41 files changed, 276 insertions, 197 deletions
diff --git a/net/9p/client.c b/net/9p/client.c
index 48b8e084e710..77367745be9b 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -929,15 +929,15 @@ error:
 }
 EXPORT_SYMBOL(p9_client_attach);
-struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
+struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname,
-        int clone)
+                char **wnames, int clone)
 {
        int err;
        struct p9_client *clnt;
        struct p9_fid *fid;
        struct p9_qid *wqids;
        struct p9_req_t *req;
-        int16_t nwqids, count;
+        uint16_t nwqids, count;
        err = 0;
        wqids = NULL;
@@ -955,7 +955,7 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
                fid = oldfid;
-        P9_DPRINTK(P9_DEBUG_9P, ">>> TWALK fids %d,%d nwname %d wname[0] %s\n",
+        P9_DPRINTK(P9_DEBUG_9P, ">>> TWALK fids %d,%d nwname %ud wname[0] %s\n",
                oldfid->fid, fid->fid, nwname, wnames ? wnames[0] : NULL);
        req = p9_client_rpc(clnt, P9_TWALK, "ddT", oldfid->fid, fid->fid,
@@ -1220,27 +1220,6 @@ error:
 }
 EXPORT_SYMBOL(p9_client_fsync);
-int p9_client_sync_fs(struct p9_fid *fid)
-{
-        int err = 0;
-        struct p9_req_t *req;
-        struct p9_client *clnt;
-        P9_DPRINTK(P9_DEBUG_9P, ">>> TSYNC_FS fid %d\n", fid->fid);
-        clnt = fid->clnt;
-        req = p9_client_rpc(clnt, P9_TSYNCFS, "d", fid->fid);
-        if (IS_ERR(req)) {
-                err = PTR_ERR(req);
-                goto error;
-        }
-        P9_DPRINTK(P9_DEBUG_9P, "<<< RSYNCFS fid %d\n", fid->fid);
-        p9_free_req(clnt, req);
-error:
-        return err;
-}
-EXPORT_SYMBOL(p9_client_sync_fs);
 int p9_client_clunk(struct p9_fid *fid)
 {
        int err;
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 8a4084fa8b5a..b58a501cf3d1 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -265,7 +265,7 @@ p9pdu_vreadf(struct p9_fcall *pdu, int proto_version, const char *fmt,
                        }
                        break;
                case 'T':{
-                                int16_t *nwname = va_arg(ap, int16_t *);
+                                uint16_t *nwname = va_arg(ap, uint16_t *);
                                char ***wnames = va_arg(ap, char ***);
                                errcode = p9pdu_readf(pdu, proto_version,
@@ -468,7 +468,8 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                case 'E':{
                                 int32_t cnt = va_arg(ap, int32_t);
                                 const char *k = va_arg(ap, const void *);
-                                 const char *u = va_arg(ap, const void *);
+                                 const char __user *u = va_arg(ap,
+                                                        const void __user *);
                                 errcode = p9pdu_writef(pdu, proto_version, "d",
                                                 cnt);
                                 if (!errcode && pdu_write_urw(pdu, k, u, cnt))
@@ -495,7 +496,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
                        }
                        break;
                case 'T':{
-                                int16_t nwname = va_arg(ap, int);
+                                uint16_t nwname = va_arg(ap, int);
                                const char **wnames = va_arg(ap, const char **);
                                errcode = p9pdu_writef(pdu, proto_version, "w",
diff --git a/net/9p/trans_common.c b/net/9p/trans_common.c
index d47880e971dd..e883172f9aa2 100644
--- a/net/9p/trans_common.c
+++ b/net/9p/trans_common.c
@@ -66,7 +66,7 @@ p9_payload_gup(struct p9_req_t *req, size_t *pdata_off, int *pdata_len,
        uint32_t pdata_mapped_pages;
        struct trans_rpage_info  *rpinfo;
-        *pdata_off = (size_t)req->tc->pubuf & (PAGE_SIZE-1);
+        *pdata_off = (__force size_t)req->tc->pubuf & (PAGE_SIZE-1);
        if (*pdata_off)
                first_page_bytes = min(((size_t)PAGE_SIZE - *pdata_off),
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index e8f046b07182..244e70742183 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -326,8 +326,11 @@ req_retry_pinned:
                        outp = pack_sg_list_p(chan->sg, out, VIRTQUEUE_NUM,
                                        pdata_off, rpinfo->rp_data, pdata_len);
                } else {
-                        char *pbuf = req->tc->pubuf ? req->tc->pubuf :
+                        char *pbuf;
-                                                                req->tc->pkbuf;
+                        if (req->tc->pubuf)
+                                pbuf = (__force char *) req->tc->pubuf;
+                        else
+                                pbuf = req->tc->pkbuf;
                        outp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, pbuf,
                                        req->tc->pbuf_size);
                }
@@ -352,8 +355,12 @@ req_retry_pinned:
                        in = pack_sg_list_p(chan->sg, out+inp, VIRTQUEUE_NUM,
                                        pdata_off, rpinfo->rp_data, pdata_len);
                } else {
-                        char *pbuf = req->tc->pubuf ? req->tc->pubuf :
+                        char *pbuf;
-                                                                req->tc->pkbuf;
+                        if (req->tc->pubuf)
+                                pbuf = (__force char *) req->tc->pubuf;
+                        else
+                                pbuf = req->tc->pkbuf;
                        in = pack_sg_list(chan->sg, out+inp, VIRTQUEUE_NUM,
                                        pbuf, req->tc->pbuf_size);
                }
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 008ff6c4eecf..f3bc322c5891 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -249,11 +249,9 @@ static int br_parse_ip_options(struct sk_buff *skb)
                goto drop;
        }
-        /* Zero out the CB buffer if no options present */
+        memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
-        if (iph->ihl == 5) {
+        if (iph->ihl == 5)
-                memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
                return 0;
-        }
        opt->optlen = iph->ihl*4 - sizeof(struct iphdr);
        if (ip_options_compile(dev_net(dev), opt, skb))
diff --git a/net/caif/cfdgml.c b/net/caif/cfdgml.c
index 27dab26ad3b8..054fdb5aeb88 100644
--- a/net/caif/cfdgml.c
+++ b/net/caif/cfdgml.c
@@ -13,6 +13,7 @@
 #include <net/caif/cfsrvl.h>
 #include <net/caif/cfpkt.h>
 #define container_obj(layr) ((struct cfsrvl *) layr)
 #define DGM_CMD_BIT  0x80
@@ -83,6 +84,7 @@ static int cfdgml_receive(struct cflayer *layr, struct cfpkt *pkt)
 static int cfdgml_transmit(struct cflayer *layr, struct cfpkt *pkt)
 {
+        u8 packet_type;
        u32 zero = 0;
        struct caif_payload_info *info;
        struct cfsrvl *service = container_obj(layr);
@@ -94,7 +96,9 @@ static int cfdgml_transmit(struct cflayer *layr, struct cfpkt *pkt)
        if (cfpkt_getlen(pkt) > DGM_MTU)
                return -EMSGSIZE;
-        cfpkt_add_head(pkt, &zero, 4);
+        cfpkt_add_head(pkt, &zero, 3);
+        packet_type = 0x08; /* B9 set - UNCLASSIFIED */
+        cfpkt_add_head(pkt, &packet_type, 1);
        /* Add info for MUX-layer to route the packet out. */
        info = cfpkt_info(pkt);
diff --git a/net/caif/cfmuxl.c b/net/caif/cfmuxl.c
index 46f34b2e0478..24f1ffa74b06 100644
--- a/net/caif/cfmuxl.c
+++ b/net/caif/cfmuxl.c
@@ -244,9 +244,9 @@ static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
                                int phyid)
 {
        struct cfmuxl *muxl = container_obj(layr);
-        struct list_head *node;
+        struct list_head *node, *next;
        struct cflayer *layer;
-        list_for_each(node, &muxl->srvl_list) {
+        list_for_each_safe(node, next, &muxl->srvl_list) {
                layer = list_entry(node, struct cflayer, node);
                if (cfsrvl_phyid_match(layer, phyid))
                        layer->ctrlcmd(layer, ctrl, phyid);
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 50af02737a3d..5a80f41c0cba 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -579,9 +579,15 @@ static void __kick_osd_requests(struct ceph_osd_client *osdc,
        list_for_each_entry_safe(req, nreq, &osd->o_linger_requests,
                                 r_linger_osd) {
-                __unregister_linger_request(osdc, req);
+                /*
+                 * reregister request prior to unregistering linger so
+                 * that r_osd is preserved.
+                 */
+                BUG_ON(!list_empty(&req->r_req_lru_item));
                __register_request(osdc, req);
-                list_move(&req->r_req_lru_item, &osdc->req_unsent);
+                list_add(&req->r_req_lru_item, &osdc->req_unsent);
+                list_add(&req->r_osd_item, &req->r_osd->o_requests);
+                __unregister_linger_request(osdc, req);
                dout("requeued lingering %p tid %llu osd%d\n", req, req->r_tid,
                     osd->o_osd);
        }
@@ -798,7 +804,7 @@ static void __register_request(struct ceph_osd_client *osdc,
        req->r_request->hdr.tid = cpu_to_le64(req->r_tid);
        INIT_LIST_HEAD(&req->r_req_lru_item);
-        dout("register_request %p tid %lld\n", req, req->r_tid);
+        dout("__register_request %p tid %lld\n", req, req->r_tid);
        __insert_request(osdc, req);
        ceph_osdc_get_request(req);
        osdc->num_requests++;
diff --git a/net/core/dev.c b/net/core/dev.c
index 956d3b006e8b..c2ac599fa0f6 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5203,11 +5203,15 @@ u32 netdev_fix_features(struct net_device *dev, u32 features)
        }
        /* TSO requires that SG is present as well. */
-        if ((features & NETIF_F_TSO) && !(features & NETIF_F_SG)) {
+        if ((features & NETIF_F_ALL_TSO) && !(features & NETIF_F_SG)) {
-                netdev_info(dev, "Dropping NETIF_F_TSO since no SG feature.\n");
+                netdev_info(dev, "Dropping TSO features since no SG feature.\n");
-                features &= ~NETIF_F_TSO;
+                features &= ~NETIF_F_ALL_TSO;
        }
+        /* TSO ECN requires that TSO is present as well. */
+        if ((features & NETIF_F_ALL_TSO) == NETIF_F_TSO_ECN)
+                features &= ~NETIF_F_TSO_ECN;
        /* Software GSO depends on SG. */
        if ((features & NETIF_F_GSO) && !(features & NETIF_F_SG)) {
                netdev_info(dev, "Dropping NETIF_F_GSO since no SG feature.\n");
diff --git a/net/dsa/mv88e6131.c b/net/dsa/mv88e6131.c
index d951f93644bf..3da418894efc 100644
--- a/net/dsa/mv88e6131.c
+++ b/net/dsa/mv88e6131.c
@@ -14,6 +14,13 @@
 #include "dsa_priv.h"
 #include "mv88e6xxx.h"
+/*
+ * Switch product IDs
+ */
+#define ID_6085         0x04a0
+#define ID_6095         0x0950
+#define ID_6131         0x1060
 static char *mv88e6131_probe(struct mii_bus *bus, int sw_addr)
 {
        int ret;
@@ -21,9 +28,11 @@ static char *mv88e6131_probe(struct mii_bus *bus, int sw_addr)
        ret = __mv88e6xxx_reg_read(bus, sw_addr, REG_PORT(0), 0x03);
        if (ret >= 0) {
                ret &= 0xfff0;
-                if (ret == 0x0950)
+                if (ret == ID_6085)
+                        return "Marvell 88E6085";
+                if (ret == ID_6095)
                        return "Marvell 88E6095/88E6095F";
-                if (ret == 0x1060)
+                if (ret == ID_6131)
                        return "Marvell 88E6131";
        }
@@ -164,6 +173,7 @@ static int mv88e6131_setup_global(struct dsa_switch *ds)
 static int mv88e6131_setup_port(struct dsa_switch *ds, int p)
 {
+        struct mv88e6xxx_priv_state *ps = (void *)(ds + 1);
        int addr = REG_PORT(p);
        u16 val;
@@ -171,10 +181,13 @@ static int mv88e6131_setup_port(struct dsa_switch *ds, int p)
         * MAC Forcing register: don't force link, speed, duplex
         * or flow control state to any particular values on physical
         * ports, but force the CPU port and all DSA ports to 1000 Mb/s
-         * full duplex.
+         * (100 Mb/s on 6085) full duplex.
         */
        if (dsa_is_cpu_port(ds, p) || ds->dsa_port_mask & (1 << p))
-                REG_WRITE(addr, 0x01, 0x003e);
+                if (ps->id == ID_6085)
+                        REG_WRITE(addr, 0x01, 0x003d); /* 100 Mb/s */
+                else
+                        REG_WRITE(addr, 0x01, 0x003e); /* 1000 Mb/s */
        else
                REG_WRITE(addr, 0x01, 0x0003);
@@ -286,6 +299,8 @@ static int mv88e6131_setup(struct dsa_switch *ds)
        mv88e6xxx_ppu_state_init(ds);
        mutex_init(&ps->stats_mutex);
+        ps->id = REG_READ(REG_PORT(0), 0x03) & 0xfff0;
        ret = mv88e6131_switch_reset(ds);
        if (ret < 0)
                return ret;
diff --git a/net/dsa/mv88e6xxx.h b/net/dsa/mv88e6xxx.h
index eb0e0aaa9f1b..61156ca26a0d 100644
--- a/net/dsa/mv88e6xxx.h
+++ b/net/dsa/mv88e6xxx.h
@@ -39,6 +39,8 @@ struct mv88e6xxx_priv_state {
         * Hold this mutex over snapshot + dump sequences.
         */
        struct mutex    stats_mutex;
+        int             id; /* switch product id */
 };
 struct mv88e6xxx_hw_stat {
diff --git a/net/ieee802154/Makefile b/net/ieee802154/Makefile
index ce2d33582859..5761185f884e 100644
--- a/net/ieee802154/Makefile
+++ b/net/ieee802154/Makefile
@@ -1,5 +1,3 @@
 obj-$(CONFIG_IEEE802154) +=     ieee802154.o af_802154.o
 ieee802154-y            := netlink.o nl-mac.o nl-phy.o nl_policy.o wpan-class.o
 af_802154-y             := af_ieee802154.o raw.o dgram.o
-ccflags-y += -Wall -DDEBUG
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 6c0b7f4a3d7d..38f23e721b80 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -73,7 +73,7 @@ int inet_csk_bind_conflict(const struct sock *sk,
                     !sk2->sk_bound_dev_if ||
                     sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
                        if (!reuse || !sk2->sk_reuse ||
-                            ((1 << sk2->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))) {
+                            sk2->sk_state == TCP_LISTEN) {
                                const __be32 sk2_rcv_saddr = sk_rcv_saddr(sk2);
                                if (!sk2_rcv_saddr || !sk_rcv_saddr(sk) ||
                                    sk2_rcv_saddr == sk_rcv_saddr(sk))
@@ -122,8 +122,7 @@ again:
                                            (tb->num_owners < smallest_size || smallest_size == -1)) {
                                                smallest_size = tb->num_owners;
                                                smallest_rover = rover;
-                                                if (atomic_read(&hashinfo->bsockets) > (high - low) + 1 &&
+                                                if (atomic_read(&hashinfo->bsockets) > (high - low) + 1) {
-                                                    !inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
                                                        spin_unlock(&head->lock);
                                                        snum = smallest_rover;
                                                        goto have_snum;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index dd1b20eca1a2..9df4e635fb5f 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -354,7 +354,8 @@ static void inetpeer_free_rcu(struct rcu_head *head)
 }
 /* May be called with local BH enabled. */
-static void unlink_from_pool(struct inet_peer *p, struct inet_peer_base *base)
+static void unlink_from_pool(struct inet_peer *p, struct inet_peer_base *base,
+                             struct inet_peer __rcu **stack[PEER_MAXDEPTH])
 {
        int do_free;
@@ -368,7 +369,6 @@ static void unlink_from_pool(struct inet_peer *p, struct inet_peer_base *base)
         * We use refcnt=-1 to alert lockless readers this entry is deleted.
         */
        if (atomic_cmpxchg(&p->refcnt, 1, -1) == 1) {
-                struct inet_peer __rcu **stack[PEER_MAXDEPTH];
                struct inet_peer __rcu ***stackptr, ***delp;
                if (lookup(&p->daddr, stack, base) != p)
                        BUG();
@@ -422,7 +422,7 @@ static struct inet_peer_base *peer_to_base(struct inet_peer *p)
 }
 /* May be called with local BH enabled. */
-static int cleanup_once(unsigned long ttl)
+static int cleanup_once(unsigned long ttl, struct inet_peer __rcu **stack[PEER_MAXDEPTH])
 {
        struct inet_peer *p = NULL;
@@ -454,7 +454,7 @@ static int cleanup_once(unsigned long ttl)
                 * happen because of entry limits in route cache. */
                return -1;
-        unlink_from_pool(p, peer_to_base(p));
+        unlink_from_pool(p, peer_to_base(p), stack);
        return 0;
 }
@@ -524,7 +524,7 @@ struct inet_peer *inet_getpeer(struct inetpeer_addr *daddr, int create)
        if (base->total >= inet_peer_threshold)
                /* Remove one less-recently-used entry. */
-                cleanup_once(0);
+                cleanup_once(0, stack);
        return p;
 }
@@ -540,6 +540,7 @@ static void peer_check_expire(unsigned long dummy)
 {
        unsigned long now = jiffies;
        int ttl, total;
+        struct inet_peer __rcu **stack[PEER_MAXDEPTH];
        total = compute_total();
        if (total >= inet_peer_threshold)
@@ -548,7 +549,7 @@ static void peer_check_expire(unsigned long dummy)
                ttl = inet_peer_maxttl
                                - (inet_peer_maxttl - inet_peer_minttl) / HZ *
                                        total / inet_peer_threshold * HZ;
-        while (!cleanup_once(ttl)) {
+        while (!cleanup_once(ttl, stack)) {
                if (jiffies != now)
                        break;
        }
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 28a736f3442f..2391b24e8251 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -329,7 +329,7 @@ int ip_options_compile(struct net *net,
                                        pp_ptr = optptr + 2;
                                        goto error;
                                }
-                                if (skb) {
+                                if (rt) {
                                        memcpy(&optptr[optptr[2]-1], &rt->rt_spec_dst, 4);
                                        opt->is_changed = 1;
                                }
@@ -371,7 +371,7 @@ int ip_options_compile(struct net *net,
                                                goto error;
                                        }
                                        opt->ts = optptr - iph;
-                                        if (skb) {
+                                        if (rt)  {
                                                memcpy(&optptr[optptr[2]-1], &rt->rt_spec_dst, 4);
                                                timeptr = (__be32*)&optptr[optptr[2]+3];
                                        }
@@ -603,7 +603,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
        unsigned long orefdst;
        int err;
-        if (!opt->srr)
+        if (!opt->srr || !rt)
                return 0;
        if (skb->pkt_type != PACKET_HOST)
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index f3c0b549b8e1..4614babdc45f 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -221,9 +221,10 @@ static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
        return csum;
 }
-static int nf_ip_route(struct dst_entry **dst, struct flowi *fl)
+static int nf_ip_route(struct net *net, struct dst_entry **dst,
+                       struct flowi *fl, bool strict __always_unused)
 {
-        struct rtable *rt = ip_route_output_key(&init_net, &fl->u.ip4);
+        struct rtable *rt = ip_route_output_key(net, &fl->u.ip4);
        if (IS_ERR(rt))
                return PTR_ERR(rt);
        *dst = &rt->dst;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ea107515c53e..c1acf69858fd 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1891,6 +1891,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 #ifdef CONFIG_IP_ROUTE_CLASSID
        rth->dst.tclassid = itag;
 #endif
+        rth->rt_route_iif = dev->ifindex;
        rth->rt_iif     = dev->ifindex;
        rth->dst.dev    = init_net.loopback_dev;
        dev_hold(rth->dst.dev);
@@ -2026,6 +2027,7 @@ static int __mkroute_input(struct sk_buff *skb,
        rth->rt_key_src = saddr;
        rth->rt_src     = saddr;
        rth->rt_gateway = daddr;
+        rth->rt_route_iif = in_dev->dev->ifindex;
        rth->rt_iif     = in_dev->dev->ifindex;
        rth->dst.dev    = (out_dev)->dev;
        dev_hold(rth->dst.dev);
@@ -2202,6 +2204,7 @@ local_input:
 #ifdef CONFIG_IP_ROUTE_CLASSID
        rth->dst.tclassid = itag;
 #endif
+        rth->rt_route_iif = dev->ifindex;
        rth->rt_iif     = dev->ifindex;
        rth->dst.dev    = net->loopback_dev;
        dev_hold(rth->dst.dev);
@@ -2401,7 +2404,8 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
        rth->rt_mark    = oldflp4->flowi4_mark;
        rth->rt_dst     = fl4->daddr;
        rth->rt_src     = fl4->saddr;
-        rth->rt_iif     = 0;
+        rth->rt_route_iif = 0;
+        rth->rt_iif     = oldflp4->flowi4_oif ? : dev_out->ifindex;
        /* get references to the devices that are to be hold by the routing
           cache entry */
        rth->dst.dev    = dev_out;
@@ -2716,6 +2720,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
                rt->rt_key_dst = ort->rt_key_dst;
                rt->rt_key_src = ort->rt_key_src;
                rt->rt_tos = ort->rt_tos;
+                rt->rt_route_iif = ort->rt_route_iif;
                rt->rt_iif = ort->rt_iif;
                rt->rt_oif = ort->rt_oif;
                rt->rt_mark = ort->rt_mark;
@@ -2725,7 +2730,6 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
                rt->rt_type = ort->rt_type;
                rt->rt_dst = ort->rt_dst;
                rt->rt_src = ort->rt_src;
-                rt->rt_iif = ort->rt_iif;
                rt->rt_gateway = ort->rt_gateway;
                rt->rt_spec_dst = ort->rt_spec_dst;
                rt->peer = ort->peer;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 1a456652086b..321e6e84dbcc 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -311,7 +311,6 @@ static struct ctl_table ipv4_table[] = {
                .mode           = 0644,
                .proc_handler   = proc_do_large_bitmap,
        },
-#ifdef CONFIG_IP_MULTICAST
        {
                .procname       = "igmp_max_memberships",
                .data           = &sysctl_igmp_max_memberships,
@@ -319,8 +318,6 @@ static struct ctl_table ipv4_table[] = {
                .mode           = 0644,
                .proc_handler   = proc_dointvec
        },
-#endif
        {
                .procname       = "igmp_max_msf",
                .data           = &sysctl_igmp_max_msf,
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 13e0e7f659ff..d20a05e970d8 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -74,6 +74,7 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
        rt->rt_key_dst = fl4->daddr;
        rt->rt_key_src = fl4->saddr;
        rt->rt_tos = fl4->flowi4_tos;
+        rt->rt_route_iif = fl4->flowi4_iif;
        rt->rt_iif = fl4->flowi4_iif;
        rt->rt_oif = fl4->flowi4_oif;
        rt->rt_mark = fl4->flowi4_mark;
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 166054650466..f2c5b0fc0f21 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -44,7 +44,7 @@ int inet6_csk_bind_conflict(const struct sock *sk,
                     !sk2->sk_bound_dev_if ||
                     sk->sk_bound_dev_if == sk2->sk_bound_dev_if) &&
                    (!sk->sk_reuse || !sk2->sk_reuse ||
-                     ((1 << sk2->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))) &&
+                     sk2->sk_state == TCP_LISTEN) &&
                     ipv6_rcv_saddr_equal(sk, sk2))
                        break;
        }
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 39aaca2b4fd2..28bc1f644b7b 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -90,9 +90,18 @@ static int nf_ip6_reroute(struct sk_buff *skb,
        return 0;
 }
-static int nf_ip6_route(struct dst_entry **dst, struct flowi *fl)
+static int nf_ip6_route(struct net *net, struct dst_entry **dst,
+                        struct flowi *fl, bool strict)
 {
-        *dst = ip6_route_output(&init_net, NULL, &fl->u.ip6);
+        static const struct ipv6_pinfo fake_pinfo;
+        static const struct inet_sock fake_sk = {
+                /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */
+                .sk.sk_bound_dev_if = 1,
+                .pinet6 = (struct ipv6_pinfo *) &fake_pinfo,
+        };
+        const void *sk = strict ? &fake_sk : NULL;
+        *dst = ip6_route_output(net, sk, &fl->u.ip6);
        return (*dst)->error;
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 56fa12538d45..4f49e5dd41bb 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1622,6 +1622,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                opt_skb = skb_clone(skb, GFP_ATOMIC);
        if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+                sock_rps_save_rxhash(sk, skb->rxhash);
                if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
                        goto reset;
                if (opt_skb)
@@ -1649,7 +1650,8 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                                __kfree_skb(opt_skb);
                        return 0;
                }
-        }
+        } else
+                sock_rps_save_rxhash(sk, skb->rxhash);
        if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
                goto reset;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index d7037c006e13..15c37746845e 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -505,6 +505,9 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
        int rc;
        int is_udplite = IS_UDPLITE(sk);
+        if (!ipv6_addr_any(&inet6_sk(sk)->daddr))
+                sock_rps_save_rxhash(sk, skb->rxhash);
        if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                goto drop;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index c9890e25cd4c..cc616974a447 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1297,8 +1297,7 @@ static int irda_sendmsg(struct kiocb *iocb, struct socket *sock,
        /* Note : socket.c set MSG_EOR on SEQPACKET sockets */
        if (msg->msg_flags & ~(MSG_DONTWAIT | MSG_EOR | MSG_CMSG_COMPAT |
                               MSG_NOSIGNAL)) {
-                err = -EINVAL;
+                return -EINVAL;
-                goto out;
        }
        lock_sock(sk);
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 058f1e9a9128..903242111317 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -121,8 +121,7 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
                s32 data_size = ntohs(pdulen) - llc_len;
                if (data_size < 0 ||
-                    ((skb_tail_pointer(skb) -
+                    !pskb_may_pull(skb, data_size))
-                      (u8 *)pdu) - llc_len) < data_size)
                        return 0;
                if (unlikely(pskb_trim_rcsum(skb, data_size)))
                        return 0;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 9d192d665ff5..c5d4530d8284 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2541,7 +2541,6 @@ static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
                 * same TID from the same station
                 */
                rx->skb = skb;
-                rx->flags = 0;
                CALL_RXH(ieee80211_rx_h_decrypt)
                CALL_RXH(ieee80211_rx_h_check_more_data)
@@ -2612,6 +2611,7 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
                .sdata = sta->sdata,
                .local = sta->local,
                .queue = tid,
+                .flags = 0,
        };
        struct tid_ampdu_rx *tid_agg_rx;
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index c3f988aa1152..32bff6d86cb2 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -652,7 +652,6 @@ comment "Xtables matches"
 config NETFILTER_XT_MATCH_ADDRTYPE
        tristate '"addrtype" address type match support'
        depends on NETFILTER_ADVANCED
-        depends on (IPV6 || IPV6=n)
        ---help---
          This option allows you to match what routing thinks of an address,
          eg. UNICAST, LOCAL, BROADCAST, ...
diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c
index bca96990218d..a113ff066928 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -338,8 +338,7 @@ bitmap_ip_head(struct ip_set *set, struct sk_buff *skb)
        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
        if (map->netmask != 32)
                NLA_PUT_U8(skb, IPSET_ATTR_NETMASK, map->netmask);
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
+        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
-                      htonl(atomic_read(&set->ref) - 1));
        NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
                      htonl(sizeof(*map) + map->memsize));
        if (with_timeout(map->timeout))
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 5e790172deff..a274300b6a56 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -343,6 +343,10 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
        ipset_adtfn adtfn = set->variant->adt[adt];
        struct ipmac data;
+        /* MAC can be src only */
+        if (!(flags & IPSET_DIM_TWO_SRC))
+                return 0;
        data.id = ntohl(ip4addr(skb, flags & IPSET_DIM_ONE_SRC));
        if (data.id < map->first_ip || data.id > map->last_ip)
                return -IPSET_ERR_BITMAP_RANGE;
@@ -434,8 +438,7 @@ bitmap_ipmac_head(struct ip_set *set, struct sk_buff *skb)
                goto nla_put_failure;
        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP, htonl(map->first_ip));
        NLA_PUT_IPADDR4(skb, IPSET_ATTR_IP_TO, htonl(map->last_ip));
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
+        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
-                      htonl(atomic_read(&set->ref) - 1));
        NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
                      htonl(sizeof(*map)
                            + (map->last_ip - map->first_ip + 1) * map->dsize));
diff --git a/net/netfilter/ipset/ip_set_bitmap_port.c b/net/netfilter/ipset/ip_set_bitmap_port.c
index 165f09b1a9cb..6b38eb8f6ed8 100644
--- a/net/netfilter/ipset/ip_set_bitmap_port.c
+++ b/net/netfilter/ipset/ip_set_bitmap_port.c
@@ -320,8 +320,7 @@ bitmap_port_head(struct ip_set *set, struct sk_buff *skb)
                goto nla_put_failure;
        NLA_PUT_NET16(skb, IPSET_ATTR_PORT, htons(map->first_port));
        NLA_PUT_NET16(skb, IPSET_ATTR_PORT_TO, htons(map->last_port));
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
+        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
-                      htonl(atomic_read(&set->ref) - 1));
        NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
                      htonl(sizeof(*map) + map->memsize));
        if (with_timeout(map->timeout))
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 253326e8d990..72d1ac611fdc 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -26,6 +26,7 @@
 static LIST_HEAD(ip_set_type_list);             /* all registered set types */
 static DEFINE_MUTEX(ip_set_type_mutex);         /* protects ip_set_type_list */
+static DEFINE_RWLOCK(ip_set_ref_lock);          /* protects the set refs */
 static struct ip_set **ip_set_list;             /* all individual sets */
 static ip_set_id_t ip_set_max = CONFIG_IP_SET_MAX; /* max number of sets */
@@ -301,13 +302,18 @@ EXPORT_SYMBOL_GPL(ip_set_get_ipaddr6);
 static inline void
 __ip_set_get(ip_set_id_t index)
 {
-        atomic_inc(&ip_set_list[index]->ref);
+        write_lock_bh(&ip_set_ref_lock);
+        ip_set_list[index]->ref++;
+        write_unlock_bh(&ip_set_ref_lock);
 }
 static inline void
 __ip_set_put(ip_set_id_t index)
 {
-        atomic_dec(&ip_set_list[index]->ref);
+        write_lock_bh(&ip_set_ref_lock);
+        BUG_ON(ip_set_list[index]->ref == 0);
+        ip_set_list[index]->ref--;
+        write_unlock_bh(&ip_set_ref_lock);
 }
 /*
@@ -324,7 +330,7 @@ ip_set_test(ip_set_id_t index, const struct sk_buff *skb,
        struct ip_set *set = ip_set_list[index];
        int ret = 0;
-        BUG_ON(set == NULL || atomic_read(&set->ref) == 0);
+        BUG_ON(set == NULL);
        pr_debug("set %s, index %u\n", set->name, index);
        if (dim < set->type->dimension ||
@@ -356,7 +362,7 @@ ip_set_add(ip_set_id_t index, const struct sk_buff *skb,
        struct ip_set *set = ip_set_list[index];
        int ret;
-        BUG_ON(set == NULL || atomic_read(&set->ref) == 0);
+        BUG_ON(set == NULL);
        pr_debug("set %s, index %u\n", set->name, index);
        if (dim < set->type->dimension ||
@@ -378,7 +384,7 @@ ip_set_del(ip_set_id_t index, const struct sk_buff *skb,
        struct ip_set *set = ip_set_list[index];
        int ret = 0;
-        BUG_ON(set == NULL || atomic_read(&set->ref) == 0);
+        BUG_ON(set == NULL);
        pr_debug("set %s, index %u\n", set->name, index);
        if (dim < set->type->dimension ||
@@ -397,7 +403,6 @@ EXPORT_SYMBOL_GPL(ip_set_del);
 * Find set by name, reference it once. The reference makes sure the
 * thing pointed to, does not go away under our feet.
 *
- * The nfnl mutex must already be activated.
 */
 ip_set_id_t
 ip_set_get_byname(const char *name, struct ip_set **set)
@@ -423,15 +428,12 @@ EXPORT_SYMBOL_GPL(ip_set_get_byname);
 * reference count by 1. The caller shall not assume the index
 * to be valid, after calling this function.
 *
- * The nfnl mutex must already be activated.
 */
 void
 ip_set_put_byindex(ip_set_id_t index)
 {
-        if (ip_set_list[index] != NULL) {
+        if (ip_set_list[index] != NULL)
-                BUG_ON(atomic_read(&ip_set_list[index]->ref) == 0);
                __ip_set_put(index);
-        }
 }
 EXPORT_SYMBOL_GPL(ip_set_put_byindex);
@@ -441,7 +443,6 @@ EXPORT_SYMBOL_GPL(ip_set_put_byindex);
 * can't be destroyed. The set cannot be renamed due to
 * the referencing either.
 *
- * The nfnl mutex must already be activated.
 */
 const char *
 ip_set_name_byindex(ip_set_id_t index)
@@ -449,7 +450,7 @@ ip_set_name_byindex(ip_set_id_t index)
        const struct ip_set *set = ip_set_list[index];
        BUG_ON(set == NULL);
-        BUG_ON(atomic_read(&set->ref) == 0);
+        BUG_ON(set->ref == 0);
        /* Referenced, so it's safe */
        return set->name;
@@ -515,10 +516,7 @@ void
 ip_set_nfnl_put(ip_set_id_t index)
 {
        nfnl_lock();
-        if (ip_set_list[index] != NULL) {
+        ip_set_put_byindex(index);
-                BUG_ON(atomic_read(&ip_set_list[index]->ref) == 0);
-                __ip_set_put(index);
-        }
        nfnl_unlock();
 }
 EXPORT_SYMBOL_GPL(ip_set_nfnl_put);
@@ -526,7 +524,7 @@ EXPORT_SYMBOL_GPL(ip_set_nfnl_put);
 /*
 * Communication protocol with userspace over netlink.
 *
- * We already locked by nfnl_lock.
+ * The commands are serialized by the nfnl mutex.
 */
 static inline bool
@@ -657,7 +655,6 @@ ip_set_create(struct sock *ctnl, struct sk_buff *skb,
                return -ENOMEM;
        rwlock_init(&set->lock);
        strlcpy(set->name, name, IPSET_MAXNAMELEN);
-        atomic_set(&set->ref, 0);
        set->family = family;
        /*
@@ -690,8 +687,8 @@ ip_set_create(struct sock *ctnl, struct sk_buff *skb,
        /*
         * Here, we have a valid, constructed set and we are protected
-         * by nfnl_lock. Find the first free index in ip_set_list and
+         * by the nfnl mutex. Find the first free index in ip_set_list
-         * check clashing.
+         * and check clashing.
         */
        if ((ret = find_free_id(set->name, &index, &clash)) != 0) {
                /* If this is the same set and requested, ignore error */
@@ -751,31 +748,51 @@ ip_set_destroy(struct sock *ctnl, struct sk_buff *skb,
               const struct nlattr * const attr[])
 {
        ip_set_id_t i;
+        int ret = 0;
        if (unlikely(protocol_failed(attr)))
                return -IPSET_ERR_PROTOCOL;
-        /* References are protected by the nfnl mutex */
+        /* Commands are serialized and references are
+         * protected by the ip_set_ref_lock.
+         * External systems (i.e. xt_set) must call
+         * ip_set_put|get_nfnl_* functions, that way we
+         * can safely check references here.
+         *
+         * list:set timer can only decrement the reference
+         * counter, so if it's already zero, we can proceed
+         * without holding the lock.
+         */
+        read_lock_bh(&ip_set_ref_lock);
        if (!attr[IPSET_ATTR_SETNAME]) {
                for (i = 0; i < ip_set_max; i++) {
-                        if (ip_set_list[i] != NULL &&
+                        if (ip_set_list[i] != NULL && ip_set_list[i]->ref) {
-                            (atomic_read(&ip_set_list[i]->ref)))
+                                ret = IPSET_ERR_BUSY;
-                                return -IPSET_ERR_BUSY;
+                                goto out;
+                        }
                }
+                read_unlock_bh(&ip_set_ref_lock);
                for (i = 0; i < ip_set_max; i++) {
                        if (ip_set_list[i] != NULL)
                                ip_set_destroy_set(i);
                }
        } else {
                i = find_set_id(nla_data(attr[IPSET_ATTR_SETNAME]));
-                if (i == IPSET_INVALID_ID)
+                if (i == IPSET_INVALID_ID) {
-                        return -ENOENT;
+                        ret = -ENOENT;
-                else if (atomic_read(&ip_set_list[i]->ref))
+                        goto out;
-                        return -IPSET_ERR_BUSY;
+                } else if (ip_set_list[i]->ref) {
+                        ret = -IPSET_ERR_BUSY;
+                        goto out;
+                }
+                read_unlock_bh(&ip_set_ref_lock);
                ip_set_destroy_set(i);
        }
        return 0;
+out:
+        read_unlock_bh(&ip_set_ref_lock);
+        return ret;
 }
 /* Flush sets */
@@ -834,6 +851,7 @@ ip_set_rename(struct sock *ctnl, struct sk_buff *skb,
        struct ip_set *set;
        const char *name2;
        ip_set_id_t i;
+        int ret = 0;
        if (unlikely(protocol_failed(attr) ||
                     attr[IPSET_ATTR_SETNAME] == NULL ||
@@ -843,25 +861,33 @@ ip_set_rename(struct sock *ctnl, struct sk_buff *skb,
        set = find_set(nla_data(attr[IPSET_ATTR_SETNAME]));
        if (set == NULL)
                return -ENOENT;
-        if (atomic_read(&set->ref) != 0)
-                return -IPSET_ERR_REFERENCED;
+        read_lock_bh(&ip_set_ref_lock);
+        if (set->ref != 0) {
+                ret = -IPSET_ERR_REFERENCED;
+                goto out;
+        }
        name2 = nla_data(attr[IPSET_ATTR_SETNAME2]);
        for (i = 0; i < ip_set_max; i++) {
                if (ip_set_list[i] != NULL &&
-                    STREQ(ip_set_list[i]->name, name2))
+                    STREQ(ip_set_list[i]->name, name2)) {
-                        return -IPSET_ERR_EXIST_SETNAME2;
+                        ret = -IPSET_ERR_EXIST_SETNAME2;
+                        goto out;
+                }
        }
        strncpy(set->name, name2, IPSET_MAXNAMELEN);
-        return 0;
+out:
+        read_unlock_bh(&ip_set_ref_lock);
+        return ret;
 }
 /* Swap two sets so that name/index points to the other.
 * References and set names are also swapped.
 *
- * We are protected by the nfnl mutex and references are
+ * The commands are serialized by the nfnl mutex and references are
- * manipulated only by holding the mutex. The kernel interfaces
+ * protected by the ip_set_ref_lock. The kernel interfaces
 * do not hold the mutex but the pointer settings are atomic
 * so the ip_set_list always contains valid pointers to the sets.
 */
@@ -874,7 +900,6 @@ ip_set_swap(struct sock *ctnl, struct sk_buff *skb,
        struct ip_set *from, *to;
        ip_set_id_t from_id, to_id;
        char from_name[IPSET_MAXNAMELEN];
-        u32 from_ref;
        if (unlikely(protocol_failed(attr) ||
                     attr[IPSET_ATTR_SETNAME] == NULL ||
@@ -899,17 +924,15 @@ ip_set_swap(struct sock *ctnl, struct sk_buff *skb,
              from->type->family == to->type->family))
                return -IPSET_ERR_TYPE_MISMATCH;
-        /* No magic here: ref munging protected by the nfnl_lock */
        strncpy(from_name, from->name, IPSET_MAXNAMELEN);
-        from_ref = atomic_read(&from->ref);
        strncpy(from->name, to->name, IPSET_MAXNAMELEN);
-        atomic_set(&from->ref, atomic_read(&to->ref));
        strncpy(to->name, from_name, IPSET_MAXNAMELEN);
-        atomic_set(&to->ref, from_ref);
+        write_lock_bh(&ip_set_ref_lock);
+        swap(from->ref, to->ref);
        ip_set_list[from_id] = to;
        ip_set_list[to_id] = from;
+        write_unlock_bh(&ip_set_ref_lock);
        return 0;
 }
@@ -926,7 +949,7 @@ ip_set_dump_done(struct netlink_callback *cb)
 {
        if (cb->args[2]) {
                pr_debug("release set %s\n", ip_set_list[cb->args[1]]->name);
-                __ip_set_put((ip_set_id_t) cb->args[1]);
+                ip_set_put_byindex((ip_set_id_t) cb->args[1]);
        }
        return 0;
 }
@@ -999,8 +1022,9 @@ ip_set_dump_start(struct sk_buff *skb, struct netlink_callback *cb)
        if (cb->args[1] >= ip_set_max)
                goto out;
-        pr_debug("args[0]: %ld args[1]: %ld\n", cb->args[0], cb->args[1]);
        max = cb->args[0] == DUMP_ONE ? cb->args[1] + 1 : ip_set_max;
+dump_last:
+        pr_debug("args[0]: %ld args[1]: %ld\n", cb->args[0], cb->args[1]);
        for (; cb->args[1] < max; cb->args[1]++) {
                index = (ip_set_id_t) cb->args[1];
                set = ip_set_list[index];
@@ -1015,8 +1039,8 @@ ip_set_dump_start(struct sk_buff *skb, struct netlink_callback *cb)
                 * so that lists (unions of sets) are dumped last.
                 */
                if (cb->args[0] != DUMP_ONE &&
-                    !((cb->args[0] == DUMP_ALL) ^
+                    ((cb->args[0] == DUMP_ALL) ==
-                      (set->type->features & IPSET_DUMP_LAST)))
+                     !!(set->type->features & IPSET_DUMP_LAST)))
                        continue;
                pr_debug("List set: %s\n", set->name);
                if (!cb->args[2]) {
@@ -1060,6 +1084,12 @@ ip_set_dump_start(struct sk_buff *skb, struct netlink_callback *cb)
                        goto release_refcount;
                }
        }
+        /* If we dump all sets, continue with dumping last ones */
+        if (cb->args[0] == DUMP_ALL) {
+                cb->args[0] = DUMP_LAST;
+                cb->args[1] = 0;
+                goto dump_last;
+        }
        goto out;
 nla_put_failure:
@@ -1068,13 +1098,8 @@ release_refcount:
        /* If there was an error or set is done, release set */
        if (ret || !cb->args[2]) {
                pr_debug("release set %s\n", ip_set_list[index]->name);
-                __ip_set_put(index);
+                ip_set_put_byindex(index);
        }
-        /* If we dump all sets, continue with dumping last ones */
-        if (cb->args[0] == DUMP_ALL && cb->args[1] >= max && !cb->args[2])
-                cb->args[0] = DUMP_LAST;
 out:
        if (nlh) {
                nlmsg_end(skb, nlh);
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index a47c32982f06..e9159e99fc4b 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -43,14 +43,19 @@ struct list_set {
 static inline struct set_elem *
 list_set_elem(const struct list_set *map, u32 id)
 {
-        return (struct set_elem *)((char *)map->members + id * map->dsize);
+        return (struct set_elem *)((void *)map->members + id * map->dsize);
+}
+static inline struct set_telem *
+list_set_telem(const struct list_set *map, u32 id)
+{
+        return (struct set_telem *)((void *)map->members + id * map->dsize);
 }
 static inline bool
 list_set_timeout(const struct list_set *map, u32 id)
 {
-        const struct set_telem *elem =
+        const struct set_telem *elem = list_set_telem(map, id);
-                (const struct set_telem *) list_set_elem(map, id);
        return ip_set_timeout_test(elem->timeout);
 }
@@ -58,19 +63,11 @@ list_set_timeout(const struct list_set *map, u32 id)
 static inline bool
 list_set_expired(const struct list_set *map, u32 id)
 {
-        const struct set_telem *elem =
+        const struct set_telem *elem = list_set_telem(map, id);
-                (const struct set_telem *) list_set_elem(map, id);
        return ip_set_timeout_expired(elem->timeout);
 }
-static inline int
-list_set_exist(const struct set_telem *elem)
-{
-        return elem->id != IPSET_INVALID_ID &&
-               !ip_set_timeout_expired(elem->timeout);
-}
 /* Set list without and with timeout */
 static int
@@ -146,11 +143,11 @@ list_elem_tadd(struct list_set *map, u32 i, ip_set_id_t id,
        struct set_telem *e;
        for (; i < map->size; i++) {
-                e = (struct set_telem *)list_set_elem(map, i);
+                e = list_set_telem(map, i);
                swap(e->id, id);
+                swap(e->timeout, timeout);
                if (e->id == IPSET_INVALID_ID)
                        break;
-                swap(e->timeout, timeout);
        }
 }
@@ -164,7 +161,7 @@ list_set_add(struct list_set *map, u32 i, ip_set_id_t id,
                /* Last element replaced: e.g. add new,before,last */
                ip_set_put_byindex(e->id);
        if (with_timeout(map->timeout))
-                list_elem_tadd(map, i, id, timeout);
+                list_elem_tadd(map, i, id, ip_set_timeout_set(timeout));
        else
                list_elem_add(map, i, id);
@@ -172,11 +169,11 @@ list_set_add(struct list_set *map, u32 i, ip_set_id_t id,
 }
 static int
-list_set_del(struct list_set *map, ip_set_id_t id, u32 i)
+list_set_del(struct list_set *map, u32 i)
 {
        struct set_elem *a = list_set_elem(map, i), *b;
-        ip_set_put_byindex(id);
+        ip_set_put_byindex(a->id);
        for (; i < map->size - 1; i++) {
                b = list_set_elem(map, i + 1);
@@ -308,11 +305,11 @@ list_set_uadt(struct ip_set *set, struct nlattr *tb[],
                                 (before == 0 ||
                                  (before > 0 &&
                                   next_id_eq(map, i, refid))))
-                                ret = list_set_del(map, id, i);
+                                ret = list_set_del(map, i);
                        else if (before < 0 &&
                                 elem->id == refid &&
                                 next_id_eq(map, i, id))
-                                ret = list_set_del(map, id, i + 1);
+                                ret = list_set_del(map, i + 1);
                }
                break;
        default:
@@ -369,8 +366,7 @@ list_set_head(struct ip_set *set, struct sk_buff *skb)
        NLA_PUT_NET32(skb, IPSET_ATTR_SIZE, htonl(map->size));
        if (with_timeout(map->timeout))
                NLA_PUT_NET32(skb, IPSET_ATTR_TIMEOUT, htonl(map->timeout));
-        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES,
+        NLA_PUT_NET32(skb, IPSET_ATTR_REFERENCES, htonl(set->ref - 1));
-                      htonl(atomic_read(&set->ref) - 1));
        NLA_PUT_NET32(skb, IPSET_ATTR_MEMSIZE,
                      htonl(sizeof(*map) + map->size * map->dsize));
        ipset_nest_end(skb, nested);
@@ -461,16 +457,13 @@ list_set_gc(unsigned long ul_set)
        struct set_telem *e;
        u32 i;
-        /* We run parallel with other readers (test element)
+        write_lock_bh(&set->lock);
-         * but adding/deleting new entries is locked out */
+        for (i = 0; i < map->size; i++) {
-        read_lock_bh(&set->lock);
+                e = list_set_telem(map, i);
-        for (i = map->size - 1; i >= 0; i--) {
+                if (e->id != IPSET_INVALID_ID && list_set_expired(map, i))
-                e = (struct set_telem *) list_set_elem(map, i);
+                        list_set_del(map, i);
-                if (e->id != IPSET_INVALID_ID &&
-                    list_set_expired(map, i))
-                        list_set_del(map, e->id, i);
        }
-        read_unlock_bh(&set->lock);
+        write_unlock_bh(&set->lock);
        map->gc.expires = jiffies + IPSET_GC_PERIOD(map->timeout) * HZ;
        add_timer(&map->gc);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 33733c8872e7..ae47090bf45f 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3120,7 +3120,7 @@ nla_put_failure:
 static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
                                   struct netlink_callback *cb)
 {
-        struct net *net = skb_net(skb);
+        struct net *net = skb_sknet(skb);
        struct netns_ipvs *ipvs = net_ipvs(net);
        mutex_lock(&__ip_vs_mutex);
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index 867882313e49..bcd5ed6b7130 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -631,7 +631,7 @@ static int decode_seqof(bitstr_t *bs, const struct field_t *f,
                CHECK_BOUND(bs, 2);
                count = *bs->cur++;
                count <<= 8;
-                count = *bs->cur++;
+                count += *bs->cur++;
                break;
        case SEMI:
                BYTE_ALIGN(bs);
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 533a183e6661..18b2ce5c8ced 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -731,10 +731,10 @@ static int callforward_do_filter(const union nf_inet_addr *src,
                memset(&fl2, 0, sizeof(fl2));
                fl2.daddr = dst->ip;
-                if (!afinfo->route((struct dst_entry **)&rt1,
+                if (!afinfo->route(&init_net, (struct dst_entry **)&rt1,
-                                   flowi4_to_flowi(&fl1))) {
+                                   flowi4_to_flowi(&fl1), false)) {
-                        if (!afinfo->route((struct dst_entry **)&rt2,
+                        if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
-                                           flowi4_to_flowi(&fl2))) {
+                                           flowi4_to_flowi(&fl2), false)) {
                                if (rt1->rt_gateway == rt2->rt_gateway &&
                                    rt1->dst.dev  == rt2->dst.dev)
                                        ret = 1;
@@ -755,10 +755,10 @@ static int callforward_do_filter(const union nf_inet_addr *src,
                memset(&fl2, 0, sizeof(fl2));
                ipv6_addr_copy(&fl2.daddr, &dst->in6);
-                if (!afinfo->route((struct dst_entry **)&rt1,
+                if (!afinfo->route(&init_net, (struct dst_entry **)&rt1,
-                                   flowi6_to_flowi(&fl1))) {
+                                   flowi6_to_flowi(&fl1), false)) {
-                        if (!afinfo->route((struct dst_entry **)&rt2,
+                        if (!afinfo->route(&init_net, (struct dst_entry **)&rt2,
-                                           flowi6_to_flowi(&fl2))) {
+                                           flowi6_to_flowi(&fl2), false)) {
                                if (!memcmp(&rt1->rt6i_gateway, &rt2->rt6i_gateway,
                                            sizeof(rt1->rt6i_gateway)) &&
                                    rt1->dst.dev == rt2->dst.dev)
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 6e6b46cb1db9..9e63b43faeed 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -166,7 +166,7 @@ static u_int32_t tcpmss_reverse_mtu(const struct sk_buff *skb,
        rcu_read_lock();
        ai = nf_get_afinfo(family);
        if (ai != NULL)
-                ai->route((struct dst_entry **)&rt, &fl);
+                ai->route(&init_net, (struct dst_entry **)&rt, &fl, false);
        rcu_read_unlock();
        if (rt != NULL) {
diff --git a/net/netfilter/xt_addrtype.c b/net/netfilter/xt_addrtype.c
index 2220b85e9519..b77d383cec78 100644
--- a/net/netfilter/xt_addrtype.c
+++ b/net/netfilter/xt_addrtype.c
@@ -32,11 +32,32 @@ MODULE_ALIAS("ipt_addrtype");
 MODULE_ALIAS("ip6t_addrtype");
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
-static u32 xt_addrtype_rt6_to_type(const struct rt6_info *rt)
+static u32 match_lookup_rt6(struct net *net, const struct net_device *dev,
+                            const struct in6_addr *addr)
 {
+        const struct nf_afinfo *afinfo;
+        struct flowi6 flow;
+        struct rt6_info *rt;
        u32 ret;
+        int route_err;
-        if (!rt)
+        memset(&flow, 0, sizeof(flow));
+        ipv6_addr_copy(&flow.daddr, addr);
+        if (dev)
+                flow.flowi6_oif = dev->ifindex;
+        rcu_read_lock();
+        afinfo = nf_get_afinfo(NFPROTO_IPV6);
+        if (afinfo != NULL)
+                route_err = afinfo->route(net, (struct dst_entry **)&rt,
+                                        flowi6_to_flowi(&flow), !!dev);
+        else
+                route_err = 1;
+        rcu_read_unlock();
+        if (route_err)
                return XT_ADDRTYPE_UNREACHABLE;
        if (rt->rt6i_flags & RTF_REJECT)
@@ -48,6 +69,9 @@ static u32 xt_addrtype_rt6_to_type(const struct rt6_info *rt)
                ret |= XT_ADDRTYPE_LOCAL;
        if (rt->rt6i_flags & RTF_ANYCAST)
                ret |= XT_ADDRTYPE_ANYCAST;
+        dst_release(&rt->dst);
        return ret;
 }
@@ -65,18 +89,8 @@ static bool match_type6(struct net *net, const struct net_device *dev,
                return false;
        if ((XT_ADDRTYPE_LOCAL | XT_ADDRTYPE_ANYCAST |
-             XT_ADDRTYPE_UNREACHABLE) & mask) {
+             XT_ADDRTYPE_UNREACHABLE) & mask)
-                struct rt6_info *rt;
+                return !!(mask & match_lookup_rt6(net, dev, addr));
-                u32 type;
-                int ifindex = dev ? dev->ifindex : 0;
-                rt = rt6_lookup(net, addr, NULL, ifindex, !!dev);
-                type = xt_addrtype_rt6_to_type(rt);
-                dst_release(&rt->dst);
-                return !!(mask & type);
-        }
        return true;
 }
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 2c0086a4751e..481a86fdc409 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -195,7 +195,7 @@ conntrack_mt(const struct sk_buff *skb, struct xt_action_param *par,
                return info->match_flags & XT_CONNTRACK_STATE;
        if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
            (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
-            !!(info->invert_flags & XT_CONNTRACK_DIRECTION))
+            !(info->invert_flags & XT_CONNTRACK_DIRECTION))
                return false;
        if (info->match_flags & XT_CONNTRACK_ORIGSRC)
diff --git a/net/netfilter/xt_set.c b/net/netfilter/xt_set.c
index 061d48cec137..b3babaed7719 100644
--- a/net/netfilter/xt_set.c
+++ b/net/netfilter/xt_set.c
@@ -81,6 +81,7 @@ set_match_v0_checkentry(const struct xt_mtchk_param *par)
        if (info->match_set.u.flags[IPSET_DIM_MAX-1] != 0) {
                pr_warning("Protocol error: set match dimension "
                           "is over the limit!\n");
+                ip_set_nfnl_put(info->match_set.index);
                return -ERANGE;
        }
@@ -135,6 +136,8 @@ set_target_v0_checkentry(const struct xt_tgchk_param *par)
                if (index == IPSET_INVALID_ID) {
                        pr_warning("Cannot find del_set index %u as target\n",
                                   info->del_set.index);
+                        if (info->add_set.index != IPSET_INVALID_ID)
+                                ip_set_nfnl_put(info->add_set.index);
                        return -ENOENT;
                }
        }
@@ -142,6 +145,10 @@ set_target_v0_checkentry(const struct xt_tgchk_param *par)
            info->del_set.u.flags[IPSET_DIM_MAX-1] != 0) {
                pr_warning("Protocol error: SET target dimension "
                           "is over the limit!\n");
+                if (info->add_set.index != IPSET_INVALID_ID)
+                        ip_set_nfnl_put(info->add_set.index);
+                if (info->del_set.index != IPSET_INVALID_ID)
+                        ip_set_nfnl_put(info->del_set.index);
                return -ERANGE;
        }
@@ -192,6 +199,7 @@ set_match_checkentry(const struct xt_mtchk_param *par)
        if (info->match_set.dim > IPSET_DIM_MAX) {
                pr_warning("Protocol error: set match dimension "
                           "is over the limit!\n");
+                ip_set_nfnl_put(info->match_set.index);
                return -ERANGE;
        }
@@ -219,7 +227,7 @@ set_target(struct sk_buff *skb, const struct xt_action_param *par)
        if (info->del_set.index != IPSET_INVALID_ID)
                ip_set_del(info->del_set.index,
                           skb, par->family,
-                           info->add_set.dim,
+                           info->del_set.dim,
                           info->del_set.flags);
        return XT_CONTINUE;
@@ -245,13 +253,19 @@ set_target_checkentry(const struct xt_tgchk_param *par)
                if (index == IPSET_INVALID_ID) {
                        pr_warning("Cannot find del_set index %u as target\n",
                                   info->del_set.index);
+                        if (info->add_set.index != IPSET_INVALID_ID)
+                                ip_set_nfnl_put(info->add_set.index);
                        return -ENOENT;
                }
        }
        if (info->add_set.dim > IPSET_DIM_MAX ||
-            info->del_set.flags > IPSET_DIM_MAX) {
+            info->del_set.dim > IPSET_DIM_MAX) {
                pr_warning("Protocol error: SET target dimension "
                           "is over the limit!\n");
+                if (info->add_set.index != IPSET_INVALID_ID)
+                        ip_set_nfnl_put(info->add_set.index);
+                if (info->del_set.index != IPSET_INVALID_ID)
+                        ip_set_nfnl_put(info->del_set.index);
                return -ERANGE;
        }
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 0698cad61763..1a21c571aa03 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -569,6 +569,8 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,
                sctp_assoc_set_primary(asoc, transport);
        if (asoc->peer.active_path == peer)
                asoc->peer.active_path = transport;
+        if (asoc->peer.retran_path == peer)
+                asoc->peer.retran_path = transport;
        if (asoc->peer.last_data_from == peer)
                asoc->peer.last_data_from = transport;
@@ -1323,6 +1325,8 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
        if (t)
                asoc->peer.retran_path = t;
+        else
+                t = asoc->peer.retran_path;
        SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_update_retran_path:association"
                                 " %p addr: ",
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 9022f0a6503e..0a9a2ec2e469 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -427,7 +427,7 @@ static int
 context_derive_keys_rc4(struct krb5_ctx *ctx)
 {
        struct crypto_hash *hmac;
-        static const char sigkeyconstant[] = "signaturekey";
+        char sigkeyconstant[] = "signaturekey";
        int slen = strlen(sigkeyconstant) + 1;  /* include null terminator */
        struct hash_desc desc;
        struct scatterlist sg[1];