112 files changed, 1282 insertions, 714 deletions

diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index af73bc3acb40..410dd5e76c41 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -101,11 +101,11 @@ static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 
+static DECLARE_WAIT_QUEUE_HEAD(rfcomm_wq);
+
 static void rfcomm_schedule(void)
 {
-        if (!rfcomm_thread)
-                return;
-        wake_up_process(rfcomm_thread);
+        wake_up_all(&rfcomm_wq);
 }
 
 /* ---- RFCOMM FCS computation ---- */
@@ -2086,24 +2086,22 @@ static void rfcomm_kill_listener(void)
 
 static int rfcomm_run(void *unused)
 {
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
         BT_DBG("");
 
         set_user_nice(current, -10);
 
         rfcomm_add_listener(BDADDR_ANY);
 
-        while (1) {
-                set_current_state(TASK_INTERRUPTIBLE);
-
-                if (kthread_should_stop())
-                        break;
+        add_wait_queue(&rfcomm_wq, &wait);
+        while (!kthread_should_stop()) {
 
                 /* Process stuff */
                 rfcomm_process_sessions();
 
-                schedule();
+                wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
         }
-        __set_current_state(TASK_RUNNING);
+        remove_wait_queue(&rfcomm_wq, &wait);
 
         rfcomm_kill_listener();
 
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 648d79ccf462..c465876c7861 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -813,10 +813,9 @@ static void __br_multicast_send_query(struct net_bridge *br,
                 return;
 
         if (port) {
-                __skb_push(skb, sizeof(struct ethhdr));
                 skb->dev = port->dev;
                 NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
-                        dev_queue_xmit);
+                        br_dev_queue_push_xmit);
         } else {
                 br_multicast_select_own_querier(br, ip, skb);
                 netif_rx(skb);
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 2ff9706647f2..e5ec470b851f 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -280,6 +280,7 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = {
         [IFLA_BRPORT_MODE]      = { .type = NLA_U8 },
         [IFLA_BRPORT_GUARD]     = { .type = NLA_U8 },
         [IFLA_BRPORT_PROTECT]   = { .type = NLA_U8 },
+        [IFLA_BRPORT_FAST_LEAVE]= { .type = NLA_U8 },
         [IFLA_BRPORT_LEARNING]  = { .type = NLA_U8 },
         [IFLA_BRPORT_UNICAST_FLOOD] = { .type = NLA_U8 },
 };
diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
index 654c9018e3e7..48da2c54a69e 100644
--- a/net/bridge/netfilter/nft_reject_bridge.c
+++ b/net/bridge/netfilter/nft_reject_bridge.c
@@ -18,6 +18,7 @@
 #include <net/netfilter/ipv6/nf_reject.h>
 #include <linux/ip.h>
 #include <net/ip.h>
+#include <net/ip6_checksum.h>
 #include <linux/netfilter_bridge.h>
 #include "../br_private.h"
 
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index de6662b14e1f..7e38b729696a 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -149,6 +149,7 @@ static int process_one_ticket(struct ceph_auth_client *ac,
         struct ceph_crypto_key old_key;
         void *ticket_buf = NULL;
         void *tp, *tpend;
+        void **ptp;
         struct ceph_timespec new_validity;
         struct ceph_crypto_key new_session_key;
         struct ceph_buffer *new_ticket_blob;
@@ -208,25 +209,19 @@ static int process_one_ticket(struct ceph_auth_client *ac,
                         goto out;
                 }
                 tp = ticket_buf;
-                dlen = ceph_decode_32(&tp);
+                ptp = &tp;
+                tpend = *ptp + dlen;
         } else {
                 /* unencrypted */
-                ceph_decode_32_safe(p, end, dlen, bad);
-                ticket_buf = kmalloc(dlen, GFP_NOFS);
-                if (!ticket_buf) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
-                tp = ticket_buf;
-                ceph_decode_need(p, end, dlen, bad);
-                ceph_decode_copy(p, ticket_buf, dlen);
+                ptp = p;
+                tpend = end;
         }
-        tpend = tp + dlen;
+        ceph_decode_32_safe(ptp, tpend, dlen, bad);
         dout(" ticket blob is %d bytes\n", dlen);
-        ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
-        blob_struct_v = ceph_decode_8(&tp);
-        new_secret_id = ceph_decode_64(&tp);
-        ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
+        ceph_decode_need(ptp, tpend, 1 + sizeof(u64), bad);
+        blob_struct_v = ceph_decode_8(ptp);
+        new_secret_id = ceph_decode_64(ptp);
+        ret = ceph_decode_buffer(&new_ticket_blob, ptp, tpend);
         if (ret)
                 goto out;
 
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
index 62fc5e7a9acf..790fe89d90c0 100644
--- a/net/ceph/crypto.c
+++ b/net/ceph/crypto.c
@@ -90,11 +90,82 @@ static struct crypto_blkcipher *ceph_crypto_alloc_cipher(void)
 
 static const u8 *aes_iv = (u8 *)CEPH_AES_IV;
 
+/*
+ * Should be used for buffers allocated with ceph_kvmalloc().
+ * Currently these are encrypt out-buffer (ceph_buffer) and decrypt
+ * in-buffer (msg front).
+ *
+ * Dispose of @sgt with teardown_sgtable().
+ *
+ * @prealloc_sg is to avoid memory allocation inside sg_alloc_table()
+ * in cases where a single sg is sufficient.  No attempt to reduce the
+ * number of sgs by squeezing physically contiguous pages together is
+ * made though, for simplicity.
+ */
+static int setup_sgtable(struct sg_table *sgt, struct scatterlist *prealloc_sg,
+                         const void *buf, unsigned int buf_len)
+{
+        struct scatterlist *sg;
+        const bool is_vmalloc = is_vmalloc_addr(buf);
+        unsigned int off = offset_in_page(buf);
+        unsigned int chunk_cnt = 1;
+        unsigned int chunk_len = PAGE_ALIGN(off + buf_len);
+        int i;
+        int ret;
+
+        if (buf_len == 0) {
+                memset(sgt, 0, sizeof(*sgt));
+                return -EINVAL;
+        }
+
+        if (is_vmalloc) {
+                chunk_cnt = chunk_len >> PAGE_SHIFT;
+                chunk_len = PAGE_SIZE;
+        }
+
+        if (chunk_cnt > 1) {
+                ret = sg_alloc_table(sgt, chunk_cnt, GFP_NOFS);
+                if (ret)
+                        return ret;
+        } else {
+                WARN_ON(chunk_cnt != 1);
+                sg_init_table(prealloc_sg, 1);
+                sgt->sgl = prealloc_sg;
+                sgt->nents = sgt->orig_nents = 1;
+        }
+
+        for_each_sg(sgt->sgl, sg, sgt->orig_nents, i) {
+                struct page *page;
+                unsigned int len = min(chunk_len - off, buf_len);
+
+                if (is_vmalloc)
+                        page = vmalloc_to_page(buf);
+                else
+                        page = virt_to_page(buf);
+
+                sg_set_page(sg, page, len, off);
+
+                off = 0;
+                buf += len;
+                buf_len -= len;
+        }
+        WARN_ON(buf_len != 0);
+
+        return 0;
+}
+
+static void teardown_sgtable(struct sg_table *sgt)
+{
+        if (sgt->orig_nents > 1)
+                sg_free_table(sgt);
+}
+
 static int ceph_aes_encrypt(const void *key, int key_len,
                             void *dst, size_t *dst_len,
                             const void *src, size_t src_len)
 {
-        struct scatterlist sg_in[2], sg_out[1];
+        struct scatterlist sg_in[2], prealloc_sg;
+        struct sg_table sg_out;
         struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
         struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 };
         int ret;
@@ -110,16 +181,18 @@ static int ceph_aes_encrypt(const void *key, int key_len,
 
         *dst_len = src_len + zero_padding;
 
-        crypto_blkcipher_setkey((void *)tfm, key, key_len);
         sg_init_table(sg_in, 2);
         sg_set_buf(&sg_in[0], src, src_len);
         sg_set_buf(&sg_in[1], pad, zero_padding);
-        sg_init_table(sg_out, 1);
-        sg_set_buf(sg_out, dst, *dst_len);
+        ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len);
+        if (ret)
+                goto out_tfm;
+
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
         iv = crypto_blkcipher_crt(tfm)->iv;
         ivsize = crypto_blkcipher_ivsize(tfm);
-
         memcpy(iv, aes_iv, ivsize);
+
         /*
         print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1,
                        key, key_len, 1);
@@ -128,16 +201,22 @@ static int ceph_aes_encrypt(const void *key, int key_len,
         print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1,
                         pad, zero_padding, 1);
         */
-        ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
+        ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in,
                                      src_len + zero_padding);
-        crypto_free_blkcipher(tfm);
-        if (ret < 0)
+        if (ret < 0) {
                 pr_err("ceph_aes_crypt failed %d\n", ret);
+                goto out_sg;
+        }
         /*
         print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1,
                        dst, *dst_len, 1);
         */
-        return 0;
+
+out_sg:
+        teardown_sgtable(&sg_out);
+out_tfm:
+        crypto_free_blkcipher(tfm);
+        return ret;
 }
 
 static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
@@ -145,7 +224,8 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
                              const void *src1, size_t src1_len,
                              const void *src2, size_t src2_len)
 {
-        struct scatterlist sg_in[3], sg_out[1];
+        struct scatterlist sg_in[3], prealloc_sg;
+        struct sg_table sg_out;
         struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
         struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 };
         int ret;
@@ -161,17 +241,19 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
 
         *dst_len = src1_len + src2_len + zero_padding;
 
-        crypto_blkcipher_setkey((void *)tfm, key, key_len);
         sg_init_table(sg_in, 3);
         sg_set_buf(&sg_in[0], src1, src1_len);
         sg_set_buf(&sg_in[1], src2, src2_len);
         sg_set_buf(&sg_in[2], pad, zero_padding);
-        sg_init_table(sg_out, 1);
-        sg_set_buf(sg_out, dst, *dst_len);
+        ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len);
+        if (ret)
+                goto out_tfm;
+
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
         iv = crypto_blkcipher_crt(tfm)->iv;
         ivsize = crypto_blkcipher_ivsize(tfm);
-
         memcpy(iv, aes_iv, ivsize);
+
         /*
         print_hex_dump(KERN_ERR, "enc  key: ", DUMP_PREFIX_NONE, 16, 1,
                        key, key_len, 1);
@@ -182,23 +264,30 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
         print_hex_dump(KERN_ERR, "enc  pad: ", DUMP_PREFIX_NONE, 16, 1,
                         pad, zero_padding, 1);
         */
-        ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
+        ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in,
                                      src1_len + src2_len + zero_padding);
-        crypto_free_blkcipher(tfm);
-        if (ret < 0)
+        if (ret < 0) {
                 pr_err("ceph_aes_crypt2 failed %d\n", ret);
+                goto out_sg;
+        }
         /*
         print_hex_dump(KERN_ERR, "enc  out: ", DUMP_PREFIX_NONE, 16, 1,
                        dst, *dst_len, 1);
         */
-        return 0;
+
+out_sg:
+        teardown_sgtable(&sg_out);
+out_tfm:
+        crypto_free_blkcipher(tfm);
+        return ret;
 }
 
 static int ceph_aes_decrypt(const void *key, int key_len,
                             void *dst, size_t *dst_len,
                             const void *src, size_t src_len)
 {
-        struct scatterlist sg_in[1], sg_out[2];
+        struct sg_table sg_in;
+        struct scatterlist sg_out[2], prealloc_sg;
         struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
         struct blkcipher_desc desc = { .tfm = tfm };
         char pad[16];
@@ -210,16 +299,16 @@ static int ceph_aes_decrypt(const void *key, int key_len,
         if (IS_ERR(tfm))
                 return PTR_ERR(tfm);
 
-        crypto_blkcipher_setkey((void *)tfm, key, key_len);
-        sg_init_table(sg_in, 1);
         sg_init_table(sg_out, 2);
-        sg_set_buf(sg_in, src, src_len);
         sg_set_buf(&sg_out[0], dst, *dst_len);
         sg_set_buf(&sg_out[1], pad, sizeof(pad));
+        ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len);
+        if (ret)
+                goto out_tfm;
 
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
         iv = crypto_blkcipher_crt(tfm)->iv;
         ivsize = crypto_blkcipher_ivsize(tfm);
-
         memcpy(iv, aes_iv, ivsize);
 
         /*
@@ -228,12 +317,10 @@ static int ceph_aes_decrypt(const void *key, int key_len,
         print_hex_dump(KERN_ERR, "dec  in: ", DUMP_PREFIX_NONE, 16, 1,
                        src, src_len, 1);
         */
-
-        ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len);
-        crypto_free_blkcipher(tfm);
+        ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len);
         if (ret < 0) {
                 pr_err("ceph_aes_decrypt failed %d\n", ret);
-                return ret;
+                goto out_sg;
         }
 
         if (src_len <= *dst_len)
@@ -251,7 +338,12 @@ static int ceph_aes_decrypt(const void *key, int key_len,
         print_hex_dump(KERN_ERR, "dec out: ", DUMP_PREFIX_NONE, 16, 1,
                        dst, *dst_len, 1);
         */
-        return 0;
+
+out_sg:
+        teardown_sgtable(&sg_in);
+out_tfm:
+        crypto_free_blkcipher(tfm);
+        return ret;
 }
 
 static int ceph_aes_decrypt2(const void *key, int key_len,
@@ -259,7 +351,8 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
                              void *dst2, size_t *dst2_len,
                              const void *src, size_t src_len)
 {
-        struct scatterlist sg_in[1], sg_out[3];
+        struct sg_table sg_in;
+        struct scatterlist sg_out[3], prealloc_sg;
         struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
         struct blkcipher_desc desc = { .tfm = tfm };
         char pad[16];
@@ -271,17 +364,17 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
         if (IS_ERR(tfm))
                 return PTR_ERR(tfm);
 
-        sg_init_table(sg_in, 1);
-        sg_set_buf(sg_in, src, src_len);
         sg_init_table(sg_out, 3);
         sg_set_buf(&sg_out[0], dst1, *dst1_len);
         sg_set_buf(&sg_out[1], dst2, *dst2_len);
         sg_set_buf(&sg_out[2], pad, sizeof(pad));
+        ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len);
+        if (ret)
+                goto out_tfm;
 
         crypto_blkcipher_setkey((void *)tfm, key, key_len);
         iv = crypto_blkcipher_crt(tfm)->iv;
         ivsize = crypto_blkcipher_ivsize(tfm);
-
         memcpy(iv, aes_iv, ivsize);
 
         /*
@@ -290,12 +383,10 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
         print_hex_dump(KERN_ERR, "dec   in: ", DUMP_PREFIX_NONE, 16, 1,
                        src, src_len, 1);
         */
-
-        ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len);
-        crypto_free_blkcipher(tfm);
+        ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len);
         if (ret < 0) {
                 pr_err("ceph_aes_decrypt failed %d\n", ret);
-                return ret;
+                goto out_sg;
         }
 
         if (src_len <= *dst1_len)
@@ -325,7 +416,11 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
                        dst2, *dst2_len, 1);
         */
 
-        return 0;
+out_sg:
+        teardown_sgtable(&sg_in);
+out_tfm:
+        crypto_free_blkcipher(tfm);
+        return ret;
 }
 
 
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 559c9f619c20..8d1653caffdb 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -484,7 +484,7 @@ static int ceph_tcp_connect(struct ceph_connection *con)
                                IPPROTO_TCP, &sock);
         if (ret)
                 return ret;
-        sock->sk->sk_allocation = GFP_NOFS;
+        sock->sk->sk_allocation = GFP_NOFS | __GFP_MEMALLOC;
 
 #ifdef CONFIG_LOCKDEP
         lockdep_set_class(&sock->sk->sk_lock, &socket_class);
@@ -509,6 +509,9 @@ static int ceph_tcp_connect(struct ceph_connection *con)
 
                 return ret;
         }
+
+        sk_set_memalloc(sock->sk);
+
         con->sock = sock;
         return 0;
 }
@@ -2769,8 +2772,11 @@ static void con_work(struct work_struct *work)
 {
         struct ceph_connection *con = container_of(work, struct ceph_connection,
                                                    work.work);
+        unsigned long pflags = current->flags;
         bool fault;
 
+        current->flags |= PF_MEMALLOC;
+
         mutex_lock(&con->mutex);
         while (true) {
                 int ret;
@@ -2824,6 +2830,8 @@ static void con_work(struct work_struct *work)
                 con_fault_finish(con);
 
         con->ops->put(con);
+
+        tsk_restore_flags(current, pflags, PF_MEMALLOC);
 }
 
 /*
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index f3fc54eac09d..6f164289bde8 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -1007,8 +1007,8 @@ static void put_osd(struct ceph_osd *osd)
 static void __remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
 {
         dout("__remove_osd %p\n", osd);
-        BUG_ON(!list_empty(&osd->o_requests));
-        BUG_ON(!list_empty(&osd->o_linger_requests));
+        WARN_ON(!list_empty(&osd->o_requests));
+        WARN_ON(!list_empty(&osd->o_linger_requests));
 
         rb_erase(&osd->o_node, &osdc->osds);
         list_del_init(&osd->o_osd_lru);
@@ -1254,6 +1254,8 @@ static void __unregister_linger_request(struct ceph_osd_client *osdc,
                 if (list_empty(&req->r_osd_item))
                         req->r_osd = NULL;
         }
+
+        list_del_init(&req->r_req_lru_item); /* can be on notarget */
         ceph_osdc_put_request(req);
 }
 
@@ -1395,6 +1397,7 @@ static int __map_request(struct ceph_osd_client *osdc,
         if (req->r_osd) {
                 __cancel_request(req);
                 list_del_init(&req->r_osd_item);
+                list_del_init(&req->r_linger_osd_item);
                 req->r_osd = NULL;
         }
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 945bbd001359..3acff0974560 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7200,11 +7200,10 @@ static void __net_exit rtnl_lock_unregistering(struct list_head *net_list)
          */
         struct net *net;
         bool unregistering;
-        DEFINE_WAIT(wait);
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
+        add_wait_queue(&netdev_unregistering_wq, &wait);
         for (;;) {
-                prepare_to_wait(&netdev_unregistering_wq, &wait,
-                                TASK_UNINTERRUPTIBLE);
                 unregistering = false;
                 rtnl_lock();
                 list_for_each_entry(net, net_list, exit_list) {
@@ -7216,9 +7215,10 @@ static void __net_exit rtnl_lock_unregistering(struct list_head *net_list)
                 if (!unregistering)
                         break;
                 __rtnl_unlock();
-                schedule();
+
+                wait_woken(&wait, TASK_UNINTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
         }
-        finish_wait(&netdev_unregistering_wq, &wait);
+        remove_wait_queue(&netdev_unregistering_wq, &wait);
 }
 
 static void __net_exit default_device_exit_batch(struct list_head *net_list)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a6882686ca3a..88e8de3b59b0 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -365,11 +365,10 @@ static void rtnl_lock_unregistering_all(void)
 {
         struct net *net;
         bool unregistering;
-        DEFINE_WAIT(wait);
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
+        add_wait_queue(&netdev_unregistering_wq, &wait);
         for (;;) {
-                prepare_to_wait(&netdev_unregistering_wq, &wait,
-                                TASK_UNINTERRUPTIBLE);
                 unregistering = false;
                 rtnl_lock();
                 for_each_net(net) {
@@ -381,9 +380,10 @@ static void rtnl_lock_unregistering_all(void)
                 if (!unregistering)
                         break;
                 __rtnl_unlock();
-                schedule();
+
+                wait_woken(&wait, TASK_UNINTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
         }
-        finish_wait(&netdev_unregistering_wq, &wait);
+        remove_wait_queue(&netdev_unregistering_wq, &wait);
 }
 
 /**
@@ -1498,6 +1498,7 @@ static int do_setlink(const struct sk_buff *skb,
                         goto errout;
                 }
                 if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
+                        put_net(net);
                         err = -EPERM;
                         goto errout;
                 }
@@ -2685,13 +2686,20 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
         int idx = 0;
         u32 portid = NETLINK_CB(cb->skb).portid;
         u32 seq = cb->nlh->nlmsg_seq;
-        struct nlattr *extfilt;
         u32 filter_mask = 0;
 
-        extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct ifinfomsg),
-                                  IFLA_EXT_MASK);
-        if (extfilt)
-                filter_mask = nla_get_u32(extfilt);
+        if (nlmsg_len(cb->nlh) > sizeof(struct ifinfomsg)) {
+                struct nlattr *extfilt;
+
+                extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct ifinfomsg),
+                                          IFLA_EXT_MASK);
+                if (extfilt) {
+                        if (nla_len(extfilt) < sizeof(filter_mask))
+                                return -EINVAL;
+
+                        filter_mask = nla_get_u32(extfilt);
+                }
+        }
 
         rcu_read_lock();
         for_each_netdev_rcu(net, dev) {
@@ -2798,6 +2806,9 @@ static int rtnl_bridge_setlink(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (br_spec) {
                 nla_for_each_nested(attr, br_spec, rem) {
                         if (nla_type(attr) == IFLA_BRIDGE_FLAGS) {
+                                if (nla_len(attr) < sizeof(flags))
+                                        return -EINVAL;
+
                                 have_flags = true;
                                 flags = nla_get_u16(attr);
                                 break;
@@ -2868,6 +2879,9 @@ static int rtnl_bridge_dellink(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (br_spec) {
                 nla_for_each_nested(attr, br_spec, rem) {
                         if (nla_type(attr) == IFLA_BRIDGE_FLAGS) {
+                                if (nla_len(attr) < sizeof(flags))
+                                        return -EINVAL;
+
                                 have_flags = true;
                                 flags = nla_get_u16(attr);
                                 break;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index c16615bfb61e..32e31c299631 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -552,20 +552,13 @@ static void kfree_skbmem(struct sk_buff *skb)
         case SKB_FCLONE_CLONE:
                 fclones = container_of(skb, struct sk_buff_fclones, skb2);
 
-                /* Warning : We must perform the atomic_dec_and_test() before
-                 * setting skb->fclone back to SKB_FCLONE_FREE, otherwise
-                 * skb_clone() could set clone_ref to 2 before our decrement.
-                 * Anyway, if we are going to free the structure, no need to
-                 * rewrite skb->fclone.
+                /* The clone portion is available for
+                 * fast-cloning again.
                  */
-                if (atomic_dec_and_test(&fclones->fclone_ref)) {
+                skb->fclone = SKB_FCLONE_FREE;
+
+                if (atomic_dec_and_test(&fclones->fclone_ref))
                         kmem_cache_free(skbuff_fclone_cache, fclones);
-                } else {
-                        /* The clone portion is available for
-                         * fast-cloning again.
-                         */
-                        skb->fclone = SKB_FCLONE_FREE;
-                }
                 break;
         }
 }
@@ -887,11 +880,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         if (skb->fclone == SKB_FCLONE_ORIG &&
             n->fclone == SKB_FCLONE_FREE) {
                 n->fclone = SKB_FCLONE_CLONE;
-                /* As our fastclone was free, clone_ref must be 1 at this point.
-                 * We could use atomic_inc() here, but it is faster
-                 * to set the final value.
-                 */
-                atomic_set(&fclones->fclone_ref, 2);
+                atomic_inc(&fclones->fclone_ref);
         } else {
                 if (skb_pfmemalloc(skb))
                         gfp_mask |= __GFP_MEMALLOC;
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index ca11d283bbeb..93ea80196f0e 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -1080,13 +1080,13 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
         if (!app)
                 return -EMSGSIZE;
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         list_for_each_entry(itr, &dcb_app_list, list) {
                 if (itr->ifindex == netdev->ifindex) {
                         err = nla_put(skb, DCB_ATTR_IEEE_APP, sizeof(itr->app),
                                          &itr->app);
                         if (err) {
-                                spin_unlock(&dcb_lock);
+                                spin_unlock_bh(&dcb_lock);
                                 return -EMSGSIZE;
                         }
                 }
@@ -1097,7 +1097,7 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
         else
                 dcbx = -EOPNOTSUPP;
 
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
         nla_nest_end(skb, app);
 
         /* get peer info if available */
@@ -1234,7 +1234,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
         }
 
         /* local app */
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         app = nla_nest_start(skb, DCB_ATTR_CEE_APP_TABLE);
         if (!app)
                 goto dcb_unlock;
@@ -1271,7 +1271,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
         else
                 dcbx = -EOPNOTSUPP;
 
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
 
         /* features flags */
         if (ops->getfeatcfg) {
@@ -1326,7 +1326,7 @@ static int dcbnl_cee_fill(struct sk_buff *skb, struct net_device *netdev)
         return 0;
 
 dcb_unlock:
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
 nla_put_failure:
         return err;
 }
@@ -1762,10 +1762,10 @@ u8 dcb_getapp(struct net_device *dev, struct dcb_app *app)
         struct dcb_app_type *itr;
         u8 prio = 0;
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         if ((itr = dcb_app_lookup(app, dev->ifindex, 0)))
                 prio = itr->app.priority;
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
 
         return prio;
 }
@@ -1789,7 +1789,7 @@ int dcb_setapp(struct net_device *dev, struct dcb_app *new)
         if (dev->dcbnl_ops->getdcbx)
                 event.dcbx = dev->dcbnl_ops->getdcbx(dev);
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         /* Search for existing match and replace */
         if ((itr = dcb_app_lookup(new, dev->ifindex, 0))) {
                 if (new->priority)
@@ -1804,7 +1804,7 @@ int dcb_setapp(struct net_device *dev, struct dcb_app *new)
         if (new->priority)
                 err = dcb_app_add(new, dev->ifindex);
 out:
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
         if (!err)
                 call_dcbevent_notifiers(DCB_APP_EVENT, &event);
         return err;
@@ -1823,10 +1823,10 @@ u8 dcb_ieee_getapp_mask(struct net_device *dev, struct dcb_app *app)
         struct dcb_app_type *itr;
         u8 prio = 0;
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         if ((itr = dcb_app_lookup(app, dev->ifindex, 0)))
                 prio |= 1 << itr->app.priority;
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
 
         return prio;
 }
@@ -1850,7 +1850,7 @@ int dcb_ieee_setapp(struct net_device *dev, struct dcb_app *new)
         if (dev->dcbnl_ops->getdcbx)
                 event.dcbx = dev->dcbnl_ops->getdcbx(dev);
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         /* Search for existing match and abort if found */
         if (dcb_app_lookup(new, dev->ifindex, new->priority)) {
                 err = -EEXIST;
@@ -1859,7 +1859,7 @@ int dcb_ieee_setapp(struct net_device *dev, struct dcb_app *new)
 
         err = dcb_app_add(new, dev->ifindex);
 out:
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
         if (!err)
                 call_dcbevent_notifiers(DCB_APP_EVENT, &event);
         return err;
@@ -1882,7 +1882,7 @@ int dcb_ieee_delapp(struct net_device *dev, struct dcb_app *del)
         if (dev->dcbnl_ops->getdcbx)
                 event.dcbx = dev->dcbnl_ops->getdcbx(dev);
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         /* Search for existing match and remove it. */
         if ((itr = dcb_app_lookup(del, dev->ifindex, del->priority))) {
                 list_del(&itr->list);
@@ -1890,7 +1890,7 @@ int dcb_ieee_delapp(struct net_device *dev, struct dcb_app *del)
                 err = 0;
         }
 
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
         if (!err)
                 call_dcbevent_notifiers(DCB_APP_EVENT, &event);
         return err;
@@ -1902,12 +1902,12 @@ static void dcb_flushapp(void)
         struct dcb_app_type *app;
         struct dcb_app_type *tmp;
 
-        spin_lock(&dcb_lock);
+        spin_lock_bh(&dcb_lock);
         list_for_each_entry_safe(app, tmp, &dcb_app_list, list) {
                 list_del(&app->list);
                 kfree(app);
         }
-        spin_unlock(&dcb_lock);
+        spin_unlock_bh(&dcb_lock);
 }
 
 static int __init dcbnl_init(void)
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 6d1817449c36..ab03e00ffe8f 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -489,11 +489,14 @@ static void dsa_slave_phy_setup(struct dsa_slave_priv *p,
         /* We could not connect to a designated PHY, so use the switch internal
          * MDIO bus instead
          */
-        if (!p->phy)
+        if (!p->phy) {
                 p->phy = ds->slave_mii_bus->phy_map[p->port];
-        else
+                phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link,
+                                   p->phy_interface);
+        } else {
                 pr_info("attached PHY at address %d [%s]\n",
                         p->phy->addr, p->phy->drv->name);
+        }
 }
 
 int dsa_slave_suspend(struct net_device *slave_dev)
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 8b7fe5b03906..e67da4e6c324 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1386,6 +1386,17 @@ out:
         return pp;
 }
 
+int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
+{
+        if (sk->sk_family == AF_INET)
+                return ip_recv_error(sk, msg, len, addr_len);
+#if IS_ENABLED(CONFIG_IPV6)
+        if (sk->sk_family == AF_INET6)
+                return pingv6_ops.ipv6_recv_error(sk, msg, len, addr_len);
+#endif
+        return -EINVAL;
+}
+
 static int inet_gro_complete(struct sk_buff *skb, int nhoff)
 {
         __be16 newlen = htons(skb->len - nhoff);
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index f2e15738534d..8f7bd56955b0 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -62,6 +62,10 @@ int __fib_lookup(struct net *net, struct flowi4 *flp, struct fib_result *res)
         else
                 res->tclassid = 0;
 #endif
+
+        if (err == -ESRCH)
+                err = -ENETUNREACH;
+
         return err;
 }
 EXPORT_SYMBOL_GPL(__fib_lookup);
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
index 32e78924e246..606c520ffd5a 100644
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -133,6 +133,8 @@ static int fou_gro_complete(struct sk_buff *skb, int nhoff)
         int err = -ENOSYS;
         const struct net_offload **offloads;
 
+        udp_tunnel_gro_complete(skb, nhoff);
+
         rcu_read_lock();
         offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
         ops = rcu_dereference(offloads[proto]);
diff --git a/net/ipv4/geneve.c b/net/ipv4/geneve.c
index 065cd94c640c..dedb21e99914 100644
--- a/net/ipv4/geneve.c
+++ b/net/ipv4/geneve.c
@@ -144,6 +144,8 @@ int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
         gnvh = (struct genevehdr *)__skb_push(skb, sizeof(*gnvh) + opt_len);
         geneve_build_header(gnvh, tun_flags, vni, opt_len, opt);
 
+        skb_set_inner_protocol(skb, htons(ETH_P_TEB));
+
         return udp_tunnel_xmit_skb(gs->sock, rt, skb, src, dst,
                                    tos, ttl, df, src_port, dst_port, xnet);
 }
@@ -364,6 +366,7 @@ late_initcall(geneve_init_module);
 static void __exit geneve_cleanup_module(void)
 {
         destroy_workqueue(geneve_wq);
+        unregister_pernet_subsys(&geneve_net_ops);
 }
 module_exit(geneve_cleanup_module);
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index fb70e3ecc3e4..bb15d0e03d4f 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -318,9 +318,7 @@ igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
         return scount;
 }
 
-#define igmp_skb_size(skb) (*(unsigned int *)((skb)->cb))
-
-static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
+static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
 {
         struct sk_buff *skb;
         struct rtable *rt;
@@ -330,6 +328,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         struct flowi4 fl4;
         int hlen = LL_RESERVED_SPACE(dev);
         int tlen = dev->needed_tailroom;
+        unsigned int size = mtu;
 
         while (1) {
                 skb = alloc_skb(size + hlen + tlen,
@@ -341,7 +340,6 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
                         return NULL;
         }
         skb->priority = TC_PRIO_CONTROL;
-        igmp_skb_size(skb) = size;
 
         rt = ip_route_output_ports(net, &fl4, NULL, IGMPV3_ALL_MCR, 0,
                                    0, 0,
@@ -354,6 +352,8 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         skb_dst_set(skb, &rt->dst);
         skb->dev = dev;
 
+        skb->reserved_tailroom = skb_end_offset(skb) -
+                                 min(mtu, skb_end_offset(skb));
         skb_reserve(skb, hlen);
 
         skb_reset_network_header(skb);
@@ -423,8 +423,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
         return skb;
 }
 
-#define AVAILABLE(skb) ((skb) ? ((skb)->dev ? igmp_skb_size(skb) - (skb)->len : \
-        skb_tailroom(skb)) : 0)
+#define AVAILABLE(skb)  ((skb) ? skb_availroom(skb) : 0)
 
 static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
         int type, int gdeleted, int sdeleted)
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index c373a9ad4555..9daf2177dc00 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -195,7 +195,7 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc,
         for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
                 if (!CMSG_OK(msg, cmsg))
                         return -EINVAL;
-#if defined(CONFIG_IPV6)
+#if IS_ENABLED(CONFIG_IPV6)
                 if (allow_ipv6 &&
                     cmsg->cmsg_level == SOL_IPV6 &&
                     cmsg->cmsg_type == IPV6_PKTINFO) {
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 3e861011e4a3..1a7e979e80ba 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -528,6 +528,7 @@ static struct rtnl_link_ops vti_link_ops __read_mostly = {
         .validate       = vti_tunnel_validate,
         .newlink        = vti_newlink,
         .changelink     = vti_changelink,
+        .dellink        = ip_tunnel_dellink,
         .get_size       = vti_get_size,
         .fill_info      = vti_fill_info,
 };
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index a054fe083431..5c61328b7704 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -56,11 +56,11 @@ static bool ipv4_invert_tuple(struct nf_conntrack_tuple *tuple,
         return true;
 }
 
-static int ipv4_print_tuple(struct seq_file *s,
+static void ipv4_print_tuple(struct seq_file *s,
                             const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "src=%pI4 dst=%pI4 ",
-                          &tuple->src.u3.ip, &tuple->dst.u3.ip);
+        seq_printf(s, "src=%pI4 dst=%pI4 ",
+                   &tuple->src.u3.ip, &tuple->dst.u3.ip);
 }
 
 static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 4c48e434bb1f..a460a87e14f8 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -94,7 +94,7 @@ static void ct_seq_stop(struct seq_file *s, void *v)
 }
 
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
-static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
+static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
 {
         int ret;
         u32 len;
@@ -102,17 +102,15 @@ static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
 
         ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
         if (ret)
-                return 0;
+                return;
 
-        ret = seq_printf(s, "secctx=%s ", secctx);
+        seq_printf(s, "secctx=%s ", secctx);
 
         security_release_secctx(secctx, len);
-        return ret;
 }
 #else
-static inline int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
+static inline void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
 {
-        return 0;
 }
 #endif
 
@@ -141,47 +139,52 @@ static int ct_seq_show(struct seq_file *s, void *v)
         NF_CT_ASSERT(l4proto);
 
         ret = -ENOSPC;
-        if (seq_printf(s, "%-8s %u %ld ",
-                      l4proto->name, nf_ct_protonum(ct),
-                      timer_pending(&ct->timeout)
-                      ? (long)(ct->timeout.expires - jiffies)/HZ : 0) != 0)
-                goto release;
+        seq_printf(s, "%-8s %u %ld ",
+                   l4proto->name, nf_ct_protonum(ct),
+                   timer_pending(&ct->timeout)
+                   ? (long)(ct->timeout.expires - jiffies)/HZ : 0);
+
+        if (l4proto->print_conntrack)
+                l4proto->print_conntrack(s, ct);
 
-        if (l4proto->print_conntrack && l4proto->print_conntrack(s, ct))
+        if (seq_has_overflowed(s))
                 goto release;
 
-        if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
-                        l3proto, l4proto))
+        print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                    l3proto, l4proto);
+
+        if (seq_has_overflowed(s))
                 goto release;
 
         if (seq_print_acct(s, ct, IP_CT_DIR_ORIGINAL))
                 goto release;
 
         if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status)))
-                if (seq_printf(s, "[UNREPLIED] "))
-                        goto release;
+                seq_printf(s, "[UNREPLIED] ");
 
-        if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
-                        l3proto, l4proto))
+        print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
+                    l3proto, l4proto);
+
+        if (seq_has_overflowed(s))
                 goto release;
 
         if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
                 goto release;
 
         if (test_bit(IPS_ASSURED_BIT, &ct->status))
-                if (seq_printf(s, "[ASSURED] "))
-                        goto release;
+                seq_printf(s, "[ASSURED] ");
 
 #ifdef CONFIG_NF_CONNTRACK_MARK
-        if (seq_printf(s, "mark=%u ", ct->mark))
-                goto release;
+        seq_printf(s, "mark=%u ", ct->mark);
 #endif
 
-        if (ct_show_secctx(s, ct))
-                goto release;
+        ct_show_secctx(s, ct);
 
-        if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)))
+        seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use));
+
+        if (seq_has_overflowed(s))
                 goto release;
+
         ret = 0;
 release:
         nf_ct_put(ct);
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index b91b2641adda..80d5554b9a88 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -72,13 +72,13 @@ static bool icmp_invert_tuple(struct nf_conntrack_tuple *tuple,
 }
 
 /* Print out the per-protocol part of the tuple. */
-static int icmp_print_tuple(struct seq_file *s,
+static void icmp_print_tuple(struct seq_file *s,
                             const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "type=%u code=%u id=%u ",
-                          tuple->dst.u.icmp.type,
-                          tuple->dst.u.icmp.code,
-                          ntohs(tuple->src.u.icmp.id));
+        seq_printf(s, "type=%u code=%u id=%u ",
+                   tuple->dst.u.icmp.type,
+                   tuple->dst.u.icmp.code,
+                   ntohs(tuple->src.u.icmp.id));
 }
 
 static unsigned int *icmp_get_timeouts(struct net *net)
diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
index c1023c445920..665de06561cd 100644
--- a/net/ipv4/netfilter/nft_masq_ipv4.c
+++ b/net/ipv4/netfilter/nft_masq_ipv4.c
@@ -24,6 +24,7 @@ static void nft_masq_ipv4_eval(const struct nft_expr *expr,
         struct nf_nat_range range;
         unsigned int verdict;
 
+        memset(&range, 0, sizeof(range));
         range.flags = priv->flags;
 
         verdict = nf_nat_masquerade_ipv4(pkt->skb, pkt->ops->hooknum,
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 57f7c9804139..5d740cccf69e 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -217,6 +217,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
                                              &ipv6_hdr(skb)->daddr))
                                 continue;
 #endif
+                } else {
+                        continue;
                 }
 
                 if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif)
@@ -853,16 +855,8 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (flags & MSG_OOB)
                 goto out;
 
-        if (flags & MSG_ERRQUEUE) {
-                if (family == AF_INET) {
-                        return ip_recv_error(sk, msg, len, addr_len);
-#if IS_ENABLED(CONFIG_IPV6)
-                } else if (family == AF_INET6) {
-                        return pingv6_ops.ipv6_recv_error(sk, msg, len,
-                                                          addr_len);
-#endif
-                }
-        }
+        if (flags & MSG_ERRQUEUE)
+                return inet_recv_error(sk, msg, len, addr_len);
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 39ec0c379545..38c2bcb8dd5d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1598,7 +1598,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         u32 urg_hole = 0;
 
         if (unlikely(flags & MSG_ERRQUEUE))
-                return ip_recv_error(sk, msg, len, addr_len);
+                return inet_recv_error(sk, msg, len, addr_len);
 
         if (sk_can_busy_loop(sk) && skb_queue_empty(&sk->sk_receive_queue) &&
             (sk->sk_state == TCP_ESTABLISHED))
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a12b455928e5..d107ee246a1d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2315,6 +2315,35 @@ static inline bool tcp_packet_delayed(const struct tcp_sock *tp)
 
 /* Undo procedures. */
 
+/* We can clear retrans_stamp when there are no retransmissions in the
+ * window. It would seem that it is trivially available for us in
+ * tp->retrans_out, however, that kind of assumptions doesn't consider
+ * what will happen if errors occur when sending retransmission for the
+ * second time. ...It could the that such segment has only
+ * TCPCB_EVER_RETRANS set at the present time. It seems that checking
+ * the head skb is enough except for some reneging corner cases that
+ * are not worth the effort.
+ *
+ * Main reason for all this complexity is the fact that connection dying
+ * time now depends on the validity of the retrans_stamp, in particular,
+ * that successive retransmissions of a segment must not advance
+ * retrans_stamp under any conditions.
+ */
+static bool tcp_any_retrans_done(const struct sock *sk)
+{
+        const struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb;
+
+        if (tp->retrans_out)
+                return true;
+
+        skb = tcp_write_queue_head(sk);
+        if (unlikely(skb && TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS))
+                return true;
+
+        return false;
+}
+
 #if FASTRETRANS_DEBUG > 1
 static void DBGUNDO(struct sock *sk, const char *msg)
 {
@@ -2410,6 +2439,8 @@ static bool tcp_try_undo_recovery(struct sock *sk)
                  * is ACKed. For Reno it is MUST to prevent false
                  * fast retransmits (RFC2582). SACK TCP is safe. */
                 tcp_moderate_cwnd(tp);
+                if (!tcp_any_retrans_done(sk))
+                        tp->retrans_stamp = 0;
                 return true;
         }
         tcp_set_ca_state(sk, TCP_CA_Open);
@@ -2430,35 +2461,6 @@ static bool tcp_try_undo_dsack(struct sock *sk)
         return false;
 }
 
-/* We can clear retrans_stamp when there are no retransmissions in the
- * window. It would seem that it is trivially available for us in
- * tp->retrans_out, however, that kind of assumptions doesn't consider
- * what will happen if errors occur when sending retransmission for the
- * second time. ...It could the that such segment has only
- * TCPCB_EVER_RETRANS set at the present time. It seems that checking
- * the head skb is enough except for some reneging corner cases that
- * are not worth the effort.
- *
- * Main reason for all this complexity is the fact that connection dying
- * time now depends on the validity of the retrans_stamp, in particular,
- * that successive retransmissions of a segment must not advance
- * retrans_stamp under any conditions.
- */
-static bool tcp_any_retrans_done(const struct sock *sk)
-{
-        const struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *skb;
-
-        if (tp->retrans_out)
-                return true;
-
-        skb = tcp_write_queue_head(sk);
-        if (unlikely(skb && TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS))
-                return true;
-
-        return false;
-}
-
 /* Undo during loss recovery after partial ACK or using F-RTO. */
 static bool tcp_try_undo_loss(struct sock *sk, bool frto_undo)
 {
@@ -5229,7 +5231,7 @@ slow_path:
         if (len < (th->doff << 2) || tcp_checksum_complete_user(sk, skb))
                 goto csum_error;
 
-        if (!th->ack && !th->rst)
+        if (!th->ack && !th->rst && !th->syn)
                 goto discard;
 
         /*
@@ -5648,7 +5650,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                         goto discard;
         }
 
-        if (!th->ack && !th->rst)
+        if (!th->ack && !th->rst && !th->syn)
                 goto discard;
 
         if (!tcp_validate_incoming(sk, skb, th, 0))
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 9c7d7621466b..147be2024290 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -598,7 +598,10 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
         if (th->rst)
                 return;
 
-        if (skb_rtable(skb)->rt_type != RTN_LOCAL)
+        /* If sk not NULL, it means we did a successful lookup and incoming
+         * route had to be correct. prequeue might have dropped our dst.
+         */
+        if (!sk && skb_rtable(skb)->rt_type != RTN_LOCAL)
                 return;
 
         /* Swap the send and the receive. */
diff --git a/net/ipv4/tcp_memcontrol.c b/net/ipv4/tcp_memcontrol.c
index 1d191357bf88..272327134a1b 100644
--- a/net/ipv4/tcp_memcontrol.c
+++ b/net/ipv4/tcp_memcontrol.c
@@ -9,13 +9,13 @@
 int tcp_init_cgroup(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
 {
         /*
-         * The root cgroup does not use res_counters, but rather,
+         * The root cgroup does not use page_counters, but rather,
          * rely on the data already collected by the network
          * subsystem
          */
-        struct res_counter *res_parent = NULL;
-        struct cg_proto *cg_proto, *parent_cg;
         struct mem_cgroup *parent = parent_mem_cgroup(memcg);
+        struct page_counter *counter_parent = NULL;
+        struct cg_proto *cg_proto, *parent_cg;
 
         cg_proto = tcp_prot.proto_cgroup(memcg);
         if (!cg_proto)
@@ -29,9 +29,9 @@ int tcp_init_cgroup(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
 
         parent_cg = tcp_prot.proto_cgroup(parent);
         if (parent_cg)
-                res_parent = &parent_cg->memory_allocated;
+                counter_parent = &parent_cg->memory_allocated;
 
-        res_counter_init(&cg_proto->memory_allocated, res_parent);
+        page_counter_init(&cg_proto->memory_allocated, counter_parent);
         percpu_counter_init(&cg_proto->sockets_allocated, 0, GFP_KERNEL);
 
         return 0;
@@ -50,7 +50,7 @@ void tcp_destroy_cgroup(struct mem_cgroup *memcg)
 }
 EXPORT_SYMBOL(tcp_destroy_cgroup);
 
-static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
+static int tcp_update_limit(struct mem_cgroup *memcg, unsigned long nr_pages)
 {
         struct cg_proto *cg_proto;
         int i;
@@ -60,20 +60,17 @@ static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
         if (!cg_proto)
                 return -EINVAL;
 
-        if (val > RES_COUNTER_MAX)
-                val = RES_COUNTER_MAX;
-
-        ret = res_counter_set_limit(&cg_proto->memory_allocated, val);
+        ret = page_counter_limit(&cg_proto->memory_allocated, nr_pages);
         if (ret)
                 return ret;
 
         for (i = 0; i < 3; i++)
-                cg_proto->sysctl_mem[i] = min_t(long, val >> PAGE_SHIFT,
+                cg_proto->sysctl_mem[i] = min_t(long, nr_pages,
                                                 sysctl_tcp_mem[i]);
 
-        if (val == RES_COUNTER_MAX)
+        if (nr_pages == PAGE_COUNTER_MAX)
                 clear_bit(MEMCG_SOCK_ACTIVE, &cg_proto->flags);
-        else if (val != RES_COUNTER_MAX) {
+        else {
                 /*
                  * The active bit needs to be written after the static_key
                  * update. This is what guarantees that the socket activation
@@ -102,11 +99,20 @@ static int tcp_update_limit(struct mem_cgroup *memcg, u64 val)
         return 0;
 }
 
+enum {
+        RES_USAGE,
+        RES_LIMIT,
+        RES_MAX_USAGE,
+        RES_FAILCNT,
+};
+
+static DEFINE_MUTEX(tcp_limit_mutex);
+
 static ssize_t tcp_cgroup_write(struct kernfs_open_file *of,
                                 char *buf, size_t nbytes, loff_t off)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of));
-        unsigned long long val;
+        unsigned long nr_pages;
         int ret = 0;
 
         buf = strstrip(buf);
@@ -114,10 +120,12 @@ static ssize_t tcp_cgroup_write(struct kernfs_open_file *of,
         switch (of_cft(of)->private) {
         case RES_LIMIT:
                 /* see memcontrol.c */
-                ret = res_counter_memparse_write_strategy(buf, &val);
+                ret = page_counter_memparse(buf, &nr_pages);
                 if (ret)
                         break;
-                ret = tcp_update_limit(memcg, val);
+                mutex_lock(&tcp_limit_mutex);
+                ret = tcp_update_limit(memcg, nr_pages);
+                mutex_unlock(&tcp_limit_mutex);
                 break;
         default:
                 ret = -EINVAL;
@@ -126,43 +134,36 @@ static ssize_t tcp_cgroup_write(struct kernfs_open_file *of,
         return ret ?: nbytes;
 }
 
-static u64 tcp_read_stat(struct mem_cgroup *memcg, int type, u64 default_val)
-{
-        struct cg_proto *cg_proto;
-
-        cg_proto = tcp_prot.proto_cgroup(memcg);
-        if (!cg_proto)
-                return default_val;
-
-        return res_counter_read_u64(&cg_proto->memory_allocated, type);
-}
-
-static u64 tcp_read_usage(struct mem_cgroup *memcg)
-{
-        struct cg_proto *cg_proto;
-
-        cg_proto = tcp_prot.proto_cgroup(memcg);
-        if (!cg_proto)
-                return atomic_long_read(&tcp_memory_allocated) << PAGE_SHIFT;
-
-        return res_counter_read_u64(&cg_proto->memory_allocated, RES_USAGE);
-}
-
 static u64 tcp_cgroup_read(struct cgroup_subsys_state *css, struct cftype *cft)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
+        struct cg_proto *cg_proto = tcp_prot.proto_cgroup(memcg);
         u64 val;
 
         switch (cft->private) {
         case RES_LIMIT:
-                val = tcp_read_stat(memcg, RES_LIMIT, RES_COUNTER_MAX);
+                if (!cg_proto)
+                        return PAGE_COUNTER_MAX;
+                val = cg_proto->memory_allocated.limit;
+                val *= PAGE_SIZE;
                 break;
         case RES_USAGE:
-                val = tcp_read_usage(memcg);
+                if (!cg_proto)
+                        val = atomic_long_read(&tcp_memory_allocated);
+                else
+                        val = page_counter_read(&cg_proto->memory_allocated);
+                val *= PAGE_SIZE;
                 break;
         case RES_FAILCNT:
+                if (!cg_proto)
+                        return 0;
+                val = cg_proto->memory_allocated.failcnt;
+                break;
         case RES_MAX_USAGE:
-                val = tcp_read_stat(memcg, cft->private, 0);
+                if (!cg_proto)
+                        return 0;
+                val = cg_proto->memory_allocated.watermark;
+                val *= PAGE_SIZE;
                 break;
         default:
                 BUG();
@@ -183,10 +184,10 @@ static ssize_t tcp_cgroup_reset(struct kernfs_open_file *of,
 
         switch (of_cft(of)->private) {
         case RES_MAX_USAGE:
-                res_counter_reset_max(&cg_proto->memory_allocated);
+                page_counter_reset_watermark(&cg_proto->memory_allocated);
                 break;
         case RES_FAILCNT:
-                res_counter_reset_failcnt(&cg_proto->memory_allocated);
+                cg_proto->memory_allocated.failcnt = 0;
                 break;
         }
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 12c3c8ef3849..0e32d2e1bdbf 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -502,11 +502,11 @@ static int ip6gre_rcv(struct sk_buff *skb)
 
                 skb->protocol = gre_proto;
                 /* WCCP version 1 and 2 protocol decoding.
-                 * - Change protocol to IP
+                 * - Change protocol to IPv6
                  * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
                  */
                 if (flags == 0 && gre_proto == htons(ETH_P_WCCP)) {
-                        skb->protocol = htons(ETH_P_IP);
+                        skb->protocol = htons(ETH_P_IPV6);
                         if ((*(h + offset) & 0xF0) != 0x40)
                                 offset += 4;
                 }
@@ -961,8 +961,6 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
         else
                 dev->flags &= ~IFF_POINTOPOINT;
 
-        dev->iflink = p->link;
-
         /* Precalculate GRE options length */
         if (t->parms.o_flags&(GRE_CSUM|GRE_KEY|GRE_SEQ)) {
                 if (t->parms.o_flags&GRE_CSUM)
@@ -1272,6 +1270,7 @@ static int ip6gre_tunnel_init(struct net_device *dev)
                 u64_stats_init(&ip6gre_tunnel_stats->syncp);
         }
 
+        dev->iflink = tunnel->parms.link;
 
         return 0;
 }
@@ -1481,6 +1480,8 @@ static int ip6gre_tap_init(struct net_device *dev)
         if (!dev->tstats)
                 return -ENOMEM;
 
+        dev->iflink = tunnel->parms.link;
+
         return 0;
 }
 
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index a071563a7e6e..01e12d0d8fcc 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -69,7 +69,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         int nhoff;
 
         if (unlikely(skb_shinfo(skb)->gso_type &
-                     ~(SKB_GSO_UDP |
+                     ~(SKB_GSO_TCPV4 |
+                       SKB_GSO_UDP |
                        SKB_GSO_DODGY |
                        SKB_GSO_TCP_ECN |
                        SKB_GSO_GRE |
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 9409887fb664..9cb94cfa0ae7 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -272,9 +272,6 @@ static int ip6_tnl_create2(struct net_device *dev)
         int err;
 
         t = netdev_priv(dev);
-        err = ip6_tnl_dev_init(dev);
-        if (err < 0)
-                goto out;
 
         err = register_netdevice(dev);
         if (err < 0)
@@ -1462,6 +1459,7 @@ ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
 
 
 static const struct net_device_ops ip6_tnl_netdev_ops = {
+        .ndo_init       = ip6_tnl_dev_init,
         .ndo_uninit     = ip6_tnl_dev_uninit,
         .ndo_start_xmit = ip6_tnl_xmit,
         .ndo_do_ioctl   = ip6_tnl_ioctl,
@@ -1546,16 +1544,10 @@ static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
         struct ip6_tnl *t = netdev_priv(dev);
         struct net *net = dev_net(dev);
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-        int err = ip6_tnl_dev_init_gen(dev);
-
-        if (err)
-                return err;
 
         t->parms.proto = IPPROTO_IPV6;
         dev_hold(dev);
 
-        ip6_tnl_link_config(t);
-
         rcu_assign_pointer(ip6n->tnls_wc[0], t);
         return 0;
 }
diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
index b04ed72c4542..8db6c98fe218 100644
--- a/net/ipv6/ip6_udp_tunnel.c
+++ b/net/ipv6/ip6_udp_tunnel.c
@@ -79,15 +79,13 @@ int udp_tunnel6_xmit_skb(struct socket *sock, struct dst_entry *dst,
         uh->source = src_port;
 
         uh->len = htons(skb->len);
-        uh->check = 0;
 
         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED
                             | IPSKB_REROUTED);
         skb_dst_set(skb, dst);
 
-        udp6_set_csum(udp_get_no_check6_tx(sk), skb, &inet6_sk(sk)->saddr,
-                      &sk->sk_v6_daddr, skb->len);
+        udp6_set_csum(udp_get_no_check6_tx(sk), skb, saddr, daddr, skb->len);
 
         __skb_push(skb, sizeof(*ip6h));
         skb_reset_network_header(skb);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index d440bb585524..bcda14de7f84 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -172,10 +172,6 @@ static int vti6_tnl_create2(struct net_device *dev)
         struct vti6_net *ip6n = net_generic(net, vti6_net_id);
         int err;
 
-        err = vti6_dev_init(dev);
-        if (err < 0)
-                goto out;
-
         err = register_netdevice(dev);
         if (err < 0)
                 goto out;
@@ -783,6 +779,7 @@ static int vti6_change_mtu(struct net_device *dev, int new_mtu)
 }
 
 static const struct net_device_ops vti6_netdev_ops = {
+        .ndo_init       = vti6_dev_init,
         .ndo_uninit     = vti6_dev_uninit,
         .ndo_start_xmit = vti6_tnl_xmit,
         .ndo_do_ioctl   = vti6_ioctl,
@@ -852,16 +849,10 @@ static int __net_init vti6_fb_tnl_dev_init(struct net_device *dev)
         struct ip6_tnl *t = netdev_priv(dev);
         struct net *net = dev_net(dev);
         struct vti6_net *ip6n = net_generic(net, vti6_net_id);
-        int err = vti6_dev_init_gen(dev);
-
-        if (err)
-                return err;
 
         t->parms.proto = IPPROTO_IPV6;
         dev_hold(dev);
 
-        vti6_link_config(t);
-
         rcu_assign_pointer(ip6n->tnls_wc[0], t);
         return 0;
 }
@@ -914,6 +905,15 @@ static int vti6_newlink(struct net *src_net, struct net_device *dev,
         return vti6_tnl_create2(dev);
 }
 
+static void vti6_dellink(struct net_device *dev, struct list_head *head)
+{
+        struct net *net = dev_net(dev);
+        struct vti6_net *ip6n = net_generic(net, vti6_net_id);
+
+        if (dev != ip6n->fb_tnl_dev)
+                unregister_netdevice_queue(dev, head);
+}
+
 static int vti6_changelink(struct net_device *dev, struct nlattr *tb[],
                            struct nlattr *data[])
 {
@@ -989,6 +989,7 @@ static struct rtnl_link_ops vti6_link_ops __read_mostly = {
         .setup          = vti6_dev_setup,
         .validate       = vti6_validate,
         .newlink        = vti6_newlink,
+        .dellink        = vti6_dellink,
         .changelink     = vti6_changelink,
         .get_size       = vti6_get_size,
         .fill_info      = vti6_fill_info,
@@ -1029,6 +1030,7 @@ static int __net_init vti6_init_net(struct net *net)
         if (!ip6n->fb_tnl_dev)
                 goto err_alloc_dev;
         dev_net_set(ip6n->fb_tnl_dev, net);
+        ip6n->fb_tnl_dev->rtnl_link_ops = &vti6_link_ops;
 
         err = vti6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
         if (err < 0)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 0171f08325c3..1a01d79b8698 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1439,6 +1439,10 @@ reg_pernet_fail:
 
 void ip6_mr_cleanup(void)
 {
+        rtnl_unregister(RTNL_FAMILY_IP6MR, RTM_GETROUTE);
+#ifdef CONFIG_IPV6_PIMSM_V2
+        inet6_del_protocol(&pim6_protocol, IPPROTO_PIM);
+#endif
         unregister_netdevice_notifier(&ip6_mr_notifier);
         unregister_pernet_subsys(&ip6mr_net_ops);
         kmem_cache_destroy(mrt_cachep);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 9648de2b6745..ed2c4e400b46 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1550,7 +1550,7 @@ static void ip6_mc_hdr(struct sock *sk, struct sk_buff *skb,
         hdr->daddr = *daddr;
 }
 
-static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
+static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu)
 {
         struct net_device *dev = idev->dev;
         struct net *net = dev_net(dev);
@@ -1561,13 +1561,13 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
         const struct in6_addr *saddr;
         int hlen = LL_RESERVED_SPACE(dev);
         int tlen = dev->needed_tailroom;
+        unsigned int size = mtu + hlen + tlen;
         int err;
         u8 ra[8] = { IPPROTO_ICMPV6, 0,
                      IPV6_TLV_ROUTERALERT, 2, 0, 0,
                      IPV6_TLV_PADN, 0 };
 
         /* we assume size > sizeof(ra) here */
-        size += hlen + tlen;
         /* limit our allocations to order-0 page */
         size = min_t(int, size, SKB_MAX_ORDER(0, 0));
         skb = sock_alloc_send_skb(sk, size, 1, &err);
@@ -1576,6 +1576,8 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
                 return NULL;
 
         skb->priority = TC_PRIO_CONTROL;
+        skb->reserved_tailroom = skb_end_offset(skb) -
+                                 min(mtu, skb_end_offset(skb));
         skb_reserve(skb, hlen);
 
         if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
@@ -1690,8 +1692,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
         return skb;
 }
 
-#define AVAILABLE(skb) ((skb) ? ((skb)->dev ? (skb)->dev->mtu - (skb)->len : \
-        skb_tailroom(skb)) : 0)
+#define AVAILABLE(skb)  ((skb) ? skb_availroom(skb) : 0)
 
 static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
         int type, int gdeleted, int sdeleted, int crsend)
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 4cbc6b290dd5..b68d0e59c1f8 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -60,11 +60,11 @@ static bool ipv6_invert_tuple(struct nf_conntrack_tuple *tuple,
         return true;
 }
 
-static int ipv6_print_tuple(struct seq_file *s,
+static void ipv6_print_tuple(struct seq_file *s,
                             const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "src=%pI6 dst=%pI6 ",
-                          tuple->src.u3.ip6, tuple->dst.u3.ip6);
+        seq_printf(s, "src=%pI6 dst=%pI6 ",
+                   tuple->src.u3.ip6, tuple->dst.u3.ip6);
 }
 
 static int ipv6_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index b3807c5cb888..90388d606483 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -84,13 +84,13 @@ static bool icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
 }
 
 /* Print out the per-protocol part of the tuple. */
-static int icmpv6_print_tuple(struct seq_file *s,
+static void icmpv6_print_tuple(struct seq_file *s,
                               const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "type=%u code=%u id=%u ",
-                          tuple->dst.u.icmp.type,
-                          tuple->dst.u.icmp.code,
-                          ntohs(tuple->src.u.icmp.id));
+        seq_printf(s, "type=%u code=%u id=%u ",
+                   tuple->dst.u.icmp.type,
+                   tuple->dst.u.icmp.code,
+                   ntohs(tuple->src.u.icmp.id));
 }
 
 static unsigned int *icmpv6_get_timeouts(struct net *net)
diff --git a/net/ipv6/netfilter/nft_masq_ipv6.c b/net/ipv6/netfilter/nft_masq_ipv6.c
index 8a7ac685076d..529c119cbb14 100644
--- a/net/ipv6/netfilter/nft_masq_ipv6.c
+++ b/net/ipv6/netfilter/nft_masq_ipv6.c
@@ -25,6 +25,7 @@ static void nft_masq_ipv6_eval(const struct nft_expr *expr,
         struct nf_nat_range range;
         unsigned int verdict;
 
+        memset(&range, 0, sizeof(range));
         range.flags = priv->flags;
 
         verdict = nf_nat_masquerade_ipv6(pkt->skb, &range, pkt->out);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 58e5b4710127..a24557a1c1d8 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -195,10 +195,8 @@ static int ipip6_tunnel_create(struct net_device *dev)
         struct sit_net *sitn = net_generic(net, sit_net_id);
         int err;
 
-        err = ipip6_tunnel_init(dev);
-        if (err < 0)
-                goto out;
-        ipip6_tunnel_clone_6rd(dev, sitn);
+        memcpy(dev->dev_addr, &t->parms.iph.saddr, 4);
+        memcpy(dev->broadcast, &t->parms.iph.daddr, 4);
 
         if ((__force u16)t->parms.i_flags & SIT_ISATAP)
                 dev->priv_flags |= IFF_ISATAP;
@@ -207,7 +205,8 @@ static int ipip6_tunnel_create(struct net_device *dev)
         if (err < 0)
                 goto out;
 
-        strcpy(t->parms.name, dev->name);
+        ipip6_tunnel_clone_6rd(dev, sitn);
+
         dev->rtnl_link_ops = &sit_link_ops;
 
         dev_hold(dev);
@@ -1330,6 +1329,7 @@ static int ipip6_tunnel_change_mtu(struct net_device *dev, int new_mtu)
 }
 
 static const struct net_device_ops ipip6_netdev_ops = {
+        .ndo_init       = ipip6_tunnel_init,
         .ndo_uninit     = ipip6_tunnel_uninit,
         .ndo_start_xmit = sit_tunnel_xmit,
         .ndo_do_ioctl   = ipip6_tunnel_ioctl,
@@ -1378,9 +1378,7 @@ static int ipip6_tunnel_init(struct net_device *dev)
 
         tunnel->dev = dev;
         tunnel->net = dev_net(dev);
-
-        memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
-        memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
+        strcpy(tunnel->parms.name, dev->name);
 
         ipip6_tunnel_bind_dev(dev);
         dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
@@ -1405,7 +1403,6 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
 
         tunnel->dev = dev;
         tunnel->net = dev_net(dev);
-        strcpy(tunnel->parms.name, dev->name);
 
         iph->version            = 4;
         iph->protocol           = IPPROTO_IPV6;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ace29b60813c..dc495ae2ead0 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -903,7 +903,10 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
         if (th->rst)
                 return;
 
-        if (!ipv6_unicast_destination(skb))
+        /* If sk not NULL, it means we did a successful lookup and incoming
+         * route had to be correct. prequeue might have dropped our dst.
+         */
+        if (!sk && !ipv6_unicast_destination(skb))
                 return;
 
 #ifdef CONFIG_TCP_MD5SIG
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 91729b807c7d..1b095ca37aa4 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -1764,6 +1764,7 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct ipxhdr *ipx = NULL;
         struct sk_buff *skb;
         int copied, rc;
+        bool locked = true;
 
         lock_sock(sk);
         /* put the autobinding in */
@@ -1790,6 +1791,8 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (sock_flag(sk, SOCK_ZAPPED))
                 goto out;
 
+        release_sock(sk);
+        locked = false;
         skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
                                 flags & MSG_DONTWAIT, &rc);
         if (!skb) {
@@ -1826,7 +1829,8 @@ static int ipx_recvmsg(struct kiocb *iocb, struct socket *sock,
 out_free:
         skb_free_datagram(sk, skb);
 out:
-        release_sock(sk);
+        if (locked)
+                release_sock(sk);
         return rc;
 }
 
diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aes_ccm.c
index ec24378caaaf..09d9caaec591 100644
--- a/net/mac80211/aes_ccm.c
+++ b/net/mac80211/aes_ccm.c
@@ -53,6 +53,9 @@ int ieee80211_aes_ccm_decrypt(struct crypto_aead *tfm, u8 *b_0, u8 *aad,
                 __aligned(__alignof__(struct aead_request));
         struct aead_request *aead_req = (void *) aead_req_data;
 
+        if (data_len == 0)
+                return -EINVAL;
+
         memset(aead_req, 0, sizeof(aead_req_data));
 
         sg_init_one(&pt, data, data_len);
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 56b53571c807..509bc157ce55 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -805,7 +805,7 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 
         memset(&params, 0, sizeof(params));
         memset(&csa_ie, 0, sizeof(csa_ie));
-        err = ieee80211_parse_ch_switch_ie(sdata, elems, beacon,
+        err = ieee80211_parse_ch_switch_ie(sdata, elems,
                                            ifibss->chandef.chan->band,
                                            sta_flags, ifibss->bssid, &csa_ie);
         /* can't switch to destination channel, fail */
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c2aaec4dfcf0..8c68da30595d 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1642,7 +1642,6 @@ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
  * ieee80211_parse_ch_switch_ie - parses channel switch IEs
  * @sdata: the sdata of the interface which has received the frame
  * @elems: parsed 802.11 elements received with the frame
- * @beacon: indicates if the frame was a beacon or probe response
  * @current_band: indicates the current band
  * @sta_flags: contains information about own capabilities and restrictions
  *      to decide which channel switch announcements can be accepted. Only the
@@ -1656,7 +1655,7 @@ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
  * Return: 0 on success, <0 on error and >0 if there is nothing to parse.
  */
 int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
-                                 struct ieee802_11_elems *elems, bool beacon,
+                                 struct ieee802_11_elems *elems,
                                  enum ieee80211_band current_band,
                                  u32 sta_flags, u8 *bssid,
                                  struct ieee80211_csa_ie *csa_ie);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index af237223a8cd..653f5eb07a27 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -766,10 +766,12 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         int i, flushed;
         struct ps_data *ps;
         struct cfg80211_chan_def chandef;
+        bool cancel_scan;
 
         clear_bit(SDATA_STATE_RUNNING, &sdata->state);
 
-        if (rcu_access_pointer(local->scan_sdata) == sdata)
+        cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
+        if (cancel_scan)
                 ieee80211_scan_cancel(local);
 
         /*
@@ -898,6 +900,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 list_del(&sdata->u.vlan.list);
                 mutex_unlock(&local->mtx);
                 RCU_INIT_POINTER(sdata->vif.chanctx_conf, NULL);
+                /* see comment in the default case below */
+                ieee80211_free_keys(sdata, true);
                 /* no need to tell driver */
                 break;
         case NL80211_IFTYPE_MONITOR:
@@ -923,17 +927,16 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 /*
                  * When we get here, the interface is marked down.
                  * Free the remaining keys, if there are any
-                 * (shouldn't be, except maybe in WDS mode?)
+                 * (which can happen in AP mode if userspace sets
+                 * keys before the interface is operating, and maybe
+                 * also in WDS mode)
                  *
                  * Force the key freeing to always synchronize_net()
                  * to wait for the RX path in case it is using this
-                 * interface enqueuing frames * at this very time on
+                 * interface enqueuing frames at this very time on
                  * another CPU.
                  */
                 ieee80211_free_keys(sdata, true);
-
-                /* fall through */
-        case NL80211_IFTYPE_AP:
                 skb_queue_purge(&sdata->skb_queue);
         }
 
@@ -991,6 +994,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_recalc_ps(local, -1);
 
+        if (cancel_scan)
+                flush_delayed_work(&local->scan_work);
+
         if (local->open_count == 0) {
                 ieee80211_stop_device(local);
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index e9f99c1e3fad..0c8b2a77d312 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -874,7 +874,7 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
 
         memset(&params, 0, sizeof(params));
         memset(&csa_ie, 0, sizeof(csa_ie));
-        err = ieee80211_parse_ch_switch_ie(sdata, elems, beacon, band,
+        err = ieee80211_parse_ch_switch_ie(sdata, elems, band,
                                            sta_flags, sdata->vif.addr,
                                            &csa_ie);
         if (err < 0)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 2de88704278b..93af0f1c9d99 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1072,7 +1072,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
 
         current_band = cbss->channel->band;
         memset(&csa_ie, 0, sizeof(csa_ie));
-        res = ieee80211_parse_ch_switch_ie(sdata, elems, beacon, current_band,
+        res = ieee80211_parse_ch_switch_ie(sdata, elems, current_band,
                                            ifmgd->flags,
                                            ifmgd->associated->bssid, &csa_ie);
         if (res < 0)
@@ -1168,7 +1168,8 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                 ieee80211_queue_work(&local->hw, &ifmgd->chswitch_work);
         else
                 mod_timer(&ifmgd->chswitch_timer,
-                          TU_TO_EXP_TIME(csa_ie.count * cbss->beacon_interval));
+                          TU_TO_EXP_TIME((csa_ie.count - 1) *
+                                         cbss->beacon_interval));
 }
 
 static bool
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index df90ce2db00c..408fd8ab4eef 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -252,19 +252,16 @@ minstrel_ht_sort_best_tp_rates(struct minstrel_ht_sta *mi, u8 index,
         cur_thr = mi->groups[cur_group].rates[cur_idx].cur_tp;
         cur_prob = mi->groups[cur_group].rates[cur_idx].probability;
 
-        tmp_group = tp_list[j - 1] / MCS_GROUP_RATES;
-        tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES;
-        tmp_thr = mi->groups[tmp_group].rates[tmp_idx].cur_tp;
-        tmp_prob = mi->groups[tmp_group].rates[tmp_idx].probability;
-
-        while (j > 0 && (cur_thr > tmp_thr ||
-              (cur_thr == tmp_thr && cur_prob > tmp_prob))) {
-                j--;
+        do {
                 tmp_group = tp_list[j - 1] / MCS_GROUP_RATES;
                 tmp_idx = tp_list[j - 1] % MCS_GROUP_RATES;
                 tmp_thr = mi->groups[tmp_group].rates[tmp_idx].cur_tp;
                 tmp_prob = mi->groups[tmp_group].rates[tmp_idx].probability;
-        }
+                if (cur_thr < tmp_thr ||
+                    (cur_thr == tmp_thr && cur_prob <= tmp_prob))
+                        break;
+                j--;
+        } while (j > 0);
 
         if (j < MAX_THR_RATES - 1) {
                 memmove(&tp_list[j + 1], &tp_list[j], (sizeof(*tp_list) *
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index b04ca4049c95..a37f9af634cb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1678,11 +1678,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
         sc = le16_to_cpu(hdr->seq_ctrl);
         frag = sc & IEEE80211_SCTL_FRAG;
 
-        if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
-                   is_multicast_ether_addr(hdr->addr1))) {
-                /* not fragmented */
+        if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
+                goto out;
+
+        if (is_multicast_ether_addr(hdr->addr1)) {
+                rx->local->dot11MulticastReceivedFrameCount++;
                 goto out;
         }
+
         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
 
         if (skb_linearize(rx->skb))
@@ -1775,10 +1778,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
  out:
         if (rx->sta)
                 rx->sta->rx_packets++;
-        if (is_multicast_ether_addr(hdr->addr1))
-                rx->local->dot11MulticastReceivedFrameCount++;
-        else
-                ieee80211_led_rx(rx->local);
+        ieee80211_led_rx(rx->local);
         return RX_CONTINUE;
 }
 
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index 6ab009070084..efeba56c913b 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -22,7 +22,7 @@
 #include "wme.h"
 
 int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
-                                 struct ieee802_11_elems *elems, bool beacon,
+                                 struct ieee802_11_elems *elems,
                                  enum ieee80211_band current_band,
                                  u32 sta_flags, u8 *bssid,
                                  struct ieee80211_csa_ie *csa_ie)
@@ -91,19 +91,13 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata,
                 return -EINVAL;
         }
 
-        if (!beacon && sec_chan_offs) {
+        if (sec_chan_offs) {
                 secondary_channel_offset = sec_chan_offs->sec_chan_offs;
-        } else if (beacon && ht_oper) {
-                secondary_channel_offset =
-                        ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET;
         } else if (!(sta_flags & IEEE80211_STA_DISABLE_HT)) {
-                /* If it's not a beacon, HT is enabled and the IE not present,
-                 * it's 20 MHz, 802.11-2012 8.5.2.6:
-                 *      This element [the Secondary Channel Offset Element] is
-                 *      present when switching to a 40 MHz channel. It may be
-                 *      present when switching to a 20 MHz channel (in which
-                 *      case the secondary channel offset is set to SCN).
-                 */
+                /* If the secondary channel offset IE is not present,
+                 * we can't know what's the post-CSA offset, so the
+                 * best we can do is use 20MHz.
+                */
                 secondary_channel_offset = IEEE80211_HT_PARAM_CHA_SEC_NONE;
         }
 
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 86f9d76b1464..d259da3ce67a 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1863,6 +1863,12 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
         if (*op < IP_SET_OP_VERSION) {
                 /* Check the version at the beginning of operations */
                 struct ip_set_req_version *req_version = data;
+
+                if (*len < sizeof(struct ip_set_req_version)) {
+                        ret = -EINVAL;
+                        goto done;
+                }
+
                 if (req_version->version != IPSET_PROTOCOL) {
                         ret = -EPROTO;
                         goto done;
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 437a3663ad03..bd90bf8107da 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -846,6 +846,8 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af,
                 new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb)
                         goto error;
+                if (skb->sk)
+                        skb_set_owner_w(new_skb, skb->sk);
                 consume_skb(skb);
                 skb = new_skb;
         }
diff --git a/net/netfilter/nf_conntrack_l3proto_generic.c b/net/netfilter/nf_conntrack_l3proto_generic.c
index e7eb807fe07d..cf9ace70bece 100644
--- a/net/netfilter/nf_conntrack_l3proto_generic.c
+++ b/net/netfilter/nf_conntrack_l3proto_generic.c
@@ -49,10 +49,9 @@ static bool generic_invert_tuple(struct nf_conntrack_tuple *tuple,
         return true;
 }
 
-static int generic_print_tuple(struct seq_file *s,
-                            const struct nf_conntrack_tuple *tuple)
+static void generic_print_tuple(struct seq_file *s,
+                                const struct nf_conntrack_tuple *tuple)
 {
-        return 0;
 }
 
 static int generic_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index cb372f96f10d..6dd995c7c72b 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -618,17 +618,17 @@ out_invalid:
         return -NF_ACCEPT;
 }
 
-static int dccp_print_tuple(struct seq_file *s,
-                            const struct nf_conntrack_tuple *tuple)
+static void dccp_print_tuple(struct seq_file *s,
+                             const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "sport=%hu dport=%hu ",
-                          ntohs(tuple->src.u.dccp.port),
-                          ntohs(tuple->dst.u.dccp.port));
+        seq_printf(s, "sport=%hu dport=%hu ",
+                   ntohs(tuple->src.u.dccp.port),
+                   ntohs(tuple->dst.u.dccp.port));
 }
 
-static int dccp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
+static void dccp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
 {
-        return seq_printf(s, "%s ", dccp_state_names[ct->proto.dccp.state]);
+        seq_printf(s, "%s ", dccp_state_names[ct->proto.dccp.state]);
 }
 
 #if IS_ENABLED(CONFIG_NF_CT_NETLINK)
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index 957c1db66652..60865f110309 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -63,10 +63,9 @@ static bool generic_invert_tuple(struct nf_conntrack_tuple *tuple,
 }
 
 /* Print out the per-protocol part of the tuple. */
-static int generic_print_tuple(struct seq_file *s,
-                               const struct nf_conntrack_tuple *tuple)
+static void generic_print_tuple(struct seq_file *s,
+                                const struct nf_conntrack_tuple *tuple)
 {
-        return 0;
 }
 
 static unsigned int *generic_get_timeouts(struct net *net)
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index d5665739e3b1..7648674f29c3 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -226,20 +226,20 @@ static bool gre_pkt_to_tuple(const struct sk_buff *skb, unsigned int dataoff,
 }
 
 /* print gre part of tuple */
-static int gre_print_tuple(struct seq_file *s,
-                           const struct nf_conntrack_tuple *tuple)
+static void gre_print_tuple(struct seq_file *s,
+                            const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "srckey=0x%x dstkey=0x%x ",
-                          ntohs(tuple->src.u.gre.key),
-                          ntohs(tuple->dst.u.gre.key));
+        seq_printf(s, "srckey=0x%x dstkey=0x%x ",
+                   ntohs(tuple->src.u.gre.key),
+                   ntohs(tuple->dst.u.gre.key));
 }
 
 /* print private data for conntrack */
-static int gre_print_conntrack(struct seq_file *s, struct nf_conn *ct)
+static void gre_print_conntrack(struct seq_file *s, struct nf_conn *ct)
 {
-        return seq_printf(s, "timeout=%u, stream_timeout=%u ",
-                          (ct->proto.gre.timeout / HZ),
-                          (ct->proto.gre.stream_timeout / HZ));
+        seq_printf(s, "timeout=%u, stream_timeout=%u ",
+                   (ct->proto.gre.timeout / HZ),
+                   (ct->proto.gre.stream_timeout / HZ));
 }
 
 static unsigned int *gre_get_timeouts(struct net *net)
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 1314d33f6bcf..b45da90fad32 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -166,16 +166,16 @@ static bool sctp_invert_tuple(struct nf_conntrack_tuple *tuple,
 }
 
 /* Print out the per-protocol part of the tuple. */
-static int sctp_print_tuple(struct seq_file *s,
-                            const struct nf_conntrack_tuple *tuple)
+static void sctp_print_tuple(struct seq_file *s,
+                             const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "sport=%hu dport=%hu ",
-                          ntohs(tuple->src.u.sctp.port),
-                          ntohs(tuple->dst.u.sctp.port));
+        seq_printf(s, "sport=%hu dport=%hu ",
+                   ntohs(tuple->src.u.sctp.port),
+                   ntohs(tuple->dst.u.sctp.port));
 }
 
 /* Print out the private part of the conntrack. */
-static int sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
+static void sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
 {
         enum sctp_conntrack state;
 
@@ -183,7 +183,7 @@ static int sctp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
         state = ct->proto.sctp.state;
         spin_unlock_bh(&ct->lock);
 
-        return seq_printf(s, "%s ", sctp_conntrack_names[state]);
+        seq_printf(s, "%s ", sctp_conntrack_names[state]);
 }
 
 #define for_each_sctp_chunk(skb, sch, _sch, offset, dataoff, count)     \
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index d87b6423ffb2..5caa0c41bf26 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -302,16 +302,16 @@ static bool tcp_invert_tuple(struct nf_conntrack_tuple *tuple,
 }
 
 /* Print out the per-protocol part of the tuple. */
-static int tcp_print_tuple(struct seq_file *s,
-                           const struct nf_conntrack_tuple *tuple)
+static void tcp_print_tuple(struct seq_file *s,
+                            const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "sport=%hu dport=%hu ",
-                          ntohs(tuple->src.u.tcp.port),
-                          ntohs(tuple->dst.u.tcp.port));
+        seq_printf(s, "sport=%hu dport=%hu ",
+                   ntohs(tuple->src.u.tcp.port),
+                   ntohs(tuple->dst.u.tcp.port));
 }
 
 /* Print out the private part of the conntrack. */
-static int tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
+static void tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
 {
         enum tcp_conntrack state;
 
@@ -319,7 +319,7 @@ static int tcp_print_conntrack(struct seq_file *s, struct nf_conn *ct)
         state = ct->proto.tcp.state;
         spin_unlock_bh(&ct->lock);
 
-        return seq_printf(s, "%s ", tcp_conntrack_names[state]);
+        seq_printf(s, "%s ", tcp_conntrack_names[state]);
 }
 
 static unsigned int get_conntrack_index(const struct tcphdr *tcph)
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 9d7721cbce4b..6957281ffee5 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -63,12 +63,12 @@ static bool udp_invert_tuple(struct nf_conntrack_tuple *tuple,
 }
 
 /* Print out the per-protocol part of the tuple. */
-static int udp_print_tuple(struct seq_file *s,
-                           const struct nf_conntrack_tuple *tuple)
+static void udp_print_tuple(struct seq_file *s,
+                            const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "sport=%hu dport=%hu ",
-                          ntohs(tuple->src.u.udp.port),
-                          ntohs(tuple->dst.u.udp.port));
+        seq_printf(s, "sport=%hu dport=%hu ",
+                   ntohs(tuple->src.u.udp.port),
+                   ntohs(tuple->dst.u.udp.port));
 }
 
 static unsigned int *udp_get_timeouts(struct net *net)
diff --git a/net/netfilter/nf_conntrack_proto_udplite.c b/net/netfilter/nf_conntrack_proto_udplite.c
index 2750e6c69f82..c5903d1649f9 100644
--- a/net/netfilter/nf_conntrack_proto_udplite.c
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -71,12 +71,12 @@ static bool udplite_invert_tuple(struct nf_conntrack_tuple *tuple,
 }
 
 /* Print out the per-protocol part of the tuple. */
-static int udplite_print_tuple(struct seq_file *s,
-                               const struct nf_conntrack_tuple *tuple)
+static void udplite_print_tuple(struct seq_file *s,
+                                const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "sport=%hu dport=%hu ",
-                          ntohs(tuple->src.u.udp.port),
-                          ntohs(tuple->dst.u.udp.port));
+        seq_printf(s, "sport=%hu dport=%hu ",
+                   ntohs(tuple->src.u.udp.port),
+                   ntohs(tuple->dst.u.udp.port));
 }
 
 static unsigned int *udplite_get_timeouts(struct net *net)
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index cf65a1e040dd..fc823fa5dcf5 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -36,12 +36,13 @@
 MODULE_LICENSE("GPL");
 
 #ifdef CONFIG_NF_CONNTRACK_PROCFS
-int
+void
 print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
             const struct nf_conntrack_l3proto *l3proto,
             const struct nf_conntrack_l4proto *l4proto)
 {
-        return l3proto->print_tuple(s, tuple) || l4proto->print_tuple(s, tuple);
+        l3proto->print_tuple(s, tuple);
+        l4proto->print_tuple(s, tuple);
 }
 EXPORT_SYMBOL_GPL(print_tuple);
 
@@ -119,7 +120,7 @@ static void ct_seq_stop(struct seq_file *s, void *v)
 }
 
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
-static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
+static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
 {
         int ret;
         u32 len;
@@ -127,22 +128,20 @@ static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
 
         ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
         if (ret)
-                return 0;
+                return;
 
-        ret = seq_printf(s, "secctx=%s ", secctx);
+        seq_printf(s, "secctx=%s ", secctx);
 
         security_release_secctx(secctx, len);
-        return ret;
 }
 #else
-static inline int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
+static inline void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
 {
-        return 0;
 }
 #endif
 
 #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP
-static int ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
+static void ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
 {
         struct ct_iter_state *st = s->private;
         struct nf_conn_tstamp *tstamp;
@@ -156,16 +155,15 @@ static int ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
                 else
                         delta_time = 0;
 
-                return seq_printf(s, "delta-time=%llu ",
-                                  (unsigned long long)delta_time);
+                seq_printf(s, "delta-time=%llu ",
+                           (unsigned long long)delta_time);
         }
-        return 0;
+        return;
 }
 #else
-static inline int
+static inline void
 ct_show_delta_time(struct seq_file *s, const struct nf_conn *ct)
 {
-        return 0;
 }
 #endif
 
@@ -192,55 +190,54 @@ static int ct_seq_show(struct seq_file *s, void *v)
         NF_CT_ASSERT(l4proto);
 
         ret = -ENOSPC;
-        if (seq_printf(s, "%-8s %u %-8s %u %ld ",
-                       l3proto->name, nf_ct_l3num(ct),
-                       l4proto->name, nf_ct_protonum(ct),
-                       timer_pending(&ct->timeout)
-                       ? (long)(ct->timeout.expires - jiffies)/HZ : 0) != 0)
-                goto release;
+        seq_printf(s, "%-8s %u %-8s %u %ld ",
+                   l3proto->name, nf_ct_l3num(ct),
+                   l4proto->name, nf_ct_protonum(ct),
+                   timer_pending(&ct->timeout)
+                   ? (long)(ct->timeout.expires - jiffies)/HZ : 0);
 
-        if (l4proto->print_conntrack && l4proto->print_conntrack(s, ct))
-                goto release;
+        if (l4proto->print_conntrack)
+                l4proto->print_conntrack(s, ct);
+
+        print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                    l3proto, l4proto);
 
-        if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
-                        l3proto, l4proto))
+        if (seq_has_overflowed(s))
                 goto release;
 
         if (seq_print_acct(s, ct, IP_CT_DIR_ORIGINAL))
                 goto release;
 
         if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status)))
-                if (seq_printf(s, "[UNREPLIED] "))
-                        goto release;
+                seq_printf(s, "[UNREPLIED] ");
 
-        if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
-                        l3proto, l4proto))
-                goto release;
+        print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
+                    l3proto, l4proto);
 
         if (seq_print_acct(s, ct, IP_CT_DIR_REPLY))
                 goto release;
 
         if (test_bit(IPS_ASSURED_BIT, &ct->status))
-                if (seq_printf(s, "[ASSURED] "))
-                        goto release;
+                seq_printf(s, "[ASSURED] ");
 
-#if defined(CONFIG_NF_CONNTRACK_MARK)
-        if (seq_printf(s, "mark=%u ", ct->mark))
+        if (seq_has_overflowed(s))
                 goto release;
+
+#if defined(CONFIG_NF_CONNTRACK_MARK)
+        seq_printf(s, "mark=%u ", ct->mark);
 #endif
 
-        if (ct_show_secctx(s, ct))
-                goto release;
+        ct_show_secctx(s, ct);
 
 #ifdef CONFIG_NF_CONNTRACK_ZONES
-        if (seq_printf(s, "zone=%u ", nf_ct_zone(ct)))
-                goto release;
+        seq_printf(s, "zone=%u ", nf_ct_zone(ct));
 #endif
 
-        if (ct_show_delta_time(s, ct))
-                goto release;
+        ct_show_delta_time(s, ct);
+
+        seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use));
 
-        if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)))
+        if (seq_has_overflowed(s))
                 goto release;
 
         ret = 0;
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index d7197649dba6..6e3b9117db1f 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -294,19 +294,19 @@ static int seq_show(struct seq_file *s, void *v)
 {
         loff_t *pos = v;
         const struct nf_logger *logger;
-        int i, ret;
+        int i;
         struct net *net = seq_file_net(s);
 
         logger = rcu_dereference_protected(net->nf.nf_loggers[*pos],
                                            lockdep_is_held(&nf_log_mutex));
 
         if (!logger)
-                ret = seq_printf(s, "%2lld NONE (", *pos);
+                seq_printf(s, "%2lld NONE (", *pos);
         else
-                ret = seq_printf(s, "%2lld %s (", *pos, logger->name);
+                seq_printf(s, "%2lld %s (", *pos, logger->name);
 
-        if (ret < 0)
-                return ret;
+        if (seq_has_overflowed(s))
+                return -ENOSPC;
 
         for (i = 0; i < NF_LOG_TYPE_MAX; i++) {
                 if (loggers[*pos][i] == NULL)
@@ -314,17 +314,19 @@ static int seq_show(struct seq_file *s, void *v)
 
                 logger = rcu_dereference_protected(loggers[*pos][i],
                                            lockdep_is_held(&nf_log_mutex));
-                ret = seq_printf(s, "%s", logger->name);
-                if (ret < 0)
-                        return ret;
-                if (i == 0 && loggers[*pos][i + 1] != NULL) {
-                        ret = seq_printf(s, ",");
-                        if (ret < 0)
-                                return ret;
-                }
+                seq_printf(s, "%s", logger->name);
+                if (i == 0 && loggers[*pos][i + 1] != NULL)
+                        seq_printf(s, ",");
+
+                if (seq_has_overflowed(s))
+                        return -ENOSPC;
         }
 
-        return seq_printf(s, ")\n");
+        seq_printf(s, ")\n");
+
+        if (seq_has_overflowed(s))
+                return -ENOSPC;
+        return 0;
 }
 
 static const struct seq_operations nflog_seq_ops = {
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 11ab4b078f3b..66e8425dbfe7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3484,13 +3484,8 @@ static void nft_chain_commit_update(struct nft_trans *trans)
         }
 }
 
-/* Schedule objects for release via rcu to make sure no packets are accesing
- * removed rules.
- */
-static void nf_tables_commit_release_rcu(struct rcu_head *rt)
+static void nf_tables_commit_release(struct nft_trans *trans)
 {
-        struct nft_trans *trans = container_of(rt, struct nft_trans, rcu_head);
-
         switch (trans->msg_type) {
         case NFT_MSG_DELTABLE:
                 nf_tables_table_destroy(&trans->ctx);
@@ -3612,10 +3607,11 @@ static int nf_tables_commit(struct sk_buff *skb)
                 }
         }
 
+        synchronize_rcu();
+
         list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
                 list_del(&trans->list);
-                trans->ctx.nla = NULL;
-                call_rcu(&trans->rcu_head, nf_tables_commit_release_rcu);
+                nf_tables_commit_release(trans);
         }
 
         nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
@@ -3623,13 +3619,8 @@ static int nf_tables_commit(struct sk_buff *skb)
         return 0;
 }
 
-/* Schedule objects for release via rcu to make sure no packets are accesing
- * aborted rules.
- */
-static void nf_tables_abort_release_rcu(struct rcu_head *rt)
+static void nf_tables_abort_release(struct nft_trans *trans)
 {
-        struct nft_trans *trans = container_of(rt, struct nft_trans, rcu_head);
-
         switch (trans->msg_type) {
         case NFT_MSG_NEWTABLE:
                 nf_tables_table_destroy(&trans->ctx);
@@ -3725,11 +3716,12 @@ static int nf_tables_abort(struct sk_buff *skb)
                 }
         }
 
+        synchronize_rcu();
+
         list_for_each_entry_safe_reverse(trans, next,
                                          &net->nft.commit_list, list) {
                 list_del(&trans->list);
-                trans->ctx.nla = NULL;
-                call_rcu(&trans->rcu_head, nf_tables_abort_release_rcu);
+                nf_tables_abort_release(trans);
         }
 
         return 0;
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 6c5a915cfa75..13c2e17bbe27 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -47,6 +47,8 @@ static const int nfnl_group2type[NFNLGRP_MAX+1] = {
         [NFNLGRP_CONNTRACK_EXP_NEW]     = NFNL_SUBSYS_CTNETLINK_EXP,
         [NFNLGRP_CONNTRACK_EXP_UPDATE]  = NFNL_SUBSYS_CTNETLINK_EXP,
         [NFNLGRP_CONNTRACK_EXP_DESTROY] = NFNL_SUBSYS_CTNETLINK_EXP,
+        [NFNLGRP_NFTABLES]              = NFNL_SUBSYS_NFTABLES,
+        [NFNLGRP_ACCT_QUOTA]            = NFNL_SUBSYS_ACCT,
 };
 
 void nfnl_lock(__u8 subsys_id)
@@ -464,7 +466,12 @@ static void nfnetlink_rcv(struct sk_buff *skb)
 static int nfnetlink_bind(int group)
 {
         const struct nfnetlink_subsystem *ss;
-        int type = nfnl_group2type[group];
+        int type;
+
+        if (group <= NFNLGRP_NONE || group > NFNLGRP_MAX)
+                return -EINVAL;
+
+        type = nfnl_group2type[group];
 
         rcu_read_lock();
         ss = nfnetlink_get_subsys(type);
@@ -514,6 +521,9 @@ static int __init nfnetlink_init(void)
 {
         int i;
 
+        for (i = NFNLGRP_NONE + 1; i <= NFNLGRP_MAX; i++)
+                BUG_ON(nfnl_group2type[i] == NFNL_SUBSYS_NONE);
+
         for (i=0; i<NFNL_SUBSYS_COUNT; i++)
                 mutex_init(&table[i].mutex);
 
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 7c60ccd61a3e..0db8515e76da 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -1242,12 +1242,13 @@ static int seq_show(struct seq_file *s, void *v)
 {
         const struct nfqnl_instance *inst = v;
 
-        return seq_printf(s, "%5d %6d %5d %1d %5d %5d %5d %8d %2d\n",
-                          inst->queue_num,
-                          inst->peer_portid, inst->queue_total,
-                          inst->copy_mode, inst->copy_range,
-                          inst->queue_dropped, inst->queue_user_dropped,
-                          inst->id_sequence, 1);
+        seq_printf(s, "%5d %6d %5d %1d %5d %5d %5d %8d %2d\n",
+                   inst->queue_num,
+                   inst->peer_portid, inst->queue_total,
+                   inst->copy_mode, inst->copy_range,
+                   inst->queue_dropped, inst->queue_user_dropped,
+                   inst->id_sequence, 1);
+        return seq_has_overflowed(s);
 }
 
 static const struct seq_operations nfqnl_seq_ops = {
diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
index 9d6d6f60a80f..265e190f2218 100644
--- a/net/netfilter/nft_compat.c
+++ b/net/netfilter/nft_compat.c
@@ -21,45 +21,17 @@
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <net/netfilter/nf_tables.h>
 
-static const struct {
-       const char       *name;
-       u8               type;
-} table_to_chaintype[] = {
-       { "filter",     NFT_CHAIN_T_DEFAULT },
-       { "raw",        NFT_CHAIN_T_DEFAULT },
-       { "security",   NFT_CHAIN_T_DEFAULT },
-       { "mangle",     NFT_CHAIN_T_ROUTE },
-       { "nat",        NFT_CHAIN_T_NAT },
-       { },
-};
-
-static int nft_compat_table_to_chaintype(const char *table)
-{
-        int i;
-
-        for (i = 0; table_to_chaintype[i].name != NULL; i++) {
-                if (strcmp(table_to_chaintype[i].name, table) == 0)
-                        return table_to_chaintype[i].type;
-        }
-
-        return -1;
-}
-
 static int nft_compat_chain_validate_dependency(const char *tablename,
                                                 const struct nft_chain *chain)
 {
-        enum nft_chain_type type;
         const struct nft_base_chain *basechain;
 
         if (!tablename || !(chain->flags & NFT_BASE_CHAIN))
                 return 0;
 
-        type = nft_compat_table_to_chaintype(tablename);
-        if (type < 0)
-                return -EINVAL;
-
         basechain = nft_base_chain(chain);
-        if (basechain->type->type != type)
+        if (strcmp(tablename, "nat") == 0 &&
+            basechain->type->type != NFT_CHAIN_T_NAT)
                 return -EINVAL;
 
         return 0;
@@ -117,7 +89,7 @@ nft_target_set_tgchk_param(struct xt_tgchk_param *par,
                            struct xt_target *target, void *info,
                            union nft_entry *entry, u8 proto, bool inv)
 {
-        par->net        = &init_net;
+        par->net        = ctx->net;
         par->table      = ctx->table->name;
         switch (ctx->afi->family) {
         case AF_INET:
@@ -324,7 +296,7 @@ nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx,
                           struct xt_match *match, void *info,
                           union nft_entry *entry, u8 proto, bool inv)
 {
-        par->net        = &init_net;
+        par->net        = ctx->net;
         par->table      = ctx->table->name;
         switch (ctx->afi->family) {
         case AF_INET:
@@ -374,7 +346,7 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
         union nft_entry e = {};
         int ret;
 
-        ret = nft_compat_chain_validate_dependency(match->name, ctx->chain);
+        ret = nft_compat_chain_validate_dependency(match->table, ctx->chain);
         if (ret < 0)
                 goto err;
 
@@ -448,7 +420,7 @@ static int nft_match_validate(const struct nft_ctx *ctx,
                 if (!(hook_mask & match->hooks))
                         return -EINVAL;
 
-                ret = nft_compat_chain_validate_dependency(match->name,
+                ret = nft_compat_chain_validate_dependency(match->table,
                                                            ctx->chain);
                 if (ret < 0)
                         return ret;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 133eb4772f12..51a459c3c649 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -947,9 +947,10 @@ static int xt_table_seq_show(struct seq_file *seq, void *v)
 {
         struct xt_table *table = list_entry(v, struct xt_table, list);
 
-        if (strlen(table->name))
-                return seq_printf(seq, "%s\n", table->name);
-        else
+        if (strlen(table->name)) {
+                seq_printf(seq, "%s\n", table->name);
+                return seq_has_overflowed(seq);
+        } else
                 return 0;
 }
 
@@ -1086,8 +1087,10 @@ static int xt_match_seq_show(struct seq_file *seq, void *v)
                 if (trav->curr == trav->head)
                         return 0;
                 match = list_entry(trav->curr, struct xt_match, list);
-                return (*match->name == '\0') ? 0 :
-                       seq_printf(seq, "%s\n", match->name);
+                if (*match->name == '\0')
+                        return 0;
+                seq_printf(seq, "%s\n", match->name);
+                return seq_has_overflowed(seq);
         }
         return 0;
 }
@@ -1139,8 +1142,10 @@ static int xt_target_seq_show(struct seq_file *seq, void *v)
                 if (trav->curr == trav->head)
                         return 0;
                 target = list_entry(trav->curr, struct xt_target, list);
-                return (*target->name == '\0') ? 0 :
-                       seq_printf(seq, "%s\n", target->name);
+                if (*target->name == '\0')
+                        return 0;
+                seq_printf(seq, "%s\n", target->name);
+                return seq_has_overflowed(seq);
         }
         return 0;
 }
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 05fbc2a0be46..178696852bde 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -789,7 +789,6 @@ static void dl_seq_stop(struct seq_file *s, void *v)
 static int dl_seq_real_show(struct dsthash_ent *ent, u_int8_t family,
                                    struct seq_file *s)
 {
-        int res;
         const struct xt_hashlimit_htable *ht = s->private;
 
         spin_lock(&ent->lock);
@@ -798,33 +797,32 @@ static int dl_seq_real_show(struct dsthash_ent *ent, u_int8_t family,
 
         switch (family) {
         case NFPROTO_IPV4:
-                res = seq_printf(s, "%ld %pI4:%u->%pI4:%u %u %u %u\n",
-                                 (long)(ent->expires - jiffies)/HZ,
-                                 &ent->dst.ip.src,
-                                 ntohs(ent->dst.src_port),
-                                 &ent->dst.ip.dst,
-                                 ntohs(ent->dst.dst_port),
-                                 ent->rateinfo.credit, ent->rateinfo.credit_cap,
-                                 ent->rateinfo.cost);
+                seq_printf(s, "%ld %pI4:%u->%pI4:%u %u %u %u\n",
+                           (long)(ent->expires - jiffies)/HZ,
+                           &ent->dst.ip.src,
+                           ntohs(ent->dst.src_port),
+                           &ent->dst.ip.dst,
+                           ntohs(ent->dst.dst_port),
+                           ent->rateinfo.credit, ent->rateinfo.credit_cap,
+                           ent->rateinfo.cost);
                 break;
 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
         case NFPROTO_IPV6:
-                res = seq_printf(s, "%ld %pI6:%u->%pI6:%u %u %u %u\n",
-                                 (long)(ent->expires - jiffies)/HZ,
-                                 &ent->dst.ip6.src,
-                                 ntohs(ent->dst.src_port),
-                                 &ent->dst.ip6.dst,
-                                 ntohs(ent->dst.dst_port),
-                                 ent->rateinfo.credit, ent->rateinfo.credit_cap,
-                                 ent->rateinfo.cost);
+                seq_printf(s, "%ld %pI6:%u->%pI6:%u %u %u %u\n",
+                           (long)(ent->expires - jiffies)/HZ,
+                           &ent->dst.ip6.src,
+                           ntohs(ent->dst.src_port),
+                           &ent->dst.ip6.dst,
+                           ntohs(ent->dst.dst_port),
+                           ent->rateinfo.credit, ent->rateinfo.credit_cap,
+                           ent->rateinfo.cost);
                 break;
 #endif
         default:
                 BUG();
-                res = 0;
         }
         spin_unlock(&ent->lock);
-        return res;
+        return seq_has_overflowed(s);
 }
 
 static int dl_seq_show(struct seq_file *s, void *v)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index f1de72de273e..0007b8180397 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1440,7 +1440,7 @@ static void netlink_unbind(int group, long unsigned int groups,
                 return;
 
         for (undo = 0; undo < group; undo++)
-                if (test_bit(group, &groups))
+                if (test_bit(undo, &groups))
                         nlk->netlink_unbind(undo);
 }
 
@@ -1492,7 +1492,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
                         netlink_insert(sk, net, nladdr->nl_pid) :
                         netlink_autobind(sock);
                 if (err) {
-                        netlink_unbind(nlk->ngroups - 1, groups, nlk);
+                        netlink_unbind(nlk->ngroups, groups, nlk);
                         return err;
                 }
         }
@@ -2509,6 +2509,7 @@ __netlink_kernel_create(struct net *net, int unit, struct module *module,
                 nl_table[unit].module = module;
                 if (cfg) {
                         nl_table[unit].bind = cfg->bind;
+                        nl_table[unit].unbind = cfg->unbind;
                         nl_table[unit].flags = cfg->flags;
                         if (cfg->compare)
                                 nl_table[unit].compare = cfg->compare;
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 006886dbee36..8c4229b11c34 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -246,11 +246,11 @@ static void update_ipv6_checksum(struct sk_buff *skb, u8 l4_proto,
 {
         int transport_len = skb->len - skb_transport_offset(skb);
 
-        if (l4_proto == IPPROTO_TCP) {
+        if (l4_proto == NEXTHDR_TCP) {
                 if (likely(transport_len >= sizeof(struct tcphdr)))
                         inet_proto_csum_replace16(&tcp_hdr(skb)->check, skb,
                                                   addr, new_addr, 1);
-        } else if (l4_proto == IPPROTO_UDP) {
+        } else if (l4_proto == NEXTHDR_UDP) {
                 if (likely(transport_len >= sizeof(struct udphdr))) {
                         struct udphdr *uh = udp_hdr(skb);
 
@@ -261,6 +261,10 @@ static void update_ipv6_checksum(struct sk_buff *skb, u8 l4_proto,
                                         uh->check = CSUM_MANGLED_0;
                         }
                 }
+        } else if (l4_proto == NEXTHDR_ICMP) {
+                if (likely(transport_len >= sizeof(struct icmp6hdr)))
+                        inet_proto_csum_replace16(&icmp6_hdr(skb)->icmp6_cksum,
+                                                  skb, addr, new_addr, 1);
         }
 }
 
@@ -722,8 +726,6 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb,
 
                 case OVS_ACTION_ATTR_SAMPLE:
                         err = sample(dp, skb, key, a);
-                        if (unlikely(err)) /* skb already freed. */
-                                return err;
                         break;
                 }
 
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index e6d7255183eb..f9e556b56086 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1265,7 +1265,7 @@ static size_t ovs_dp_cmd_msg_size(void)
         return msgsize;
 }
 
-/* Called with ovs_mutex or RCU read lock. */
+/* Called with ovs_mutex. */
 static int ovs_dp_cmd_fill_info(struct datapath *dp, struct sk_buff *skb,
                                 u32 portid, u32 seq, u32 flags, u8 cmd)
 {
@@ -1555,7 +1555,7 @@ static int ovs_dp_cmd_get(struct sk_buff *skb, struct genl_info *info)
         if (!reply)
                 return -ENOMEM;
 
-        rcu_read_lock();
+        ovs_lock();
         dp = lookup_datapath(sock_net(skb->sk), info->userhdr, info->attrs);
         if (IS_ERR(dp)) {
                 err = PTR_ERR(dp);
@@ -1564,12 +1564,12 @@ static int ovs_dp_cmd_get(struct sk_buff *skb, struct genl_info *info)
         err = ovs_dp_cmd_fill_info(dp, reply, info->snd_portid,
                                    info->snd_seq, 0, OVS_DP_CMD_NEW);
         BUG_ON(err < 0);
-        rcu_read_unlock();
+        ovs_unlock();
 
         return genlmsg_reply(reply, info);
 
 err_unlock_free:
-        rcu_read_unlock();
+        ovs_unlock();
         kfree_skb(reply);
         return err;
 }
@@ -1581,8 +1581,8 @@ static int ovs_dp_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int skip = cb->args[0];
         int i = 0;
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(dp, &ovs_net->dps, list_node) {
+        ovs_lock();
+        list_for_each_entry(dp, &ovs_net->dps, list_node) {
                 if (i >= skip &&
                     ovs_dp_cmd_fill_info(dp, skb, NETLINK_CB(cb->skb).portid,
                                          cb->nlh->nlmsg_seq, NLM_F_MULTI,
@@ -1590,7 +1590,7 @@ static int ovs_dp_cmd_dump(struct sk_buff *skb, struct netlink_callback *cb)
                         break;
                 i++;
         }
-        rcu_read_unlock();
+        ovs_unlock();
 
         cb->args[0] = i;
 
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 939bcb32100f..089b195c064a 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -145,7 +145,7 @@ static bool match_validate(const struct sw_flow_match *match,
         if (match->key->eth.type == htons(ETH_P_ARP)
                         || match->key->eth.type == htons(ETH_P_RARP)) {
                 key_expected |= 1 << OVS_KEY_ATTR_ARP;
-                if (match->mask && (match->mask->key.eth.type == htons(0xffff)))
+                if (match->mask && (match->mask->key.tp.src == htons(0xff)))
                         mask_allowed |= 1 << OVS_KEY_ATTR_ARP;
         }
 
@@ -689,6 +689,13 @@ static int ovs_key_from_nlattrs(struct sw_flow_match *match, u64 attrs,
                                 ipv6_key->ipv6_frag, OVS_FRAG_TYPE_MAX);
                         return -EINVAL;
                 }
+
+                if (!is_mask && ipv6_key->ipv6_label & htonl(0xFFF00000)) {
+                        OVS_NLERR("IPv6 flow label %x is out of range (max=%x).\n",
+                                  ntohl(ipv6_key->ipv6_label), (1 << 20) - 1);
+                        return -EINVAL;
+                }
+
                 SW_FLOW_KEY_PUT(match, ipv6.label,
                                 ipv6_key->ipv6_label, is_mask);
                 SW_FLOW_KEY_PUT(match, ip.proto,
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 87d20f48ff06..586229a14ad3 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -378,7 +378,7 @@ static void unregister_prot_hook(struct sock *sk, bool sync)
                 __unregister_prot_hook(sk, sync);
 }
 
-static inline __pure struct page *pgv_to_page(void *addr)
+static inline struct page * __pure pgv_to_page(void *addr)
 {
         if (is_vmalloc_addr(addr))
                 return vmalloc_to_page(addr);
@@ -2444,13 +2444,15 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                         goto out_unlock;
 
                 if ((vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
-                    (vnet_hdr.csum_start + vnet_hdr.csum_offset + 2 >
-                      vnet_hdr.hdr_len))
-                        vnet_hdr.hdr_len = vnet_hdr.csum_start +
-                                                 vnet_hdr.csum_offset + 2;
+                    (__virtio16_to_cpu(false, vnet_hdr.csum_start) +
+                     __virtio16_to_cpu(false, vnet_hdr.csum_offset) + 2 >
+                      __virtio16_to_cpu(false, vnet_hdr.hdr_len)))
+                        vnet_hdr.hdr_len = __cpu_to_virtio16(false,
+                                 __virtio16_to_cpu(false, vnet_hdr.csum_start) +
+                                __virtio16_to_cpu(false, vnet_hdr.csum_offset) + 2);
 
                 err = -EINVAL;
-                if (vnet_hdr.hdr_len > len)
+                if (__virtio16_to_cpu(false, vnet_hdr.hdr_len) > len)
                         goto out_unlock;
 
                 if (vnet_hdr.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
@@ -2492,7 +2494,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         err = -ENOBUFS;
         hlen = LL_RESERVED_SPACE(dev);
         tlen = dev->needed_tailroom;
-        skb = packet_alloc_skb(sk, hlen + tlen, hlen, len, vnet_hdr.hdr_len,
+        skb = packet_alloc_skb(sk, hlen + tlen, hlen, len,
+                               __virtio16_to_cpu(false, vnet_hdr.hdr_len),
                                msg->msg_flags & MSG_DONTWAIT, &err);
         if (skb == NULL)
                 goto out_unlock;
@@ -2534,14 +2537,16 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 
         if (po->has_vnet_hdr) {
                 if (vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
-                        if (!skb_partial_csum_set(skb, vnet_hdr.csum_start,
-                                                  vnet_hdr.csum_offset)) {
+                        u16 s = __virtio16_to_cpu(false, vnet_hdr.csum_start);
+                        u16 o = __virtio16_to_cpu(false, vnet_hdr.csum_offset);
+                        if (!skb_partial_csum_set(skb, s, o)) {
                                 err = -EINVAL;
                                 goto out_free;
                         }
                 }
 
-                skb_shinfo(skb)->gso_size = vnet_hdr.gso_size;
+                skb_shinfo(skb)->gso_size =
+                        __virtio16_to_cpu(false, vnet_hdr.gso_size);
                 skb_shinfo(skb)->gso_type = gso_type;
 
                 /* Header must be checked, and gso_segs computed. */
@@ -2912,8 +2917,10 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
                         struct skb_shared_info *sinfo = skb_shinfo(skb);
 
                         /* This is a hint as to how much should be linear. */
-                        vnet_hdr.hdr_len = skb_headlen(skb);
-                        vnet_hdr.gso_size = sinfo->gso_size;
+                        vnet_hdr.hdr_len =
+                                __cpu_to_virtio16(false, skb_headlen(skb));
+                        vnet_hdr.gso_size =
+                                __cpu_to_virtio16(false, sinfo->gso_size);
                         if (sinfo->gso_type & SKB_GSO_TCPV4)
                                 vnet_hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                         else if (sinfo->gso_type & SKB_GSO_TCPV6)
@@ -2931,8 +2938,10 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                 if (skb->ip_summed == CHECKSUM_PARTIAL) {
                         vnet_hdr.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
-                        vnet_hdr.csum_start = skb_checksum_start_offset(skb);
-                        vnet_hdr.csum_offset = skb->csum_offset;
+                        vnet_hdr.csum_start = __cpu_to_virtio16(false,
+                                          skb_checksum_start_offset(skb));
+                        vnet_hdr.csum_offset = __cpu_to_virtio16(false,
+                                                         skb->csum_offset);
                 } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
                         vnet_hdr.flags = VIRTIO_NET_HDR_F_DATA_VALID;
                 } /* else everything is zero */
diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c
index 0f62326c0f5e..2a4717967502 100644
--- a/net/rfkill/rfkill-gpio.c
+++ b/net/rfkill/rfkill-gpio.c
@@ -63,6 +63,15 @@ static const struct rfkill_ops rfkill_gpio_ops = {
         .set_block = rfkill_gpio_set_power,
 };
 
+static const struct acpi_gpio_params reset_gpios = { 0, 0, false };
+static const struct acpi_gpio_params shutdown_gpios = { 1, 0, false };
+
+static const struct acpi_gpio_mapping acpi_rfkill_default_gpios[] = {
+        { "reset-gpios", &reset_gpios, 1 },
+        { "shutdown-gpios", &shutdown_gpios, 1 },
+        { },
+};
+
 static int rfkill_gpio_acpi_probe(struct device *dev,
                                   struct rfkill_gpio_data *rfkill)
 {
@@ -75,7 +84,8 @@ static int rfkill_gpio_acpi_probe(struct device *dev,
         rfkill->name = dev_name(dev);
         rfkill->type = (unsigned)id->driver_data;
 
-        return 0;
+        return acpi_dev_add_driver_gpios(ACPI_COMPANION(dev),
+                                         acpi_rfkill_default_gpios);
 }
 
 static int rfkill_gpio_probe(struct platform_device *pdev)
@@ -102,7 +112,7 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
 
         rfkill->clk = devm_clk_get(&pdev->dev, NULL);
 
-        gpio = devm_gpiod_get_index(&pdev->dev, "reset", 0);
+        gpio = devm_gpiod_get(&pdev->dev, "reset");
         if (!IS_ERR(gpio)) {
                 ret = gpiod_direction_output(gpio, 0);
                 if (ret)
@@ -110,7 +120,7 @@ static int rfkill_gpio_probe(struct platform_device *pdev)
                 rfkill->reset_gpio = gpio;
         }
 
-        gpio = devm_gpiod_get_index(&pdev->dev, "shutdown", 1);
+        gpio = devm_gpiod_get(&pdev->dev, "shutdown");
         if (!IS_ERR(gpio)) {
                 ret = gpiod_direction_output(gpio, 0);
                 if (ret)
@@ -150,6 +160,8 @@ static int rfkill_gpio_remove(struct platform_device *pdev)
         rfkill_unregister(rfkill->rfkill_dev);
         rfkill_destroy(rfkill->rfkill_dev);
 
+        acpi_dev_remove_driver_gpios(ACPI_COMPANION(&pdev->dev));
+
         return 0;
 }
 
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 0e8529113dc5..fb7976aee61c 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -862,8 +862,6 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,
                 list_add(&cur_key->key_list, sh_keys);
 
         cur_key->key = key;
-        sctp_auth_key_hold(key);
-
         return 0;
 nomem:
         if (!replace)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index ab734be8cb20..9f32741abb1c 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2609,6 +2609,9 @@ do_addr_param:
                 addr_param = param.v + sizeof(sctp_addip_param_t);
 
                 af = sctp_get_af_specific(param_type2af(param.p->type));
+                if (af == NULL)
+                        break;
+
                 af->from_addr_param(&addr, addr_param,
                                     htons(asoc->peer.port), 0);
 
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index 0754d0f466d2..fb78117b896c 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -35,6 +35,7 @@ config RPCSEC_GSS_KRB5
 config SUNRPC_DEBUG
         bool "RPC: Enable dprintk debugging"
         depends on SUNRPC && SYSCTL
+        select DEBUG_FS
         help
           This option enables a sysctl-based debugging interface
           that is be used by the 'rpcdebug' utility to turn on or off
diff --git a/net/sunrpc/Makefile b/net/sunrpc/Makefile
index e5a7a1cac8f3..15e6f6c23c5d 100644
--- a/net/sunrpc/Makefile
+++ b/net/sunrpc/Makefile
@@ -14,6 +14,7 @@ sunrpc-y := clnt.o xprt.o socklib.o xprtsock.o sched.o \
             addr.o rpcb_clnt.o timer.o xdr.o \
             sunrpc_syms.o cache.o rpc_pipe.o \
             svc_xprt.o
+sunrpc-$(CONFIG_SUNRPC_DEBUG) += debugfs.o
 sunrpc-$(CONFIG_SUNRPC_BACKCHANNEL) += backchannel_rqst.o bc_svc.o
 sunrpc-$(CONFIG_PROC_FS) += stats.o
 sunrpc-$(CONFIG_SYSCTL) += sysctl.o
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 383eb919ac0b..47f38be4155f 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -16,7 +16,7 @@
 #include <linux/sunrpc/gss_api.h>
 #include <linux/spinlock.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
@@ -646,7 +646,7 @@ rpcauth_init_cred(struct rpc_cred *cred, const struct auth_cred *acred,
         cred->cr_auth = auth;
         cred->cr_ops = ops;
         cred->cr_expire = jiffies;
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
         cred->cr_magic = RPCAUTH_CRED_MAGIC;
 #endif
         cred->cr_uid = acred->uid;
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index 6f6b829c9e8e..41248b1820c7 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -14,7 +14,7 @@
 #include <linux/sunrpc/debug.h>
 #include <linux/sunrpc/sched.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index afb292cd797d..dace13d7638e 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -66,7 +66,7 @@ static unsigned int gss_expired_cred_retry_delay = GSS_RETRY_EXPIRED;
 #define GSS_KEY_EXPIRE_TIMEO 240
 static unsigned int gss_key_expire_timeo = GSS_KEY_EXPIRE_TIMEO;
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
@@ -1353,6 +1353,7 @@ gss_stringify_acceptor(struct rpc_cred *cred)
         char *string = NULL;
         struct gss_cred *gss_cred = container_of(cred, struct gss_cred, gc_base);
         struct gss_cl_ctx *ctx;
+        unsigned int len;
         struct xdr_netobj *acceptor;
 
         rcu_read_lock();
@@ -1360,15 +1361,39 @@ gss_stringify_acceptor(struct rpc_cred *cred)
         if (!ctx)
                 goto out;
 
-        acceptor = &ctx->gc_acceptor;
+        len = ctx->gc_acceptor.len;
+        rcu_read_unlock();
 
         /* no point if there's no string */
-        if (!acceptor->len)
-                goto out;
-
-        string = kmalloc(acceptor->len + 1, GFP_KERNEL);
+        if (!len)
+                return NULL;
+realloc:
+        string = kmalloc(len + 1, GFP_KERNEL);
         if (!string)
+                return NULL;
+
+        rcu_read_lock();
+        ctx = rcu_dereference(gss_cred->gc_ctx);
+
+        /* did the ctx disappear or was it replaced by one with no acceptor? */
+        if (!ctx || !ctx->gc_acceptor.len) {
+                kfree(string);
+                string = NULL;
                 goto out;
+        }
+
+        acceptor = &ctx->gc_acceptor;
+
+        /*
+         * Did we find a new acceptor that's longer than the original? Allocate
+         * a longer buffer and try again.
+         */
+        if (len < acceptor->len) {
+                len = acceptor->len;
+                rcu_read_unlock();
+                kfree(string);
+                goto realloc;
+        }
 
         memcpy(string, acceptor->data, acceptor->len);
         string[acceptor->len] = '\0';
diff --git a/net/sunrpc/auth_gss/gss_generic_token.c b/net/sunrpc/auth_gss/gss_generic_token.c
index c586e92bcf76..254defe446a7 100644
--- a/net/sunrpc/auth_gss/gss_generic_token.c
+++ b/net/sunrpc/auth_gss/gss_generic_token.c
@@ -38,7 +38,7 @@
 #include <linux/sunrpc/gss_asn1.h>
 
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index f5ed9f6ece06..b5408e8a37f2 100644
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -45,7 +45,7 @@
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/sunrpc/xdr.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_keys.c b/net/sunrpc/auth_gss/gss_krb5_keys.c
index 24589bd2a4b6..234fa8d0fd9b 100644
--- a/net/sunrpc/auth_gss/gss_krb5_keys.c
+++ b/net/sunrpc/auth_gss/gss_krb5_keys.c
@@ -61,7 +61,7 @@
 #include <linux/sunrpc/xdr.h>
 #include <linux/lcm.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 0d3c158ef8fa..28db442a0034 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -45,7 +45,7 @@
 #include <linux/crypto.h>
 #include <linux/sunrpc/gss_krb5_enctypes.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
index 42768e5c3994..1d74d653e6c0 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
@@ -64,7 +64,7 @@
 #include <linux/random.h>
 #include <linux/crypto.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_seqnum.c b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
index 62ac90c62cb1..20d55c793eb6 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seqnum.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
@@ -35,7 +35,7 @@
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/crypto.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_unseal.c b/net/sunrpc/auth_gss/gss_krb5_unseal.c
index 6c981ddc19f8..dcf9515d9aef 100644
--- a/net/sunrpc/auth_gss/gss_krb5_unseal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_unseal.c
@@ -62,7 +62,7 @@
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/crypto.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
index 4b614c604fe0..ca7e92a32f84 100644
--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -35,7 +35,7 @@
 #include <linux/pagemap.h>
 #include <linux/crypto.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
index 92d5ab99fbf3..7063d856a598 100644
--- a/net/sunrpc/auth_gss/gss_mech_switch.c
+++ b/net/sunrpc/auth_gss/gss_mech_switch.c
@@ -46,7 +46,7 @@
 #include <linux/sunrpc/gss_api.h>
 #include <linux/sunrpc/clnt.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.h b/net/sunrpc/auth_gss/gss_rpc_xdr.h
index 685a688f3d8a..9d88c6239f01 100644
--- a/net/sunrpc/auth_gss/gss_rpc_xdr.h
+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.h
@@ -25,7 +25,7 @@
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/xprtsock.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index c548ab213f76..de856ddf5fed 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -51,7 +51,7 @@
 #include "gss_rpc_upcall.h"
 
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/auth_null.c b/net/sunrpc/auth_null.c
index 712c123e04e9..c2a2b584a056 100644
--- a/net/sunrpc/auth_null.c
+++ b/net/sunrpc/auth_null.c
@@ -10,7 +10,7 @@
 #include <linux/module.h>
 #include <linux/sunrpc/clnt.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
@@ -138,7 +138,7 @@ struct rpc_cred null_cred = {
         .cr_ops         = &null_credops,
         .cr_count       = ATOMIC_INIT(1),
         .cr_flags       = 1UL << RPCAUTH_CRED_UPTODATE,
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
         .cr_magic       = RPCAUTH_CRED_MAGIC,
 #endif
 };
diff --git a/net/sunrpc/auth_unix.c b/net/sunrpc/auth_unix.c
index d5d692366294..4feda2d0a833 100644
--- a/net/sunrpc/auth_unix.c
+++ b/net/sunrpc/auth_unix.c
@@ -25,7 +25,7 @@ struct unx_cred {
 
 #define UNX_WRITESLACK          (21 + (UNX_MAXNODENAME >> 2))
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
 #endif
 
diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
index 9761a0da964d..651f49ab601f 100644
--- a/net/sunrpc/backchannel_rqst.c
+++ b/net/sunrpc/backchannel_rqst.c
@@ -27,7 +27,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #include <linux/export.h>
 #include <linux/sunrpc/bc_xprt.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 #define RPCDBG_FACILITY RPCDBG_TRANS
 #endif
 
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 9acd6ce88db7..05da12a33945 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -42,7 +42,7 @@
 #include "sunrpc.h"
 #include "netns.h"
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_CALL
 #endif
 
@@ -305,6 +305,10 @@ static int rpc_client_register(struct rpc_clnt *clnt,
         struct super_block *pipefs_sb;
         int err;
 
+        err = rpc_clnt_debugfs_register(clnt);
+        if (err)
+                return err;
+
         pipefs_sb = rpc_get_sb_net(net);
         if (pipefs_sb) {
                 err = rpc_setup_pipedir(pipefs_sb, clnt);
@@ -331,6 +335,7 @@ err_auth:
 out:
         if (pipefs_sb)
                 rpc_put_sb_net(net);
+        rpc_clnt_debugfs_unregister(clnt);
         return err;
 }
 
@@ -670,6 +675,7 @@ int rpc_switch_client_transport(struct rpc_clnt *clnt,
 
         rpc_unregister_client(clnt);
         __rpc_clnt_remove_pipedir(clnt);
+        rpc_clnt_debugfs_unregister(clnt);
 
         /*
          * A new transport was created.  "clnt" therefore
@@ -771,6 +777,7 @@ rpc_free_client(struct rpc_clnt *clnt)
                         rcu_dereference(clnt->cl_xprt)->servername);
         if (clnt->cl_parent != clnt)
                 parent = clnt->cl_parent;
+        rpc_clnt_debugfs_unregister(clnt);
         rpc_clnt_remove_pipedir(clnt);
         rpc_unregister_client(clnt);
         rpc_free_iostats(clnt->cl_metrics);
@@ -1396,8 +1403,9 @@ rpc_restart_call(struct rpc_task *task)
 }
 EXPORT_SYMBOL_GPL(rpc_restart_call);
 
-#ifdef RPC_DEBUG
-static const char *rpc_proc_name(const struct rpc_task *task)
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
+const char
+*rpc_proc_name(const struct rpc_task *task)
 {
         const struct rpc_procinfo *proc = task->tk_msg.rpc_proc;
 
@@ -2421,7 +2429,7 @@ struct rpc_task *rpc_call_null(struct rpc_clnt *clnt, struct rpc_cred *cred, int
 }
 EXPORT_SYMBOL_GPL(rpc_call_null);
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 static void rpc_show_header(void)
 {
         printk(KERN_INFO "-pid- flgs status -client- --rqstp- "
diff --git a/net/sunrpc/debugfs.c b/net/sunrpc/debugfs.c
new file mode 100644
index 000000000000..e811f390f9f6
--- /dev/null
+++ b/net/sunrpc/debugfs.c
@@ -0,0 +1,292 @@
+/**
+ * debugfs interface for sunrpc
+ *
+ * (c) 2014 Jeff Layton <jlayton@primarydata.com>
+ */
+
+#include <linux/debugfs.h>
+#include <linux/sunrpc/sched.h>
+#include <linux/sunrpc/clnt.h>
+#include "netns.h"
+
+static struct dentry *topdir;
+static struct dentry *rpc_clnt_dir;
+static struct dentry *rpc_xprt_dir;
+
+struct rpc_clnt_iter {
+        struct rpc_clnt *clnt;
+        loff_t          pos;
+};
+
+static int
+tasks_show(struct seq_file *f, void *v)
+{
+        u32 xid = 0;
+        struct rpc_task *task = v;
+        struct rpc_clnt *clnt = task->tk_client;
+        const char *rpc_waitq = "none";
+
+        if (RPC_IS_QUEUED(task))
+                rpc_waitq = rpc_qname(task->tk_waitqueue);
+
+        if (task->tk_rqstp)
+                xid = be32_to_cpu(task->tk_rqstp->rq_xid);
+
+        seq_printf(f, "%5u %04x %6d 0x%x 0x%x %8ld %ps %sv%u %s a:%ps q:%s\n",
+                task->tk_pid, task->tk_flags, task->tk_status,
+                clnt->cl_clid, xid, task->tk_timeout, task->tk_ops,
+                clnt->cl_program->name, clnt->cl_vers, rpc_proc_name(task),
+                task->tk_action, rpc_waitq);
+        return 0;
+}
+
+static void *
+tasks_start(struct seq_file *f, loff_t *ppos)
+        __acquires(&clnt->cl_lock)
+{
+        struct rpc_clnt_iter *iter = f->private;
+        loff_t pos = *ppos;
+        struct rpc_clnt *clnt = iter->clnt;
+        struct rpc_task *task;
+
+        iter->pos = pos + 1;
+        spin_lock(&clnt->cl_lock);
+        list_for_each_entry(task, &clnt->cl_tasks, tk_task)
+                if (pos-- == 0)
+                        return task;
+        return NULL;
+}
+
+static void *
+tasks_next(struct seq_file *f, void *v, loff_t *pos)
+{
+        struct rpc_clnt_iter *iter = f->private;
+        struct rpc_clnt *clnt = iter->clnt;
+        struct rpc_task *task = v;
+        struct list_head *next = task->tk_task.next;
+
+        ++iter->pos;
+        ++*pos;
+
+        /* If there's another task on list, return it */
+        if (next == &clnt->cl_tasks)
+                return NULL;
+        return list_entry(next, struct rpc_task, tk_task);
+}
+
+static void
+tasks_stop(struct seq_file *f, void *v)
+        __releases(&clnt->cl_lock)
+{
+        struct rpc_clnt_iter *iter = f->private;
+        struct rpc_clnt *clnt = iter->clnt;
+
+        spin_unlock(&clnt->cl_lock);
+}
+
+static const struct seq_operations tasks_seq_operations = {
+        .start  = tasks_start,
+        .next   = tasks_next,
+        .stop   = tasks_stop,
+        .show   = tasks_show,
+};
+
+static int tasks_open(struct inode *inode, struct file *filp)
+{
+        int ret = seq_open_private(filp, &tasks_seq_operations,
+                                        sizeof(struct rpc_clnt_iter));
+
+        if (!ret) {
+                struct seq_file *seq = filp->private_data;
+                struct rpc_clnt_iter *iter = seq->private;
+
+                iter->clnt = inode->i_private;
+
+                if (!atomic_inc_not_zero(&iter->clnt->cl_count)) {
+                        seq_release_private(inode, filp);
+                        ret = -EINVAL;
+                }
+        }
+
+        return ret;
+}
+
+static int
+tasks_release(struct inode *inode, struct file *filp)
+{
+        struct seq_file *seq = filp->private_data;
+        struct rpc_clnt_iter *iter = seq->private;
+
+        rpc_release_client(iter->clnt);
+        return seq_release_private(inode, filp);
+}
+
+static const struct file_operations tasks_fops = {
+        .owner          = THIS_MODULE,
+        .open           = tasks_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = tasks_release,
+};
+
+int
+rpc_clnt_debugfs_register(struct rpc_clnt *clnt)
+{
+        int len, err;
+        char name[24]; /* enough for "../../rpc_xprt/ + 8 hex digits + NULL */
+
+        /* Already registered? */
+        if (clnt->cl_debugfs)
+                return 0;
+
+        len = snprintf(name, sizeof(name), "%x", clnt->cl_clid);
+        if (len >= sizeof(name))
+                return -EINVAL;
+
+        /* make the per-client dir */
+        clnt->cl_debugfs = debugfs_create_dir(name, rpc_clnt_dir);
+        if (!clnt->cl_debugfs)
+                return -ENOMEM;
+
+        /* make tasks file */
+        err = -ENOMEM;
+        if (!debugfs_create_file("tasks", S_IFREG | S_IRUSR, clnt->cl_debugfs,
+                                 clnt, &tasks_fops))
+                goto out_err;
+
+        err = -EINVAL;
+        rcu_read_lock();
+        len = snprintf(name, sizeof(name), "../../rpc_xprt/%s",
+                        rcu_dereference(clnt->cl_xprt)->debugfs->d_name.name);
+        rcu_read_unlock();
+        if (len >= sizeof(name))
+                goto out_err;
+
+        err = -ENOMEM;
+        if (!debugfs_create_symlink("xprt", clnt->cl_debugfs, name))
+                goto out_err;
+
+        return 0;
+out_err:
+        debugfs_remove_recursive(clnt->cl_debugfs);
+        clnt->cl_debugfs = NULL;
+        return err;
+}
+
+void
+rpc_clnt_debugfs_unregister(struct rpc_clnt *clnt)
+{
+        debugfs_remove_recursive(clnt->cl_debugfs);
+        clnt->cl_debugfs = NULL;
+}
+
+static int
+xprt_info_show(struct seq_file *f, void *v)
+{
+        struct rpc_xprt *xprt = f->private;
+
+        seq_printf(f, "netid: %s\n", xprt->address_strings[RPC_DISPLAY_NETID]);
+        seq_printf(f, "addr:  %s\n", xprt->address_strings[RPC_DISPLAY_ADDR]);
+        seq_printf(f, "port:  %s\n", xprt->address_strings[RPC_DISPLAY_PORT]);
+        seq_printf(f, "state: 0x%lx\n", xprt->state);
+        return 0;
+}
+
+static int
+xprt_info_open(struct inode *inode, struct file *filp)
+{
+        int ret;
+        struct rpc_xprt *xprt = inode->i_private;
+
+        ret = single_open(filp, xprt_info_show, xprt);
+
+        if (!ret) {
+                if (!xprt_get(xprt)) {
+                        single_release(inode, filp);
+                        ret = -EINVAL;
+                }
+        }
+        return ret;
+}
+
+static int
+xprt_info_release(struct inode *inode, struct file *filp)
+{
+        struct rpc_xprt *xprt = inode->i_private;
+
+        xprt_put(xprt);
+        return single_release(inode, filp);
+}
+
+static const struct file_operations xprt_info_fops = {
+        .owner          = THIS_MODULE,
+        .open           = xprt_info_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = xprt_info_release,
+};
+
+int
+rpc_xprt_debugfs_register(struct rpc_xprt *xprt)
+{
+        int len, id;
+        static atomic_t cur_id;
+        char            name[9]; /* 8 hex digits + NULL term */
+
+        id = (unsigned int)atomic_inc_return(&cur_id);
+
+        len = snprintf(name, sizeof(name), "%x", id);
+        if (len >= sizeof(name))
+                return -EINVAL;
+
+        /* make the per-client dir */
+        xprt->debugfs = debugfs_create_dir(name, rpc_xprt_dir);
+        if (!xprt->debugfs)
+                return -ENOMEM;
+
+        /* make tasks file */
+        if (!debugfs_create_file("info", S_IFREG | S_IRUSR, xprt->debugfs,
+                                 xprt, &xprt_info_fops)) {
+                debugfs_remove_recursive(xprt->debugfs);
+                xprt->debugfs = NULL;
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
+void
+rpc_xprt_debugfs_unregister(struct rpc_xprt *xprt)
+{
+        debugfs_remove_recursive(xprt->debugfs);
+        xprt->debugfs = NULL;
+}
+
+void __exit
+sunrpc_debugfs_exit(void)
+{
+        debugfs_remove_recursive(topdir);
+}
+
+int __init
+sunrpc_debugfs_init(void)
+{
+        topdir = debugfs_create_dir("sunrpc", NULL);
+        if (!topdir)
+                goto out;
+
+        rpc_clnt_dir = debugfs_create_dir("rpc_clnt", topdir);
+        if (!rpc_clnt_dir)
+                goto out_remove;
+
+        rpc_xprt_dir = debugfs_create_dir("rpc_xprt", topdir);
+        if (!rpc_xprt_dir)
+                goto out_remove;
+
+        return 0;
+out_remove:
+        debugfs_remove_recursive(topdir);
+        topdir = NULL;
+out:
+        return -ENOMEM;
+}
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 1891a1022c17..05202012bcfc 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -32,7 +32,7 @@
 
 #include "netns.h"
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_BIND
 #endif
 
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index fe3441abdbe5..d20f2329eea3 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -24,7 +24,7 @@
 
 #include "sunrpc.h"
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 #define RPCDBG_FACILITY         RPCDBG_SCHED
 #endif
 
@@ -258,7 +258,7 @@ static int rpc_wait_bit_killable(struct wait_bit_key *key)
         return 0;
 }
 
-#if defined(RPC_DEBUG) || defined(RPC_TRACEPOINTS)
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG) || IS_ENABLED(CONFIG_TRACEPOINTS)
 static void rpc_task_set_debuginfo(struct rpc_task *task)
 {
         static atomic_t rpc_pid;
diff --git a/net/sunrpc/stats.c b/net/sunrpc/stats.c
index 54530490944e..9711a155bc50 100644
--- a/net/sunrpc/stats.c
+++ b/net/sunrpc/stats.c
@@ -116,7 +116,15 @@ EXPORT_SYMBOL_GPL(svc_seq_show);
  */
 struct rpc_iostats *rpc_alloc_iostats(struct rpc_clnt *clnt)
 {
-        return kcalloc(clnt->cl_maxproc, sizeof(struct rpc_iostats), GFP_KERNEL);
+        struct rpc_iostats *stats;
+        int i;
+
+        stats = kcalloc(clnt->cl_maxproc, sizeof(*stats), GFP_KERNEL);
+        if (stats) {
+                for (i = 0; i < clnt->cl_maxproc; i++)
+                        spin_lock_init(&stats[i].om_lock);
+        }
+        return stats;
 }
 EXPORT_SYMBOL_GPL(rpc_alloc_iostats);
 
@@ -135,20 +143,21 @@ EXPORT_SYMBOL_GPL(rpc_free_iostats);
  * rpc_count_iostats - tally up per-task stats
  * @task: completed rpc_task
  * @stats: array of stat structures
- *
- * Relies on the caller for serialization.
  */
 void rpc_count_iostats(const struct rpc_task *task, struct rpc_iostats *stats)
 {
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_iostats *op_metrics;
-        ktime_t delta;
+        ktime_t delta, now;
 
         if (!stats || !req)
                 return;
 
+        now = ktime_get();
         op_metrics = &stats[task->tk_msg.rpc_proc->p_statidx];
 
+        spin_lock(&op_metrics->om_lock);
+
         op_metrics->om_ops++;
         op_metrics->om_ntrans += req->rq_ntrans;
         op_metrics->om_timeouts += task->tk_timeouts;
@@ -161,8 +170,10 @@ void rpc_count_iostats(const struct rpc_task *task, struct rpc_iostats *stats)
 
         op_metrics->om_rtt = ktime_add(op_metrics->om_rtt, req->rq_rtt);
 
-        delta = ktime_sub(ktime_get(), task->tk_start);
+        delta = ktime_sub(now, task->tk_start);
         op_metrics->om_execute = ktime_add(op_metrics->om_execute, delta);
+
+        spin_unlock(&op_metrics->om_lock);
 }
 EXPORT_SYMBOL_GPL(rpc_count_iostats);
 
diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c
index cd30120de9e4..e37fbed87956 100644
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -97,13 +97,20 @@ init_sunrpc(void)
         err = register_rpc_pipefs();
         if (err)
                 goto out4;
-#ifdef RPC_DEBUG
+
+        err = sunrpc_debugfs_init();
+        if (err)
+                goto out5;
+
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
         rpc_register_sysctl();
 #endif
         svc_init_xprt_sock();   /* svc sock transport */
         init_socket_xprt();     /* clnt sock transport */
         return 0;
 
+out5:
+        unregister_rpc_pipefs();
 out4:
         unregister_pernet_subsys(&sunrpc_net_ops);
 out3:
@@ -120,10 +127,11 @@ cleanup_sunrpc(void)
         rpcauth_remove_module();
         cleanup_socket_xprt();
         svc_cleanup_xprt_sock();
+        sunrpc_debugfs_exit();
         unregister_rpc_pipefs();
         rpc_destroy_mempool();
         unregister_pernet_subsys(&sunrpc_net_ops);
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
         rpc_unregister_sysctl();
 #endif
         rcu_barrier(); /* Wait for completion of call_rcu()'s */
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index ca8a7958f4e6..2783fd80c229 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -28,6 +28,8 @@
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/bc_xprt.h>
 
+#include <trace/events/sunrpc.h>
+
 #define RPCDBG_FACILITY RPCDBG_SVCDSP
 
 static void svc_unregister(const struct svc_serv *serv, struct net *net);
@@ -1040,7 +1042,7 @@ static void svc_unregister(const struct svc_serv *serv, struct net *net)
 /*
  * dprintk the given error with the address of the client that caused it.
  */
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 static __printf(2, 3)
 void svc_printk(struct svc_rqst *rqstp, const char *fmt, ...)
 {
@@ -1314,24 +1316,25 @@ svc_process(struct svc_rqst *rqstp)
         rqstp->rq_res.tail[0].iov_base = NULL;
         rqstp->rq_res.tail[0].iov_len = 0;
 
-        rqstp->rq_xid = svc_getu32(argv);
-
         dir  = svc_getnl(argv);
         if (dir != 0) {
                 /* direction != CALL */
                 svc_printk(rqstp, "bad direction %d, dropping request\n", dir);
                 serv->sv_stats->rpcbadfmt++;
-                svc_drop(rqstp);
-                return 0;
+                goto out_drop;
         }
 
         /* Returns 1 for send, 0 for drop */
-        if (svc_process_common(rqstp, argv, resv))
-                return svc_send(rqstp);
-        else {
-                svc_drop(rqstp);
-                return 0;
+        if (likely(svc_process_common(rqstp, argv, resv))) {
+                int ret = svc_send(rqstp);
+
+                trace_svc_process(rqstp, ret);
+                return ret;
         }
+out_drop:
+        trace_svc_process(rqstp, 0);
+        svc_drop(rqstp);
+        return 0;
 }
 
 #if defined(CONFIG_SUNRPC_BACKCHANNEL)
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index c179ca2a5aa4..bbb3b044b877 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -15,6 +15,7 @@
 #include <linux/sunrpc/svcsock.h>
 #include <linux/sunrpc/xprt.h>
 #include <linux/module.h>
+#include <trace/events/sunrpc.h>
 
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
 
@@ -773,35 +774,43 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
 
         err = svc_alloc_arg(rqstp);
         if (err)
-                return err;
+                goto out;
 
         try_to_freeze();
         cond_resched();
+        err = -EINTR;
         if (signalled() || kthread_should_stop())
-                return -EINTR;
+                goto out;
 
         xprt = svc_get_next_xprt(rqstp, timeout);
-        if (IS_ERR(xprt))
-                return PTR_ERR(xprt);
+        if (IS_ERR(xprt)) {
+                err = PTR_ERR(xprt);
+                goto out;
+        }
 
         len = svc_handle_xprt(rqstp, xprt);
 
         /* No data, incomplete (TCP) read, or accept() */
+        err = -EAGAIN;
         if (len <= 0)
-                goto out;
+                goto out_release;
 
         clear_bit(XPT_OLD, &xprt->xpt_flags);
 
         rqstp->rq_secure = xprt->xpt_ops->xpo_secure_port(rqstp);
         rqstp->rq_chandle.defer = svc_defer;
+        rqstp->rq_xid = svc_getu32(&rqstp->rq_arg.head[0]);
 
         if (serv->sv_stats)
                 serv->sv_stats->netcnt++;
+        trace_svc_recv(rqstp, len);
         return len;
-out:
+out_release:
         rqstp->rq_res.len = 0;
         svc_xprt_release(rqstp);
-        return -EAGAIN;
+out:
+        trace_svc_recv(rqstp, err);
+        return err;
 }
 EXPORT_SYMBOL_GPL(svc_recv);
 
@@ -821,12 +830,12 @@ EXPORT_SYMBOL_GPL(svc_drop);
 int svc_send(struct svc_rqst *rqstp)
 {
         struct svc_xprt *xprt;
-        int             len;
+        int             len = -EFAULT;
         struct xdr_buf  *xb;
 
         xprt = rqstp->rq_xprt;
         if (!xprt)
-                return -EFAULT;
+                goto out;
 
         /* release the receive skb before sending the reply */
         rqstp->rq_xprt->xpt_ops->xpo_release_rqst(rqstp);
@@ -849,7 +858,9 @@ int svc_send(struct svc_rqst *rqstp)
         svc_xprt_release(rqstp);
 
         if (len == -ECONNREFUSED || len == -ENOTCONN || len == -EAGAIN)
-                return 0;
+                len = 0;
+out:
+        trace_svc_send(rqstp, len);
         return len;
 }
 
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 3f959c681885..f9c052d508f0 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1019,17 +1019,12 @@ static int receive_cb_reply(struct svc_sock *svsk, struct svc_rqst *rqstp)
         xid = *p++;
         calldir = *p;
 
-        if (bc_xprt)
-                req = xprt_lookup_rqst(bc_xprt, xid);
-
-        if (!req) {
-                printk(KERN_NOTICE
-                        "%s: Got unrecognized reply: "
-                        "calldir 0x%x xpt_bc_xprt %p xid %08x\n",
-                        __func__, ntohl(calldir),
-                        bc_xprt, ntohl(xid));
+        if (!bc_xprt)
                 return -EAGAIN;
-        }
+        spin_lock_bh(&bc_xprt->transport_lock);
+        req = xprt_lookup_rqst(bc_xprt, xid);
+        if (!req)
+                goto unlock_notfound;
 
         memcpy(&req->rq_private_buf, &req->rq_rcv_buf, sizeof(struct xdr_buf));
         /*
@@ -1040,11 +1035,21 @@ static int receive_cb_reply(struct svc_sock *svsk, struct svc_rqst *rqstp)
         dst = &req->rq_private_buf.head[0];
         src = &rqstp->rq_arg.head[0];
         if (dst->iov_len < src->iov_len)
-                return -EAGAIN; /* whatever; just giving up. */
+                goto unlock_eagain; /* whatever; just giving up. */
         memcpy(dst->iov_base, src->iov_base, src->iov_len);
         xprt_complete_rqst(req->rq_task, rqstp->rq_arg.len);
         rqstp->rq_arg.len = 0;
+        spin_unlock_bh(&bc_xprt->transport_lock);
         return 0;
+unlock_notfound:
+        printk(KERN_NOTICE
+                "%s: Got unrecognized reply: "
+                "calldir 0x%x xpt_bc_xprt %p xid %08x\n",
+                __func__, ntohl(calldir),
+                bc_xprt, ntohl(xid));
+unlock_eagain:
+        spin_unlock_bh(&bc_xprt->transport_lock);
+        return -EAGAIN;
 }
 
 static int copy_pages_to_kvecs(struct kvec *vec, struct page **pages, int len)
diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
index c99c58e2ee66..887f0183b4c6 100644
--- a/net/sunrpc/sysctl.c
+++ b/net/sunrpc/sysctl.c
@@ -37,7 +37,7 @@ EXPORT_SYMBOL_GPL(nfsd_debug);
 unsigned int    nlm_debug;
 EXPORT_SYMBOL_GPL(nlm_debug);
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 
 static struct ctl_table_header *sunrpc_table_header;
 static struct ctl_table sunrpc_table[];
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 56e4e150e80e..ebbefad21a37 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -49,13 +49,15 @@
 #include <linux/sunrpc/metrics.h>
 #include <linux/sunrpc/bc_xprt.h>
 
+#include <trace/events/sunrpc.h>
+
 #include "sunrpc.h"
 
 /*
  * Local variables
  */
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_XPRT
 #endif
 
@@ -772,11 +774,14 @@ struct rpc_rqst *xprt_lookup_rqst(struct rpc_xprt *xprt, __be32 xid)
         struct rpc_rqst *entry;
 
         list_for_each_entry(entry, &xprt->recv, rq_list)
-                if (entry->rq_xid == xid)
+                if (entry->rq_xid == xid) {
+                        trace_xprt_lookup_rqst(xprt, xid, 0);
                         return entry;
+                }
 
         dprintk("RPC:       xprt_lookup_rqst did not find xid %08x\n",
                         ntohl(xid));
+        trace_xprt_lookup_rqst(xprt, xid, -ENOENT);
         xprt->stat.bad_xids++;
         return NULL;
 }
@@ -810,6 +815,7 @@ void xprt_complete_rqst(struct rpc_task *task, int copied)
 
         dprintk("RPC: %5u xid %08x complete (%d bytes received)\n",
                         task->tk_pid, ntohl(req->rq_xid), copied);
+        trace_xprt_complete_rqst(xprt, req->rq_xid, copied);
 
         xprt->stat.recvs++;
         req->rq_rtt = ktime_sub(ktime_get(), req->rq_xtime);
@@ -926,6 +932,7 @@ void xprt_transmit(struct rpc_task *task)
 
         req->rq_xtime = ktime_get();
         status = xprt->ops->send_request(task);
+        trace_xprt_transmit(xprt, req->rq_xid, status);
         if (status != 0) {
                 task->tk_status = status;
                 return;
@@ -1296,6 +1303,7 @@ static void xprt_init(struct rpc_xprt *xprt, struct net *net)
  */
 struct rpc_xprt *xprt_create_transport(struct xprt_create *args)
 {
+        int err;
         struct rpc_xprt *xprt;
         struct xprt_class *t;
 
@@ -1336,6 +1344,12 @@ found:
                 return ERR_PTR(-ENOMEM);
         }
 
+        err = rpc_xprt_debugfs_register(xprt);
+        if (err) {
+                xprt_destroy(xprt);
+                return ERR_PTR(err);
+        }
+
         dprintk("RPC:       created transport %p with %u slots\n", xprt,
                         xprt->max_reqs);
 out:
@@ -1352,6 +1366,7 @@ static void xprt_destroy(struct rpc_xprt *xprt)
         dprintk("RPC:       destroying transport %p\n", xprt);
         del_timer_sync(&xprt->timer);
 
+        rpc_xprt_debugfs_unregister(xprt);
         rpc_destroy_wait_queue(&xprt->binding);
         rpc_destroy_wait_queue(&xprt->pending);
         rpc_destroy_wait_queue(&xprt->sending);
diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
index 6166c985fe24..df01d124936c 100644
--- a/net/sunrpc/xprtrdma/rpc_rdma.c
+++ b/net/sunrpc/xprtrdma/rpc_rdma.c
@@ -49,11 +49,11 @@
 
 #include <linux/highmem.h>
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_TRANS
 #endif
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 static const char transfertypes[][12] = {
         "pure inline",  /* no chunks */
         " read chunk",  /* some argument via rdma read */
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index 6a4615dd0261..bbd6155d3e34 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -55,7 +55,7 @@
 
 #include "xprt_rdma.h"
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_TRANS
 #endif
 
@@ -73,9 +73,9 @@ static unsigned int xprt_rdma_max_inline_read = RPCRDMA_DEF_INLINE;
 static unsigned int xprt_rdma_max_inline_write = RPCRDMA_DEF_INLINE;
 static unsigned int xprt_rdma_inline_write_padding;
 static unsigned int xprt_rdma_memreg_strategy = RPCRDMA_FRMR;
-                int xprt_rdma_pad_optimize = 0;
+                int xprt_rdma_pad_optimize = 1;
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 
 static unsigned int min_slot_table_size = RPCRDMA_MIN_SLOT_TABLE;
 static unsigned int max_slot_table_size = RPCRDMA_MAX_SLOT_TABLE;
@@ -599,7 +599,7 @@ xprt_rdma_send_request(struct rpc_task *task)
 
         if (req->rl_niovs == 0)
                 rc = rpcrdma_marshal_req(rqst);
-        else if (r_xprt->rx_ia.ri_memreg_strategy == RPCRDMA_FRMR)
+        else if (r_xprt->rx_ia.ri_memreg_strategy != RPCRDMA_ALLPHYSICAL)
                 rc = rpcrdma_marshal_chunks(rqst, 0);
         if (rc < 0)
                 goto failed_marshal;
@@ -705,7 +705,7 @@ static void __exit xprt_rdma_cleanup(void)
         int rc;
 
         dprintk("RPCRDMA Module Removed, deregister RPC RDMA transport\n");
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
         if (sunrpc_table_header) {
                 unregister_sysctl_table(sunrpc_table_header);
                 sunrpc_table_header = NULL;
@@ -736,7 +736,7 @@ static int __init xprt_rdma_init(void)
         dprintk("\tPadding %d\n\tMemreg %d\n",
                 xprt_rdma_inline_write_padding, xprt_rdma_memreg_strategy);
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
         if (!sunrpc_table_header)
                 sunrpc_table_header = register_sysctl_table(sunrpc_table);
 #endif
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 61c41298b4ea..c98e40643910 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -57,11 +57,12 @@
  * Globals/Macros
  */
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_TRANS
 #endif
 
 static void rpcrdma_reset_frmrs(struct rpcrdma_ia *);
+static void rpcrdma_reset_fmrs(struct rpcrdma_ia *);
 
 /*
  * internal functions
@@ -105,13 +106,51 @@ rpcrdma_run_tasklet(unsigned long data)
 
 static DECLARE_TASKLET(rpcrdma_tasklet_g, rpcrdma_run_tasklet, 0UL);
 
+static const char * const async_event[] = {
+        "CQ error",
+        "QP fatal error",
+        "QP request error",
+        "QP access error",
+        "communication established",
+        "send queue drained",
+        "path migration successful",
+        "path mig error",
+        "device fatal error",
+        "port active",
+        "port error",
+        "LID change",
+        "P_key change",
+        "SM change",
+        "SRQ error",
+        "SRQ limit reached",
+        "last WQE reached",
+        "client reregister",
+        "GID change",
+};
+
+#define ASYNC_MSG(status)                                       \
+        ((status) < ARRAY_SIZE(async_event) ?                   \
+                async_event[(status)] : "unknown async error")
+
+static void
+rpcrdma_schedule_tasklet(struct list_head *sched_list)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&rpcrdma_tk_lock_g, flags);
+        list_splice_tail(sched_list, &rpcrdma_tasklets_g);
+        spin_unlock_irqrestore(&rpcrdma_tk_lock_g, flags);
+        tasklet_schedule(&rpcrdma_tasklet_g);
+}
+
 static void
 rpcrdma_qp_async_error_upcall(struct ib_event *event, void *context)
 {
         struct rpcrdma_ep *ep = context;
 
-        dprintk("RPC:       %s: QP error %X on device %s ep %p\n",
-                __func__, event->event, event->device->name, context);
+        pr_err("RPC:       %s: %s on device %s ep %p\n",
+               __func__, ASYNC_MSG(event->event),
+                event->device->name, context);
         if (ep->rep_connected == 1) {
                 ep->rep_connected = -EIO;
                 ep->rep_func(ep);
@@ -124,8 +163,9 @@ rpcrdma_cq_async_error_upcall(struct ib_event *event, void *context)
 {
         struct rpcrdma_ep *ep = context;
 
-        dprintk("RPC:       %s: CQ error %X on device %s ep %p\n",
-                __func__, event->event, event->device->name, context);
+        pr_err("RPC:       %s: %s on device %s ep %p\n",
+               __func__, ASYNC_MSG(event->event),
+                event->device->name, context);
         if (ep->rep_connected == 1) {
                 ep->rep_connected = -EIO;
                 ep->rep_func(ep);
@@ -243,7 +283,6 @@ rpcrdma_recvcq_poll(struct ib_cq *cq, struct rpcrdma_ep *ep)
         struct list_head sched_list;
         struct ib_wc *wcs;
         int budget, count, rc;
-        unsigned long flags;
 
         INIT_LIST_HEAD(&sched_list);
         budget = RPCRDMA_WC_BUDGET / RPCRDMA_POLLSIZE;
@@ -261,10 +300,7 @@ rpcrdma_recvcq_poll(struct ib_cq *cq, struct rpcrdma_ep *ep)
         rc = 0;
 
 out_schedule:
-        spin_lock_irqsave(&rpcrdma_tk_lock_g, flags);
-        list_splice_tail(&sched_list, &rpcrdma_tasklets_g);
-        spin_unlock_irqrestore(&rpcrdma_tk_lock_g, flags);
-        tasklet_schedule(&rpcrdma_tasklet_g);
+        rpcrdma_schedule_tasklet(&sched_list);
         return rc;
 }
 
@@ -309,11 +345,18 @@ rpcrdma_recvcq_upcall(struct ib_cq *cq, void *cq_context)
 static void
 rpcrdma_flush_cqs(struct rpcrdma_ep *ep)
 {
-        rpcrdma_recvcq_upcall(ep->rep_attr.recv_cq, ep);
-        rpcrdma_sendcq_upcall(ep->rep_attr.send_cq, ep);
+        struct ib_wc wc;
+        LIST_HEAD(sched_list);
+
+        while (ib_poll_cq(ep->rep_attr.recv_cq, 1, &wc) > 0)
+                rpcrdma_recvcq_process_wc(&wc, &sched_list);
+        if (!list_empty(&sched_list))
+                rpcrdma_schedule_tasklet(&sched_list);
+        while (ib_poll_cq(ep->rep_attr.send_cq, 1, &wc) > 0)
+                rpcrdma_sendcq_process_wc(&wc);
 }
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 static const char * const conn[] = {
         "address resolved",
         "address error",
@@ -344,7 +387,7 @@ rpcrdma_conn_upcall(struct rdma_cm_id *id, struct rdma_cm_event *event)
         struct rpcrdma_xprt *xprt = id->context;
         struct rpcrdma_ia *ia = &xprt->rx_ia;
         struct rpcrdma_ep *ep = &xprt->rx_ep;
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
         struct sockaddr_in *addr = (struct sockaddr_in *) &ep->rep_remote_addr;
 #endif
         struct ib_qp_attr attr;
@@ -408,7 +451,7 @@ connected:
                 break;
         }
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
         if (connstate == 1) {
                 int ird = attr.max_dest_rd_atomic;
                 int tird = ep->rep_remote_cma.responder_resources;
@@ -733,7 +776,9 @@ rpcrdma_ep_create(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia,
 
         /* set trigger for requesting send completion */
         ep->rep_cqinit = ep->rep_attr.cap.max_send_wr/2 - 1;
-        if (ep->rep_cqinit <= 2)
+        if (ep->rep_cqinit > RPCRDMA_MAX_UNSIGNALED_SENDS)
+                ep->rep_cqinit = RPCRDMA_MAX_UNSIGNALED_SENDS;
+        else if (ep->rep_cqinit <= 2)
                 ep->rep_cqinit = 0;
         INIT_CQCOUNT(ep);
         ep->rep_ia = ia;
@@ -866,8 +911,19 @@ retry:
                 rpcrdma_ep_disconnect(ep, ia);
                 rpcrdma_flush_cqs(ep);
 
-                if (ia->ri_memreg_strategy == RPCRDMA_FRMR)
+                switch (ia->ri_memreg_strategy) {
+                case RPCRDMA_FRMR:
                         rpcrdma_reset_frmrs(ia);
+                        break;
+                case RPCRDMA_MTHCAFMR:
+                        rpcrdma_reset_fmrs(ia);
+                        break;
+                case RPCRDMA_ALLPHYSICAL:
+                        break;
+                default:
+                        rc = -EIO;
+                        goto out;
+                }
 
                 xprt = container_of(ia, struct rpcrdma_xprt, rx_ia);
                 id = rpcrdma_create_id(xprt, ia,
@@ -1287,6 +1343,34 @@ rpcrdma_buffer_destroy(struct rpcrdma_buffer *buf)
         kfree(buf->rb_pool);
 }
 
+/* After a disconnect, unmap all FMRs.
+ *
+ * This is invoked only in the transport connect worker in order
+ * to serialize with rpcrdma_register_fmr_external().
+ */
+static void
+rpcrdma_reset_fmrs(struct rpcrdma_ia *ia)
+{
+        struct rpcrdma_xprt *r_xprt =
+                                container_of(ia, struct rpcrdma_xprt, rx_ia);
+        struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
+        struct list_head *pos;
+        struct rpcrdma_mw *r;
+        LIST_HEAD(l);
+        int rc;
+
+        list_for_each(pos, &buf->rb_all) {
+                r = list_entry(pos, struct rpcrdma_mw, mw_all);
+
+                INIT_LIST_HEAD(&l);
+                list_add(&r->r.fmr->list, &l);
+                rc = ib_unmap_fmr(&l);
+                if (rc)
+                        dprintk("RPC:       %s: ib_unmap_fmr failed %i\n",
+                                __func__, rc);
+        }
+}
+
 /* After a disconnect, a flushed FAST_REG_MR can leave an FRMR in
  * an unusable state. Find FRMRs in this state and dereg / reg
  * each.  FRMRs that are VALID and attached to an rpcrdma_req are
@@ -1918,10 +2002,10 @@ rpcrdma_register_external(struct rpcrdma_mr_seg *seg,
                 break;
 
         default:
-                return -1;
+                return -EIO;
         }
         if (rc)
-                return -1;
+                return rc;
 
         return nsegs;
 }
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index ac7fc9a31342..b799041b75bf 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -97,6 +97,12 @@ struct rpcrdma_ep {
         struct ib_wc            rep_recv_wcs[RPCRDMA_POLLSIZE];
 };
 
+/*
+ * Force a signaled SEND Work Request every so often,
+ * in case the provider needs to do some housekeeping.
+ */
+#define RPCRDMA_MAX_UNSIGNALED_SENDS    (32)
+
 #define INIT_CQCOUNT(ep) atomic_set(&(ep)->rep_cqcount, (ep)->rep_cqinit)
 #define DECR_CQCOUNT(ep) atomic_sub_return(1, &(ep)->rep_cqcount)
 
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 3b305ab17afe..87ce7e8bb8dc 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -75,7 +75,7 @@ static unsigned int xs_tcp_fin_timeout __read_mostly = XS_TCP_LINGER_TO;
  * someone else's file names!
  */
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 
 static unsigned int min_slot_table_size = RPC_MIN_SLOT_TABLE;
 static unsigned int max_slot_table_size = RPC_MAX_SLOT_TABLE;
@@ -186,7 +186,7 @@ static struct ctl_table sunrpc_table[] = {
  */
 #define XS_IDLE_DISC_TO         (5U * 60 * HZ)
 
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # undef  RPC_DEBUG_DATA
 # define RPCDBG_FACILITY        RPCDBG_TRANS
 #endif
@@ -216,65 +216,6 @@ static inline void xs_pktdump(char *msg, u32 *packet, unsigned int count)
 }
 #endif
 
-struct sock_xprt {
-        struct rpc_xprt         xprt;
-
-        /*
-         * Network layer
-         */
-        struct socket *         sock;
-        struct sock *           inet;
-
-        /*
-         * State of TCP reply receive
-         */
-        __be32                  tcp_fraghdr,
-                                tcp_xid,
-                                tcp_calldir;
-
-        u32                     tcp_offset,
-                                tcp_reclen;
-
-        unsigned long           tcp_copied,
-                                tcp_flags;
-
-        /*
-         * Connection of transports
-         */
-        struct delayed_work     connect_worker;
-        struct sockaddr_storage srcaddr;
-        unsigned short          srcport;
-
-        /*
-         * UDP socket buffer size parameters
-         */
-        size_t                  rcvsize,
-                                sndsize;
-
-        /*
-         * Saved socket callback addresses
-         */
-        void                    (*old_data_ready)(struct sock *);
-        void                    (*old_state_change)(struct sock *);
-        void                    (*old_write_space)(struct sock *);
-        void                    (*old_error_report)(struct sock *);
-};
-
-/*
- * TCP receive state flags
- */
-#define TCP_RCV_LAST_FRAG       (1UL << 0)
-#define TCP_RCV_COPY_FRAGHDR    (1UL << 1)
-#define TCP_RCV_COPY_XID        (1UL << 2)
-#define TCP_RCV_COPY_DATA       (1UL << 3)
-#define TCP_RCV_READ_CALLDIR    (1UL << 4)
-#define TCP_RCV_COPY_CALLDIR    (1UL << 5)
-
-/*
- * TCP RPC flags
- */
-#define TCP_RPC_REPLY           (1UL << 6)
-
 static inline struct rpc_xprt *xprt_from_sock(struct sock *sk)
 {
         return (struct rpc_xprt *) sk->sk_user_data;
@@ -1415,6 +1356,7 @@ static int xs_tcp_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb, uns
 
         dprintk("RPC:       xs_tcp_data_recv started\n");
         do {
+                trace_xs_tcp_data_recv(transport);
                 /* Read in a new fragment marker if necessary */
                 /* Can we ever really expect to get completely empty fragments? */
                 if (transport->tcp_flags & TCP_RCV_COPY_FRAGHDR) {
@@ -1439,6 +1381,7 @@ static int xs_tcp_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb, uns
                 /* Skip over any trailing bytes on short reads */
                 xs_tcp_read_discard(transport, &desc);
         } while (desc.count);
+        trace_xs_tcp_data_recv(transport);
         dprintk("RPC:       xs_tcp_data_recv done\n");
         return len - desc.count;
 }
@@ -1454,12 +1397,15 @@ static void xs_tcp_data_ready(struct sock *sk)
         struct rpc_xprt *xprt;
         read_descriptor_t rd_desc;
         int read;
+        unsigned long total = 0;
 
         dprintk("RPC:       xs_tcp_data_ready...\n");
 
         read_lock_bh(&sk->sk_callback_lock);
-        if (!(xprt = xprt_from_sock(sk)))
+        if (!(xprt = xprt_from_sock(sk))) {
+                read = 0;
                 goto out;
+        }
         /* Any data means we had a useful conversation, so
          * the we don't need to delay the next reconnect
          */
@@ -1471,8 +1417,11 @@ static void xs_tcp_data_ready(struct sock *sk)
         do {
                 rd_desc.count = 65536;
                 read = tcp_read_sock(sk, &rd_desc, xs_tcp_data_recv);
+                if (read > 0)
+                        total += read;
         } while (read > 0);
 out:
+        trace_xs_tcp_data_ready(xprt, read, total);
         read_unlock_bh(&sk->sk_callback_lock);
 }
 
@@ -3042,7 +2991,7 @@ static struct xprt_class	xs_bc_tcp_transport = {
  */
 int init_socket_xprt(void)
 {
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
         if (!sunrpc_table_header)
                 sunrpc_table_header = register_sysctl_table(sunrpc_table);
 #endif
@@ -3061,7 +3010,7 @@ int init_socket_xprt(void)
  */
 void cleanup_socket_xprt(void)
 {
-#ifdef RPC_DEBUG
+#if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
         if (sunrpc_table_header) {
                 unregister_sysctl_table(sunrpc_table_header);
                 sunrpc_table_header = NULL;