54 files changed, 499 insertions, 338 deletions

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 762896ebfcf5..47c908f1f626 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -530,6 +530,23 @@ static const struct header_ops vlan_header_ops = {
         .parse   = eth_header_parse,
 };
 
+static int vlan_passthru_hard_header(struct sk_buff *skb, struct net_device *dev,
+                                     unsigned short type,
+                                     const void *daddr, const void *saddr,
+                                     unsigned int len)
+{
+        struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
+        struct net_device *real_dev = vlan->real_dev;
+
+        return dev_hard_header(skb, real_dev, type, daddr, saddr, len);
+}
+
+static const struct header_ops vlan_passthru_header_ops = {
+        .create  = vlan_passthru_hard_header,
+        .rebuild = dev_rebuild_header,
+        .parse   = eth_header_parse,
+};
+
 static struct device_type vlan_type = {
         .name   = "vlan",
 };
@@ -573,7 +590,7 @@ static int vlan_dev_init(struct net_device *dev)
 
         dev->needed_headroom = real_dev->needed_headroom;
         if (real_dev->features & NETIF_F_HW_VLAN_CTAG_TX) {
-                dev->header_ops      = real_dev->header_ops;
+                dev->header_ops      = &vlan_passthru_header_ops;
                 dev->hard_header_len = real_dev->hard_header_len;
         } else {
                 dev->header_ops      = &vlan_header_ops;
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index a2b480a90872..b9c8a6eedf45 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -307,9 +307,9 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface)
         hard_iface->bat_iv.ogm_buff = ogm_buff;
 
         batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
-        batadv_ogm_packet->header.packet_type = BATADV_IV_OGM;
-        batadv_ogm_packet->header.version = BATADV_COMPAT_VERSION;
-        batadv_ogm_packet->header.ttl = 2;
+        batadv_ogm_packet->packet_type = BATADV_IV_OGM;
+        batadv_ogm_packet->version = BATADV_COMPAT_VERSION;
+        batadv_ogm_packet->ttl = 2;
         batadv_ogm_packet->flags = BATADV_NO_FLAGS;
         batadv_ogm_packet->reserved = 0;
         batadv_ogm_packet->tq = BATADV_TQ_MAX_VALUE;
@@ -346,7 +346,7 @@ batadv_iv_ogm_primary_iface_set(struct batadv_hard_iface *hard_iface)
 
         batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
         batadv_ogm_packet->flags = BATADV_PRIMARIES_FIRST_HOP;
-        batadv_ogm_packet->header.ttl = BATADV_TTL;
+        batadv_ogm_packet->ttl = BATADV_TTL;
 }
 
 /* when do we schedule our own ogm to be sent */
@@ -435,7 +435,7 @@ static void batadv_iv_ogm_send_to_if(struct batadv_forw_packet *forw_packet,
                            fwd_str, (packet_num > 0 ? "aggregated " : ""),
                            batadv_ogm_packet->orig,
                            ntohl(batadv_ogm_packet->seqno),
-                           batadv_ogm_packet->tq, batadv_ogm_packet->header.ttl,
+                           batadv_ogm_packet->tq, batadv_ogm_packet->ttl,
                            (batadv_ogm_packet->flags & BATADV_DIRECTLINK ?
                             "on" : "off"),
                            hard_iface->net_dev->name,
@@ -491,7 +491,7 @@ static void batadv_iv_ogm_emit(struct batadv_forw_packet *forw_packet)
         /* multihomed peer assumed
          * non-primary OGMs are only broadcasted on their interface
          */
-        if ((directlink && (batadv_ogm_packet->header.ttl == 1)) ||
+        if ((directlink && (batadv_ogm_packet->ttl == 1)) ||
             (forw_packet->own && (forw_packet->if_incoming != primary_if))) {
                 /* FIXME: what about aggregated packets ? */
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
@@ -499,7 +499,7 @@ static void batadv_iv_ogm_emit(struct batadv_forw_packet *forw_packet)
                            (forw_packet->own ? "Sending own" : "Forwarding"),
                            batadv_ogm_packet->orig,
                            ntohl(batadv_ogm_packet->seqno),
-                           batadv_ogm_packet->header.ttl,
+                           batadv_ogm_packet->ttl,
                            forw_packet->if_incoming->net_dev->name,
                            forw_packet->if_incoming->net_dev->dev_addr);
 
@@ -572,7 +572,7 @@ batadv_iv_ogm_can_aggregate(const struct batadv_ogm_packet *new_bat_ogm_packet,
                  */
                 if ((!directlink) &&
                     (!(batadv_ogm_packet->flags & BATADV_DIRECTLINK)) &&
-                    (batadv_ogm_packet->header.ttl != 1) &&
+                    (batadv_ogm_packet->ttl != 1) &&
 
                     /* own packets originating non-primary
                      * interfaces leave only that interface
@@ -587,7 +587,7 @@ batadv_iv_ogm_can_aggregate(const struct batadv_ogm_packet *new_bat_ogm_packet,
                  * interface only - we still can aggregate
                  */
                 if ((directlink) &&
-                    (new_bat_ogm_packet->header.ttl == 1) &&
+                    (new_bat_ogm_packet->ttl == 1) &&
                     (forw_packet->if_incoming == if_incoming) &&
 
                     /* packets from direct neighbors or
@@ -778,7 +778,7 @@ static void batadv_iv_ogm_forward(struct batadv_orig_node *orig_node,
         struct batadv_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
         uint16_t tvlv_len;
 
-        if (batadv_ogm_packet->header.ttl <= 1) {
+        if (batadv_ogm_packet->ttl <= 1) {
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv, "ttl exceeded\n");
                 return;
         }
@@ -798,7 +798,7 @@ static void batadv_iv_ogm_forward(struct batadv_orig_node *orig_node,
 
         tvlv_len = ntohs(batadv_ogm_packet->tvlv_len);
 
-        batadv_ogm_packet->header.ttl--;
+        batadv_ogm_packet->ttl--;
         memcpy(batadv_ogm_packet->prev_sender, ethhdr->h_source, ETH_ALEN);
 
         /* apply hop penalty */
@@ -807,7 +807,7 @@ static void batadv_iv_ogm_forward(struct batadv_orig_node *orig_node,
 
         batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                    "Forwarding packet: tq: %i, ttl: %i\n",
-                   batadv_ogm_packet->tq, batadv_ogm_packet->header.ttl);
+                   batadv_ogm_packet->tq, batadv_ogm_packet->ttl);
 
         /* switch of primaries first hop flag when forwarding */
         batadv_ogm_packet->flags &= ~BATADV_PRIMARIES_FIRST_HOP;
@@ -972,8 +972,8 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         spin_unlock_bh(&neigh_node->bat_iv.lq_update_lock);
 
         if (dup_status == BATADV_NO_DUP) {
-                orig_node->last_ttl = batadv_ogm_packet->header.ttl;
-                neigh_node->last_ttl = batadv_ogm_packet->header.ttl;
+                orig_node->last_ttl = batadv_ogm_packet->ttl;
+                neigh_node->last_ttl = batadv_ogm_packet->ttl;
         }
 
         batadv_bonding_candidate_add(bat_priv, orig_node, neigh_node);
@@ -1247,7 +1247,7 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
          * packet in an aggregation.  Here we expect that the padding
          * is always zero (or not 0x01)
          */
-        if (batadv_ogm_packet->header.packet_type != BATADV_IV_OGM)
+        if (batadv_ogm_packet->packet_type != BATADV_IV_OGM)
                 return;
 
         /* could be changed by schedule_own_packet() */
@@ -1267,8 +1267,8 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
                    if_incoming->net_dev->dev_addr, batadv_ogm_packet->orig,
                    batadv_ogm_packet->prev_sender,
                    ntohl(batadv_ogm_packet->seqno), batadv_ogm_packet->tq,
-                   batadv_ogm_packet->header.ttl,
-                   batadv_ogm_packet->header.version, has_directlink_flag);
+                   batadv_ogm_packet->ttl,
+                   batadv_ogm_packet->version, has_directlink_flag);
 
         rcu_read_lock();
         list_for_each_entry_rcu(hard_iface, &batadv_hardif_list, list) {
@@ -1433,7 +1433,7 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
          * seqno and similar ttl as the non-duplicate
          */
         sameseq = orig_node->last_real_seqno == ntohl(batadv_ogm_packet->seqno);
-        similar_ttl = orig_node->last_ttl - 3 <= batadv_ogm_packet->header.ttl;
+        similar_ttl = orig_node->last_ttl - 3 <= batadv_ogm_packet->ttl;
         if (is_bidirect && ((dup_status == BATADV_NO_DUP) ||
                             (sameseq && similar_ttl)))
                 batadv_iv_ogm_orig_update(bat_priv, orig_node, ethhdr,
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 6c8c3934bd7b..b316a4cb6f14 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -349,7 +349,7 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
 
         unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
 
-        switch (unicast_4addr_packet->u.header.packet_type) {
+        switch (unicast_4addr_packet->u.packet_type) {
         case BATADV_UNICAST:
                 batadv_dbg(BATADV_DBG_DAT, bat_priv,
                            "* encapsulated within a UNICAST packet\n");
@@ -374,7 +374,7 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
                         break;
                 default:
                         batadv_dbg(BATADV_DBG_DAT, bat_priv, "* type: Unknown (%u)!\n",
-                                   unicast_4addr_packet->u.header.packet_type);
+                                   unicast_4addr_packet->u.packet_type);
                 }
                 break;
         case BATADV_BCAST:
@@ -387,7 +387,7 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
         default:
                 batadv_dbg(BATADV_DBG_DAT, bat_priv,
                            "* encapsulated within an unknown packet type (0x%x)\n",
-                           unicast_4addr_packet->u.header.packet_type);
+                           unicast_4addr_packet->u.packet_type);
         }
 }
 
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 271d321b3a04..6ddb6145ffb5 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -355,7 +355,7 @@ bool batadv_frag_skb_fwd(struct sk_buff *skb,
                 batadv_add_counter(bat_priv, BATADV_CNT_FRAG_FWD_BYTES,
                                    skb->len + ETH_HLEN);
 
-                packet->header.ttl--;
+                packet->ttl--;
                 batadv_send_skb_packet(skb, neigh_node->if_incoming,
                                        neigh_node->addr);
                 ret = true;
@@ -444,9 +444,9 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
                 goto out_err;
 
         /* Create one header to be copied to all fragments */
-        frag_header.header.packet_type = BATADV_UNICAST_FRAG;
-        frag_header.header.version = BATADV_COMPAT_VERSION;
-        frag_header.header.ttl = BATADV_TTL;
+        frag_header.packet_type = BATADV_UNICAST_FRAG;
+        frag_header.version = BATADV_COMPAT_VERSION;
+        frag_header.ttl = BATADV_TTL;
         frag_header.seqno = htons(atomic_inc_return(&bat_priv->frag_seqno));
         frag_header.reserved = 0;
         frag_header.no = 0;
diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c
index 29ae4efe3543..130cc3217e2b 100644
--- a/net/batman-adv/icmp_socket.c
+++ b/net/batman-adv/icmp_socket.c
@@ -194,7 +194,7 @@ static ssize_t batadv_socket_write(struct file *file, const char __user *buff,
                 goto free_skb;
         }
 
-        if (icmp_header->header.packet_type != BATADV_ICMP) {
+        if (icmp_header->packet_type != BATADV_ICMP) {
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                            "Error - can't send packet from char device: got bogus packet type (expected: BAT_ICMP)\n");
                 len = -EINVAL;
@@ -243,9 +243,9 @@ static ssize_t batadv_socket_write(struct file *file, const char __user *buff,
 
         icmp_header->uid = socket_client->index;
 
-        if (icmp_header->header.version != BATADV_COMPAT_VERSION) {
+        if (icmp_header->version != BATADV_COMPAT_VERSION) {
                 icmp_header->msg_type = BATADV_PARAMETER_PROBLEM;
-                icmp_header->header.version = BATADV_COMPAT_VERSION;
+                icmp_header->version = BATADV_COMPAT_VERSION;
                 batadv_socket_add_packet(socket_client, icmp_header,
                                          packet_len);
                 goto free_skb;
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index c51a5e568f0a..1511f64a6cea 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -383,17 +383,17 @@ int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
 
         batadv_ogm_packet = (struct batadv_ogm_packet *)skb->data;
 
-        if (batadv_ogm_packet->header.version != BATADV_COMPAT_VERSION) {
+        if (batadv_ogm_packet->version != BATADV_COMPAT_VERSION) {
                 batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                            "Drop packet: incompatible batman version (%i)\n",
-                           batadv_ogm_packet->header.version);
+                           batadv_ogm_packet->version);
                 goto err_free;
         }
 
         /* all receive handlers return whether they received or reused
          * the supplied skb. if not, we have to free the skb.
          */
-        idx = batadv_ogm_packet->header.packet_type;
+        idx = batadv_ogm_packet->packet_type;
         ret = (*batadv_rx_handler[idx])(skb, hard_iface);
 
         if (ret == NET_RX_DROP)
@@ -426,8 +426,8 @@ static void batadv_recv_handler_init(void)
         BUILD_BUG_ON(offsetof(struct batadv_unicast_packet, dest) != 4);
         BUILD_BUG_ON(offsetof(struct batadv_unicast_tvlv_packet, dst) != 4);
         BUILD_BUG_ON(offsetof(struct batadv_frag_packet, dest) != 4);
-        BUILD_BUG_ON(offsetof(struct batadv_icmp_packet, icmph.dst) != 4);
-        BUILD_BUG_ON(offsetof(struct batadv_icmp_packet_rr, icmph.dst) != 4);
+        BUILD_BUG_ON(offsetof(struct batadv_icmp_packet, dst) != 4);
+        BUILD_BUG_ON(offsetof(struct batadv_icmp_packet_rr, dst) != 4);
 
         /* broadcast packet */
         batadv_rx_handler[BATADV_BCAST] = batadv_recv_bcast_packet;
@@ -1119,9 +1119,9 @@ void batadv_tvlv_unicast_send(struct batadv_priv *bat_priv, uint8_t *src,
         skb_reserve(skb, ETH_HLEN);
         tvlv_buff = skb_put(skb, sizeof(*unicast_tvlv_packet) + tvlv_len);
         unicast_tvlv_packet = (struct batadv_unicast_tvlv_packet *)tvlv_buff;
-        unicast_tvlv_packet->header.packet_type = BATADV_UNICAST_TVLV;
-        unicast_tvlv_packet->header.version = BATADV_COMPAT_VERSION;
-        unicast_tvlv_packet->header.ttl = BATADV_TTL;
+        unicast_tvlv_packet->packet_type = BATADV_UNICAST_TVLV;
+        unicast_tvlv_packet->version = BATADV_COMPAT_VERSION;
+        unicast_tvlv_packet->ttl = BATADV_TTL;
         unicast_tvlv_packet->reserved = 0;
         unicast_tvlv_packet->tvlv_len = htons(tvlv_len);
         unicast_tvlv_packet->align = 0;
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index 351e199bc0af..511d7e1eea38 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -722,7 +722,7 @@ static bool batadv_can_nc_with_orig(struct batadv_priv *bat_priv,
 {
         if (orig_node->last_real_seqno != ntohl(ogm_packet->seqno))
                 return false;
-        if (orig_node->last_ttl != ogm_packet->header.ttl + 1)
+        if (orig_node->last_ttl != ogm_packet->ttl + 1)
                 return false;
         if (!batadv_compare_eth(ogm_packet->orig, ogm_packet->prev_sender))
                 return false;
@@ -1082,9 +1082,9 @@ static bool batadv_nc_code_packets(struct batadv_priv *bat_priv,
         coded_packet = (struct batadv_coded_packet *)skb_dest->data;
         skb_reset_mac_header(skb_dest);
 
-        coded_packet->header.packet_type = BATADV_CODED;
-        coded_packet->header.version = BATADV_COMPAT_VERSION;
-        coded_packet->header.ttl = packet1->header.ttl;
+        coded_packet->packet_type = BATADV_CODED;
+        coded_packet->version = BATADV_COMPAT_VERSION;
+        coded_packet->ttl = packet1->ttl;
 
         /* Info about first unicast packet */
         memcpy(coded_packet->first_source, first_source, ETH_ALEN);
@@ -1097,7 +1097,7 @@ static bool batadv_nc_code_packets(struct batadv_priv *bat_priv,
         memcpy(coded_packet->second_source, second_source, ETH_ALEN);
         memcpy(coded_packet->second_orig_dest, packet2->dest, ETH_ALEN);
         coded_packet->second_crc = packet_id2;
-        coded_packet->second_ttl = packet2->header.ttl;
+        coded_packet->second_ttl = packet2->ttl;
         coded_packet->second_ttvn = packet2->ttvn;
         coded_packet->coded_len = htons(coding_len);
 
@@ -1452,7 +1452,7 @@ bool batadv_nc_skb_forward(struct sk_buff *skb,
         /* We only handle unicast packets */
         payload = skb_network_header(skb);
         packet = (struct batadv_unicast_packet *)payload;
-        if (packet->header.packet_type != BATADV_UNICAST)
+        if (packet->packet_type != BATADV_UNICAST)
                 goto out;
 
         /* Try to find a coding opportunity and send the skb if one is found */
@@ -1505,7 +1505,7 @@ void batadv_nc_skb_store_for_decoding(struct batadv_priv *bat_priv,
         /* Check for supported packet type */
         payload = skb_network_header(skb);
         packet = (struct batadv_unicast_packet *)payload;
-        if (packet->header.packet_type != BATADV_UNICAST)
+        if (packet->packet_type != BATADV_UNICAST)
                 goto out;
 
         /* Find existing nc_path or create a new */
@@ -1623,7 +1623,7 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
                 ttvn = coded_packet_tmp.second_ttvn;
         } else {
                 orig_dest = coded_packet_tmp.first_orig_dest;
-                ttl = coded_packet_tmp.header.ttl;
+                ttl = coded_packet_tmp.ttl;
                 ttvn = coded_packet_tmp.first_ttvn;
         }
 
@@ -1648,9 +1648,9 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
 
         /* Create decoded unicast packet */
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
-        unicast_packet->header.packet_type = BATADV_UNICAST;
-        unicast_packet->header.version = BATADV_COMPAT_VERSION;
-        unicast_packet->header.ttl = ttl;
+        unicast_packet->packet_type = BATADV_UNICAST;
+        unicast_packet->version = BATADV_COMPAT_VERSION;
+        unicast_packet->ttl = ttl;
         memcpy(unicast_packet->dest, orig_dest, ETH_ALEN);
         unicast_packet->ttvn = ttvn;
 
diff --git a/net/batman-adv/packet.h b/net/batman-adv/packet.h
index 207459b62966..2dd8f2422550 100644
--- a/net/batman-adv/packet.h
+++ b/net/batman-adv/packet.h
@@ -155,6 +155,7 @@ enum batadv_tvlv_type {
         BATADV_TVLV_ROAM        = 0x05,
 };
 
+#pragma pack(2)
 /* the destination hardware field in the ARP frame is used to
  * transport the claim type and the group id
  */
@@ -163,24 +164,20 @@ struct batadv_bla_claim_dst {
         uint8_t type;           /* bla_claimframe */
         __be16 group;           /* group id */
 };
-
-struct batadv_header {
-        uint8_t  packet_type;
-        uint8_t  version;  /* batman version field */
-        uint8_t  ttl;
-        /* the parent struct has to add a byte after the header to make
-         * everything 4 bytes aligned again
-         */
-};
+#pragma pack()
 
 /**
  * struct batadv_ogm_packet - ogm (routing protocol) packet
- * @header: common batman packet header
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
  * @flags: contains routing relevant flags - see enum batadv_iv_flags
  * @tvlv_len: length of tvlv data following the ogm header
  */
 struct batadv_ogm_packet {
-        struct batadv_header header;
+        uint8_t  packet_type;
+        uint8_t  version;
+        uint8_t  ttl;
         uint8_t  flags;
         __be32   seqno;
         uint8_t  orig[ETH_ALEN];
@@ -196,29 +193,51 @@ struct batadv_ogm_packet {
 #define BATADV_OGM_HLEN sizeof(struct batadv_ogm_packet)
 
 /**
- * batadv_icmp_header - common ICMP header
- * @header: common batman header
+ * batadv_icmp_header - common members among all the ICMP packets
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
  * @msg_type: ICMP packet type
  * @dst: address of the destination node
  * @orig: address of the source node
  * @uid: local ICMP socket identifier
+ * @align: not used - useful for alignment purposes only
+ *
+ * This structure is used for ICMP packets parsing only and it is never sent
+ * over the wire. The alignment field at the end is there to ensure that
+ * members are padded the same way as they are in real packets.
  */
 struct batadv_icmp_header {
-        struct batadv_header header;
+        uint8_t  packet_type;
+        uint8_t  version;
+        uint8_t  ttl;
         uint8_t  msg_type; /* see ICMP message types above */
         uint8_t  dst[ETH_ALEN];
         uint8_t  orig[ETH_ALEN];
         uint8_t  uid;
+        uint8_t  align[3];
 };
 
 /**
  * batadv_icmp_packet - ICMP packet
- * @icmph: common ICMP header
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
+ * @msg_type: ICMP packet type
+ * @dst: address of the destination node
+ * @orig: address of the source node
+ * @uid: local ICMP socket identifier
  * @reserved: not used - useful for alignment
  * @seqno: ICMP sequence number
  */
 struct batadv_icmp_packet {
-        struct batadv_icmp_header icmph;
+        uint8_t  packet_type;
+        uint8_t  version;
+        uint8_t  ttl;
+        uint8_t  msg_type; /* see ICMP message types above */
+        uint8_t  dst[ETH_ALEN];
+        uint8_t  orig[ETH_ALEN];
+        uint8_t  uid;
         uint8_t  reserved;
         __be16   seqno;
 };
@@ -227,13 +246,25 @@ struct batadv_icmp_packet {
 
 /**
  * batadv_icmp_packet_rr - ICMP RouteRecord packet
- * @icmph: common ICMP header
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
+ * @msg_type: ICMP packet type
+ * @dst: address of the destination node
+ * @orig: address of the source node
+ * @uid: local ICMP socket identifier
  * @rr_cur: number of entries the rr array
  * @seqno: ICMP sequence number
  * @rr: route record array
  */
 struct batadv_icmp_packet_rr {
-        struct batadv_icmp_header icmph;
+        uint8_t  packet_type;
+        uint8_t  version;
+        uint8_t  ttl;
+        uint8_t  msg_type; /* see ICMP message types above */
+        uint8_t  dst[ETH_ALEN];
+        uint8_t  orig[ETH_ALEN];
+        uint8_t  uid;
         uint8_t  rr_cur;
         __be16   seqno;
         uint8_t  rr[BATADV_RR_LEN][ETH_ALEN];
@@ -253,8 +284,18 @@ struct batadv_icmp_packet_rr {
  */
 #pragma pack(2)
 
+/**
+ * struct batadv_unicast_packet - unicast packet for network payload
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
+ * @ttvn: translation table version number
+ * @dest: originator destination of the unicast packet
+ */
 struct batadv_unicast_packet {
-        struct batadv_header header;
+        uint8_t  packet_type;
+        uint8_t  version;
+        uint8_t  ttl;
         uint8_t  ttvn; /* destination translation table version number */
         uint8_t  dest[ETH_ALEN];
         /* "4 bytes boundary + 2 bytes" long to make the payload after the
@@ -280,7 +321,9 @@ struct batadv_unicast_4addr_packet {
 
 /**
  * struct batadv_frag_packet - fragmented packet
- * @header: common batman packet header with type, compatversion, and ttl
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
  * @dest: final destination used when routing fragments
  * @orig: originator of the fragment used when merging the packet
  * @no: fragment number within this sequence
@@ -289,7 +332,9 @@ struct batadv_unicast_4addr_packet {
  * @total_size: size of the merged packet
  */
 struct batadv_frag_packet {
-        struct  batadv_header header;
+        uint8_t packet_type;
+        uint8_t version;  /* batman version field */
+        uint8_t ttl;
 #if defined(__BIG_ENDIAN_BITFIELD)
         uint8_t no:4;
         uint8_t reserved:4;
@@ -305,8 +350,19 @@ struct batadv_frag_packet {
         __be16  total_size;
 };
 
+/**
+ * struct batadv_bcast_packet - broadcast packet for network payload
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
+ * @reserved: reserved byte for alignment
+ * @seqno: sequence identification
+ * @orig: originator of the broadcast packet
+ */
 struct batadv_bcast_packet {
-        struct batadv_header header;
+        uint8_t  packet_type;
+        uint8_t  version;  /* batman version field */
+        uint8_t  ttl;
         uint8_t  reserved;
         __be32   seqno;
         uint8_t  orig[ETH_ALEN];
@@ -315,11 +371,11 @@ struct batadv_bcast_packet {
          */
 };
 
-#pragma pack()
-
 /**
  * struct batadv_coded_packet - network coded packet
- * @header: common batman packet header and ttl of first included packet
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
  * @reserved: Align following fields to 2-byte boundaries
  * @first_source: original source of first included packet
  * @first_orig_dest: original destinal of first included packet
@@ -334,7 +390,9 @@ struct batadv_bcast_packet {
  * @coded_len: length of network coded part of the payload
  */
 struct batadv_coded_packet {
-        struct batadv_header header;
+        uint8_t  packet_type;
+        uint8_t  version;  /* batman version field */
+        uint8_t  ttl;
         uint8_t  first_ttvn;
         /* uint8_t  first_dest[ETH_ALEN]; - saved in mac header destination */
         uint8_t  first_source[ETH_ALEN];
@@ -349,9 +407,13 @@ struct batadv_coded_packet {
         __be16   coded_len;
 };
 
+#pragma pack()
+
 /**
  * struct batadv_unicast_tvlv - generic unicast packet with tvlv payload
- * @header: common batman packet header
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
  * @reserved: reserved field (for packet alignment)
  * @src: address of the source
  * @dst: address of the destination
@@ -359,7 +421,9 @@ struct batadv_coded_packet {
  * @align: 2 bytes to align the header to a 4 byte boundry
  */
 struct batadv_unicast_tvlv_packet {
-        struct batadv_header header;
+        uint8_t  packet_type;
+        uint8_t  version;  /* batman version field */
+        uint8_t  ttl;
         uint8_t  reserved;
         uint8_t  dst[ETH_ALEN];
         uint8_t  src[ETH_ALEN];
@@ -420,13 +484,13 @@ struct batadv_tvlv_tt_vlan_data {
  * struct batadv_tvlv_tt_change - translation table diff data
  * @flags: status indicators concerning the non-mesh client (see
  *  batadv_tt_client_flags)
- * @reserved: reserved field
+ * @reserved: reserved field - useful for alignment purposes only
  * @addr: mac address of non-mesh client that triggered this tt change
  * @vid: VLAN identifier
  */
 struct batadv_tvlv_tt_change {
         uint8_t flags;
-        uint8_t reserved;
+        uint8_t reserved[3];
         uint8_t addr[ETH_ALEN];
         __be16 vid;
 };
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index d4114d775ad6..46278bfb8fdb 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -308,7 +308,7 @@ static int batadv_recv_my_icmp_packet(struct batadv_priv *bat_priv,
                 memcpy(icmph->dst, icmph->orig, ETH_ALEN);
                 memcpy(icmph->orig, primary_if->net_dev->dev_addr, ETH_ALEN);
                 icmph->msg_type = BATADV_ECHO_REPLY;
-                icmph->header.ttl = BATADV_TTL;
+                icmph->ttl = BATADV_TTL;
 
                 res = batadv_send_skb_to_orig(skb, orig_node, NULL);
                 if (res != NET_XMIT_DROP)
@@ -338,9 +338,9 @@ static int batadv_recv_icmp_ttl_exceeded(struct batadv_priv *bat_priv,
         icmp_packet = (struct batadv_icmp_packet *)skb->data;
 
         /* send TTL exceeded if packet is an echo request (traceroute) */
-        if (icmp_packet->icmph.msg_type != BATADV_ECHO_REQUEST) {
+        if (icmp_packet->msg_type != BATADV_ECHO_REQUEST) {
                 pr_debug("Warning - can't forward icmp packet from %pM to %pM: ttl exceeded\n",
-                         icmp_packet->icmph.orig, icmp_packet->icmph.dst);
+                         icmp_packet->orig, icmp_packet->dst);
                 goto out;
         }
 
@@ -349,7 +349,7 @@ static int batadv_recv_icmp_ttl_exceeded(struct batadv_priv *bat_priv,
                 goto out;
 
         /* get routing information */
-        orig_node = batadv_orig_hash_find(bat_priv, icmp_packet->icmph.orig);
+        orig_node = batadv_orig_hash_find(bat_priv, icmp_packet->orig);
         if (!orig_node)
                 goto out;
 
@@ -359,11 +359,11 @@ static int batadv_recv_icmp_ttl_exceeded(struct batadv_priv *bat_priv,
 
         icmp_packet = (struct batadv_icmp_packet *)skb->data;
 
-        memcpy(icmp_packet->icmph.dst, icmp_packet->icmph.orig, ETH_ALEN);
-        memcpy(icmp_packet->icmph.orig, primary_if->net_dev->dev_addr,
+        memcpy(icmp_packet->dst, icmp_packet->orig, ETH_ALEN);
+        memcpy(icmp_packet->orig, primary_if->net_dev->dev_addr,
                ETH_ALEN);
-        icmp_packet->icmph.msg_type = BATADV_TTL_EXCEEDED;
-        icmp_packet->icmph.header.ttl = BATADV_TTL;
+        icmp_packet->msg_type = BATADV_TTL_EXCEEDED;
+        icmp_packet->ttl = BATADV_TTL;
 
         if (batadv_send_skb_to_orig(skb, orig_node, NULL) != NET_XMIT_DROP)
                 ret = NET_RX_SUCCESS;
@@ -434,7 +434,7 @@ int batadv_recv_icmp_packet(struct sk_buff *skb,
                 return batadv_recv_my_icmp_packet(bat_priv, skb);
 
         /* TTL exceeded */
-        if (icmph->header.ttl < 2)
+        if (icmph->ttl < 2)
                 return batadv_recv_icmp_ttl_exceeded(bat_priv, skb);
 
         /* get routing information */
@@ -449,7 +449,7 @@ int batadv_recv_icmp_packet(struct sk_buff *skb,
         icmph = (struct batadv_icmp_header *)skb->data;
 
         /* decrement ttl */
-        icmph->header.ttl--;
+        icmph->ttl--;
 
         /* route it */
         if (batadv_send_skb_to_orig(skb, orig_node, recv_if) != NET_XMIT_DROP)
@@ -709,7 +709,7 @@ static int batadv_route_unicast_packet(struct sk_buff *skb,
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
 
         /* TTL exceeded */
-        if (unicast_packet->header.ttl < 2) {
+        if (unicast_packet->ttl < 2) {
                 pr_debug("Warning - can't forward unicast packet from %pM to %pM: ttl exceeded\n",
                          ethhdr->h_source, unicast_packet->dest);
                 goto out;
@@ -727,9 +727,9 @@ static int batadv_route_unicast_packet(struct sk_buff *skb,
 
         /* decrement ttl */
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
-        unicast_packet->header.ttl--;
+        unicast_packet->ttl--;
 
-        switch (unicast_packet->header.packet_type) {
+        switch (unicast_packet->packet_type) {
         case BATADV_UNICAST_4ADDR:
                 hdr_len = sizeof(struct batadv_unicast_4addr_packet);
                 break;
@@ -970,7 +970,7 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
         unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
 
-        is4addr = unicast_packet->header.packet_type == BATADV_UNICAST_4ADDR;
+        is4addr = unicast_packet->packet_type == BATADV_UNICAST_4ADDR;
         /* the caller function should have already pulled 2 bytes */
         if (is4addr)
                 hdr_size = sizeof(*unicast_4addr_packet);
@@ -1160,7 +1160,7 @@ int batadv_recv_bcast_packet(struct sk_buff *skb,
         if (batadv_is_my_mac(bat_priv, bcast_packet->orig))
                 goto out;
 
-        if (bcast_packet->header.ttl < 2)
+        if (bcast_packet->ttl < 2)
                 goto out;
 
         orig_node = batadv_orig_hash_find(bat_priv, bcast_packet->orig);
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index c83be5ebaa28..fba4dcfcfac2 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -161,11 +161,11 @@ batadv_send_skb_push_fill_unicast(struct sk_buff *skb, int hdr_size,
                 return false;
 
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
-        unicast_packet->header.version = BATADV_COMPAT_VERSION;
+        unicast_packet->version = BATADV_COMPAT_VERSION;
         /* batman packet type: unicast */
-        unicast_packet->header.packet_type = BATADV_UNICAST;
+        unicast_packet->packet_type = BATADV_UNICAST;
         /* set unicast ttl */
-        unicast_packet->header.ttl = BATADV_TTL;
+        unicast_packet->ttl = BATADV_TTL;
         /* copy the destination for faster routing */
         memcpy(unicast_packet->dest, orig_node->orig, ETH_ALEN);
         /* set the destination tt version number */
@@ -221,7 +221,7 @@ bool batadv_send_skb_prepare_unicast_4addr(struct batadv_priv *bat_priv,
                 goto out;
 
         uc_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
-        uc_4addr_packet->u.header.packet_type = BATADV_UNICAST_4ADDR;
+        uc_4addr_packet->u.packet_type = BATADV_UNICAST_4ADDR;
         memcpy(uc_4addr_packet->src, primary_if->net_dev->dev_addr, ETH_ALEN);
         uc_4addr_packet->subtype = packet_subtype;
         uc_4addr_packet->reserved = 0;
@@ -436,7 +436,7 @@ int batadv_add_bcast_packet_to_list(struct batadv_priv *bat_priv,
 
         /* as we have a copy now, it is safe to decrease the TTL */
         bcast_packet = (struct batadv_bcast_packet *)newskb->data;
-        bcast_packet->header.ttl--;
+        bcast_packet->ttl--;
 
         skb_reset_mac_header(newskb);
 
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 36f050876f82..a8f99d1486c0 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -264,11 +264,11 @@ static int batadv_interface_tx(struct sk_buff *skb,
                         goto dropped;
 
                 bcast_packet = (struct batadv_bcast_packet *)skb->data;
-                bcast_packet->header.version = BATADV_COMPAT_VERSION;
-                bcast_packet->header.ttl = BATADV_TTL;
+                bcast_packet->version = BATADV_COMPAT_VERSION;
+                bcast_packet->ttl = BATADV_TTL;
 
                 /* batman packet type: broadcast */
-                bcast_packet->header.packet_type = BATADV_BCAST;
+                bcast_packet->packet_type = BATADV_BCAST;
                 bcast_packet->reserved = 0;
 
                 /* hw address of first interface is the orig mac because only
@@ -328,7 +328,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
                          struct sk_buff *skb, struct batadv_hard_iface *recv_if,
                          int hdr_size, struct batadv_orig_node *orig_node)
 {
-        struct batadv_header *batadv_header = (struct batadv_header *)skb->data;
+        struct batadv_bcast_packet *batadv_bcast_packet;
         struct batadv_priv *bat_priv = netdev_priv(soft_iface);
         __be16 ethertype = htons(ETH_P_BATMAN);
         struct vlan_ethhdr *vhdr;
@@ -336,7 +336,8 @@ void batadv_interface_rx(struct net_device *soft_iface,
         unsigned short vid;
         bool is_bcast;
 
-        is_bcast = (batadv_header->packet_type == BATADV_BCAST);
+        batadv_bcast_packet = (struct batadv_bcast_packet *)skb->data;
+        is_bcast = (batadv_bcast_packet->packet_type == BATADV_BCAST);
 
         /* check if enough space is available for pulling, and pull */
         if (!pskb_may_pull(skb, hdr_size))
@@ -345,7 +346,12 @@ void batadv_interface_rx(struct net_device *soft_iface,
         skb_pull_rcsum(skb, hdr_size);
         skb_reset_mac_header(skb);
 
-        vid = batadv_get_vid(skb, hdr_size);
+        /* clean the netfilter state now that the batman-adv header has been
+         * removed
+         */
+        nf_reset(skb);
+
+        vid = batadv_get_vid(skb, 0);
         ethhdr = eth_hdr(skb);
 
         switch (ntohs(ethhdr->h_proto)) {
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 06506e6f9006..19bc42f8b8be 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -333,7 +333,8 @@ static void batadv_tt_local_event(struct batadv_priv *bat_priv,
                 return;
 
         tt_change_node->change.flags = flags;
-        tt_change_node->change.reserved = 0;
+        memset(tt_change_node->change.reserved, 0,
+               sizeof(tt_change_node->change.reserved));
         memcpy(tt_change_node->change.addr, common->addr, ETH_ALEN);
         tt_change_node->change.vid = htons(common->vid);
 
@@ -2221,7 +2222,8 @@ static void batadv_tt_tvlv_generate(struct batadv_priv *bat_priv,
                                ETH_ALEN);
                         tt_change->flags = tt_common_entry->flags;
                         tt_change->vid = htons(tt_common_entry->vid);
-                        tt_change->reserved = 0;
+                        memset(tt_change->reserved, 0,
+                               sizeof(tt_change->reserved));
 
                         tt_num_entries++;
                         tt_change++;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 6a6c8bb4fd72..7552f9e3089c 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -940,8 +940,22 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
         skb_pull(skb, 1);
 
-        if (hci_pi(sk)->channel == HCI_CHANNEL_RAW &&
-            bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
+        if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
+                /* No permission check is needed for user channel
+                 * since that gets enforced when binding the socket.
+                 *
+                 * However check that the packet type is valid.
+                 */
+                if (bt_cb(skb)->pkt_type != HCI_COMMAND_PKT &&
+                    bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
+                    bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) {
+                        err = -EINVAL;
+                        goto drop;
+                }
+
+                skb_queue_tail(&hdev->raw_q, skb);
+                queue_work(hdev->workqueue, &hdev->tx_work);
+        } else if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
                 u16 opcode = get_unaligned_le16(skb->data);
                 u16 ogf = hci_opcode_ogf(opcode);
                 u16 ocf = hci_opcode_ocf(opcode);
@@ -972,14 +986,6 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                         goto drop;
                 }
 
-                if (hci_pi(sk)->channel == HCI_CHANNEL_USER &&
-                    bt_cb(skb)->pkt_type != HCI_COMMAND_PKT &&
-                    bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
-                    bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) {
-                        err = -EINVAL;
-                        goto drop;
-                }
-
                 skb_queue_tail(&hdev->raw_q, skb);
                 queue_work(hdev->workqueue, &hdev->tx_work);
         }
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 4c214b2b88ef..ef66365b7354 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1998,7 +1998,7 @@ int br_multicast_set_hash_max(struct net_bridge *br, unsigned long val)
         u32 old;
         struct net_bridge_mdb_htable *mdb;
 
-        spin_lock(&br->multicast_lock);
+        spin_lock_bh(&br->multicast_lock);
         if (!netif_running(br->dev))
                 goto unlock;
 
@@ -2030,7 +2030,7 @@ rollback:
         }
 
 unlock:
-        spin_unlock(&br->multicast_lock);
+        spin_unlock_bh(&br->multicast_lock);
 
         return err;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 153ee2f8c33e..e5e23d785454 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4446,7 +4446,7 @@ struct net_device *netdev_all_upper_get_next_dev_rcu(struct net_device *dev,
 {
         struct netdev_adjacent *upper;
 
-        WARN_ON_ONCE(!rcu_read_lock_held());
+        WARN_ON_ONCE(!rcu_read_lock_held() && !lockdep_rtnl_is_held());
 
         upper = list_entry_rcu((*iter)->next, struct netdev_adjacent, list);
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index a666740051dc..ea97361f0e9b 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1298,7 +1298,7 @@ int neigh_compat_output(struct neighbour *neigh, struct sk_buff *skb)
 
         if (dev_hard_header(skb, dev, ntohs(skb->protocol), NULL, NULL,
                             skb->len) < 0 &&
-            dev->header_ops->rebuild(skb))
+            dev_rebuild_header(skb))
                 return 0;
 
         return dev_queue_xmit(skb);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 8f971990677c..303097874633 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -386,8 +386,14 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                                             !vlan_hw_offload_capable(netif_skb_features(skb),
                                                                      skb->vlan_proto)) {
                                                 skb = __vlan_put_tag(skb, skb->vlan_proto, vlan_tx_tag_get(skb));
-                                                if (unlikely(!skb))
-                                                        break;
+                                                if (unlikely(!skb)) {
+                                                        /* This is actually a packet drop, but we
+                                                         * don't want the code at the end of this
+                                                         * function to try and re-queue a NULL skb.
+                                                         */
+                                                        status = NETDEV_TX_OK;
+                                                        goto unlock_txq;
+                                                }
                                                 skb->vlan_tci = 0;
                                         }
 
@@ -395,6 +401,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                                         if (status == NETDEV_TX_OK)
                                                 txq_trans_update(txq);
                                 }
+                        unlock_txq:
                                 __netif_tx_unlock(txq);
 
                                 if (status == NETDEV_TX_OK)
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 4c6bdf97a657..595ddf0459db 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -152,17 +152,6 @@ static const struct file_operations dccpprobe_fops = {
         .llseek  = noop_llseek,
 };
 
-static __init int setup_jprobe(void)
-{
-        int ret = register_jprobe(&dccp_send_probe);
-
-        if (ret) {
-                request_module("dccp");
-                ret = register_jprobe(&dccp_send_probe);
-        }
-        return ret;
-}
-
 static __init int dccpprobe_init(void)
 {
         int ret = -ENOMEM;
@@ -174,7 +163,13 @@ static __init int dccpprobe_init(void)
         if (!proc_create(procname, S_IRUSR, init_net.proc_net, &dccpprobe_fops))
                 goto err0;
 
-        ret = setup_jprobe();
+        ret = register_jprobe(&dccp_send_probe);
+        if (ret) {
+                ret = request_module("dccp");
+                if (!ret)
+                        ret = register_jprobe(&dccp_send_probe);
+        }
+
         if (ret)
                 goto err1;
 
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 459e200c08a4..a2d2456a557a 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -547,7 +547,7 @@ static int lowpan_header_create(struct sk_buff *skb,
                         hc06_ptr += 3;
                 } else {
                         /* compress nothing */
-                        memcpy(hc06_ptr, &hdr, 4);
+                        memcpy(hc06_ptr, hdr, 4);
                         /* replace the top byte with new ECN | DSCP format */
                         *hc06_ptr = tmp;
                         hc06_ptr += 4;
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index e5d436188464..2cd02f32f99f 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -28,6 +28,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
         netdev_features_t enc_features;
         int ghl = GRE_HEADER_SECTION;
         struct gre_base_hdr *greh;
+        u16 mac_offset = skb->mac_header;
         int mac_len = skb->mac_len;
         __be16 protocol = skb->protocol;
         int tnl_hlen;
@@ -58,13 +59,13 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
         } else
                 csum = false;
 
+        if (unlikely(!pskb_may_pull(skb, ghl)))
+                goto out;
+
         /* setup inner skb. */
         skb->protocol = greh->protocol;
         skb->encapsulation = 0;
 
-        if (unlikely(!pskb_may_pull(skb, ghl)))
-                goto out;
-
         __skb_pull(skb, ghl);
         skb_reset_mac_header(skb);
         skb_set_network_header(skb, skb_inner_network_offset(skb));
@@ -73,8 +74,10 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
         /* segment inner packet. */
         enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
         segs = skb_mac_gso_segment(skb, enc_features);
-        if (!segs || IS_ERR(segs))
+        if (!segs || IS_ERR(segs)) {
+                skb_gso_error_unwind(skb, protocol, ghl, mac_offset, mac_len);
                 goto out;
+        }
 
         skb = segs;
         tnl_hlen = skb_tnl_header_len(skb);
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 56a964a553d2..a0f52dac8940 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -106,6 +106,10 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
 
         r->id.idiag_sport = inet->inet_sport;
         r->id.idiag_dport = inet->inet_dport;
+
+        memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
+        memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
+
         r->id.idiag_src[0] = inet->inet_rcv_saddr;
         r->id.idiag_dst[0] = inet->inet_daddr;
 
@@ -240,12 +244,19 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
 
         r->idiag_family       = tw->tw_family;
         r->idiag_retrans      = 0;
+
         r->id.idiag_if        = tw->tw_bound_dev_if;
         sock_diag_save_cookie(tw, r->id.idiag_cookie);
+
         r->id.idiag_sport     = tw->tw_sport;
         r->id.idiag_dport     = tw->tw_dport;
+
+        memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
+        memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
+
         r->id.idiag_src[0]    = tw->tw_rcv_saddr;
         r->id.idiag_dst[0]    = tw->tw_daddr;
+
         r->idiag_state        = tw->tw_substate;
         r->idiag_timer        = 3;
         r->idiag_expires      = jiffies_to_msecs(tmo);
@@ -726,8 +737,13 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
 
         r->id.idiag_sport = inet->inet_sport;
         r->id.idiag_dport = ireq->ir_rmt_port;
+
+        memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
+        memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
+
         r->id.idiag_src[0] = ireq->ir_loc_addr;
         r->id.idiag_dst[0] = ireq->ir_rmt_addr;
+
         r->idiag_expires = jiffies_to_msecs(tmo);
         r->idiag_rqueue = 0;
         r->idiag_wqueue = 0;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index d7aea4c5b940..e560ef34cf4b 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -217,6 +217,7 @@ static int ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
                                   iph->saddr, iph->daddr, tpi->key);
 
         if (tunnel) {
+                skb_pop_mac_header(skb);
                 ip_tunnel_rcv(tunnel, skb, tpi, log_ecn_error);
                 return PACKET_RCVD;
         }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 912402752f2f..df184616493f 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -828,7 +828,7 @@ static int __ip_append_data(struct sock *sk,
 
         if (cork->length + length > maxnonfragsize - fragheaderlen) {
                 ip_local_error(sk, EMSGSIZE, fl4->daddr, inet->inet_dport,
-                               mtu-exthdrlen);
+                               mtu - (opt ? opt->optlen : 0));
                 return -EMSGSIZE;
         }
 
@@ -1151,7 +1151,8 @@ ssize_t	ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
                          mtu : 0xFFFF;
 
         if (cork->length + size > maxnonfragsize - fragheaderlen) {
-                ip_local_error(sk, EMSGSIZE, fl4->daddr, inet->inet_dport, mtu);
+                ip_local_error(sk, EMSGSIZE, fl4->daddr, inet->inet_dport,
+                               mtu - (opt ? opt->optlen : 0));
                 return -EMSGSIZE;
         }
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index d5d24ecde6a5..80f649fbee63 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2478,6 +2478,7 @@ struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
                                        netdev_features_t features)
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
+        u16 mac_offset = skb->mac_header;
         int mac_len = skb->mac_len;
         int tnl_hlen = skb_inner_mac_header(skb) - skb_transport_header(skb);
         __be16 protocol = skb->protocol;
@@ -2497,8 +2498,11 @@ struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
         /* segment inner packet. */
         enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
         segs = skb_mac_gso_segment(skb, enc_features);
-        if (!segs || IS_ERR(segs))
+        if (!segs || IS_ERR(segs)) {
+                skb_gso_error_unwind(skb, protocol, tnl_hlen, mac_offset,
+                                     mac_len);
                 goto out;
+        }
 
         outer_hlen = skb_tnl_header_len(skb);
         skb = segs;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 83206de2bc76..79c62bdcd3c5 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -41,6 +41,14 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         unsigned int mss;
+        int offset;
+        __wsum csum;
+
+        if (skb->encapsulation &&
+            skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL) {
+                segs = skb_udp_tunnel_segment(skb, features);
+                goto out;
+        }
 
         mss = skb_shinfo(skb)->gso_size;
         if (unlikely(skb->len <= mss))
@@ -63,27 +71,20 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
                 goto out;
         }
 
+        /* Do software UFO. Complete and fill in the UDP checksum as
+         * HW cannot do checksum of UDP packets sent as multiple
+         * IP fragments.
+         */
+        offset = skb_checksum_start_offset(skb);
+        csum = skb_checksum(skb, offset, skb->len - offset, 0);
+        offset += skb->csum_offset;
+        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+        skb->ip_summed = CHECKSUM_NONE;
+
         /* Fragment the skb. IP headers of the fragments are updated in
          * inet_gso_segment()
          */
-        if (skb->encapsulation && skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL)
-                segs = skb_udp_tunnel_segment(skb, features);
-        else {
-                int offset;
-                __wsum csum;
-
-                /* Do software UFO. Complete and fill in the UDP checksum as
-                 * HW cannot do checksum of UDP packets sent as multiple
-                 * IP fragments.
-                 */
-                offset = skb_checksum_start_offset(skb);
-                csum = skb_checksum(skb, offset, skb->len - offset, 0);
-                offset += skb->csum_offset;
-                *(__sum16 *)(skb->data + offset) = csum_fold(csum);
-                skb->ip_summed = CHECKSUM_NONE;
-
-                segs = skb_segment(skb, features);
-        }
+        segs = skb_segment(skb, features);
 out:
         return segs;
 }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 6c1634507ec2..31f75ea9cb60 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1677,7 +1677,7 @@ void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
 static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
 {
         struct in6_addr addr;
-        if (ifp->prefix_len == 127) /* RFC 6164 */
+        if (ifp->prefix_len >= 127) /* RFC 6164 */
                 return;
         ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
         if (ipv6_addr_any(&addr))
@@ -1688,7 +1688,7 @@ static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
 {
         struct in6_addr addr;
-        if (ifp->prefix_len == 127) /* RFC 6164 */
+        if (ifp->prefix_len >= 127) /* RFC 6164 */
                 return;
         ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
         if (ipv6_addr_any(&addr))
@@ -3476,7 +3476,12 @@ restart:
                                          &inet6_addr_lst[i], addr_lst) {
                         unsigned long age;
 
-                        if (ifp->flags & IFA_F_PERMANENT)
+                        /* When setting preferred_lft to a value not zero or
+                         * infinity, while valid_lft is infinity
+                         * IFA_F_PERMANENT has a non-infinity life time.
+                         */
+                        if ((ifp->flags & IFA_F_PERMANENT) &&
+                            (ifp->prefered_lft == INFINITY_LIFE_TIME))
                                 continue;
 
                         spin_lock(&ifp->lock);
@@ -3501,7 +3506,8 @@ restart:
                                         ifp->flags |= IFA_F_DEPRECATED;
                                 }
 
-                                if (time_before(ifp->tstamp + ifp->valid_lft * HZ, next))
+                                if ((ifp->valid_lft != INFINITY_LIFE_TIME) &&
+                                    (time_before(ifp->tstamp + ifp->valid_lft * HZ, next)))
                                         next = ifp->tstamp + ifp->valid_lft * HZ;
 
                                 spin_unlock(&ifp->lock);
@@ -3801,7 +3807,8 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
         put_ifaddrmsg(nlh, ifa->prefix_len, ifa->flags, rt_scope(ifa->scope),
                       ifa->idev->dev->ifindex);
 
-        if (!(ifa->flags&IFA_F_PERMANENT)) {
+        if (!((ifa->flags&IFA_F_PERMANENT) &&
+              (ifa->prefered_lft == INFINITY_LIFE_TIME))) {
                 preferred = ifa->prefered_lft;
                 valid = ifa->valid_lft;
                 if (preferred != INFINITY_LIFE_TIME) {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 788c01a53593..d1de9560c421 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1188,11 +1188,35 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
 
         fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
                         (opt ? opt->opt_nflen : 0);
-        maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
+        maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
+                     sizeof(struct frag_hdr);
 
         if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
-                if (cork->length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
-                        ipv6_local_error(sk, EMSGSIZE, fl6, mtu-exthdrlen);
+                unsigned int maxnonfragsize, headersize;
+
+                headersize = sizeof(struct ipv6hdr) +
+                             (opt ? opt->tot_len : 0) +
+                             (dst_allfrag(&rt->dst) ?
+                              sizeof(struct frag_hdr) : 0) +
+                             rt->rt6i_nfheader_len;
+
+                maxnonfragsize = (np->pmtudisc >= IPV6_PMTUDISC_DO) ?
+                                 mtu : sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
+
+                /* dontfrag active */
+                if ((cork->length + length > mtu - headersize) && dontfrag &&
+                    (sk->sk_protocol == IPPROTO_UDP ||
+                     sk->sk_protocol == IPPROTO_RAW)) {
+                        ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
+                                                   sizeof(struct ipv6hdr));
+                        goto emsgsize;
+                }
+
+                if (cork->length + length > maxnonfragsize - headersize) {
+emsgsize:
+                        ipv6_local_error(sk, EMSGSIZE, fl6,
+                                         mtu - headersize +
+                                         sizeof(struct ipv6hdr));
                         return -EMSGSIZE;
                 }
         }
@@ -1217,12 +1241,6 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
          * --yoshfuji
          */
 
-        if ((length > mtu) && dontfrag && (sk->sk_protocol == IPPROTO_UDP ||
-                                           sk->sk_protocol == IPPROTO_RAW)) {
-                ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
-                return -EMSGSIZE;
-        }
-
         skb = skb_peek_tail(&sk->sk_write_queue);
         cork->length += length;
         if (((length > mtu) ||
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 02894216a46d..1e5e2404f1af 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -101,17 +101,26 @@ struct ip6_tnl_net {
 
 static struct net_device_stats *ip6_get_stats(struct net_device *dev)
 {
-        struct pcpu_sw_netstats sum = { 0 };
+        struct pcpu_sw_netstats tmp, sum = { 0 };
         int i;
 
         for_each_possible_cpu(i) {
+                unsigned int start;
                 const struct pcpu_sw_netstats *tstats =
                                                    per_cpu_ptr(dev->tstats, i);
 
-                sum.rx_packets += tstats->rx_packets;
-                sum.rx_bytes   += tstats->rx_bytes;
-                sum.tx_packets += tstats->tx_packets;
-                sum.tx_bytes   += tstats->tx_bytes;
+                do {
+                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
+                        tmp.rx_packets = tstats->rx_packets;
+                        tmp.rx_bytes = tstats->rx_bytes;
+                        tmp.tx_packets = tstats->tx_packets;
+                        tmp.tx_bytes =  tstats->tx_bytes;
+                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
+
+                sum.rx_packets += tmp.rx_packets;
+                sum.rx_bytes   += tmp.rx_bytes;
+                sum.tx_packets += tmp.tx_packets;
+                sum.tx_bytes   += tmp.tx_bytes;
         }
         dev->stats.rx_packets = sum.rx_packets;
         dev->stats.rx_bytes   = sum.rx_bytes;
@@ -823,8 +832,10 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                 }
 
                 tstats = this_cpu_ptr(t->dev->tstats);
+                u64_stats_update_begin(&tstats->syncp);
                 tstats->rx_packets++;
                 tstats->rx_bytes += skb->len;
+                u64_stats_update_end(&tstats->syncp);
 
                 netif_rx(skb);
 
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index da1d9e4d62ca..b50acd5e75d2 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -74,27 +74,6 @@ struct vti6_net {
         struct ip6_tnl __rcu **tnls[2];
 };
 
-static struct net_device_stats *vti6_get_stats(struct net_device *dev)
-{
-        struct pcpu_sw_netstats sum = { 0 };
-        int i;
-
-        for_each_possible_cpu(i) {
-                const struct pcpu_sw_netstats *tstats =
-                                                   per_cpu_ptr(dev->tstats, i);
-
-                sum.rx_packets += tstats->rx_packets;
-                sum.rx_bytes   += tstats->rx_bytes;
-                sum.tx_packets += tstats->tx_packets;
-                sum.tx_bytes   += tstats->tx_bytes;
-        }
-        dev->stats.rx_packets = sum.rx_packets;
-        dev->stats.rx_bytes   = sum.rx_bytes;
-        dev->stats.tx_packets = sum.tx_packets;
-        dev->stats.tx_bytes   = sum.tx_bytes;
-        return &dev->stats;
-}
-
 #define for_each_vti6_tunnel_rcu(start) \
         for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 
@@ -331,8 +310,10 @@ static int vti6_rcv(struct sk_buff *skb)
                 }
 
                 tstats = this_cpu_ptr(t->dev->tstats);
+                u64_stats_update_begin(&tstats->syncp);
                 tstats->rx_packets++;
                 tstats->rx_bytes += skb->len;
+                u64_stats_update_end(&tstats->syncp);
 
                 skb->mark = 0;
                 secpath_reset(skb);
@@ -716,7 +697,7 @@ static const struct net_device_ops vti6_netdev_ops = {
         .ndo_start_xmit = vti6_tnl_xmit,
         .ndo_do_ioctl   = vti6_ioctl,
         .ndo_change_mtu = vti6_change_mtu,
-        .ndo_get_stats  = vti6_get_stats,
+        .ndo_get_stats64 = ip_tunnel_get_stats64,
 };
 
 /**
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 266f110cb6f7..11dac21e6586 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1923,9 +1923,7 @@ static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                 else
                         rt->rt6i_gateway = *dest;
                 rt->rt6i_flags = ort->rt6i_flags;
-                if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
-                    (RTF_DEFAULT | RTF_ADDRCONF))
-                        rt6_set_from(rt, ort);
+                rt6_set_from(rt, ort);
                 rt->rt6i_metric = 0;
 
 #ifdef CONFIG_IPV6_SUBTREES
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 9937b2616713..3dfbcf1dcb1c 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -702,8 +702,10 @@ static int ipip6_rcv(struct sk_buff *skb)
                 }
 
                 tstats = this_cpu_ptr(tunnel->dev->tstats);
+                u64_stats_update_begin(&tstats->syncp);
                 tstats->rx_packets++;
                 tstats->rx_bytes += skb->len;
+                u64_stats_update_end(&tstats->syncp);
 
                 netif_rx(skb);
 
@@ -924,7 +926,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 if (tunnel->parms.iph.daddr && skb_dst(skb))
                         skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
 
-                if (skb->len > mtu) {
+                if (skb->len > mtu && !skb_is_gso(skb)) {
                         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                         ip_rt_put(rt);
                         goto tx_error;
@@ -966,8 +968,10 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         tos = INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
 
         skb = iptunnel_handle_offloads(skb, false, SKB_GSO_SIT);
-        if (IS_ERR(skb))
+        if (IS_ERR(skb)) {
+                ip_rt_put(rt);
                 goto out;
+        }
 
         err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, IPPROTO_IPV6, tos,
                             ttl, df, !net_eq(tunnel->net, dev_net(dev)));
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 7b01b9f5846c..c71b699eb555 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -715,7 +715,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
         unsigned long cpu_flags;
         size_t copied = 0;
         u32 peek_seq = 0;
-        u32 *seq;
+        u32 *seq, skb_len;
         unsigned long used;
         int target;     /* Read at least this many bytes */
         long timeo;
@@ -812,6 +812,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                 }
                 continue;
         found_ok_skb:
+                skb_len = skb->len;
                 /* Ok so how much can we use? */
                 used = skb->len - offset;
                 if (len < used)
@@ -844,7 +845,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                 }
 
                 /* Partial read */
-                if (used + offset < skb->len)
+                if (used + offset < skb_len)
                         continue;
         } while (len > 0);
 
diff --git a/net/netfilter/ipvs/ip_vs_nfct.c b/net/netfilter/ipvs/ip_vs_nfct.c
index d5f41514f577..5882bbfd198c 100644
--- a/net/netfilter/ipvs/ip_vs_nfct.c
+++ b/net/netfilter/ipvs/ip_vs_nfct.c
@@ -62,6 +62,7 @@
 #include <net/ip_vs.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 
@@ -96,6 +97,11 @@ ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp, int outin)
         if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
                 return;
 
+        /* Applications may adjust TCP seqs */
+        if (cp->app && nf_ct_protonum(ct) == IPPROTO_TCP &&
+            !nfct_seqadj(ct) && !nfct_seqadj_ext_add(ct))
+                return;
+
         /*
          * The connection is not yet in the hashtable, so we update it.
          * CIP->VIP will remain the same, so leave the tuple in
diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
index 17c1bcb182c6..b2d38da67822 100644
--- a/net/netfilter/nf_conntrack_seqadj.c
+++ b/net/netfilter/nf_conntrack_seqadj.c
@@ -36,6 +36,11 @@ int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
         if (off == 0)
                 return 0;
 
+        if (unlikely(!seqadj)) {
+                WARN(1, "Wrong seqadj usage, missing nfct_seqadj_ext_add()\n");
+                return 0;
+        }
+
         set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
 
         spin_lock_bh(&ct->lock);
diff --git a/net/netfilter/nf_conntrack_timestamp.c b/net/netfilter/nf_conntrack_timestamp.c
index 902fb0a6b38a..7a394df0deb7 100644
--- a/net/netfilter/nf_conntrack_timestamp.c
+++ b/net/netfilter/nf_conntrack_timestamp.c
@@ -97,7 +97,6 @@ int nf_conntrack_tstamp_pernet_init(struct net *net)
 void nf_conntrack_tstamp_pernet_fini(struct net *net)
 {
         nf_conntrack_tstamp_fini_sysctl(net);
-        nf_ct_extend_unregister(&tstamp_extend);
 }
 
 int nf_conntrack_tstamp_init(void)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 629b6da98318..1fcef1ec1dc1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -313,6 +313,9 @@ static int nf_tables_table_enable(struct nft_table *table)
         int err, i = 0;
 
         list_for_each_entry(chain, &table->chains, list) {
+                if (!(chain->flags & NFT_BASE_CHAIN))
+                        continue;
+
                 err = nf_register_hook(&nft_base_chain(chain)->ops);
                 if (err < 0)
                         goto err;
@@ -322,6 +325,9 @@ static int nf_tables_table_enable(struct nft_table *table)
         return 0;
 err:
         list_for_each_entry(chain, &table->chains, list) {
+                if (!(chain->flags & NFT_BASE_CHAIN))
+                        continue;
+
                 if (i-- <= 0)
                         break;
 
@@ -334,8 +340,10 @@ static int nf_tables_table_disable(struct nft_table *table)
 {
         struct nft_chain *chain;
 
-        list_for_each_entry(chain, &table->chains, list)
-                nf_unregister_hook(&nft_base_chain(chain)->ops);
+        list_for_each_entry(chain, &table->chains, list) {
+                if (chain->flags & NFT_BASE_CHAIN)
+                        nf_unregister_hook(&nft_base_chain(chain)->ops);
+        }
 
         return 0;
 }
@@ -2104,17 +2112,21 @@ static int nf_tables_dump_sets_family(struct nft_ctx *ctx, struct sk_buff *skb,
                                       struct netlink_callback *cb)
 {
         const struct nft_set *set;
-        unsigned int idx = 0, s_idx = cb->args[0];
+        unsigned int idx, s_idx = cb->args[0];
         struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
 
         if (cb->args[1])
                 return skb->len;
 
         list_for_each_entry(table, &ctx->afi->tables, list) {
-                if (cur_table && cur_table != table)
-                        continue;
+                if (cur_table) {
+                        if (cur_table != table)
+                                continue;
 
+                        cur_table = NULL;
+                }
                 ctx->table = table;
+                idx = 0;
                 list_for_each_entry(set, &ctx->table->sets, list) {
                         if (idx < s_idx)
                                 goto cont;
@@ -2443,7 +2455,9 @@ static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
         enum nft_registers dreg;
 
         dreg = nft_type_to_reg(set->dtype);
-        return nft_validate_data_load(ctx, dreg, &elem->data, set->dtype);
+        return nft_validate_data_load(ctx, dreg, &elem->data,
+                                      set->dtype == NFT_DATA_VERDICT ?
+                                      NFT_DATA_VERDICT : NFT_DATA_VALUE);
 }
 
 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 7d4254b0dc6b..d292c8d286eb 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -1050,6 +1050,7 @@ static void __net_exit nfnl_log_net_exit(struct net *net)
 #ifdef CONFIG_PROC_FS
         remove_proc_entry("nfnetlink_log", net->nf.proc_netfilter);
 #endif
+        nf_log_unset(net, &nfulnl_logger);
 }
 
 static struct pernet_operations nfnl_log_net_ops = {
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index 8e0bb75e7c51..55c939f5371f 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -31,7 +31,7 @@ static void nft_exthdr_eval(const struct nft_expr *expr,
 {
         struct nft_exthdr *priv = nft_expr_priv(expr);
         struct nft_data *dest = &data[priv->dreg];
-        unsigned int offset;
+        unsigned int offset = 0;
         int err;
 
         err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
diff --git a/net/rds/ib.c b/net/rds/ib.c
index b4c8b0022fee..ba2dffeff608 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -338,7 +338,8 @@ static int rds_ib_laddr_check(__be32 addr)
         ret = rdma_bind_addr(cm_id, (struct sockaddr *)&sin);
         /* due to this, we will claim to support iWARP devices unless we
            check node_type. */
-        if (ret || cm_id->device->node_type != RDMA_NODE_IB_CA)
+        if (ret || !cm_id->device ||
+            cm_id->device->node_type != RDMA_NODE_IB_CA)
                 ret = -EADDRNOTAVAIL;
 
         rdsdebug("addr %pI4 ret %d node type %d\n",
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 81f94b1ae1c7..d080eb4b0d29 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1253,6 +1253,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
 
         if (msg->msg_name) {
                 struct sockaddr_rose *srose;
+                struct full_sockaddr_rose *full_srose = msg->msg_name;
 
                 memset(msg->msg_name, 0, sizeof(struct full_sockaddr_rose));
                 srose = msg->msg_name;
@@ -1260,18 +1261,9 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
                 srose->srose_addr   = rose->dest_addr;
                 srose->srose_call   = rose->dest_call;
                 srose->srose_ndigis = rose->dest_ndigis;
-                if (msg->msg_namelen >= sizeof(struct full_sockaddr_rose)) {
-                        struct full_sockaddr_rose *full_srose = (struct full_sockaddr_rose *)msg->msg_name;
-                        for (n = 0 ; n < rose->dest_ndigis ; n++)
-                                full_srose->srose_digis[n] = rose->dest_digis[n];
-                        msg->msg_namelen = sizeof(struct full_sockaddr_rose);
-                } else {
-                        if (rose->dest_ndigis >= 1) {
-                                srose->srose_ndigis = 1;
-                                srose->srose_digi = rose->dest_digis[0];
-                        }
-                        msg->msg_namelen = sizeof(struct sockaddr_rose);
-                }
+                for (n = 0 ; n < rose->dest_ndigis ; n++)
+                        full_srose->srose_digis[n] = rose->dest_digis[n];
+                msg->msg_namelen = sizeof(struct full_sockaddr_rose);
         }
 
         skb_free_datagram(sk, skb);
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 9cc6717c5f19..8b1d65772a8d 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -70,16 +70,16 @@ static int tcf_csum_init(struct net *n, struct nlattr *nla, struct nlattr *est,
                                      &csum_idx_gen, &csum_hash_info);
                 if (IS_ERR(pc))
                         return PTR_ERR(pc);
-                p = to_tcf_csum(pc);
                 ret = ACT_P_CREATED;
         } else {
-                p = to_tcf_csum(pc);
-                if (!ovr) {
-                        tcf_hash_release(pc, bind, &csum_hash_info);
+                if (bind)/* dont override defaults */
+                        return 0;
+                tcf_hash_release(pc, bind, &csum_hash_info);
+                if (!ovr)
                         return -EEXIST;
-                }
         }
 
+        p = to_tcf_csum(pc);
         spin_lock_bh(&p->tcf_lock);
         p->tcf_action = parm->action;
         p->update_flags = parm->update_flags;
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index dea927343bf4..af5641c290fa 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -95,10 +95,11 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
                         return PTR_ERR(pc);
                 ret = ACT_P_CREATED;
         } else {
-                if (!ovr) {
-                        tcf_hash_release(pc, bind, &gact_hash_info);
+                if (bind)/* dont override defaults */
+                        return 0;
+                tcf_hash_release(pc, bind, &gact_hash_info);
+                if (!ovr)
                         return -EEXIST;
-                }
         }
 
         gact = to_gact(pc);
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index e13ecbbfe8c4..242636950ea5 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -134,10 +134,12 @@ static int tcf_ipt_init(struct net *net, struct nlattr *nla, struct nlattr *est,
                         return PTR_ERR(pc);
                 ret = ACT_P_CREATED;
         } else {
-                if (!ovr) {
-                        tcf_ipt_release(to_ipt(pc), bind);
+                if (bind)/* dont override defaults */
+                        return 0;
+                tcf_ipt_release(to_ipt(pc), bind);
+
+                if (!ovr)
                         return -EEXIST;
-                }
         }
         ipt = to_ipt(pc);
 
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 921fea43fca2..584e65503edb 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -64,15 +64,15 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
                                      &nat_idx_gen, &nat_hash_info);
                 if (IS_ERR(pc))
                         return PTR_ERR(pc);
-                p = to_tcf_nat(pc);
                 ret = ACT_P_CREATED;
         } else {
-                p = to_tcf_nat(pc);
-                if (!ovr) {
-                        tcf_hash_release(pc, bind, &nat_hash_info);
+                if (bind)
+                        return 0;
+                tcf_hash_release(pc, bind, &nat_hash_info);
+                if (!ovr)
                         return -EEXIST;
-                }
         }
+        p = to_tcf_nat(pc);
 
         spin_lock_bh(&p->tcf_lock);
         p->old_addr = parm->old_addr;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index e2520e90a10d..729189341933 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -78,10 +78,12 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
                 ret = ACT_P_CREATED;
         } else {
                 p = to_pedit(pc);
-                if (!ovr) {
-                        tcf_hash_release(pc, bind, &pedit_hash_info);
+                tcf_hash_release(pc, bind, &pedit_hash_info);
+                if (bind)
+                        return 0;
+                if (!ovr)
                         return -EEXIST;
-                }
+
                 if (p->tcfp_nkeys && p->tcfp_nkeys != parm->nkeys) {
                         keys = kmalloc(ksize, GFP_KERNEL);
                         if (keys == NULL)
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 819a9a4d1987..9295b86d5319 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -162,10 +162,12 @@ static int tcf_act_police_locate(struct net *net, struct nlattr *nla,
                         if (bind) {
                                 police->tcf_bindcnt += 1;
                                 police->tcf_refcnt += 1;
+                                return 0;
                         }
                         if (ovr)
                                 goto override;
-                        return ret;
+                        /* not replacing */
+                        return -EEXIST;
                 }
         }
 
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 81aebc162e5c..b44491e3ec17 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -135,10 +135,13 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
                 ret = ACT_P_CREATED;
         } else {
                 d = to_defact(pc);
-                if (!ovr) {
-                        tcf_simp_release(d, bind);
+
+                if (bind)
+                        return 0;
+                tcf_simp_release(d, bind);
+                if (!ovr)
                         return -EEXIST;
-                }
+
                 reset_policy(d, defdata, parm);
         }
 
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index aa0a4c056f31..0fa1aad6e204 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -112,10 +112,11 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
                 ret = ACT_P_CREATED;
         } else {
                 d = to_skbedit(pc);
-                if (!ovr) {
-                        tcf_hash_release(pc, bind, &skbedit_hash_info);
+                if (bind)
+                        return 0;
+                tcf_hash_release(pc, bind, &skbedit_hash_info);
+                if (!ovr)
                         return -EEXIST;
-                }
         }
 
         spin_lock_bh(&d->tcf_lock);
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 111516c3d34c..9c77947c0597 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -207,8 +207,6 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
         INIT_LIST_HEAD(&q->retransmit);
         INIT_LIST_HEAD(&q->sacked);
         INIT_LIST_HEAD(&q->abandoned);
-
-        q->empty = 1;
 }
 
 /* Free the outqueue structure and any related pending chunks.
@@ -331,7 +329,6 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
                                 SCTP_INC_STATS(net, SCTP_MIB_OUTUNORDERCHUNKS);
                         else
                                 SCTP_INC_STATS(net, SCTP_MIB_OUTORDERCHUNKS);
-                        q->empty = 0;
                         break;
                 }
         } else {
@@ -653,7 +650,6 @@ redo:
                         if (chunk->fast_retransmit == SCTP_NEED_FRTX)
                                 chunk->fast_retransmit = SCTP_DONT_FRTX;
 
-                        q->empty = 0;
                         q->asoc->stats.rtxchunks++;
                         break;
                 }
@@ -1064,8 +1060,6 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
 
                         sctp_transport_reset_timers(transport);
 
-                        q->empty = 0;
-
                         /* Only let one DATA chunk get bundled with a
                          * COOKIE-ECHO chunk.
                          */
@@ -1274,29 +1268,17 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_chunk *chunk)
                  "advertised peer ack point:0x%x\n", __func__, asoc, ctsn,
                  asoc->adv_peer_ack_point);
 
-        /* See if all chunks are acked.
-         * Make sure the empty queue handler will get run later.
-         */
-        q->empty = (list_empty(&q->out_chunk_list) &&
-                    list_empty(&q->retransmit));
-        if (!q->empty)
-                goto finish;
-
-        list_for_each_entry(transport, transport_list, transports) {
-                q->empty = q->empty && list_empty(&transport->transmitted);
-                if (!q->empty)
-                        goto finish;
-        }
-
-        pr_debug("%s: sack queue is empty\n", __func__);
-finish:
-        return q->empty;
+        return sctp_outq_is_empty(q);
 }
 
-/* Is the outqueue empty?  */
+/* Is the outqueue empty?
+ * The queue is empty when we have not pending data, no in-flight data
+ * and nothing pending retransmissions.
+ */
 int sctp_outq_is_empty(const struct sctp_outq *q)
 {
-        return q->empty;
+        return q->out_qlen == 0 && q->outstanding_bytes == 0 &&
+               list_empty(&q->retransmit);
 }
 
 /********************************************************************
diff --git a/net/tipc/port.c b/net/tipc/port.c
index 5fd4c8cec08e..b742b2654525 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -251,18 +251,15 @@ struct tipc_port *tipc_createport(struct sock *sk,
         return p_ptr;
 }
 
-int tipc_deleteport(u32 ref)
+int tipc_deleteport(struct tipc_port *p_ptr)
 {
-        struct tipc_port *p_ptr;
         struct sk_buff *buf = NULL;
 
-        tipc_withdraw(ref, 0, NULL);
-        p_ptr = tipc_port_lock(ref);
-        if (!p_ptr)
-                return -EINVAL;
+        tipc_withdraw(p_ptr, 0, NULL);
 
-        tipc_ref_discard(ref);
-        tipc_port_unlock(p_ptr);
+        spin_lock_bh(p_ptr->lock);
+        tipc_ref_discard(p_ptr->ref);
+        spin_unlock_bh(p_ptr->lock);
 
         k_cancel_timer(&p_ptr->timer);
         if (p_ptr->connected) {
@@ -704,47 +701,36 @@ int tipc_set_portimportance(u32 ref, unsigned int imp)
 }
 
 
-int tipc_publish(u32 ref, unsigned int scope, struct tipc_name_seq const *seq)
+int tipc_publish(struct tipc_port *p_ptr, unsigned int scope,
+                 struct tipc_name_seq const *seq)
 {
-        struct tipc_port *p_ptr;
         struct publication *publ;
         u32 key;
-        int res = -EINVAL;
 
-        p_ptr = tipc_port_lock(ref);
-        if (!p_ptr)
+        if (p_ptr->connected)
                 return -EINVAL;
+        key = p_ptr->ref + p_ptr->pub_count + 1;
+        if (key == p_ptr->ref)
+                return -EADDRINUSE;
 
-        if (p_ptr->connected)
-                goto exit;
-        key = ref + p_ptr->pub_count + 1;
-        if (key == ref) {
-                res = -EADDRINUSE;
-                goto exit;
-        }
         publ = tipc_nametbl_publish(seq->type, seq->lower, seq->upper,
                                     scope, p_ptr->ref, key);
         if (publ) {
                 list_add(&publ->pport_list, &p_ptr->publications);
                 p_ptr->pub_count++;
                 p_ptr->published = 1;
-                res = 0;
+                return 0;
         }
-exit:
-        tipc_port_unlock(p_ptr);
-        return res;
+        return -EINVAL;
 }
 
-int tipc_withdraw(u32 ref, unsigned int scope, struct tipc_name_seq const *seq)
+int tipc_withdraw(struct tipc_port *p_ptr, unsigned int scope,
+                  struct tipc_name_seq const *seq)
 {
-        struct tipc_port *p_ptr;
         struct publication *publ;
         struct publication *tpubl;
         int res = -EINVAL;
 
-        p_ptr = tipc_port_lock(ref);
-        if (!p_ptr)
-                return -EINVAL;
         if (!seq) {
                 list_for_each_entry_safe(publ, tpubl,
                                          &p_ptr->publications, pport_list) {
@@ -771,7 +757,6 @@ int tipc_withdraw(u32 ref, unsigned int scope, struct tipc_name_seq const *seq)
         }
         if (list_empty(&p_ptr->publications))
                 p_ptr->published = 0;
-        tipc_port_unlock(p_ptr);
         return res;
 }
 
diff --git a/net/tipc/port.h b/net/tipc/port.h
index 912253597343..34f12bd4074e 100644
--- a/net/tipc/port.h
+++ b/net/tipc/port.h
@@ -116,7 +116,7 @@ int tipc_reject_msg(struct sk_buff *buf, u32 err);
 
 void tipc_acknowledge(u32 port_ref, u32 ack);
 
-int tipc_deleteport(u32 portref);
+int tipc_deleteport(struct tipc_port *p_ptr);
 
 int tipc_portimportance(u32 portref, unsigned int *importance);
 int tipc_set_portimportance(u32 portref, unsigned int importance);
@@ -127,9 +127,9 @@ int tipc_set_portunreliable(u32 portref, unsigned int isunreliable);
 int tipc_portunreturnable(u32 portref, unsigned int *isunreturnable);
 int tipc_set_portunreturnable(u32 portref, unsigned int isunreturnable);
 
-int tipc_publish(u32 portref, unsigned int scope,
+int tipc_publish(struct tipc_port *p_ptr, unsigned int scope,
                  struct tipc_name_seq const *name_seq);
-int tipc_withdraw(u32 portref, unsigned int scope,
+int tipc_withdraw(struct tipc_port *p_ptr, unsigned int scope,
                   struct tipc_name_seq const *name_seq);
 
 int tipc_connect(u32 portref, struct tipc_portid const *port);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 5efdeef06f9d..c8341d1f995e 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -351,7 +351,7 @@ static int release(struct socket *sock)
          * Delete TIPC port; this ensures no more messages are queued
          * (also disconnects an active connection & sends a 'FIN-' to peer)
          */
-        res = tipc_deleteport(tport->ref);
+        res = tipc_deleteport(tport);
 
         /* Discard any remaining (connection-based) messages in receive queue */
         __skb_queue_purge(&sk->sk_receive_queue);
@@ -383,30 +383,46 @@ static int release(struct socket *sock)
  */
 static int bind(struct socket *sock, struct sockaddr *uaddr, int uaddr_len)
 {
+        struct sock *sk = sock->sk;
         struct sockaddr_tipc *addr = (struct sockaddr_tipc *)uaddr;
-        u32 portref = tipc_sk_port(sock->sk)->ref;
+        struct tipc_port *tport = tipc_sk_port(sock->sk);
+        int res = -EINVAL;
 
-        if (unlikely(!uaddr_len))
-                return tipc_withdraw(portref, 0, NULL);
+        lock_sock(sk);
+        if (unlikely(!uaddr_len)) {
+                res = tipc_withdraw(tport, 0, NULL);
+                goto exit;
+        }
 
-        if (uaddr_len < sizeof(struct sockaddr_tipc))
-                return -EINVAL;
-        if (addr->family != AF_TIPC)
-                return -EAFNOSUPPORT;
+        if (uaddr_len < sizeof(struct sockaddr_tipc)) {
+                res = -EINVAL;
+                goto exit;
+        }
+        if (addr->family != AF_TIPC) {
+                res = -EAFNOSUPPORT;
+                goto exit;
+        }
 
         if (addr->addrtype == TIPC_ADDR_NAME)
                 addr->addr.nameseq.upper = addr->addr.nameseq.lower;
-        else if (addr->addrtype != TIPC_ADDR_NAMESEQ)
-                return -EAFNOSUPPORT;
+        else if (addr->addrtype != TIPC_ADDR_NAMESEQ) {
+                res = -EAFNOSUPPORT;
+                goto exit;
+        }
 
         if ((addr->addr.nameseq.type < TIPC_RESERVED_TYPES) &&
             (addr->addr.nameseq.type != TIPC_TOP_SRV) &&
-            (addr->addr.nameseq.type != TIPC_CFG_SRV))
-                return -EACCES;
+            (addr->addr.nameseq.type != TIPC_CFG_SRV)) {
+                res = -EACCES;
+                goto exit;
+        }
 
-        return (addr->scope > 0) ?
-                tipc_publish(portref, addr->scope, &addr->addr.nameseq) :
-                tipc_withdraw(portref, -addr->scope, &addr->addr.nameseq);
+        res = (addr->scope > 0) ?
+                tipc_publish(tport, addr->scope, &addr->addr.nameseq) :
+                tipc_withdraw(tport, -addr->scope, &addr->addr.nameseq);
+exit:
+        release_sock(sk);
+        return res;
 }
 
 /**
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index a271c27fac77..722da616438c 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -124,6 +124,10 @@ int ieee80211_radiotap_iterator_init(
         /* find payload start allowing for extended bitmap(s) */
 
         if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) {
+                if ((unsigned long)iterator->_arg -
+                    (unsigned long)iterator->_rtheader + sizeof(uint32_t) >
+                    (unsigned long)iterator->_max_length)
+                        return -EINVAL;
                 while (get_unaligned_le32(iterator->_arg) &
                                         (1 << IEEE80211_RADIOTAP_EXT)) {
                         iterator->_arg += sizeof(uint32_t);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 65f800890d70..d3c5bd7c6b51 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -632,6 +632,16 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         }
 #endif
 
+        if (!bss && (status == WLAN_STATUS_SUCCESS)) {
+                WARN_ON_ONCE(!wiphy_to_dev(wdev->wiphy)->ops->connect);
+                bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
+                                       wdev->ssid, wdev->ssid_len,
+                                       WLAN_CAPABILITY_ESS,
+                                       WLAN_CAPABILITY_ESS);
+                if (bss)
+                        cfg80211_hold_bss(bss_from_pub(bss));
+        }
+
         if (wdev->current_bss) {
                 cfg80211_unhold_bss(wdev->current_bss);
                 cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
@@ -649,16 +659,8 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                 return;
         }
 
-        if (!bss) {
-                WARN_ON_ONCE(!wiphy_to_dev(wdev->wiphy)->ops->connect);
-                bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
-                                       wdev->ssid, wdev->ssid_len,
-                                       WLAN_CAPABILITY_ESS,
-                                       WLAN_CAPABILITY_ESS);
-                if (WARN_ON(!bss))
-                        return;
-                cfg80211_hold_bss(bss_from_pub(bss));
-        }
+        if (WARN_ON(!bss))
+                return;
 
         wdev->current_bss = bss_from_pub(bss);