {
                features &= ~NETIF_F_ALL_CSUM;
-        } else if (illegal_highdma(skb->dev, skb)) {
+        } else if (illegal_highdma(dev, skb)) {
                features &= ~NETIF_F_SG;
        }
        return features;
 }
-netdev_features_t netif_skb_features(struct sk_buff *skb)
+netdev_features_t netif_skb_dev_features(struct sk_buff *skb,
+                                         const struct net_device *dev)
 {
        __be16 protocol = skb->protocol;
-        netdev_features_t features = skb->dev->features;
+        netdev_features_t features = dev->features;
-        if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs)
+        if (skb_shinfo(skb)->gso_segs > dev->gso_max_segs)
                features &= ~NETIF_F_GSO_MASK;
        if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD)) {
                struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
                protocol = veh->h_vlan_encapsulated_proto;
        } else if (!vlan_tx_tag_present(skb)) {
-                return harmonize_features(skb, features);
+                return harmonize_features(skb, dev, features);
        }
-        features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX |
+        features &= (dev->vlan_features | NETIF_F_HW_VLAN_CTAG_TX |
                                               NETIF_F_HW_VLAN_STAG_TX);
        if (protocol == htons(ETH_P_8021Q) || protocol == htons(ETH_P_8021AD))
@@ -2530,9 +2532,9 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
                                NETIF_F_GEN_CSUM | NETIF_F_HW_VLAN_CTAG_TX |
                                NETIF_F_HW_VLAN_STAG_TX;
-        return harmonize_features(skb, features);
+        return harmonize_features(skb, dev, features);
 }
-EXPORT_SYMBOL(netif_skb_features);
+EXPORT_SYMBOL(netif_skb_dev_features);
 int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                        struct netdev_queue *txq)
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 87577d447554..e29e810663d7 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -323,17 +323,6 @@ u32 __skb_get_poff(const struct sk_buff *skb)
        return poff;
 }
-static inline u16 dev_cap_txqueue(struct net_device *dev, u16 queue_index)
-{
-        if (unlikely(queue_index >= dev->real_num_tx_queues)) {
-                net_warn_ratelimited("%s selects TX queue %d, but real number of TX queues is %d\n",
-                                     dev->name, queue_index,
-                                     dev->real_num_tx_queues);
-                return 0;
-        }
-        return queue_index;
-}
 static inline int get_xps_queue(struct net_device *dev, struct sk_buff *skb)
 {
 #ifdef CONFIG_XPS
@@ -372,7 +361,7 @@ static inline int get_xps_queue(struct net_device *dev, struct sk_buff *skb)
 #endif
 }
-u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
+static u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
 {
        struct sock *sk = skb->sk;
        int queue_index = sk_tx_queue_get(sk);
@@ -392,7 +381,6 @@ u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
        return queue_index;
 }
-EXPORT_SYMBOL(__netdev_pick_tx);
 struct netdev_queue *netdev_pick_tx(struct net_device *dev,
                                    struct sk_buff *skb,
@@ -403,13 +391,13 @@ struct netdev_queue *netdev_pick_tx(struct net_device *dev,
        if (dev->real_num_tx_queues != 1) {
                const struct net_device_ops *ops = dev->netdev_ops;
                if (ops->ndo_select_queue)
-                        queue_index = ops->ndo_select_queue(dev, skb,
+                        queue_index = ops->ndo_select_queue(dev, skb, accel_priv,
-                                                            accel_priv);
+                                                            __netdev_pick_tx);
                else
                        queue_index = __netdev_pick_tx(dev, skb);
                if (!accel_priv)
-                        queue_index = dev_cap_txqueue(dev, queue_index);
+                        queue_index = netdev_cap_txqueue(dev, queue_index);
        }
        skb_set_queue_mapping(skb, queue_index);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 048dc8d183aa..1a0dac2ef9ad 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1963,16 +1963,21 @@ replay:
                dev->ifindex = ifm->ifi_index;
-                if (ops->newlink)
+                if (ops->newlink) {
                        err = ops->newlink(net, dev, tb, data);
-                else
+                        /* Drivers should call free_netdev() in ->destructor
+                         * and unregister it on failure so that device could be
+                         * finally freed in rtnl_unlock.
+                         */
+                        if (err < 0)
+                                goto out;
+                } else {
                        err = register_netdevice(dev);
+                        if (err < 0) {
-                if (err < 0) {
+                                free_netdev(dev);
-                        free_netdev(dev);
+                                goto out;
-                        goto out;
+                        }
                }
                err = rtnl_configure_link(dev, ifm);
                if (err < 0)
                        unregister_netdevice(dev);
diff --git a/net/dccp/ccids/lib/tfrc.c b/net/dccp/ccids/lib/tfrc.c
index c073b81a1f3e..62b5828acde0 100644
--- a/net/dccp/ccids/lib/tfrc.c
+++ b/net/dccp/ccids/lib/tfrc.c
@@ -8,7 +8,7 @@
 #include "tfrc.h"
 #ifdef CONFIG_IP_DCCP_TFRC_DEBUG
-static bool tfrc_debug;
+bool tfrc_debug;
 module_param(tfrc_debug, bool, 0644);
 MODULE_PARM_DESC(tfrc_debug, "Enable TFRC debug messages");
 #endif
diff --git a/net/dccp/ccids/lib/tfrc.h b/net/dccp/ccids/lib/tfrc.h
index a3d8f7c76ae0..40ee7d62b652 100644
--- a/net/dccp/ccids/lib/tfrc.h
+++ b/net/dccp/ccids/lib/tfrc.h
@@ -21,6 +21,7 @@
 #include "packet_history.h"
 #ifdef CONFIG_IP_DCCP_TFRC_DEBUG
+extern bool tfrc_debug;
 #define tfrc_pr_debug(format, a...)     DCCP_PR_DEBUG(tfrc_debug, format, ##a)
 #else
 #define tfrc_pr_debug(format, a...)
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index e9f1217a8afd..f3869c186d97 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -39,6 +39,71 @@
 #include <net/route.h>
 #include <net/xfrm.h>
+static bool ip_may_fragment(const struct sk_buff *skb)
+{
+        return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
+               !skb->local_df;
+}
+static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
+{
+        if (skb->len <= mtu || skb->local_df)
+                return false;
+        if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+                return false;
+        return true;
+}
+static bool ip_gso_exceeds_dst_mtu(const struct sk_buff *skb)
+{
+        unsigned int mtu;
+        if (skb->local_df || !skb_is_gso(skb))
+                return false;
+        mtu = ip_dst_mtu_maybe_forward(skb_dst(skb), true);
+        /* if seglen > mtu, do software segmentation for IP fragmentation on
+         * output.  DF bit cannot be set since ip_forward would have sent
+         * icmp error.
+         */
+        return skb_gso_network_seglen(skb) > mtu;
+}
+/* called if GSO skb needs to be fragmented on forward */
+static int ip_forward_finish_gso(struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+        netdev_features_t features;
+        struct sk_buff *segs;
+        int ret = 0;
+        features = netif_skb_dev_features(skb, dst->dev);
+        segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
+        if (IS_ERR(segs)) {
+                kfree_skb(skb);
+                return -ENOMEM;
+        }
+        consume_skb(skb);
+        do {
+                struct sk_buff *nskb = segs->next;
+                int err;
+                segs->next = NULL;
+                err = dst_output(segs);
+                if (err && ret == 0)
+                        ret = err;
+                segs = nskb;
+        } while (segs);
+        return ret;
+}
 static int ip_forward_finish(struct sk_buff *skb)
 {
        struct ip_options *opt  = &(IPCB(skb)->opt);
@@ -49,6 +114,9 @@ static int ip_forward_finish(struct sk_buff *skb)
        if (unlikely(opt->optlen))
                ip_forward_options(skb);
+        if (ip_gso_exceeds_dst_mtu(skb))
+                return ip_forward_finish_gso(skb);
        return dst_output(skb);
 }
@@ -91,8 +159,7 @@ int ip_forward(struct sk_buff *skb)
        IPCB(skb)->flags |= IPSKB_FORWARDED;
        mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
-        if (unlikely(skb->len > mtu && !skb_is_gso(skb) &&
+        if (!ip_may_fragment(skb) && ip_exceeds_mtu(skb, mtu)) {
-                     (ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) {
                IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS);
                icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
                          htonl(mtu));
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index efa1138fa523..b3e86ea7b71b 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -273,7 +273,7 @@ static int __init ic_open_devs(void)
                msleep(1);
-                if time_before(jiffies, next_msg)
+                if (time_before(jiffies, next_msg))
                        continue;
                elapsed = jiffies_to_msecs(jiffies - start);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 25071b48921c..4c011ec69ed4 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1597,6 +1597,7 @@ static int __mkroute_input(struct sk_buff *skb,
        rth->rt_gateway = 0;
        rth->rt_uses_gateway = 0;
        INIT_LIST_HEAD(&rth->rt_uncached);
+        RT_CACHE_STAT_INC(in_slow_tot);
        rth->dst.input = ip_forward;
        rth->dst.output = ip_output;
@@ -1695,10 +1696,11 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
        fl4.daddr = daddr;
        fl4.saddr = saddr;
        err = fib_lookup(net, &fl4, &res);
-        if (err != 0)
+        if (err != 0) {
+                if (!IN_DEV_FORWARD(in_dev))
+                        err = -EHOSTUNREACH;
                goto no_route;
+        }
-        RT_CACHE_STAT_INC(in_slow_tot);
        if (res.type == RTN_BROADCAST)
                goto brd_input;
@@ -1712,8 +1714,10 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                goto local_input;
        }
-        if (!IN_DEV_FORWARD(in_dev))
+        if (!IN_DEV_FORWARD(in_dev)) {
+                err = -EHOSTUNREACH;
                goto no_route;
+        }
        if (res.type != RTN_UNICAST)
                goto martian_destination;
@@ -1768,6 +1772,7 @@ local_input:
        rth->rt_gateway = 0;
        rth->rt_uses_gateway = 0;
        INIT_LIST_HEAD(&rth->rt_uncached);
+        RT_CACHE_STAT_INC(in_slow_tot);
        if (res.type == RTN_UNREACHABLE) {
                rth->dst.input= ip_error;
                rth->dst.error= -err;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index ad235690684c..fdbfeca36d63 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2783,6 +2783,8 @@ static void addrconf_gre_config(struct net_device *dev)
        ipv6_addr_set(&addr,  htonl(0xFE800000), 0, 0, 0);
        if (!ipv6_generate_eui64(addr.s6_addr + 8, dev))
                addrconf_add_linklocal(idev, &addr);
+        else
+                addrconf_prefix_route(&addr, 64, dev, 0, 0);
 }
 #endif
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index ef02b26ccf81..070a2fae2375 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -342,6 +342,20 @@ static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
        return mtu;
 }
+static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
+{
+        if (skb->len <= mtu || skb->local_df)
+                return false;
+        if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
+                return true;
+        if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+                return false;
+        return true;
+}
 int ip6_forward(struct sk_buff *skb)
 {
        struct dst_entry *dst = skb_dst(skb);
@@ -466,8 +480,7 @@ int ip6_forward(struct sk_buff *skb)
        if (mtu < IPV6_MIN_MTU)
                mtu = IPV6_MIN_MTU;
-        if ((!skb->local_df && skb->len > mtu && !skb_is_gso(skb)) ||
+        if (ip6_pkt_too_big(skb, mtu)) {
-            (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)) {
                /* Again, force OUTPUT device used as source address */
                skb->dev = dst->dev;
                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index d6d1f1df9119..ce1c44370610 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1057,7 +1057,8 @@ static void ieee80211_uninit(struct net_device *dev)
 static u16 ieee80211_netdev_select_queue(struct net_device *dev,
                                         struct sk_buff *skb,
-                                         void *accel_priv)
+                                         void *accel_priv,
+                                         select_queue_fallback_t fallback)
 {
        return ieee80211_select_queue(IEEE80211_DEV_TO_SUB_IF(dev), skb);
 }
@@ -1075,7 +1076,8 @@ static const struct net_device_ops ieee80211_dataif_ops = {
 static u16 ieee80211_monitor_select_queue(struct net_device *dev,
                                          struct sk_buff *skb,
-                                          void *accel_priv)
+                                          void *accel_priv,
+                                          select_queue_fallback_t fallback)
 {
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        struct ieee80211_local *local = sdata->local;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 6a2bb37506c5..48a6a93db296 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -308,11 +308,27 @@ static bool packet_use_direct_xmit(const struct packet_sock *po)
        return po->xmit == packet_direct_xmit;
 }
-static u16 packet_pick_tx_queue(struct net_device *dev)
+static u16 __packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb)
 {
        return (u16) raw_smp_processor_id() % dev->real_num_tx_queues;
 }
+static void packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb)
+{
+        const struct net_device_ops *ops = dev->netdev_ops;
+        u16 queue_index;
+        if (ops->ndo_select_queue) {
+                queue_index = ops->ndo_select_queue(dev, skb, NULL,
+                                                    __packet_pick_tx_queue);
+                queue_index = netdev_cap_txqueue(dev, queue_index);
+        } else {
+                queue_index = __packet_pick_tx_queue(dev, skb);
+        }
+        skb_set_queue_mapping(skb, queue_index);
+}
 /* register_prot_hook must be invoked with the po->bind_lock held,
 * or from a context in which asynchronous accesses to the packet
 * socket is not possible (packet_create()).
@@ -2285,7 +2301,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                        }
                }
-                skb_set_queue_mapping(skb, packet_pick_tx_queue(dev));
+                packet_pick_tx_queue(dev, skb);
                skb->destructor = tpacket_destruct_skb;
                __packet_set_status(po, ph, TP_STATUS_SENDING);
                packet_inc_pending(&po->tx_ring);
@@ -2499,7 +2516,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
        skb->dev = dev;
        skb->priority = sk->sk_priority;
        skb->mark = sk->sk_mark;
-        skb_set_queue_mapping(skb, packet_pick_tx_queue(dev));
+        packet_pick_tx_queue(dev, skb);
        if (po->has_vnet_hdr) {
                if (vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
@@ -3786,7 +3804,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 */
                        if (!tx_ring)
                                init_prb_bdqc(po, rb, pg_vec, req_u, tx_ring);
-                                break;
+                        break;
                default:
                        break;
                }
diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c
index a255d0200a59..fefeeb73f15f 100644
--- a/net/sched/sch_pie.c
+++ b/net/sched/sch_pie.c
@@ -15,6 +15,11 @@
 *
 * ECN support is added by Naeem Khademi <naeemk@ifi.uio.no>
 * University of Oslo, Norway.
+ *
+ * References:
+ * IETF draft submission: http://tools.ietf.org/html/draft-pan-aqm-pie-00
+ * IEEE  Conference on High Performance Switching and Routing 2013 :
+ * "PIE: A * Lightweight Control Scheme to Address the Bufferbloat Problem"
 */
 #include <linux/module.h>
@@ -36,7 +41,7 @@ struct pie_params {
        psched_time_t target;   /* user specified target delay in pschedtime */
        u32 tupdate;            /* timer frequency (in jiffies) */
        u32 limit;              /* number of packets that can be enqueued */
-        u32 alpha;              /* alpha and beta are between -4 and 4 */
+        u32 alpha;              /* alpha and beta are between 0 and 32 */
        u32 beta;               /* and are used for shift relative to 1 */
        bool ecn;               /* true if ecn is enabled */
        bool bytemode;          /* to scale drop early prob based on pkt size */
@@ -326,10 +331,16 @@ static void calculate_probability(struct Qdisc *sch)
        if (qdelay == 0 && qlen != 0)
                update_prob = false;
-        /* Add ranges for alpha and beta, more aggressive for high dropping
+        /* In the algorithm, alpha and beta are between 0 and 2 with typical
-         * mode and gentle steps for light dropping mode
+         * value for alpha as 0.125. In this implementation, we use values 0-32
-         * In light dropping mode, take gentle steps; in medium dropping mode,
+         * passed from user space to represent this. Also, alpha and beta have
-         * take medium steps; in high dropping mode, take big steps.
+         * unit of HZ and need to be scaled before they can used to update
+         * probability. alpha/beta are updated locally below by 1) scaling them
+         * appropriately 2) scaling down by 16 to come to 0-2 range.
+         * Please see paper for details.
+         *
+         * We scale alpha and beta differently depending on whether we are in
+         * light, medium or high dropping mode.
         */
        if (q->vars.prob < MAX_PROB / 100) {
                alpha =
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 5ae609200674..f558433537b8 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1367,44 +1367,35 @@ static inline bool sctp_peer_needs_update(struct sctp_association *asoc)
        return false;
 }
-/* Increase asoc's rwnd by len and send any window update SACK if needed. */
+/* Update asoc's rwnd for the approximated state in the buffer,
-void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
+ * and check whether SACK needs to be sent.
+ */
+void sctp_assoc_rwnd_update(struct sctp_association *asoc, bool update_peer)
 {
+        int rx_count;
        struct sctp_chunk *sack;
        struct timer_list *timer;
-        if (asoc->rwnd_over) {
+        if (asoc->ep->rcvbuf_policy)
-                if (asoc->rwnd_over >= len) {
+                rx_count = atomic_read(&asoc->rmem_alloc);
-                        asoc->rwnd_over -= len;
+        else
-                } else {
+                rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
-                        asoc->rwnd += (len - asoc->rwnd_over);
-                        asoc->rwnd_over = 0;
-                }
-        } else {
-                asoc->rwnd += len;
-        }
-        /* If we had window pressure, start recovering it
+        if ((asoc->base.sk->sk_rcvbuf - rx_count) > 0)
-         * once our rwnd had reached the accumulated pressure
+                asoc->rwnd = (asoc->base.sk->sk_rcvbuf - rx_count) >> 1;
-         * threshold.  The idea is to recover slowly, but up
+        else
-         * to the initial advertised window.
+                asoc->rwnd = 0;
-         */
-        if (asoc->rwnd_press && asoc->rwnd >= asoc->rwnd_press) {
-                int change = min(asoc->pathmtu, asoc->rwnd_press);
-                asoc->rwnd += change;
-                asoc->rwnd_press -= change;
-        }
-        pr_debug("%s: asoc:%p rwnd increased by %d to (%u, %u) - %u\n",
+        pr_debug("%s: asoc:%p rwnd=%u, rx_count=%d, sk_rcvbuf=%d\n",
-                 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
+                 __func__, asoc, asoc->rwnd, rx_count,
-                 asoc->a_rwnd);
+                 asoc->base.sk->sk_rcvbuf);
        /* Send a window update SACK if the rwnd has increased by at least the
         * minimum of the association's PMTU and half of the receive buffer.
         * The algorithm used is similar to the one described in
         * Section 4.2.3.3 of RFC 1122.
         */
-        if (sctp_peer_needs_update(asoc)) {
+        if (update_peer && sctp_peer_needs_update(asoc)) {
                asoc->a_rwnd = asoc->rwnd;
                pr_debug("%s: sending window update SACK- asoc:%p rwnd:%u "
@@ -1426,45 +1417,6 @@ void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
        }
 }
-/* Decrease asoc's rwnd by len. */
-void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
-{
-        int rx_count;
-        int over = 0;
-        if (unlikely(!asoc->rwnd || asoc->rwnd_over))
-                pr_debug("%s: association:%p has asoc->rwnd:%u, "
-                         "asoc->rwnd_over:%u!\n", __func__, asoc,
-                         asoc->rwnd, asoc->rwnd_over);
-        if (asoc->ep->rcvbuf_policy)
-                rx_count = atomic_read(&asoc->rmem_alloc);
-        else
-                rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
-        /* If we've reached or overflowed our receive buffer, announce
-         * a 0 rwnd if rwnd would still be positive.  Store the
-         * the potential pressure overflow so that the window can be restored
-         * back to original value.
-         */
-        if (rx_count >= asoc->base.sk->sk_rcvbuf)
-                over = 1;
-        if (asoc->rwnd >= len) {
-                asoc->rwnd -= len;
-                if (over) {
-                        asoc->rwnd_press += asoc->rwnd;
-                        asoc->rwnd = 0;
-                }
-        } else {
-                asoc->rwnd_over = len - asoc->rwnd;
-                asoc->rwnd = 0;
-        }
-        pr_debug("%s: asoc:%p rwnd decreased by %d to (%u, %u, %u)\n",
-                 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
-                 asoc->rwnd_press);
-}
 /* Build the bind address list for the association based on info from the
 * local endpoint and the remote peer.
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 483dcd71b3c5..591b44d3b7de 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -6176,7 +6176,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
         * PMTU.  In cases, such as loopback, this might be a rather
         * large spill over.
         */
-        if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
+        if ((!chunk->data_accepted) && (!asoc->rwnd ||
            (datalen > asoc->rwnd + asoc->frag_point))) {
                /* If this is the next TSN, consider reneging to make
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9e91d6e5df63..981aaf8b6ace 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -64,6 +64,7 @@
 #include <linux/crypto.h>
 #include <linux/slab.h>
 #include <linux/file.h>
+#include <linux/compat.h>
 #include <net/ip.h>
 #include <net/icmp.h>
@@ -1368,11 +1369,19 @@ static int sctp_setsockopt_connectx(struct sock *sk,
 /*
 * New (hopefully final) interface for the API.
 * We use the sctp_getaddrs_old structure so that use-space library
- * can avoid any unnecessary allocations.   The only defferent part
+ * can avoid any unnecessary allocations. The only different part
 * is that we store the actual length of the address buffer into the
- * addrs_num structure member.  That way we can re-use the existing
+ * addrs_num structure member. That way we can re-use the existing
 * code.
 */
+#ifdef CONFIG_COMPAT
+struct compat_sctp_getaddrs_old {
+        sctp_assoc_t    assoc_id;
+        s32             addr_num;
+        compat_uptr_t   addrs;          /* struct sockaddr * */
+};
+#endif
 static int sctp_getsockopt_connectx3(struct sock *sk, int len,
                                     char __user *optval,
                                     int __user *optlen)
@@ -1381,16 +1390,30 @@ static int sctp_getsockopt_connectx3(struct sock *sk, int len,
        sctp_assoc_t assoc_id = 0;
        int err = 0;
-        if (len < sizeof(param))
+#ifdef CONFIG_COMPAT
-                return -EINVAL;
+        if (is_compat_task()) {
+                struct compat_sctp_getaddrs_old param32;
-        if (copy_from_user(&param, optval, sizeof(param)))
+                if (len < sizeof(param32))
-                return -EFAULT;
+                        return -EINVAL;
+                if (copy_from_user(&param32, optval, sizeof(param32)))
+                        return -EFAULT;
-        err = __sctp_setsockopt_connectx(sk,
+                param.assoc_id = param32.assoc_id;
-                        (struct sockaddr __user *)param.addrs,
+                param.addr_num = param32.addr_num;
-                        param.addr_num, &assoc_id);
+                param.addrs = compat_ptr(param32.addrs);
+        } else
+#endif
+        {
+                if (len < sizeof(param))
+                        return -EINVAL;
+                if (copy_from_user(&param, optval, sizeof(param)))
+                        return -EFAULT;
+        }
+        err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *)
+                                         param.addrs, param.addr_num,
+                                         &assoc_id);
        if (err == 0 || err == -EINPROGRESS) {
                if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
                        return -EFAULT;
@@ -2092,12 +2115,6 @@ static int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
                sctp_skb_pull(skb, copied);
                skb_queue_head(&sk->sk_receive_queue, skb);
-                /* When only partial message is copied to the user, increase
-                 * rwnd by that amount. If all the data in the skb is read,
-                 * rwnd is updated when the event is freed.
-                 */
-                if (!sctp_ulpevent_is_notification(event))
-                        sctp_assoc_rwnd_increase(event->asoc, copied);
                goto out;
        } else if ((event->msg_flags & MSG_NOTIFICATION) ||
                   (event->msg_flags & MSG_EOR))
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 7135e617ab0f..35c8923b5554 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -151,6 +151,7 @@ static struct ctl_table sctp_net_table[] = {
        },
        {
                .procname       = "cookie_hmac_alg",
+                .data           = &init_net.sctp.sctp_hmac_alg,
                .maxlen         = 8,
                .mode           = 0644,
                .proc_handler   = proc_sctp_do_hmac_alg,
@@ -401,15 +402,18 @@ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
 int sctp_sysctl_net_register(struct net *net)
 {
-        struct ctl_table *table;
+        struct ctl_table *table = sctp_net_table;
-        int i;
+        if (!net_eq(net, &init_net)) {
+                int i;
-        table = kmemdup(sctp_net_table, sizeof(sctp_net_table), GFP_KERNEL);
+                table = kmemdup(sctp_net_table, sizeof(sctp_net_table), GFP_KERNEL);
-        if (!table)
+                if (!table)
-                return -ENOMEM;
+                        return -ENOMEM;
-        for (i = 0; table[i].data; i++)
+                for (i = 0; table[i].data; i++)
-                table[i].data += (char *)(&net->sctp) - (char *)&init_net.sctp;
+                        table[i].data += (char *)(&net->sctp) - (char *)&init_net.sctp;
+        }
        net->sctp.sysctl_header = register_net_sysctl(net, "net/sctp", table);
        return 0;
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 85c64658bd0b..8d198ae03606 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -989,7 +989,7 @@ static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
        skb = sctp_event2skb(event);
        /* Set the owner and charge rwnd for bytes received.  */
        sctp_ulpevent_set_owner(event, asoc);
-        sctp_assoc_rwnd_decrease(asoc, skb_headlen(skb));
+        sctp_assoc_rwnd_update(asoc, false);
        if (!skb->data_len)
                return;
@@ -1011,6 +1011,7 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
 {
        struct sk_buff *skb, *frag;
        unsigned int    len;
+        struct sctp_association *asoc;
        /* Current stack structures assume that the rcv buffer is
         * per socket.   For UDP style sockets this is not true as
@@ -1035,8 +1036,11 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
        }
 done:
-        sctp_assoc_rwnd_increase(event->asoc, len);
+        asoc = event->asoc;
+        sctp_association_hold(asoc);
        sctp_ulpevent_release_owner(event);
+        sctp_assoc_rwnd_update(asoc, true);
+        sctp_association_put(asoc);
 }
 static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event)
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 6c0513a7f992..36e431ee1c90 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -108,6 +108,7 @@ struct gss_auth {
 static DEFINE_SPINLOCK(pipe_version_lock);
 static struct rpc_wait_queue pipe_version_rpc_waitqueue;
 static DECLARE_WAIT_QUEUE_HEAD(pipe_version_waitqueue);
+static void gss_put_auth(struct gss_auth *gss_auth);
 static void gss_free_ctx(struct gss_cl_ctx *);
 static const struct rpc_pipe_ops gss_upcall_ops_v0;
@@ -320,6 +321,7 @@ gss_release_msg(struct gss_upcall_msg *gss_msg)
        if (gss_msg->ctx != NULL)
                gss_put_ctx(gss_msg->ctx);
        rpc_destroy_wait_queue(&gss_msg->rpc_waitqueue);
+        gss_put_auth(gss_msg->auth);
        kfree(gss_msg);
 }
@@ -498,9 +500,12 @@ gss_alloc_msg(struct gss_auth *gss_auth,
        default:
                err = gss_encode_v1_msg(gss_msg, service_name, gss_auth->target_name);
                if (err)
-                        goto err_free_msg;
+                        goto err_put_pipe_version;
        };
+        kref_get(&gss_auth->kref);
        return gss_msg;
+err_put_pipe_version:
+        put_pipe_version(gss_auth->net);
 err_free_msg:
        kfree(gss_msg);
 err:
@@ -991,6 +996,8 @@ gss_create_new(struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
        gss_auth->service = gss_pseudoflavor_to_service(gss_auth->mech, flavor);
        if (gss_auth->service == 0)
                goto err_put_mech;
+        if (!gssd_running(gss_auth->net))
+                goto err_put_mech;
        auth = &gss_auth->rpc_auth;
        auth->au_cslack = GSS_CRED_SLACK >> 2;
        auth->au_rslack = GSS_VERF_SLACK >> 2;
@@ -1062,6 +1069,12 @@ gss_free_callback(struct kref *kref)
 }
 static void
+gss_put_auth(struct gss_auth *gss_auth)
+{
+        kref_put(&gss_auth->kref, gss_free_callback);
+}
+static void
 gss_destroy(struct rpc_auth *auth)
 {
        struct gss_auth *gss_auth = container_of(auth,
@@ -1082,7 +1095,7 @@ gss_destroy(struct rpc_auth *auth)
        gss_auth->gss_pipe[1] = NULL;
        rpcauth_destroy_credcache(auth);
-        kref_put(&gss_auth->kref, gss_free_callback);
+        gss_put_auth(gss_auth);
 }
 /*
@@ -1253,7 +1266,7 @@ gss_destroy_nullcred(struct rpc_cred *cred)
        call_rcu(&cred->cr_rcu, gss_free_cred_callback);
        if (ctx)
                gss_put_ctx(ctx);
-        kref_put(&gss_auth->kref, gss_free_callback);
+        gss_put_auth(gss_auth);
 }
 static void
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 890a29912d5a..e860d4f7ed2a 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -64,7 +64,6 @@ static void xprt_free_allocation(struct rpc_rqst *req)
        free_page((unsigned long)xbufp->head[0].iov_base);
        xbufp = &req->rq_snd_buf;
        free_page((unsigned long)xbufp->head[0].iov_base);
-        list_del(&req->rq_bc_pa_list);
        kfree(req);
 }
@@ -168,8 +167,10 @@ out_free:
        /*
         * Memory allocation failed, free the temporary list
         */
-        list_for_each_entry_safe(req, tmp, &tmp_list, rq_bc_pa_list)
+        list_for_each_entry_safe(req, tmp, &tmp_list, rq_bc_pa_list) {
+                list_del(&req->rq_bc_pa_list);
                xprt_free_allocation(req);
+        }
        dprintk("RPC:       setup backchannel transport failed\n");
        return -ENOMEM;
@@ -198,6 +199,7 @@ void xprt_destroy_backchannel(struct rpc_xprt *xprt, unsigned int max_reqs)
        xprt_dec_alloc_count(xprt, max_reqs);
        list_for_each_entry_safe(req, tmp, &xprt->bc_pa_list, rq_bc_pa_list) {
                dprintk("RPC:        req=%p\n", req);
+                list_del(&req->rq_bc_pa_list);
                xprt_free_allocation(req);
                if (--max_reqs == 0)
                        break;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 817a1e523969..0addefca8e77 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -510,6 +510,7 @@ static int xs_nospace(struct rpc_task *task)
        struct rpc_rqst *req = task->tk_rqstp;
        struct rpc_xprt *xprt = req->rq_xprt;
        struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+        struct sock *sk = transport->inet;
        int ret = -EAGAIN;
        dprintk("RPC: %5u xmit incomplete (%u left of %u)\n",
@@ -527,7 +528,7 @@ static int xs_nospace(struct rpc_task *task)
                         * window size
                         */
                        set_bit(SOCK_NOSPACE, &transport->sock->flags);
-                        transport->inet->sk_write_pending++;
+                        sk->sk_write_pending++;
                        /* ...and wait for more buffer space */
                        xprt_wait_for_buffer_space(task, xs_nospace_callback);
                }
@@ -537,6 +538,9 @@ static int xs_nospace(struct rpc_task *task)
        }
        spin_unlock_bh(&xprt->transport_lock);
+        /* Race breaker in case memory is freed before above code is called */
+        sk->sk_write_space(sk);
        return ret;
 }
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 1ff477b0450d..5569d96b4da3 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -192,6 +192,7 @@ static inline void k_term_timer(struct timer_list *timer)
 struct tipc_skb_cb {
        void *handle;
+        bool deferred;
 };
 #define TIPC_SKB_CB(__skb) ((struct tipc_skb_cb *)&((__skb)->cb[0]))
diff --git a/net/tipc/link.c b/net/tipc/link.c
index d4b5de41b682..da6018beb6eb 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1391,6 +1391,12 @@ static int link_recv_buf_validate(struct sk_buff *buf)
        u32 hdr_size;
        u32 min_hdr_size;
+        /* If this packet comes from the defer queue, the skb has already
+         * been validated
+         */
+        if (unlikely(TIPC_SKB_CB(buf)->deferred))
+                return 1;
        if (unlikely(buf->len < MIN_H_SIZE))
                return 0;
@@ -1703,6 +1709,7 @@ static void link_handle_out_of_seq_msg(struct tipc_link *l_ptr,
                                &l_ptr->newest_deferred_in, buf)) {
                l_ptr->deferred_inqueue_sz++;
                l_ptr->stats.deferred_recv++;
+                TIPC_SKB_CB(buf)->deferred = true;
                if ((l_ptr->deferred_inqueue_sz % 16) == 1)
                        tipc_link_send_proto_msg(l_ptr, STATE_MSG, 0, 0, 0, 0, 0);
        } else