31 files changed, 396 insertions, 183 deletions

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index ca04163635da..e6b7fecb3af1 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -64,7 +64,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
                         br_flood_deliver(br, skb, false);
                         goto out;
                 }
-                if (br_multicast_rcv(br, NULL, skb)) {
+                if (br_multicast_rcv(br, NULL, skb, vid)) {
                         kfree_skb(skb);
                         goto out;
                 }
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index a2fd37ec35f7..7e73c32e205d 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -80,7 +80,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
                 br_fdb_update(br, p, eth_hdr(skb)->h_source, vid);
 
         if (!is_broadcast_ether_addr(dest) && is_multicast_ether_addr(dest) &&
-            br_multicast_rcv(br, p, skb))
+            br_multicast_rcv(br, p, skb, vid))
                 goto drop;
 
         if (p->state == BR_STATE_LEARNING)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 8b0b610ca2c9..686284ff3d6a 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -947,7 +947,8 @@ void br_multicast_disable_port(struct net_bridge_port *port)
 
 static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
                                          struct net_bridge_port *port,
-                                         struct sk_buff *skb)
+                                         struct sk_buff *skb,
+                                         u16 vid)
 {
         struct igmpv3_report *ih;
         struct igmpv3_grec *grec;
@@ -957,12 +958,10 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
         int type;
         int err = 0;
         __be32 group;
-        u16 vid = 0;
 
         if (!pskb_may_pull(skb, sizeof(*ih)))
                 return -EINVAL;
 
-        br_vlan_get_tag(skb, &vid);
         ih = igmpv3_report_hdr(skb);
         num = ntohs(ih->ngrec);
         len = sizeof(*ih);
@@ -1005,7 +1004,8 @@ static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
 #if IS_ENABLED(CONFIG_IPV6)
 static int br_ip6_multicast_mld2_report(struct net_bridge *br,
                                         struct net_bridge_port *port,
-                                        struct sk_buff *skb)
+                                        struct sk_buff *skb,
+                                        u16 vid)
 {
         struct icmp6hdr *icmp6h;
         struct mld2_grec *grec;
@@ -1013,12 +1013,10 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
         int len;
         int num;
         int err = 0;
-        u16 vid = 0;
 
         if (!pskb_may_pull(skb, sizeof(*icmp6h)))
                 return -EINVAL;
 
-        br_vlan_get_tag(skb, &vid);
         icmp6h = icmp6_hdr(skb);
         num = ntohs(icmp6h->icmp6_dataun.un_data16[1]);
         len = sizeof(*icmp6h);
@@ -1141,7 +1139,8 @@ static void br_multicast_query_received(struct net_bridge *br,
 
 static int br_ip4_multicast_query(struct net_bridge *br,
                                   struct net_bridge_port *port,
-                                  struct sk_buff *skb)
+                                  struct sk_buff *skb,
+                                  u16 vid)
 {
         const struct iphdr *iph = ip_hdr(skb);
         struct igmphdr *ih = igmp_hdr(skb);
@@ -1153,7 +1152,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
         unsigned long now = jiffies;
         __be32 group;
         int err = 0;
-        u16 vid = 0;
 
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev) ||
@@ -1189,7 +1187,6 @@ static int br_ip4_multicast_query(struct net_bridge *br,
         if (!group)
                 goto out;
 
-        br_vlan_get_tag(skb, &vid);
         mp = br_mdb_ip4_get(mlock_dereference(br->mdb, br), group, vid);
         if (!mp)
                 goto out;
@@ -1219,7 +1216,8 @@ out:
 #if IS_ENABLED(CONFIG_IPV6)
 static int br_ip6_multicast_query(struct net_bridge *br,
                                   struct net_bridge_port *port,
-                                  struct sk_buff *skb)
+                                  struct sk_buff *skb,
+                                  u16 vid)
 {
         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
         struct mld_msg *mld;
@@ -1231,7 +1229,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         unsigned long now = jiffies;
         const struct in6_addr *group = NULL;
         int err = 0;
-        u16 vid = 0;
 
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev) ||
@@ -1265,7 +1262,6 @@ static int br_ip6_multicast_query(struct net_bridge *br,
         if (!group)
                 goto out;
 
-        br_vlan_get_tag(skb, &vid);
         mp = br_mdb_ip6_get(mlock_dereference(br->mdb, br), group, vid);
         if (!mp)
                 goto out;
@@ -1439,7 +1435,8 @@ static void br_ip6_multicast_leave_group(struct net_bridge *br,
 
 static int br_multicast_ipv4_rcv(struct net_bridge *br,
                                  struct net_bridge_port *port,
-                                 struct sk_buff *skb)
+                                 struct sk_buff *skb,
+                                 u16 vid)
 {
         struct sk_buff *skb2 = skb;
         const struct iphdr *iph;
@@ -1447,7 +1444,6 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
         unsigned int len;
         unsigned int offset;
         int err;
-        u16 vid = 0;
 
         /* We treat OOM as packet loss for now. */
         if (!pskb_may_pull(skb, sizeof(*iph)))
@@ -1508,7 +1504,6 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
 
         err = 0;
 
-        br_vlan_get_tag(skb2, &vid);
         BR_INPUT_SKB_CB(skb)->igmp = 1;
         ih = igmp_hdr(skb2);
 
@@ -1519,10 +1514,10 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
                 err = br_ip4_multicast_add_group(br, port, ih->group, vid);
                 break;
         case IGMPV3_HOST_MEMBERSHIP_REPORT:
-                err = br_ip4_multicast_igmp3_report(br, port, skb2);
+                err = br_ip4_multicast_igmp3_report(br, port, skb2, vid);
                 break;
         case IGMP_HOST_MEMBERSHIP_QUERY:
-                err = br_ip4_multicast_query(br, port, skb2);
+                err = br_ip4_multicast_query(br, port, skb2, vid);
                 break;
         case IGMP_HOST_LEAVE_MESSAGE:
                 br_ip4_multicast_leave_group(br, port, ih->group, vid);
@@ -1540,7 +1535,8 @@ err_out:
 #if IS_ENABLED(CONFIG_IPV6)
 static int br_multicast_ipv6_rcv(struct net_bridge *br,
                                  struct net_bridge_port *port,
-                                 struct sk_buff *skb)
+                                 struct sk_buff *skb,
+                                 u16 vid)
 {
         struct sk_buff *skb2;
         const struct ipv6hdr *ip6h;
@@ -1550,7 +1546,6 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
         unsigned int len;
         int offset;
         int err;
-        u16 vid = 0;
 
         if (!pskb_may_pull(skb, sizeof(*ip6h)))
                 return -EINVAL;
@@ -1640,7 +1635,6 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
 
         err = 0;
 
-        br_vlan_get_tag(skb, &vid);
         BR_INPUT_SKB_CB(skb)->igmp = 1;
 
         switch (icmp6_type) {
@@ -1657,10 +1651,10 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                 break;
             }
         case ICMPV6_MLD2_REPORT:
-                err = br_ip6_multicast_mld2_report(br, port, skb2);
+                err = br_ip6_multicast_mld2_report(br, port, skb2, vid);
                 break;
         case ICMPV6_MGM_QUERY:
-                err = br_ip6_multicast_query(br, port, skb2);
+                err = br_ip6_multicast_query(br, port, skb2, vid);
                 break;
         case ICMPV6_MGM_REDUCTION:
             {
@@ -1681,7 +1675,7 @@ out:
 #endif
 
 int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
-                     struct sk_buff *skb)
+                     struct sk_buff *skb, u16 vid)
 {
         BR_INPUT_SKB_CB(skb)->igmp = 0;
         BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
@@ -1691,10 +1685,10 @@ int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
 
         switch (skb->protocol) {
         case htons(ETH_P_IP):
-                return br_multicast_ipv4_rcv(br, port, skb);
+                return br_multicast_ipv4_rcv(br, port, skb, vid);
 #if IS_ENABLED(CONFIG_IPV6)
         case htons(ETH_P_IPV6):
-                return br_multicast_ipv6_rcv(br, port, skb);
+                return br_multicast_ipv6_rcv(br, port, skb, vid);
 #endif
         }
 
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index e14c33b42f75..2e8244efb262 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -451,7 +451,8 @@ extern int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __us
 extern unsigned int br_mdb_rehash_seq;
 extern int br_multicast_rcv(struct net_bridge *br,
                             struct net_bridge_port *port,
-                            struct sk_buff *skb);
+                            struct sk_buff *skb,
+                            u16 vid);
 extern struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
                                                struct sk_buff *skb, u16 vid);
 extern void br_multicast_add_port(struct net_bridge_port *port);
@@ -522,7 +523,8 @@ static inline bool br_multicast_querier_exists(struct net_bridge *br,
 #else
 static inline int br_multicast_rcv(struct net_bridge *br,
                                    struct net_bridge_port *port,
-                                   struct sk_buff *skb)
+                                   struct sk_buff *skb,
+                                   u16 vid)
 {
         return 0;
 }
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 518093802d1d..7c470c371e14 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -181,6 +181,7 @@ static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
         ub->qlen++;
 
         pm = nlmsg_data(nlh);
+        memset(pm, 0, sizeof(*pm));
 
         /* Fill in the ulog data */
         pm->version = EBT_ULOG_VERSION;
@@ -193,8 +194,6 @@ static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
         pm->hook = hooknr;
         if (uloginfo->prefix != NULL)
                 strcpy(pm->prefix, uloginfo->prefix);
-        else
-                *(pm->prefix) = '\0';
 
         if (in) {
                 strcpy(pm->physindev, in->name);
@@ -204,16 +203,14 @@ static void ebt_ulog_packet(struct net *net, unsigned int hooknr,
                         strcpy(pm->indev, br_port_get_rcu(in)->br->dev->name);
                 else
                         strcpy(pm->indev, in->name);
-        } else
-                pm->indev[0] = pm->physindev[0] = '\0';
+        }
 
         if (out) {
                 /* If out exists, then out is a bridge port */
                 strcpy(pm->physoutdev, out->name);
                 /* rcu_read_lock()ed by nf_hook_slow */
                 strcpy(pm->outdev, br_port_get_rcu(out)->br->dev->name);
-        } else
-                pm->outdev[0] = pm->physoutdev[0] = '\0';
+        }
 
         if (skb_copy_bits(skb, -ETH_HLEN, pm->data, copy_len) < 0)
                 BUG();
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 8d7d0dd72db2..143b6fdb9647 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -40,7 +40,7 @@ again:
                 struct iphdr _iph;
 ip:
                 iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
-                if (!iph)
+                if (!iph || iph->ihl < 5)
                         return false;
 
                 if (ip_is_fragment(iph))
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index d954b56b4e47..325dee863e46 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -1344,17 +1344,19 @@ int netdev_register_kobject(struct net_device *net)
         return error;
 }
 
-int netdev_class_create_file(struct class_attribute *class_attr)
+int netdev_class_create_file_ns(struct class_attribute *class_attr,
+                                const void *ns)
 {
-        return class_create_file(&net_class, class_attr);
+        return class_create_file_ns(&net_class, class_attr, ns);
 }
-EXPORT_SYMBOL(netdev_class_create_file);
+EXPORT_SYMBOL(netdev_class_create_file_ns);
 
-void netdev_class_remove_file(struct class_attribute *class_attr)
+void netdev_class_remove_file_ns(struct class_attribute *class_attr,
+                                 const void *ns)
 {
-        class_remove_file(&net_class, class_attr);
+        class_remove_file_ns(&net_class, class_attr, ns);
 }
-EXPORT_SYMBOL(netdev_class_remove_file);
+EXPORT_SYMBOL(netdev_class_remove_file_ns);
 
 int netdev_kobject_init(void)
 {
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index fc75c9e461b8..8f971990677c 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -636,8 +636,9 @@ static void netpoll_neigh_reply(struct sk_buff *skb, struct netpoll_info *npinfo
 
                         netpoll_send_skb(np, send_skb);
 
-                        /* If there are several rx_hooks for the same address,
-                           we're fine by sending a single reply */
+                        /* If there are several rx_skb_hooks for the same
+                         * address we're fine by sending a single reply
+                         */
                         break;
                 }
                 spin_unlock_irqrestore(&npinfo->rx_lock, flags);
@@ -719,8 +720,9 @@ static void netpoll_neigh_reply(struct sk_buff *skb, struct netpoll_info *npinfo
 
                         netpoll_send_skb(np, send_skb);
 
-                        /* If there are several rx_hooks for the same address,
-                           we're fine by sending a single reply */
+                        /* If there are several rx_skb_hooks for the same
+                         * address, we're fine by sending a single reply
+                         */
                         break;
                 }
                 spin_unlock_irqrestore(&npinfo->rx_lock, flags);
@@ -756,11 +758,12 @@ static bool pkt_is_ns(struct sk_buff *skb)
 
 int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
 {
-        int proto, len, ulen;
-        int hits = 0;
+        int proto, len, ulen, data_len;
+        int hits = 0, offset;
         const struct iphdr *iph;
         struct udphdr *uh;
         struct netpoll *np, *tmp;
+        uint16_t source;
 
         if (list_empty(&npinfo->rx_np))
                 goto out;
@@ -820,7 +823,10 @@ int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
 
                 len -= iph->ihl*4;
                 uh = (struct udphdr *)(((char *)iph) + iph->ihl*4);
+                offset = (unsigned char *)(uh + 1) - skb->data;
                 ulen = ntohs(uh->len);
+                data_len = skb->len - offset;
+                source = ntohs(uh->source);
 
                 if (ulen != len)
                         goto out;
@@ -834,9 +840,7 @@ int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
                         if (np->local_port && np->local_port != ntohs(uh->dest))
                                 continue;
 
-                        np->rx_hook(np, ntohs(uh->source),
-                                       (char *)(uh+1),
-                                       ulen - sizeof(struct udphdr));
+                        np->rx_skb_hook(np, source, skb, offset, data_len);
                         hits++;
                 }
         } else {
@@ -859,7 +863,10 @@ int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
                 if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                         goto out;
                 uh = udp_hdr(skb);
+                offset = (unsigned char *)(uh + 1) - skb->data;
                 ulen = ntohs(uh->len);
+                data_len = skb->len - offset;
+                source = ntohs(uh->source);
                 if (ulen != skb->len)
                         goto out;
                 if (udp6_csum_init(skb, uh, IPPROTO_UDP))
@@ -872,9 +879,7 @@ int __netpoll_rx(struct sk_buff *skb, struct netpoll_info *npinfo)
                         if (np->local_port && np->local_port != ntohs(uh->dest))
                                 continue;
 
-                        np->rx_hook(np, ntohs(uh->source),
-                                       (char *)(uh+1),
-                                       ulen - sizeof(struct udphdr));
+                        np->rx_skb_hook(np, source, skb, offset, data_len);
                         hits++;
                 }
 #endif
@@ -1062,7 +1067,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev, gfp_t gfp)
 
         npinfo->netpoll = np;
 
-        if (np->rx_hook) {
+        if (np->rx_skb_hook) {
                 spin_lock_irqsave(&npinfo->rx_lock, flags);
                 npinfo->rx_flags |= NETPOLL_RX_ENABLED;
                 list_add_tail(&np->rx, &npinfo->rx_np);
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 85a4f21aac1a..59da7cde0724 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -271,6 +271,11 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         local_bh_disable();
         addend = xt_write_recseq_begin();
         private = table->private;
+        /*
+         * Ensure we load private-> members after we've fetched the base
+         * pointer.
+         */
+        smp_read_barrier_depends();
         table_base = private->entries[smp_processor_id()];
 
         e = get_entry(table_base, private->hook_entry[hook]);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index d23118d95ff9..718dfbd30cbe 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -327,6 +327,11 @@ ipt_do_table(struct sk_buff *skb,
         addend = xt_write_recseq_begin();
         private = table->private;
         cpu        = smp_processor_id();
+        /*
+         * Ensure we load private-> members after we've fetched the base
+         * pointer.
+         */
+        smp_read_barrier_depends();
         table_base = private->entries[cpu];
         jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
         stackptr   = per_cpu_ptr(private->stackptr, cpu);
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index cbc22158af49..9cb993cd224b 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -220,6 +220,7 @@ static void ipt_ulog_packet(struct net *net,
         ub->qlen++;
 
         pm = nlmsg_data(nlh);
+        memset(pm, 0, sizeof(*pm));
 
         /* We might not have a timestamp, get one */
         if (skb->tstamp.tv64 == 0)
@@ -238,8 +239,6 @@ static void ipt_ulog_packet(struct net *net,
         }
         else if (loginfo->prefix[0] != '\0')
                 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
-        else
-                *(pm->prefix) = '\0';
 
         if (in && in->hard_header_len > 0 &&
             skb->mac_header != skb->network_header &&
@@ -251,13 +250,9 @@ static void ipt_ulog_packet(struct net *net,
 
         if (in)
                 strncpy(pm->indev_name, in->name, sizeof(pm->indev_name));
-        else
-                pm->indev_name[0] = '\0';
 
         if (out)
                 strncpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));
-        else
-                pm->outdev_name[0] = '\0';
 
         /* copy_len <= skb->len, so can't fail. */
         if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a16b01b537ba..068c8fb0d158 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2856,7 +2856,8 @@ static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
          * left edge of the send window.
          * See draft-ietf-tcplw-high-performance-00, section 3.3.
          */
-        if (seq_rtt < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
+        if (seq_rtt < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
+            flag & FLAG_ACKED)
                 seq_rtt = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
 
         if (seq_rtt < 0)
@@ -2871,14 +2872,19 @@ static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
 }
 
 /* Compute time elapsed between (last) SYNACK and the ACK completing 3WHS. */
-static void tcp_synack_rtt_meas(struct sock *sk, struct request_sock *req)
+static void tcp_synack_rtt_meas(struct sock *sk, const u32 synack_stamp)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         s32 seq_rtt = -1;
 
-        if (tp->lsndtime && !tp->total_retrans)
-                seq_rtt = tcp_time_stamp - tp->lsndtime;
-        tcp_ack_update_rtt(sk, FLAG_SYN_ACKED, seq_rtt, -1);
+        if (synack_stamp && !tp->total_retrans)
+                seq_rtt = tcp_time_stamp - synack_stamp;
+
+        /* If the ACK acks both the SYNACK and the (Fast Open'd) data packets
+         * sent in SYN_RECV, SYNACK RTT is the smooth RTT computed in tcp_ack()
+         */
+        if (!tp->srtt)
+                tcp_ack_update_rtt(sk, FLAG_SYN_ACKED, seq_rtt, -1);
 }
 
 static void tcp_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
@@ -2981,6 +2987,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
         s32 seq_rtt = -1;
         s32 ca_seq_rtt = -1;
         ktime_t last_ackt = net_invalid_timestamp();
+        bool rtt_update;
 
         while ((skb = tcp_write_queue_head(sk)) && skb != tcp_send_head(sk)) {
                 struct tcp_skb_cb *scb = TCP_SKB_CB(skb);
@@ -3057,14 +3064,13 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
         if (skb && (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
                 flag |= FLAG_SACK_RENEGING;
 
-        if (tcp_ack_update_rtt(sk, flag, seq_rtt, sack_rtt) ||
-            (flag & FLAG_ACKED))
-                tcp_rearm_rto(sk);
+        rtt_update = tcp_ack_update_rtt(sk, flag, seq_rtt, sack_rtt);
 
         if (flag & FLAG_ACKED) {
                 const struct tcp_congestion_ops *ca_ops
                         = inet_csk(sk)->icsk_ca_ops;
 
+                tcp_rearm_rto(sk);
                 if (unlikely(icsk->icsk_mtup.probe_size &&
                              !after(tp->mtu_probe.probe_seq_end, tp->snd_una))) {
                         tcp_mtup_probe_success(sk);
@@ -3103,6 +3109,13 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
 
                         ca_ops->pkts_acked(sk, pkts_acked, rtt_us);
                 }
+        } else if (skb && rtt_update && sack_rtt >= 0 &&
+                   sack_rtt > (s32)(now - TCP_SKB_CB(skb)->when)) {
+                /* Do not re-arm RTO if the sack RTT is measured from data sent
+                 * after when the head was last (re)transmitted. Otherwise the
+                 * timeout may continue to extend in loss recovery.
+                 */
+                tcp_rearm_rto(sk);
         }
 
 #if FASTRETRANS_DEBUG > 0
@@ -5587,6 +5600,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
         struct request_sock *req;
         int queued = 0;
         bool acceptable;
+        u32 synack_stamp;
 
         tp->rx_opt.saw_tstamp = 0;
 
@@ -5669,9 +5683,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                  * so release it.
                  */
                 if (req) {
+                        synack_stamp = tcp_rsk(req)->snt_synack;
                         tp->total_retrans = req->num_retrans;
                         reqsk_fastopen_remove(sk, req, false);
                 } else {
+                        synack_stamp = tp->lsndtime;
                         /* Make sure socket is routed, for correct metrics. */
                         icsk->icsk_af_ops->rebuild_header(sk);
                         tcp_init_congestion_control(sk);
@@ -5694,7 +5710,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                 tp->snd_una = TCP_SKB_CB(skb)->ack_seq;
                 tp->snd_wnd = ntohs(th->window) << tp->rx_opt.snd_wscale;
                 tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
-                tcp_synack_rtt_meas(sk, req);
+                tcp_synack_rtt_meas(sk, synack_stamp);
 
                 if (tp->rx_opt.tstamp_ok)
                         tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index 3a7525e6c086..533c58a5cfb7 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -18,6 +18,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
                                 netdev_features_t features)
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
+        unsigned int sum_truesize = 0;
         struct tcphdr *th;
         unsigned int thlen;
         unsigned int seq;
@@ -102,13 +103,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
                 if (copy_destructor) {
                         skb->destructor = gso_skb->destructor;
                         skb->sk = gso_skb->sk;
-                        /* {tcp|sock}_wfree() use exact truesize accounting :
-                         * sum(skb->truesize) MUST be exactly be gso_skb->truesize
-                         * So we account mss bytes of 'true size' for each segment.
-                         * The last segment will contain the remaining.
-                         */
-                        skb->truesize = mss;
-                        gso_skb->truesize -= mss;
+                        sum_truesize += skb->truesize;
                 }
                 skb = skb->next;
                 th = tcp_hdr(skb);
@@ -125,7 +120,9 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
         if (copy_destructor) {
                 swap(gso_skb->sk, skb->sk);
                 swap(gso_skb->destructor, skb->destructor);
-                swap(gso_skb->truesize, skb->truesize);
+                sum_truesize += skb->truesize;
+                atomic_add(sum_truesize - gso_skb->truesize,
+                           &skb->sk->sk_wmem_alloc);
         }
 
         delta = htonl(oldlen + (skb_tail_pointer(skb) -
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index ccde54248c8c..e1a63930a967 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -104,10 +104,14 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
         const struct iphdr *iph = ip_hdr(skb);
         u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
         struct flowi4 *fl4 = &fl->u.ip4;
+        int oif = 0;
+
+        if (skb_dst(skb))
+                oif = skb_dst(skb)->dev->ifindex;
 
         memset(fl4, 0, sizeof(struct flowi4));
         fl4->flowi4_mark = skb->mark;
-        fl4->flowi4_oif = skb_dst(skb)->dev->ifindex;
+        fl4->flowi4_oif = reverse ? skb->skb_iif : oif;
 
         if (!ip_is_fragment(iph)) {
                 switch (iph->protocol) {
@@ -236,7 +240,7 @@ static struct dst_ops xfrm4_dst_ops = {
         .destroy =              xfrm4_dst_destroy,
         .ifdown =               xfrm4_dst_ifdown,
         .local_out =            __ip_local_out,
-        .gc_thresh =            1024,
+        .gc_thresh =            32768,
 };
 
 static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 44400c216dc6..710238f58aa9 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -349,6 +349,11 @@ ip6t_do_table(struct sk_buff *skb,
         local_bh_disable();
         addend = xt_write_recseq_begin();
         private = table->private;
+        /*
+         * Ensure we load private-> members after we've fetched the base
+         * pointer.
+         */
+        smp_read_barrier_depends();
         cpu        = smp_processor_id();
         table_base = private->entries[cpu];
         jumpstack  = (struct ip6t_entry **)private->jumpstack[cpu];
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f54e3a101098..04e17b3309fb 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1087,10 +1087,13 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
         if (rt->rt6i_genid != rt_genid_ipv6(dev_net(rt->dst.dev)))
                 return NULL;
 
-        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
-                return dst;
+        if (!rt->rt6i_node || (rt->rt6i_node->fn_sernum != cookie))
+                return NULL;
 
-        return NULL;
+        if (rt6_check_expired(rt))
+                return NULL;
+
+        return dst;
 }
 
 static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 08ed2772b7aa..5f8e128c512d 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -135,10 +135,14 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
         struct ipv6_opt_hdr *exthdr;
         const unsigned char *nh = skb_network_header(skb);
         u8 nexthdr = nh[IP6CB(skb)->nhoff];
+        int oif = 0;
+
+        if (skb_dst(skb))
+                oif = skb_dst(skb)->dev->ifindex;
 
         memset(fl6, 0, sizeof(struct flowi6));
         fl6->flowi6_mark = skb->mark;
-        fl6->flowi6_oif = skb_dst(skb)->dev->ifindex;
+        fl6->flowi6_oif = reverse ? skb->skb_iif : oif;
 
         fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
         fl6->saddr = reverse ? hdr->daddr : hdr->saddr;
@@ -285,7 +289,7 @@ static struct dst_ops xfrm6_dst_ops = {
         .destroy =              xfrm6_dst_destroy,
         .ifdown =               xfrm6_dst_ifdown,
         .local_out =            __ip6_local_out,
-        .gc_thresh =            1024,
+        .gc_thresh =            32768,
 };
 
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 8b03028cca69..227aa11e8409 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -845,8 +845,13 @@ xt_replace_table(struct xt_table *table,
                 return NULL;
         }
 
-        table->private = newinfo;
         newinfo->initial_entries = private->initial_entries;
+        /*
+         * Ensure contents of newinfo are visible before assigning to
+         * private.
+         */
+        smp_wmb();
+        table->private = newinfo;
 
         /*
          * Even though table entries have now been swapped, other CPU's
diff --git a/net/netfilter/xt_NFQUEUE.c b/net/netfilter/xt_NFQUEUE.c
index 1e2fae32f81b..ed00fef58996 100644
--- a/net/netfilter/xt_NFQUEUE.c
+++ b/net/netfilter/xt_NFQUEUE.c
@@ -147,6 +147,7 @@ nfqueue_tg_v3(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct xt_NFQ_info_v3 *info = par->targinfo;
         u32 queue = info->queuenum;
+        int ret;
 
         if (info->queues_total > 1) {
                 if (info->flags & NFQ_FLAG_CPU_FANOUT) {
@@ -157,7 +158,11 @@ nfqueue_tg_v3(struct sk_buff *skb, const struct xt_action_param *par)
                         queue = nfqueue_hash(skb, par);
         }
 
-        return NF_QUEUE_NR(queue);
+        ret = NF_QUEUE_NR(queue);
+        if (info->flags & NFQ_FLAG_BYPASS)
+                ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;
+
+        return ret;
 }
 
 static struct xt_target nfqueue_tg_reg[] __read_mostly = {
diff --git a/net/openvswitch/dp_notify.c b/net/openvswitch/dp_notify.c
index c3235675f359..5c2dab276109 100644
--- a/net/openvswitch/dp_notify.c
+++ b/net/openvswitch/dp_notify.c
@@ -65,8 +65,7 @@ void ovs_dp_notify_wq(struct work_struct *work)
                                         continue;
 
                                 netdev_vport = netdev_vport_priv(vport);
-                                if (netdev_vport->dev->reg_state == NETREG_UNREGISTERED ||
-                                    netdev_vport->dev->reg_state == NETREG_UNREGISTERING)
+                                if (!(netdev_vport->dev->priv_flags & IFF_OVS_DATAPATH))
                                         dp_detach_port_notify(vport);
                         }
                 }
@@ -88,6 +87,10 @@ static int dp_device_event(struct notifier_block *unused, unsigned long event,
                 return NOTIFY_DONE;
 
         if (event == NETDEV_UNREGISTER) {
+                /* upper_dev_unlink and decrement promisc immediately */
+                ovs_netdev_detach_dev(vport);
+
+                /* schedule vport destroy, dev_put and genl notification */
                 ovs_net = net_generic(dev_net(dev), ovs_net_id);
                 queue_work(system_wq, &ovs_net->dp_notify_work);
         }
diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c
index 09d93c13cfd6..d21f77d875ba 100644
--- a/net/openvswitch/vport-netdev.c
+++ b/net/openvswitch/vport-netdev.c
@@ -150,15 +150,25 @@ static void free_port_rcu(struct rcu_head *rcu)
         ovs_vport_free(vport_from_priv(netdev_vport));
 }
 
-static void netdev_destroy(struct vport *vport)
+void ovs_netdev_detach_dev(struct vport *vport)
 {
         struct netdev_vport *netdev_vport = netdev_vport_priv(vport);
 
-        rtnl_lock();
+        ASSERT_RTNL();
         netdev_vport->dev->priv_flags &= ~IFF_OVS_DATAPATH;
         netdev_rx_handler_unregister(netdev_vport->dev);
-        netdev_upper_dev_unlink(netdev_vport->dev, get_dpdev(vport->dp));
+        netdev_upper_dev_unlink(netdev_vport->dev,
+                                netdev_master_upper_dev_get(netdev_vport->dev));
         dev_set_promiscuity(netdev_vport->dev, -1);
+}
+
+static void netdev_destroy(struct vport *vport)
+{
+        struct netdev_vport *netdev_vport = netdev_vport_priv(vport);
+
+        rtnl_lock();
+        if (netdev_vport->dev->priv_flags & IFF_OVS_DATAPATH)
+                ovs_netdev_detach_dev(vport);
         rtnl_unlock();
 
         call_rcu(&netdev_vport->rcu, free_port_rcu);
diff --git a/net/openvswitch/vport-netdev.h b/net/openvswitch/vport-netdev.h
index dd298b5c5cdb..8df01c1127e5 100644
--- a/net/openvswitch/vport-netdev.h
+++ b/net/openvswitch/vport-netdev.h
@@ -39,5 +39,6 @@ netdev_vport_priv(const struct vport *vport)
 }
 
 const char *ovs_netdev_get_name(const struct vport *);
+void ovs_netdev_detach_dev(struct vport *);
 
 #endif /* vport_netdev.h */
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
index a9dfdda9ed1d..fdc041c57853 100644
--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -255,6 +255,7 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q)
                                      f->socket_hash != sk->sk_hash)) {
                                 f->credit = q->initial_quantum;
                                 f->socket_hash = sk->sk_hash;
+                                f->time_next_packet = 0ULL;
                         }
                         return f;
                 }
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index e7b2d4fe2b6a..96a55910262c 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -279,7 +279,9 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
                 sctp_v6_to_addr(&dst_saddr, &fl6->saddr, htons(bp->port));
                 rcu_read_lock();
                 list_for_each_entry_rcu(laddr, &bp->address_list, list) {
-                        if (!laddr->valid || (laddr->state != SCTP_ADDR_SRC))
+                        if (!laddr->valid || laddr->state == SCTP_ADDR_DEL ||
+                            (laddr->state != SCTP_ADDR_SRC &&
+                             !asoc->src_out_of_asoc_ok))
                                 continue;
 
                         /* Do not compare against v4 addrs */
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 666c66842799..1a6eef39ab2f 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -860,7 +860,6 @@ static void sctp_cmd_delete_tcb(sctp_cmd_seq_t *cmds,
             (!asoc->temp) && (sk->sk_shutdown != SHUTDOWN_MASK))
                 return;
 
-        BUG_ON(asoc->peer.primary_path == NULL);
         sctp_unhash_established(asoc);
         sctp_association_free(asoc);
 }
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 084656671d6e..97912b40c254 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -420,41 +420,53 @@ static void gss_encode_v0_msg(struct gss_upcall_msg *gss_msg)
         memcpy(gss_msg->databuf, &uid, sizeof(uid));
         gss_msg->msg.data = gss_msg->databuf;
         gss_msg->msg.len = sizeof(uid);
-        BUG_ON(sizeof(uid) > UPCALL_BUF_LEN);
+
+        BUILD_BUG_ON(sizeof(uid) > sizeof(gss_msg->databuf));
 }
 
-static void gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
+static int gss_encode_v1_msg(struct gss_upcall_msg *gss_msg,
                                 const char *service_name,
                                 const char *target_name)
 {
         struct gss_api_mech *mech = gss_msg->auth->mech;
         char *p = gss_msg->databuf;
-        int len = 0;
-
-        gss_msg->msg.len = sprintf(gss_msg->databuf, "mech=%s uid=%d ",
-                                   mech->gm_name,
-                                   from_kuid(&init_user_ns, gss_msg->uid));
-        p += gss_msg->msg.len;
+        size_t buflen = sizeof(gss_msg->databuf);
+        int len;
+
+        len = scnprintf(p, buflen, "mech=%s uid=%d ", mech->gm_name,
+                        from_kuid(&init_user_ns, gss_msg->uid));
+        buflen -= len;
+        p += len;
+        gss_msg->msg.len = len;
         if (target_name) {
-                len = sprintf(p, "target=%s ", target_name);
+                len = scnprintf(p, buflen, "target=%s ", target_name);
+                buflen -= len;
                 p += len;
                 gss_msg->msg.len += len;
         }
         if (service_name != NULL) {
-                len = sprintf(p, "service=%s ", service_name);
+                len = scnprintf(p, buflen, "service=%s ", service_name);
+                buflen -= len;
                 p += len;
                 gss_msg->msg.len += len;
         }
         if (mech->gm_upcall_enctypes) {
-                len = sprintf(p, "enctypes=%s ", mech->gm_upcall_enctypes);
+                len = scnprintf(p, buflen, "enctypes=%s ",
+                                mech->gm_upcall_enctypes);
+                buflen -= len;
                 p += len;
                 gss_msg->msg.len += len;
         }
-        len = sprintf(p, "\n");
+        len = scnprintf(p, buflen, "\n");
+        if (len == 0)
+                goto out_overflow;
         gss_msg->msg.len += len;
 
         gss_msg->msg.data = gss_msg->databuf;
-        BUG_ON(gss_msg->msg.len > UPCALL_BUF_LEN);
+        return 0;
+out_overflow:
+        WARN_ON_ONCE(1);
+        return -ENOMEM;
 }
 
 static struct gss_upcall_msg *
@@ -463,15 +475,15 @@ gss_alloc_msg(struct gss_auth *gss_auth,
 {
         struct gss_upcall_msg *gss_msg;
         int vers;
+        int err = -ENOMEM;
 
         gss_msg = kzalloc(sizeof(*gss_msg), GFP_NOFS);
         if (gss_msg == NULL)
-                return ERR_PTR(-ENOMEM);
+                goto err;
         vers = get_pipe_version(gss_auth->net);
-        if (vers < 0) {
-                kfree(gss_msg);
-                return ERR_PTR(vers);
-        }
+        err = vers;
+        if (err < 0)
+                goto err_free_msg;
         gss_msg->pipe = gss_auth->gss_pipe[vers]->pipe;
         INIT_LIST_HEAD(&gss_msg->list);
         rpc_init_wait_queue(&gss_msg->rpc_waitqueue, "RPCSEC_GSS upcall waitq");
@@ -482,10 +494,17 @@ gss_alloc_msg(struct gss_auth *gss_auth,
         switch (vers) {
         case 0:
                 gss_encode_v0_msg(gss_msg);
+                break;
         default:
-                gss_encode_v1_msg(gss_msg, service_name, gss_auth->target_name);
+                err = gss_encode_v1_msg(gss_msg, service_name, gss_auth->target_name);
+                if (err)
+                        goto err_free_msg;
         };
         return gss_msg;
+err_free_msg:
+        kfree(gss_msg);
+err:
+        return ERR_PTR(err);
 }
 
 static struct gss_upcall_msg *
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 77479606a971..dab09dac8fc7 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -25,12 +25,12 @@
 #include <linux/namei.h>
 #include <linux/mount.h>
 #include <linux/slab.h>
+#include <linux/rcupdate.h>
 #include <linux/utsname.h>
 #include <linux/workqueue.h>
 #include <linux/in.h>
 #include <linux/in6.h>
 #include <linux/un.h>
-#include <linux/rcupdate.h>
 
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/addr.h>
@@ -264,6 +264,26 @@ void rpc_clients_notifier_unregister(void)
         return rpc_pipefs_notifier_unregister(&rpc_clients_block);
 }
 
+static struct rpc_xprt *rpc_clnt_set_transport(struct rpc_clnt *clnt,
+                struct rpc_xprt *xprt,
+                const struct rpc_timeout *timeout)
+{
+        struct rpc_xprt *old;
+
+        spin_lock(&clnt->cl_lock);
+        old = rcu_dereference_protected(clnt->cl_xprt,
+                        lockdep_is_held(&clnt->cl_lock));
+
+        if (!xprt_bound(xprt))
+                clnt->cl_autobind = 1;
+
+        clnt->cl_timeout = timeout;
+        rcu_assign_pointer(clnt->cl_xprt, xprt);
+        spin_unlock(&clnt->cl_lock);
+
+        return old;
+}
+
 static void rpc_clnt_set_nodename(struct rpc_clnt *clnt, const char *nodename)
 {
         clnt->cl_nodelen = strlen(nodename);
@@ -272,12 +292,13 @@ static void rpc_clnt_set_nodename(struct rpc_clnt *clnt, const char *nodename)
         memcpy(clnt->cl_nodename, nodename, clnt->cl_nodelen);
 }
 
-static int rpc_client_register(const struct rpc_create_args *args,
-                               struct rpc_clnt *clnt)
+static int rpc_client_register(struct rpc_clnt *clnt,
+                               rpc_authflavor_t pseudoflavor,
+                               const char *client_name)
 {
         struct rpc_auth_create_args auth_args = {
-                .pseudoflavor = args->authflavor,
-                .target_name = args->client_name,
+                .pseudoflavor = pseudoflavor,
+                .target_name = client_name,
         };
         struct rpc_auth *auth;
         struct net *net = rpc_net_ns(clnt);
@@ -298,7 +319,7 @@ static int rpc_client_register(const struct rpc_create_args *args,
         auth = rpcauth_create(&auth_args, clnt);
         if (IS_ERR(auth)) {
                 dprintk("RPC:       Couldn't create auth handle (flavor %u)\n",
-                                args->authflavor);
+                                pseudoflavor);
                 err = PTR_ERR(auth);
                 goto err_auth;
         }
@@ -337,7 +358,8 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args,
 {
         const struct rpc_program *program = args->program;
         const struct rpc_version *version;
-        struct rpc_clnt         *clnt = NULL;
+        struct rpc_clnt *clnt = NULL;
+        const struct rpc_timeout *timeout;
         int err;
 
         /* sanity check the name before trying to print it */
@@ -365,7 +387,6 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args,
         if (err)
                 goto out_no_clid;
 
-        rcu_assign_pointer(clnt->cl_xprt, xprt);
         clnt->cl_procinfo = version->procs;
         clnt->cl_maxproc  = version->nrprocs;
         clnt->cl_prog     = args->prognumber ? : program->number;
@@ -380,16 +401,15 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args,
         INIT_LIST_HEAD(&clnt->cl_tasks);
         spin_lock_init(&clnt->cl_lock);
 
-        if (!xprt_bound(xprt))
-                clnt->cl_autobind = 1;
-
-        clnt->cl_timeout = xprt->timeout;
+        timeout = xprt->timeout;
         if (args->timeout != NULL) {
                 memcpy(&clnt->cl_timeout_default, args->timeout,
                                 sizeof(clnt->cl_timeout_default));
-                clnt->cl_timeout = &clnt->cl_timeout_default;
+                timeout = &clnt->cl_timeout_default;
         }
 
+        rpc_clnt_set_transport(clnt, xprt, timeout);
+
         clnt->cl_rtt = &clnt->cl_rtt_default;
         rpc_init_rtt(&clnt->cl_rtt_default, clnt->cl_timeout->to_initval);
 
@@ -398,7 +418,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args,
         /* save the nodename */
         rpc_clnt_set_nodename(clnt, utsname()->nodename);
 
-        err = rpc_client_register(args, clnt);
+        err = rpc_client_register(clnt, args->authflavor, args->client_name);
         if (err)
                 goto out_no_path;
         if (parent)
@@ -600,6 +620,80 @@ rpc_clone_client_set_auth(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
 }
 EXPORT_SYMBOL_GPL(rpc_clone_client_set_auth);
 
+/**
+ * rpc_switch_client_transport: switch the RPC transport on the fly
+ * @clnt: pointer to a struct rpc_clnt
+ * @args: pointer to the new transport arguments
+ * @timeout: pointer to the new timeout parameters
+ *
+ * This function allows the caller to switch the RPC transport for the
+ * rpc_clnt structure 'clnt' to allow it to connect to a mirrored NFS
+ * server, for instance.  It assumes that the caller has ensured that
+ * there are no active RPC tasks by using some form of locking.
+ *
+ * Returns zero if "clnt" is now using the new xprt.  Otherwise a
+ * negative errno is returned, and "clnt" continues to use the old
+ * xprt.
+ */
+int rpc_switch_client_transport(struct rpc_clnt *clnt,
+                struct xprt_create *args,
+                const struct rpc_timeout *timeout)
+{
+        const struct rpc_timeout *old_timeo;
+        rpc_authflavor_t pseudoflavor;
+        struct rpc_xprt *xprt, *old;
+        struct rpc_clnt *parent;
+        int err;
+
+        xprt = xprt_create_transport(args);
+        if (IS_ERR(xprt)) {
+                dprintk("RPC:       failed to create new xprt for clnt %p\n",
+                        clnt);
+                return PTR_ERR(xprt);
+        }
+
+        pseudoflavor = clnt->cl_auth->au_flavor;
+
+        old_timeo = clnt->cl_timeout;
+        old = rpc_clnt_set_transport(clnt, xprt, timeout);
+
+        rpc_unregister_client(clnt);
+        __rpc_clnt_remove_pipedir(clnt);
+
+        /*
+         * A new transport was created.  "clnt" therefore
+         * becomes the root of a new cl_parent tree.  clnt's
+         * children, if it has any, still point to the old xprt.
+         */
+        parent = clnt->cl_parent;
+        clnt->cl_parent = clnt;
+
+        /*
+         * The old rpc_auth cache cannot be re-used.  GSS
+         * contexts in particular are between a single
+         * client and server.
+         */
+        err = rpc_client_register(clnt, pseudoflavor, NULL);
+        if (err)
+                goto out_revert;
+
+        synchronize_rcu();
+        if (parent != clnt)
+                rpc_release_client(parent);
+        xprt_put(old);
+        dprintk("RPC:       replaced xprt for clnt %p\n", clnt);
+        return 0;
+
+out_revert:
+        rpc_clnt_set_transport(clnt, old, old_timeo);
+        clnt->cl_parent = parent;
+        rpc_client_register(clnt, pseudoflavor, NULL);
+        xprt_put(xprt);
+        dprintk("RPC:       failed to switch xprt for clnt %p\n", clnt);
+        return err;
+}
+EXPORT_SYMBOL_GPL(rpc_switch_client_transport);
+
 /*
  * Kill all tasks for the given client.
  * XXX: kill their descendants as well?
@@ -772,6 +866,8 @@ void rpc_task_set_client(struct rpc_task *task, struct rpc_clnt *clnt)
                 atomic_inc(&clnt->cl_count);
                 if (clnt->cl_softrtry)
                         task->tk_flags |= RPC_TASK_SOFT;
+                if (clnt->cl_noretranstimeo)
+                        task->tk_flags |= RPC_TASK_NO_RETRANS_TIMEOUT;
                 if (sk_memalloc_socks()) {
                         struct rpc_xprt *xprt;
 
@@ -1690,6 +1786,7 @@ call_connect_status(struct rpc_task *task)
         dprint_status(task);
 
         trace_rpc_connect_status(task, status);
+        task->tk_status = 0;
         switch (status) {
                 /* if soft mounted, test if we've timed out */
         case -ETIMEDOUT:
@@ -1698,12 +1795,14 @@ call_connect_status(struct rpc_task *task)
         case -ECONNREFUSED:
         case -ECONNRESET:
         case -ENETUNREACH:
+                /* retry with existing socket, after a delay */
+                rpc_delay(task, 3*HZ);
                 if (RPC_IS_SOFTCONN(task))
                         break;
-                /* retry with existing socket, after a delay */
-        case 0:
         case -EAGAIN:
-                task->tk_status = 0;
+                task->tk_action = call_bind;
+                return;
+        case 0:
                 clnt->cl_stats->netreconn++;
                 task->tk_action = call_transmit;
                 return;
@@ -1717,13 +1816,14 @@ call_connect_status(struct rpc_task *task)
 static void
 call_transmit(struct rpc_task *task)
 {
+        int is_retrans = RPC_WAS_SENT(task);
+
         dprint_status(task);
 
         task->tk_action = call_status;
         if (task->tk_status < 0)
                 return;
-        task->tk_status = xprt_prepare_transmit(task);
-        if (task->tk_status != 0)
+        if (!xprt_prepare_transmit(task))
                 return;
         task->tk_action = call_transmit_status;
         /* Encode here so that rpcsec_gss can use correct sequence number. */
@@ -1742,6 +1842,8 @@ call_transmit(struct rpc_task *task)
         xprt_transmit(task);
         if (task->tk_status < 0)
                 return;
+        if (is_retrans)
+                task->tk_client->cl_stats->rpcretrans++;
         /*
          * On success, ensure that we call xprt_end_transmit() before sleeping
          * in order to allow access to the socket to other RPC requests.
@@ -1811,8 +1913,7 @@ call_bc_transmit(struct rpc_task *task)
 {
         struct rpc_rqst *req = task->tk_rqstp;
 
-        task->tk_status = xprt_prepare_transmit(task);
-        if (task->tk_status == -EAGAIN) {
+        if (!xprt_prepare_transmit(task)) {
                 /*
                  * Could not reserve the transport. Try again after the
                  * transport is released.
@@ -1900,7 +2001,8 @@ call_status(struct rpc_task *task)
                 rpc_delay(task, 3*HZ);
         case -ETIMEDOUT:
                 task->tk_action = call_timeout;
-                if (task->tk_client->cl_discrtry)
+                if (!(task->tk_flags & RPC_TASK_NO_RETRANS_TIMEOUT)
+                    && task->tk_client->cl_discrtry)
                         xprt_conditional_disconnect(req->rq_xprt,
                                         req->rq_connect_cookie);
                 break;
@@ -1982,7 +2084,6 @@ call_timeout(struct rpc_task *task)
         rpcauth_invalcred(task);
 
 retry:
-        clnt->cl_stats->rpcretrans++;
         task->tk_action = call_bind;
         task->tk_status = 0;
 }
@@ -2025,7 +2126,6 @@ call_decode(struct rpc_task *task)
         if (req->rq_rcv_buf.len < 12) {
                 if (!RPC_IS_SOFT(task)) {
                         task->tk_action = call_bind;
-                        clnt->cl_stats->rpcretrans++;
                         goto out_retry;
                 }
                 dprintk("RPC:       %s: too small RPC reply size (%d bytes)\n",
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 095363eee764..04199bc8416f 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -205,10 +205,8 @@ int xprt_reserve_xprt(struct rpc_xprt *xprt, struct rpc_task *task)
                 goto out_sleep;
         }
         xprt->snd_task = task;
-        if (req != NULL) {
-                req->rq_bytes_sent = 0;
+        if (req != NULL)
                 req->rq_ntrans++;
-        }
 
         return 1;
 
@@ -263,7 +261,6 @@ int xprt_reserve_xprt_cong(struct rpc_xprt *xprt, struct rpc_task *task)
         }
         if (__xprt_get_cong(xprt, task)) {
                 xprt->snd_task = task;
-                req->rq_bytes_sent = 0;
                 req->rq_ntrans++;
                 return 1;
         }
@@ -300,10 +297,8 @@ static bool __xprt_lock_write_func(struct rpc_task *task, void *data)
 
         req = task->tk_rqstp;
         xprt->snd_task = task;
-        if (req) {
-                req->rq_bytes_sent = 0;
+        if (req)
                 req->rq_ntrans++;
-        }
         return true;
 }
 
@@ -329,7 +324,6 @@ static bool __xprt_lock_write_cong_func(struct rpc_task *task, void *data)
         }
         if (__xprt_get_cong(xprt, task)) {
                 xprt->snd_task = task;
-                req->rq_bytes_sent = 0;
                 req->rq_ntrans++;
                 return true;
         }
@@ -358,6 +352,11 @@ out_unlock:
 void xprt_release_xprt(struct rpc_xprt *xprt, struct rpc_task *task)
 {
         if (xprt->snd_task == task) {
+                if (task != NULL) {
+                        struct rpc_rqst *req = task->tk_rqstp;
+                        if (req != NULL)
+                                req->rq_bytes_sent = 0;
+                }
                 xprt_clear_locked(xprt);
                 __xprt_lock_write_next(xprt);
         }
@@ -375,6 +374,11 @@ EXPORT_SYMBOL_GPL(xprt_release_xprt);
 void xprt_release_xprt_cong(struct rpc_xprt *xprt, struct rpc_task *task)
 {
         if (xprt->snd_task == task) {
+                if (task != NULL) {
+                        struct rpc_rqst *req = task->tk_rqstp;
+                        if (req != NULL)
+                                req->rq_bytes_sent = 0;
+                }
                 xprt_clear_locked(xprt);
                 __xprt_lock_write_next_cong(xprt);
         }
@@ -854,24 +858,36 @@ static inline int xprt_has_timer(struct rpc_xprt *xprt)
  * @task: RPC task about to send a request
  *
  */
-int xprt_prepare_transmit(struct rpc_task *task)
+bool xprt_prepare_transmit(struct rpc_task *task)
 {
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = req->rq_xprt;
-        int err = 0;
+        bool ret = false;
 
         dprintk("RPC: %5u xprt_prepare_transmit\n", task->tk_pid);
 
         spin_lock_bh(&xprt->transport_lock);
-        if (req->rq_reply_bytes_recvd && !req->rq_bytes_sent) {
-                err = req->rq_reply_bytes_recvd;
+        if (!req->rq_bytes_sent) {
+                if (req->rq_reply_bytes_recvd) {
+                        task->tk_status = req->rq_reply_bytes_recvd;
+                        goto out_unlock;
+                }
+                if ((task->tk_flags & RPC_TASK_NO_RETRANS_TIMEOUT)
+                    && xprt_connected(xprt)
+                    && req->rq_connect_cookie == xprt->connect_cookie) {
+                        xprt->ops->set_retrans_timeout(task);
+                        rpc_sleep_on(&xprt->pending, task, xprt_timer);
+                        goto out_unlock;
+                }
+        }
+        if (!xprt->ops->reserve_xprt(xprt, task)) {
+                task->tk_status = -EAGAIN;
                 goto out_unlock;
         }
-        if (!xprt->ops->reserve_xprt(xprt, task))
-                err = -EAGAIN;
+        ret = true;
 out_unlock:
         spin_unlock_bh(&xprt->transport_lock);
-        return err;
+        return ret;
 }
 
 void xprt_end_transmit(struct rpc_task *task)
@@ -912,7 +928,6 @@ void xprt_transmit(struct rpc_task *task)
         } else if (!req->rq_bytes_sent)
                 return;
 
-        req->rq_connect_cookie = xprt->connect_cookie;
         req->rq_xtime = ktime_get();
         status = xprt->ops->send_request(task);
         if (status != 0) {
@@ -938,12 +953,14 @@ void xprt_transmit(struct rpc_task *task)
         /* Don't race with disconnect */
         if (!xprt_connected(xprt))
                 task->tk_status = -ENOTCONN;
-        else if (!req->rq_reply_bytes_recvd && rpc_reply_expected(task)) {
+        else {
                 /*
                  * Sleep on the pending queue since
                  * we're expecting a reply.
                  */
-                rpc_sleep_on(&xprt->pending, task, xprt_timer);
+                if (!req->rq_reply_bytes_recvd && rpc_reply_expected(task))
+                        rpc_sleep_on(&xprt->pending, task, xprt_timer);
+                req->rq_connect_cookie = xprt->connect_cookie;
         }
         spin_unlock_bh(&xprt->transport_lock);
 }
@@ -1087,11 +1104,9 @@ struct rpc_xprt *xprt_alloc(struct net *net, size_t size,
         for (i = 0; i < num_prealloc; i++) {
                 req = kzalloc(sizeof(struct rpc_rqst), GFP_KERNEL);
                 if (!req)
-                        break;
+                        goto out_free;
                 list_add(&req->rq_list, &xprt->free);
         }
-        if (i < num_prealloc)
-                goto out_free;
         if (max_alloc > num_prealloc)
                 xprt->max_reqs = max_alloc;
         else
@@ -1186,6 +1201,12 @@ static void xprt_request_init(struct rpc_task *task, struct rpc_xprt *xprt)
         req->rq_xprt    = xprt;
         req->rq_buffer  = NULL;
         req->rq_xid     = xprt_alloc_xid(xprt);
+        req->rq_connect_cookie = xprt->connect_cookie - 1;
+        req->rq_bytes_sent = 0;
+        req->rq_snd_buf.len = 0;
+        req->rq_snd_buf.buflen = 0;
+        req->rq_rcv_buf.len = 0;
+        req->rq_rcv_buf.buflen = 0;
         req->rq_release_snd_buf = NULL;
         xprt_reset_majortimeo(req);
         dprintk("RPC: %5u reserved req %p xid %08x\n", task->tk_pid,
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index ee03d35677d9..17c88928b7db 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -835,6 +835,8 @@ static void xs_close(struct rpc_xprt *xprt)
 
         dprintk("RPC:       xs_close xprt %p\n", xprt);
 
+        cancel_delayed_work_sync(&transport->connect_worker);
+
         xs_reset_transport(transport);
         xprt->reestablish_timeout = 0;
 
@@ -854,14 +856,6 @@ static void xs_tcp_close(struct rpc_xprt *xprt)
                 xs_tcp_shutdown(xprt);
 }
 
-static void xs_local_destroy(struct rpc_xprt *xprt)
-{
-        xs_close(xprt);
-        xs_free_peer_addresses(xprt);
-        xprt_free(xprt);
-        module_put(THIS_MODULE);
-}
-
 /**
  * xs_destroy - prepare to shutdown a transport
  * @xprt: doomed transport
@@ -869,13 +863,12 @@ static void xs_local_destroy(struct rpc_xprt *xprt)
  */
 static void xs_destroy(struct rpc_xprt *xprt)
 {
-        struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
-
         dprintk("RPC:       xs_destroy xprt %p\n", xprt);
 
-        cancel_delayed_work_sync(&transport->connect_worker);
-
-        xs_local_destroy(xprt);
+        xs_close(xprt);
+        xs_free_peer_addresses(xprt);
+        xprt_free(xprt);
+        module_put(THIS_MODULE);
 }
 
 static inline struct rpc_xprt *xprt_from_sock(struct sock *sk)
@@ -1511,6 +1504,7 @@ static void xs_tcp_state_change(struct sock *sk)
                         transport->tcp_copied = 0;
                         transport->tcp_flags =
                                 TCP_RCV_COPY_FRAGHDR | TCP_RCV_COPY_XID;
+                        xprt->connect_cookie++;
 
                         xprt_wake_pending_tasks(xprt, -EAGAIN);
                 }
@@ -1816,6 +1810,10 @@ static inline void xs_reclassify_socket(int family, struct socket *sock)
 }
 #endif
 
+static void xs_dummy_setup_socket(struct work_struct *work)
+{
+}
+
 static struct socket *xs_create_sock(struct rpc_xprt *xprt,
                 struct sock_xprt *transport, int family, int type, int protocol)
 {
@@ -2112,6 +2110,19 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
 
         if (!transport->inet) {
                 struct sock *sk = sock->sk;
+                unsigned int keepidle = xprt->timeout->to_initval / HZ;
+                unsigned int keepcnt = xprt->timeout->to_retries + 1;
+                unsigned int opt_on = 1;
+
+                /* TCP Keepalive options */
+                kernel_setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
+                                (char *)&opt_on, sizeof(opt_on));
+                kernel_setsockopt(sock, SOL_TCP, TCP_KEEPIDLE,
+                                (char *)&keepidle, sizeof(keepidle));
+                kernel_setsockopt(sock, SOL_TCP, TCP_KEEPINTVL,
+                                (char *)&keepidle, sizeof(keepidle));
+                kernel_setsockopt(sock, SOL_TCP, TCP_KEEPCNT,
+                                (char *)&keepcnt, sizeof(keepcnt));
 
                 write_lock_bh(&sk->sk_callback_lock);
 
@@ -2151,7 +2162,6 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
         case 0:
         case -EINPROGRESS:
                 /* SYN_SENT! */
-                xprt->connect_cookie++;
                 if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
                         xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
         }
@@ -2498,7 +2508,7 @@ static struct rpc_xprt_ops xs_local_ops = {
         .send_request           = xs_local_send_request,
         .set_retrans_timeout    = xprt_set_retrans_timeout_def,
         .close                  = xs_close,
-        .destroy                = xs_local_destroy,
+        .destroy                = xs_destroy,
         .print_stats            = xs_local_print_stats,
 };
 
@@ -2655,6 +2665,9 @@ static struct rpc_xprt *xs_setup_local(struct xprt_create *args)
         xprt->ops = &xs_local_ops;
         xprt->timeout = &xs_local_default_timeout;
 
+        INIT_DELAYED_WORK(&transport->connect_worker,
+                        xs_dummy_setup_socket);
+
         switch (sun->sun_family) {
         case AF_LOCAL:
                 if (sun->sun_path[0] != '/') {
@@ -2859,8 +2872,8 @@ static struct rpc_xprt *xs_setup_bc_tcp(struct xprt_create *args)
         if (args->bc_xprt->xpt_bc_xprt) {
                 /*
                  * This server connection already has a backchannel
-                 * export; we can't create a new one, as we wouldn't be
-                 * able to match replies based on xid any more.  So,
+                 * transport; we can't create a new one, as we wouldn't
+                 * be able to match replies based on xid any more.  So,
                  * reuse the already-existing one:
                  */
                  return args->bc_xprt->xpt_bc_xprt;
diff --git a/net/x25/Kconfig b/net/x25/Kconfig
index c959312c45e3..e2fa133f9fba 100644
--- a/net/x25/Kconfig
+++ b/net/x25/Kconfig
@@ -16,8 +16,8 @@ config X25
           if you want that) and the lower level data link layer protocol LAPB
           (say Y to "LAPB Data Link Driver" below if you want that).
 
-          You can read more about X.25 at <http://www.sangoma.com/x25.htm> and
-          <http://www.cisco.com/univercd/cc/td/doc/product/software/ios11/cbook/cx25.htm>.
+          You can read more about X.25 at <http://www.sangoma.com/tutorials/x25/> and
+          <http://docwiki.cisco.com/wiki/X.25>.
           Information about X.25 for Linux is contained in the files
           <file:Documentation/networking/x25.txt> and
           <file:Documentation/networking/x25-iface.txt>.
diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
index 2906d520eea7..3be02b680268 100644
--- a/net/xfrm/xfrm_ipcomp.c
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -141,14 +141,14 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
         const int plen = skb->len;
         int dlen = IPCOMP_SCRATCH_SIZE;
         u8 *start = skb->data;
-        const int cpu = get_cpu();
-        u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
-        struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
+        struct crypto_comp *tfm;
+        u8 *scratch;
         int err;
 
         local_bh_disable();
+        scratch = *this_cpu_ptr(ipcomp_scratches);
+        tfm = *this_cpu_ptr(ipcd->tfms);
         err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
-        local_bh_enable();
         if (err)
                 goto out;
 
@@ -158,13 +158,13 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
         }
 
         memcpy(start + sizeof(struct ip_comp_hdr), scratch, dlen);
-        put_cpu();
+        local_bh_enable();
 
         pskb_trim(skb, dlen + sizeof(struct ip_comp_hdr));
         return 0;
 
 out:
-        put_cpu();
+        local_bh_enable();
         return err;
 }